2 * NSA Security-Enhanced Linux (SELinux) security module
4 * This file contains the SELinux hook function implementations.
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License version 2,
18 * as published by the Free Software Foundation.
21 #include <linux/config.h>
22 #include <linux/module.h>
23 #include <linux/init.h>
24 #include <linux/kernel.h>
25 #include <linux/ptrace.h>
26 #include <linux/errno.h>
27 #include <linux/sched.h>
28 #include <linux/security.h>
29 #include <linux/xattr.h>
30 #include <linux/capability.h>
31 #include <linux/unistd.h>
33 #include <linux/mman.h>
34 #include <linux/slab.h>
35 #include <linux/pagemap.h>
36 #include <linux/swap.h>
37 #include <linux/smp_lock.h>
38 #include <linux/spinlock.h>
39 #include <linux/syscalls.h>
40 #include <linux/file.h>
41 #include <linux/namei.h>
42 #include <linux/mount.h>
43 #include <linux/ext2_fs.h>
44 #include <linux/proc_fs.h>
46 #include <linux/netfilter_ipv4.h>
47 #include <linux/netfilter_ipv6.h>
48 #include <linux/tty.h>
50 #include <net/ip.h> /* for sysctl_local_port_range[] */
51 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
52 #include <asm/uaccess.h>
53 #include <asm/semaphore.h>
54 #include <asm/ioctls.h>
55 #include <linux/bitops.h>
56 #include <linux/interrupt.h>
57 #include <linux/netdevice.h> /* for network interface checks */
58 #include <linux/netlink.h>
59 #include <linux/tcp.h>
60 #include <linux/udp.h>
61 #include <linux/quota.h>
62 #include <linux/un.h> /* for Unix socket types */
63 #include <net/af_unix.h> /* for Unix socket types */
64 #include <linux/parser.h>
65 #include <linux/nfs_mount.h>
67 #include <linux/hugetlb.h>
68 #include <linux/personality.h>
69 #include <linux/sysctl.h>
70 #include <linux/audit.h>
71 #include <linux/string.h>
78 #define XATTR_SELINUX_SUFFIX "selinux"
79 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
81 extern unsigned int policydb_loaded_version;
82 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
83 extern int selinux_compat_net;
85 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
86 int selinux_enforcing = 0;
88 static int __init enforcing_setup(char *str)
90 selinux_enforcing = simple_strtol(str,NULL,0);
93 __setup("enforcing=", enforcing_setup);
96 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
97 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
99 static int __init selinux_enabled_setup(char *str)
101 selinux_enabled = simple_strtol(str, NULL, 0);
104 __setup("selinux=", selinux_enabled_setup);
106 int selinux_enabled = 1;
109 /* Original (dummy) security module. */
110 static struct security_operations *original_ops = NULL;
112 /* Minimal support for a secondary security module,
113 just to allow the use of the dummy or capability modules.
114 The owlsm module can alternatively be used as a secondary
115 module as long as CONFIG_OWLSM_FD is not enabled. */
116 static struct security_operations *secondary_ops = NULL;
118 /* Lists of inode and superblock security structures initialized
119 before the policy was loaded. */
120 static LIST_HEAD(superblock_security_head);
121 static DEFINE_SPINLOCK(sb_security_lock);
123 static kmem_cache_t *sel_inode_cache;
125 /* Return security context for a given sid or just the context
126 length if the buffer is null or length is 0 */
127 static int selinux_getsecurity(u32 sid, void *buffer, size_t size)
133 rc = security_sid_to_context(sid, &context, &len);
137 if (!buffer || !size)
138 goto getsecurity_exit;
142 goto getsecurity_exit;
144 memcpy(buffer, context, len);
151 /* Allocate and free functions for each kind of security blob. */
153 static int task_alloc_security(struct task_struct *task)
155 struct task_security_struct *tsec;
157 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
162 tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
163 task->security = tsec;
168 static void task_free_security(struct task_struct *task)
170 struct task_security_struct *tsec = task->security;
171 task->security = NULL;
175 static int inode_alloc_security(struct inode *inode)
177 struct task_security_struct *tsec = current->security;
178 struct inode_security_struct *isec;
180 isec = kmem_cache_alloc(sel_inode_cache, SLAB_KERNEL);
184 memset(isec, 0, sizeof(*isec));
185 init_MUTEX(&isec->sem);
186 INIT_LIST_HEAD(&isec->list);
188 isec->sid = SECINITSID_UNLABELED;
189 isec->sclass = SECCLASS_FILE;
190 isec->task_sid = tsec->sid;
191 inode->i_security = isec;
196 static void inode_free_security(struct inode *inode)
198 struct inode_security_struct *isec = inode->i_security;
199 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
201 spin_lock(&sbsec->isec_lock);
202 if (!list_empty(&isec->list))
203 list_del_init(&isec->list);
204 spin_unlock(&sbsec->isec_lock);
206 inode->i_security = NULL;
207 kmem_cache_free(sel_inode_cache, isec);
210 static int file_alloc_security(struct file *file)
212 struct task_security_struct *tsec = current->security;
213 struct file_security_struct *fsec;
215 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
220 fsec->sid = tsec->sid;
221 fsec->fown_sid = tsec->sid;
222 file->f_security = fsec;
227 static void file_free_security(struct file *file)
229 struct file_security_struct *fsec = file->f_security;
230 file->f_security = NULL;
234 static int superblock_alloc_security(struct super_block *sb)
236 struct superblock_security_struct *sbsec;
238 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
242 init_MUTEX(&sbsec->sem);
243 INIT_LIST_HEAD(&sbsec->list);
244 INIT_LIST_HEAD(&sbsec->isec_head);
245 spin_lock_init(&sbsec->isec_lock);
247 sbsec->sid = SECINITSID_UNLABELED;
248 sbsec->def_sid = SECINITSID_FILE;
249 sb->s_security = sbsec;
254 static void superblock_free_security(struct super_block *sb)
256 struct superblock_security_struct *sbsec = sb->s_security;
258 spin_lock(&sb_security_lock);
259 if (!list_empty(&sbsec->list))
260 list_del_init(&sbsec->list);
261 spin_unlock(&sb_security_lock);
263 sb->s_security = NULL;
267 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
269 struct sk_security_struct *ssec;
271 if (family != PF_UNIX)
274 ssec = kzalloc(sizeof(*ssec), priority);
279 ssec->peer_sid = SECINITSID_UNLABELED;
280 sk->sk_security = ssec;
285 static void sk_free_security(struct sock *sk)
287 struct sk_security_struct *ssec = sk->sk_security;
289 if (sk->sk_family != PF_UNIX)
292 sk->sk_security = NULL;
296 /* The security server must be initialized before
297 any labeling or access decisions can be provided. */
298 extern int ss_initialized;
300 /* The file system's label must be initialized prior to use. */
302 static char *labeling_behaviors[6] = {
304 "uses transition SIDs",
306 "uses genfs_contexts",
307 "not configured for labeling",
308 "uses mountpoint labeling",
311 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
313 static inline int inode_doinit(struct inode *inode)
315 return inode_doinit_with_dentry(inode, NULL);
324 static match_table_t tokens = {
325 {Opt_context, "context=%s"},
326 {Opt_fscontext, "fscontext=%s"},
327 {Opt_defcontext, "defcontext=%s"},
330 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
332 static int try_context_mount(struct super_block *sb, void *data)
334 char *context = NULL, *defcontext = NULL;
337 int alloc = 0, rc = 0, seen = 0;
338 struct task_security_struct *tsec = current->security;
339 struct superblock_security_struct *sbsec = sb->s_security;
344 name = sb->s_type->name;
346 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
348 /* NFS we understand. */
349 if (!strcmp(name, "nfs")) {
350 struct nfs_mount_data *d = data;
352 if (d->version < NFS_MOUNT_VERSION)
356 context = d->context;
363 /* Standard string-based options. */
364 char *p, *options = data;
366 while ((p = strsep(&options, ",")) != NULL) {
368 substring_t args[MAX_OPT_ARGS];
373 token = match_token(p, tokens, args);
379 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
382 context = match_strdup(&args[0]);
393 if (seen & (Opt_context|Opt_fscontext)) {
395 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
398 context = match_strdup(&args[0]);
405 seen |= Opt_fscontext;
409 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
411 printk(KERN_WARNING "SELinux: "
412 "defcontext option is invalid "
413 "for this filesystem type\n");
416 if (seen & (Opt_context|Opt_defcontext)) {
418 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
421 defcontext = match_strdup(&args[0]);
428 seen |= Opt_defcontext;
433 printk(KERN_WARNING "SELinux: unknown mount "
445 rc = security_context_to_sid(context, strlen(context), &sid);
447 printk(KERN_WARNING "SELinux: security_context_to_sid"
448 "(%s) failed for (dev %s, type %s) errno=%d\n",
449 context, sb->s_id, name, rc);
453 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
454 FILESYSTEM__RELABELFROM, NULL);
458 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
459 FILESYSTEM__RELABELTO, NULL);
465 if (seen & Opt_context)
466 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
470 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
472 printk(KERN_WARNING "SELinux: security_context_to_sid"
473 "(%s) failed for (dev %s, type %s) errno=%d\n",
474 defcontext, sb->s_id, name, rc);
478 if (sid == sbsec->def_sid)
481 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
482 FILESYSTEM__RELABELFROM, NULL);
486 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
487 FILESYSTEM__ASSOCIATE, NULL);
491 sbsec->def_sid = sid;
503 static int superblock_doinit(struct super_block *sb, void *data)
505 struct superblock_security_struct *sbsec = sb->s_security;
506 struct dentry *root = sb->s_root;
507 struct inode *inode = root->d_inode;
511 if (sbsec->initialized)
514 if (!ss_initialized) {
515 /* Defer initialization until selinux_complete_init,
516 after the initial policy is loaded and the security
517 server is ready to handle calls. */
518 spin_lock(&sb_security_lock);
519 if (list_empty(&sbsec->list))
520 list_add(&sbsec->list, &superblock_security_head);
521 spin_unlock(&sb_security_lock);
525 /* Determine the labeling behavior to use for this filesystem type. */
526 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
528 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
529 __FUNCTION__, sb->s_type->name, rc);
533 rc = try_context_mount(sb, data);
537 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
538 /* Make sure that the xattr handler exists and that no
539 error other than -ENODATA is returned by getxattr on
540 the root directory. -ENODATA is ok, as this may be
541 the first boot of the SELinux kernel before we have
542 assigned xattr values to the filesystem. */
543 if (!inode->i_op->getxattr) {
544 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
545 "xattr support\n", sb->s_id, sb->s_type->name);
549 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
550 if (rc < 0 && rc != -ENODATA) {
551 if (rc == -EOPNOTSUPP)
552 printk(KERN_WARNING "SELinux: (dev %s, type "
553 "%s) has no security xattr handler\n",
554 sb->s_id, sb->s_type->name);
556 printk(KERN_WARNING "SELinux: (dev %s, type "
557 "%s) getxattr errno %d\n", sb->s_id,
558 sb->s_type->name, -rc);
563 if (strcmp(sb->s_type->name, "proc") == 0)
566 sbsec->initialized = 1;
568 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
569 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
570 sb->s_id, sb->s_type->name);
573 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
574 sb->s_id, sb->s_type->name,
575 labeling_behaviors[sbsec->behavior-1]);
578 /* Initialize the root inode. */
579 rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
581 /* Initialize any other inodes associated with the superblock, e.g.
582 inodes created prior to initial policy load or inodes created
583 during get_sb by a pseudo filesystem that directly
585 spin_lock(&sbsec->isec_lock);
587 if (!list_empty(&sbsec->isec_head)) {
588 struct inode_security_struct *isec =
589 list_entry(sbsec->isec_head.next,
590 struct inode_security_struct, list);
591 struct inode *inode = isec->inode;
592 spin_unlock(&sbsec->isec_lock);
593 inode = igrab(inode);
595 if (!IS_PRIVATE (inode))
599 spin_lock(&sbsec->isec_lock);
600 list_del_init(&isec->list);
603 spin_unlock(&sbsec->isec_lock);
609 static inline u16 inode_mode_to_security_class(umode_t mode)
611 switch (mode & S_IFMT) {
613 return SECCLASS_SOCK_FILE;
615 return SECCLASS_LNK_FILE;
617 return SECCLASS_FILE;
619 return SECCLASS_BLK_FILE;
623 return SECCLASS_CHR_FILE;
625 return SECCLASS_FIFO_FILE;
629 return SECCLASS_FILE;
632 static inline int default_protocol_stream(int protocol)
634 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
637 static inline int default_protocol_dgram(int protocol)
639 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
642 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
649 return SECCLASS_UNIX_STREAM_SOCKET;
651 return SECCLASS_UNIX_DGRAM_SOCKET;
658 if (default_protocol_stream(protocol))
659 return SECCLASS_TCP_SOCKET;
661 return SECCLASS_RAWIP_SOCKET;
663 if (default_protocol_dgram(protocol))
664 return SECCLASS_UDP_SOCKET;
666 return SECCLASS_RAWIP_SOCKET;
668 return SECCLASS_RAWIP_SOCKET;
674 return SECCLASS_NETLINK_ROUTE_SOCKET;
675 case NETLINK_FIREWALL:
676 return SECCLASS_NETLINK_FIREWALL_SOCKET;
677 case NETLINK_INET_DIAG:
678 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
680 return SECCLASS_NETLINK_NFLOG_SOCKET;
682 return SECCLASS_NETLINK_XFRM_SOCKET;
683 case NETLINK_SELINUX:
684 return SECCLASS_NETLINK_SELINUX_SOCKET;
686 return SECCLASS_NETLINK_AUDIT_SOCKET;
688 return SECCLASS_NETLINK_IP6FW_SOCKET;
689 case NETLINK_DNRTMSG:
690 return SECCLASS_NETLINK_DNRT_SOCKET;
691 case NETLINK_KOBJECT_UEVENT:
692 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
694 return SECCLASS_NETLINK_SOCKET;
697 return SECCLASS_PACKET_SOCKET;
699 return SECCLASS_KEY_SOCKET;
701 return SECCLASS_APPLETALK_SOCKET;
704 return SECCLASS_SOCKET;
707 #ifdef CONFIG_PROC_FS
708 static int selinux_proc_get_sid(struct proc_dir_entry *de,
713 char *buffer, *path, *end;
715 buffer = (char*)__get_free_page(GFP_KERNEL);
725 while (de && de != de->parent) {
726 buflen -= de->namelen + 1;
730 memcpy(end, de->name, de->namelen);
735 rc = security_genfs_sid("proc", path, tclass, sid);
736 free_page((unsigned long)buffer);
740 static int selinux_proc_get_sid(struct proc_dir_entry *de,
748 /* The inode's security attributes must be initialized before first use. */
749 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
751 struct superblock_security_struct *sbsec = NULL;
752 struct inode_security_struct *isec = inode->i_security;
754 struct dentry *dentry;
755 #define INITCONTEXTLEN 255
756 char *context = NULL;
761 if (isec->initialized)
766 if (isec->initialized)
769 sbsec = inode->i_sb->s_security;
770 if (!sbsec->initialized) {
771 /* Defer initialization until selinux_complete_init,
772 after the initial policy is loaded and the security
773 server is ready to handle calls. */
774 spin_lock(&sbsec->isec_lock);
775 if (list_empty(&isec->list))
776 list_add(&isec->list, &sbsec->isec_head);
777 spin_unlock(&sbsec->isec_lock);
781 switch (sbsec->behavior) {
782 case SECURITY_FS_USE_XATTR:
783 if (!inode->i_op->getxattr) {
784 isec->sid = sbsec->def_sid;
788 /* Need a dentry, since the xattr API requires one.
789 Life would be simpler if we could just pass the inode. */
791 /* Called from d_instantiate or d_splice_alias. */
792 dentry = dget(opt_dentry);
794 /* Called from selinux_complete_init, try to find a dentry. */
795 dentry = d_find_alias(inode);
798 printk(KERN_WARNING "%s: no dentry for dev=%s "
799 "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
804 len = INITCONTEXTLEN;
805 context = kmalloc(len, GFP_KERNEL);
811 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
814 /* Need a larger buffer. Query for the right size. */
815 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
823 context = kmalloc(len, GFP_KERNEL);
829 rc = inode->i_op->getxattr(dentry,
835 if (rc != -ENODATA) {
836 printk(KERN_WARNING "%s: getxattr returned "
837 "%d for dev=%s ino=%ld\n", __FUNCTION__,
838 -rc, inode->i_sb->s_id, inode->i_ino);
842 /* Map ENODATA to the default file SID */
843 sid = sbsec->def_sid;
846 rc = security_context_to_sid_default(context, rc, &sid,
849 printk(KERN_WARNING "%s: context_to_sid(%s) "
850 "returned %d for dev=%s ino=%ld\n",
851 __FUNCTION__, context, -rc,
852 inode->i_sb->s_id, inode->i_ino);
854 /* Leave with the unlabeled SID */
862 case SECURITY_FS_USE_TASK:
863 isec->sid = isec->task_sid;
865 case SECURITY_FS_USE_TRANS:
866 /* Default to the fs SID. */
867 isec->sid = sbsec->sid;
869 /* Try to obtain a transition SID. */
870 isec->sclass = inode_mode_to_security_class(inode->i_mode);
871 rc = security_transition_sid(isec->task_sid,
880 /* Default to the fs SID. */
881 isec->sid = sbsec->sid;
884 struct proc_inode *proci = PROC_I(inode);
886 isec->sclass = inode_mode_to_security_class(inode->i_mode);
887 rc = selinux_proc_get_sid(proci->pde,
898 isec->initialized = 1;
901 if (isec->sclass == SECCLASS_FILE)
902 isec->sclass = inode_mode_to_security_class(inode->i_mode);
909 /* Convert a Linux signal to an access vector. */
910 static inline u32 signal_to_av(int sig)
916 /* Commonly granted from child to parent. */
917 perm = PROCESS__SIGCHLD;
920 /* Cannot be caught or ignored */
921 perm = PROCESS__SIGKILL;
924 /* Cannot be caught or ignored */
925 perm = PROCESS__SIGSTOP;
928 /* All other signals. */
929 perm = PROCESS__SIGNAL;
936 /* Check permission betweeen a pair of tasks, e.g. signal checks,
937 fork check, ptrace check, etc. */
938 static int task_has_perm(struct task_struct *tsk1,
939 struct task_struct *tsk2,
942 struct task_security_struct *tsec1, *tsec2;
944 tsec1 = tsk1->security;
945 tsec2 = tsk2->security;
946 return avc_has_perm(tsec1->sid, tsec2->sid,
947 SECCLASS_PROCESS, perms, NULL);
950 /* Check whether a task is allowed to use a capability. */
951 static int task_has_capability(struct task_struct *tsk,
954 struct task_security_struct *tsec;
955 struct avc_audit_data ad;
957 tsec = tsk->security;
959 AVC_AUDIT_DATA_INIT(&ad,CAP);
963 return avc_has_perm(tsec->sid, tsec->sid,
964 SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
967 /* Check whether a task is allowed to use a system operation. */
968 static int task_has_system(struct task_struct *tsk,
971 struct task_security_struct *tsec;
973 tsec = tsk->security;
975 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
976 SECCLASS_SYSTEM, perms, NULL);
979 /* Check whether a task has a particular permission to an inode.
980 The 'adp' parameter is optional and allows other audit
981 data to be passed (e.g. the dentry). */
982 static int inode_has_perm(struct task_struct *tsk,
985 struct avc_audit_data *adp)
987 struct task_security_struct *tsec;
988 struct inode_security_struct *isec;
989 struct avc_audit_data ad;
991 tsec = tsk->security;
992 isec = inode->i_security;
996 AVC_AUDIT_DATA_INIT(&ad, FS);
997 ad.u.fs.inode = inode;
1000 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1003 /* Same as inode_has_perm, but pass explicit audit data containing
1004 the dentry to help the auditing code to more easily generate the
1005 pathname if needed. */
1006 static inline int dentry_has_perm(struct task_struct *tsk,
1007 struct vfsmount *mnt,
1008 struct dentry *dentry,
1011 struct inode *inode = dentry->d_inode;
1012 struct avc_audit_data ad;
1013 AVC_AUDIT_DATA_INIT(&ad,FS);
1015 ad.u.fs.dentry = dentry;
1016 return inode_has_perm(tsk, inode, av, &ad);
1019 /* Check whether a task can use an open file descriptor to
1020 access an inode in a given way. Check access to the
1021 descriptor itself, and then use dentry_has_perm to
1022 check a particular permission to the file.
1023 Access to the descriptor is implicitly granted if it
1024 has the same SID as the process. If av is zero, then
1025 access to the file is not checked, e.g. for cases
1026 where only the descriptor is affected like seek. */
1027 static int file_has_perm(struct task_struct *tsk,
1031 struct task_security_struct *tsec = tsk->security;
1032 struct file_security_struct *fsec = file->f_security;
1033 struct vfsmount *mnt = file->f_vfsmnt;
1034 struct dentry *dentry = file->f_dentry;
1035 struct inode *inode = dentry->d_inode;
1036 struct avc_audit_data ad;
1039 AVC_AUDIT_DATA_INIT(&ad, FS);
1041 ad.u.fs.dentry = dentry;
1043 if (tsec->sid != fsec->sid) {
1044 rc = avc_has_perm(tsec->sid, fsec->sid,
1052 /* av is zero if only checking access to the descriptor. */
1054 return inode_has_perm(tsk, inode, av, &ad);
1059 /* Check whether a task can create a file. */
1060 static int may_create(struct inode *dir,
1061 struct dentry *dentry,
1064 struct task_security_struct *tsec;
1065 struct inode_security_struct *dsec;
1066 struct superblock_security_struct *sbsec;
1068 struct avc_audit_data ad;
1071 tsec = current->security;
1072 dsec = dir->i_security;
1073 sbsec = dir->i_sb->s_security;
1075 AVC_AUDIT_DATA_INIT(&ad, FS);
1076 ad.u.fs.dentry = dentry;
1078 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1079 DIR__ADD_NAME | DIR__SEARCH,
1084 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1085 newsid = tsec->create_sid;
1087 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1093 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1097 return avc_has_perm(newsid, sbsec->sid,
1098 SECCLASS_FILESYSTEM,
1099 FILESYSTEM__ASSOCIATE, &ad);
1102 /* Check whether a task can create a key. */
1103 static int may_create_key(u32 ksid,
1104 struct task_struct *ctx)
1106 struct task_security_struct *tsec;
1108 tsec = ctx->security;
1110 return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1114 #define MAY_UNLINK 1
1117 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1118 static int may_link(struct inode *dir,
1119 struct dentry *dentry,
1123 struct task_security_struct *tsec;
1124 struct inode_security_struct *dsec, *isec;
1125 struct avc_audit_data ad;
1129 tsec = current->security;
1130 dsec = dir->i_security;
1131 isec = dentry->d_inode->i_security;
1133 AVC_AUDIT_DATA_INIT(&ad, FS);
1134 ad.u.fs.dentry = dentry;
1137 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1138 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1153 printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
1157 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1161 static inline int may_rename(struct inode *old_dir,
1162 struct dentry *old_dentry,
1163 struct inode *new_dir,
1164 struct dentry *new_dentry)
1166 struct task_security_struct *tsec;
1167 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1168 struct avc_audit_data ad;
1170 int old_is_dir, new_is_dir;
1173 tsec = current->security;
1174 old_dsec = old_dir->i_security;
1175 old_isec = old_dentry->d_inode->i_security;
1176 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1177 new_dsec = new_dir->i_security;
1179 AVC_AUDIT_DATA_INIT(&ad, FS);
1181 ad.u.fs.dentry = old_dentry;
1182 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1183 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1186 rc = avc_has_perm(tsec->sid, old_isec->sid,
1187 old_isec->sclass, FILE__RENAME, &ad);
1190 if (old_is_dir && new_dir != old_dir) {
1191 rc = avc_has_perm(tsec->sid, old_isec->sid,
1192 old_isec->sclass, DIR__REPARENT, &ad);
1197 ad.u.fs.dentry = new_dentry;
1198 av = DIR__ADD_NAME | DIR__SEARCH;
1199 if (new_dentry->d_inode)
1200 av |= DIR__REMOVE_NAME;
1201 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1204 if (new_dentry->d_inode) {
1205 new_isec = new_dentry->d_inode->i_security;
1206 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1207 rc = avc_has_perm(tsec->sid, new_isec->sid,
1209 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1217 /* Check whether a task can perform a filesystem operation. */
1218 static int superblock_has_perm(struct task_struct *tsk,
1219 struct super_block *sb,
1221 struct avc_audit_data *ad)
1223 struct task_security_struct *tsec;
1224 struct superblock_security_struct *sbsec;
1226 tsec = tsk->security;
1227 sbsec = sb->s_security;
1228 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1232 /* Convert a Linux mode and permission mask to an access vector. */
1233 static inline u32 file_mask_to_av(int mode, int mask)
1237 if ((mode & S_IFMT) != S_IFDIR) {
1238 if (mask & MAY_EXEC)
1239 av |= FILE__EXECUTE;
1240 if (mask & MAY_READ)
1243 if (mask & MAY_APPEND)
1245 else if (mask & MAY_WRITE)
1249 if (mask & MAY_EXEC)
1251 if (mask & MAY_WRITE)
1253 if (mask & MAY_READ)
1260 /* Convert a Linux file to an access vector. */
1261 static inline u32 file_to_av(struct file *file)
1265 if (file->f_mode & FMODE_READ)
1267 if (file->f_mode & FMODE_WRITE) {
1268 if (file->f_flags & O_APPEND)
1277 /* Set an inode's SID to a specified value. */
1278 static int inode_security_set_sid(struct inode *inode, u32 sid)
1280 struct inode_security_struct *isec = inode->i_security;
1281 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
1283 if (!sbsec->initialized) {
1284 /* Defer initialization to selinux_complete_init. */
1289 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1291 isec->initialized = 1;
1296 /* Hook functions begin here. */
1298 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1300 struct task_security_struct *psec = parent->security;
1301 struct task_security_struct *csec = child->security;
1304 rc = secondary_ops->ptrace(parent,child);
1308 rc = task_has_perm(parent, child, PROCESS__PTRACE);
1309 /* Save the SID of the tracing process for later use in apply_creds. */
1310 if (!(child->ptrace & PT_PTRACED) && !rc)
1311 csec->ptrace_sid = psec->sid;
1315 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1316 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1320 error = task_has_perm(current, target, PROCESS__GETCAP);
1324 return secondary_ops->capget(target, effective, inheritable, permitted);
1327 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1328 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1332 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1336 return task_has_perm(current, target, PROCESS__SETCAP);
1339 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1340 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1342 secondary_ops->capset_set(target, effective, inheritable, permitted);
1345 static int selinux_capable(struct task_struct *tsk, int cap)
1349 rc = secondary_ops->capable(tsk, cap);
1353 return task_has_capability(tsk,cap);
1356 static int selinux_sysctl(ctl_table *table, int op)
1360 struct task_security_struct *tsec;
1364 rc = secondary_ops->sysctl(table, op);
1368 tsec = current->security;
1370 rc = selinux_proc_get_sid(table->de, (op == 001) ?
1371 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1373 /* Default to the well-defined sysctl SID. */
1374 tsid = SECINITSID_SYSCTL;
1377 /* The op values are "defined" in sysctl.c, thereby creating
1378 * a bad coupling between this module and sysctl.c */
1380 error = avc_has_perm(tsec->sid, tsid,
1381 SECCLASS_DIR, DIR__SEARCH, NULL);
1389 error = avc_has_perm(tsec->sid, tsid,
1390 SECCLASS_FILE, av, NULL);
1396 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1409 rc = superblock_has_perm(current,
1411 FILESYSTEM__QUOTAMOD, NULL);
1416 rc = superblock_has_perm(current,
1418 FILESYSTEM__QUOTAGET, NULL);
1421 rc = 0; /* let the kernel handle invalid cmds */
1427 static int selinux_quota_on(struct dentry *dentry)
1429 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1432 static int selinux_syslog(int type)
1436 rc = secondary_ops->syslog(type);
1441 case 3: /* Read last kernel messages */
1442 case 10: /* Return size of the log buffer */
1443 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1445 case 6: /* Disable logging to console */
1446 case 7: /* Enable logging to console */
1447 case 8: /* Set level of messages printed to console */
1448 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1450 case 0: /* Close log */
1451 case 1: /* Open log */
1452 case 2: /* Read from log */
1453 case 4: /* Read/clear last kernel messages */
1454 case 5: /* Clear ring buffer */
1456 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1463 * Check that a process has enough memory to allocate a new virtual
1464 * mapping. 0 means there is enough memory for the allocation to
1465 * succeed and -ENOMEM implies there is not.
1467 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1468 * if the capability is granted, but __vm_enough_memory requires 1 if
1469 * the capability is granted.
1471 * Do not audit the selinux permission check, as this is applied to all
1472 * processes that allocate mappings.
1474 static int selinux_vm_enough_memory(long pages)
1476 int rc, cap_sys_admin = 0;
1477 struct task_security_struct *tsec = current->security;
1479 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1481 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1482 SECCLASS_CAPABILITY,
1483 CAP_TO_MASK(CAP_SYS_ADMIN),
1489 return __vm_enough_memory(pages, cap_sys_admin);
1492 /* binprm security operations */
1494 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1496 struct bprm_security_struct *bsec;
1498 bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1503 bsec->sid = SECINITSID_UNLABELED;
1506 bprm->security = bsec;
1510 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1512 struct task_security_struct *tsec;
1513 struct inode *inode = bprm->file->f_dentry->d_inode;
1514 struct inode_security_struct *isec;
1515 struct bprm_security_struct *bsec;
1517 struct avc_audit_data ad;
1520 rc = secondary_ops->bprm_set_security(bprm);
1524 bsec = bprm->security;
1529 tsec = current->security;
1530 isec = inode->i_security;
1532 /* Default to the current task SID. */
1533 bsec->sid = tsec->sid;
1535 /* Reset create SID on execve. */
1536 tsec->create_sid = 0;
1538 if (tsec->exec_sid) {
1539 newsid = tsec->exec_sid;
1540 /* Reset exec SID on execve. */
1543 /* Check for a default transition on this program. */
1544 rc = security_transition_sid(tsec->sid, isec->sid,
1545 SECCLASS_PROCESS, &newsid);
1550 AVC_AUDIT_DATA_INIT(&ad, FS);
1551 ad.u.fs.mnt = bprm->file->f_vfsmnt;
1552 ad.u.fs.dentry = bprm->file->f_dentry;
1554 if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
1557 if (tsec->sid == newsid) {
1558 rc = avc_has_perm(tsec->sid, isec->sid,
1559 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1563 /* Check permissions for the transition. */
1564 rc = avc_has_perm(tsec->sid, newsid,
1565 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1569 rc = avc_has_perm(newsid, isec->sid,
1570 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1574 /* Clear any possibly unsafe personality bits on exec: */
1575 current->personality &= ~PER_CLEAR_ON_SETID;
1577 /* Set the security field to the new SID. */
1585 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1587 return secondary_ops->bprm_check_security(bprm);
1591 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1593 struct task_security_struct *tsec = current->security;
1596 if (tsec->osid != tsec->sid) {
1597 /* Enable secure mode for SIDs transitions unless
1598 the noatsecure permission is granted between
1599 the two SIDs, i.e. ahp returns 0. */
1600 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1602 PROCESS__NOATSECURE, NULL);
1605 return (atsecure || secondary_ops->bprm_secureexec(bprm));
1608 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1610 kfree(bprm->security);
1611 bprm->security = NULL;
1614 extern struct vfsmount *selinuxfs_mount;
1615 extern struct dentry *selinux_null;
1617 /* Derived from fs/exec.c:flush_old_files. */
1618 static inline void flush_unauthorized_files(struct files_struct * files)
1620 struct avc_audit_data ad;
1621 struct file *file, *devnull = NULL;
1622 struct tty_struct *tty = current->signal->tty;
1623 struct fdtable *fdt;
1628 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
1630 /* Revalidate access to controlling tty.
1631 Use inode_has_perm on the tty inode directly rather
1632 than using file_has_perm, as this particular open
1633 file may belong to another process and we are only
1634 interested in the inode-based check here. */
1635 struct inode *inode = file->f_dentry->d_inode;
1636 if (inode_has_perm(current, inode,
1637 FILE__READ | FILE__WRITE, NULL)) {
1638 /* Reset controlling tty. */
1639 current->signal->tty = NULL;
1640 current->signal->tty_old_pgrp = 0;
1646 /* Revalidate access to inherited open files. */
1648 AVC_AUDIT_DATA_INIT(&ad,FS);
1650 spin_lock(&files->file_lock);
1652 unsigned long set, i;
1657 fdt = files_fdtable(files);
1658 if (i >= fdt->max_fds || i >= fdt->max_fdset)
1660 set = fdt->open_fds->fds_bits[j];
1663 spin_unlock(&files->file_lock);
1664 for ( ; set ; i++,set >>= 1) {
1669 if (file_has_perm(current,
1671 file_to_av(file))) {
1673 fd = get_unused_fd();
1683 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1690 fd_install(fd, devnull);
1695 spin_lock(&files->file_lock);
1698 spin_unlock(&files->file_lock);
1701 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1703 struct task_security_struct *tsec;
1704 struct bprm_security_struct *bsec;
1708 secondary_ops->bprm_apply_creds(bprm, unsafe);
1710 tsec = current->security;
1712 bsec = bprm->security;
1715 tsec->osid = tsec->sid;
1717 if (tsec->sid != sid) {
1718 /* Check for shared state. If not ok, leave SID
1719 unchanged and kill. */
1720 if (unsafe & LSM_UNSAFE_SHARE) {
1721 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1722 PROCESS__SHARE, NULL);
1729 /* Check for ptracing, and update the task SID if ok.
1730 Otherwise, leave SID unchanged and kill. */
1731 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1732 rc = avc_has_perm(tsec->ptrace_sid, sid,
1733 SECCLASS_PROCESS, PROCESS__PTRACE,
1745 * called after apply_creds without the task lock held
1747 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1749 struct task_security_struct *tsec;
1750 struct rlimit *rlim, *initrlim;
1751 struct itimerval itimer;
1752 struct bprm_security_struct *bsec;
1755 tsec = current->security;
1756 bsec = bprm->security;
1759 force_sig_specific(SIGKILL, current);
1762 if (tsec->osid == tsec->sid)
1765 /* Close files for which the new task SID is not authorized. */
1766 flush_unauthorized_files(current->files);
1768 /* Check whether the new SID can inherit signal state
1769 from the old SID. If not, clear itimers to avoid
1770 subsequent signal generation and flush and unblock
1771 signals. This must occur _after_ the task SID has
1772 been updated so that any kill done after the flush
1773 will be checked against the new SID. */
1774 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1775 PROCESS__SIGINH, NULL);
1777 memset(&itimer, 0, sizeof itimer);
1778 for (i = 0; i < 3; i++)
1779 do_setitimer(i, &itimer, NULL);
1780 flush_signals(current);
1781 spin_lock_irq(¤t->sighand->siglock);
1782 flush_signal_handlers(current, 1);
1783 sigemptyset(¤t->blocked);
1784 recalc_sigpending();
1785 spin_unlock_irq(¤t->sighand->siglock);
1788 /* Check whether the new SID can inherit resource limits
1789 from the old SID. If not, reset all soft limits to
1790 the lower of the current task's hard limit and the init
1791 task's soft limit. Note that the setting of hard limits
1792 (even to lower them) can be controlled by the setrlimit
1793 check. The inclusion of the init task's soft limit into
1794 the computation is to avoid resetting soft limits higher
1795 than the default soft limit for cases where the default
1796 is lower than the hard limit, e.g. RLIMIT_CORE or
1798 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1799 PROCESS__RLIMITINH, NULL);
1801 for (i = 0; i < RLIM_NLIMITS; i++) {
1802 rlim = current->signal->rlim + i;
1803 initrlim = init_task.signal->rlim+i;
1804 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1806 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1808 * This will cause RLIMIT_CPU calculations
1811 current->it_prof_expires = jiffies_to_cputime(1);
1815 /* Wake up the parent if it is waiting so that it can
1816 recheck wait permission to the new task SID. */
1817 wake_up_interruptible(¤t->parent->signal->wait_chldexit);
1820 /* superblock security operations */
1822 static int selinux_sb_alloc_security(struct super_block *sb)
1824 return superblock_alloc_security(sb);
1827 static void selinux_sb_free_security(struct super_block *sb)
1829 superblock_free_security(sb);
1832 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1837 return !memcmp(prefix, option, plen);
1840 static inline int selinux_option(char *option, int len)
1842 return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1843 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1844 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len));
1847 static inline void take_option(char **to, char *from, int *first, int len)
1855 memcpy(*to, from, len);
1859 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
1861 int fnosec, fsec, rc = 0;
1862 char *in_save, *in_curr, *in_end;
1863 char *sec_curr, *nosec_save, *nosec;
1868 /* Binary mount data: just copy */
1869 if (type->fs_flags & FS_BINARY_MOUNTDATA) {
1870 copy_page(sec_curr, in_curr);
1874 nosec = (char *)get_zeroed_page(GFP_KERNEL);
1882 in_save = in_end = orig;
1885 if (*in_end == ',' || *in_end == '\0') {
1886 int len = in_end - in_curr;
1888 if (selinux_option(in_curr, len))
1889 take_option(&sec_curr, in_curr, &fsec, len);
1891 take_option(&nosec, in_curr, &fnosec, len);
1893 in_curr = in_end + 1;
1895 } while (*in_end++);
1897 strcpy(in_save, nosec_save);
1898 free_page((unsigned long)nosec_save);
1903 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
1905 struct avc_audit_data ad;
1908 rc = superblock_doinit(sb, data);
1912 AVC_AUDIT_DATA_INIT(&ad,FS);
1913 ad.u.fs.dentry = sb->s_root;
1914 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
1917 static int selinux_sb_statfs(struct dentry *dentry)
1919 struct avc_audit_data ad;
1921 AVC_AUDIT_DATA_INIT(&ad,FS);
1922 ad.u.fs.dentry = dentry->d_sb->s_root;
1923 return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
1926 static int selinux_mount(char * dev_name,
1927 struct nameidata *nd,
1929 unsigned long flags,
1934 rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
1938 if (flags & MS_REMOUNT)
1939 return superblock_has_perm(current, nd->mnt->mnt_sb,
1940 FILESYSTEM__REMOUNT, NULL);
1942 return dentry_has_perm(current, nd->mnt, nd->dentry,
1946 static int selinux_umount(struct vfsmount *mnt, int flags)
1950 rc = secondary_ops->sb_umount(mnt, flags);
1954 return superblock_has_perm(current,mnt->mnt_sb,
1955 FILESYSTEM__UNMOUNT,NULL);
1958 /* inode security operations */
1960 static int selinux_inode_alloc_security(struct inode *inode)
1962 return inode_alloc_security(inode);
1965 static void selinux_inode_free_security(struct inode *inode)
1967 inode_free_security(inode);
1970 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
1971 char **name, void **value,
1974 struct task_security_struct *tsec;
1975 struct inode_security_struct *dsec;
1976 struct superblock_security_struct *sbsec;
1979 char *namep = NULL, *context;
1981 tsec = current->security;
1982 dsec = dir->i_security;
1983 sbsec = dir->i_sb->s_security;
1985 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1986 newsid = tsec->create_sid;
1988 rc = security_transition_sid(tsec->sid, dsec->sid,
1989 inode_mode_to_security_class(inode->i_mode),
1992 printk(KERN_WARNING "%s: "
1993 "security_transition_sid failed, rc=%d (dev=%s "
1996 -rc, inode->i_sb->s_id, inode->i_ino);
2001 inode_security_set_sid(inode, newsid);
2003 if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2007 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
2014 rc = security_sid_to_context(newsid, &context, &clen);
2026 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2028 return may_create(dir, dentry, SECCLASS_FILE);
2031 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2035 rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2038 return may_link(dir, old_dentry, MAY_LINK);
2041 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2045 rc = secondary_ops->inode_unlink(dir, dentry);
2048 return may_link(dir, dentry, MAY_UNLINK);
2051 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2053 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2056 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2058 return may_create(dir, dentry, SECCLASS_DIR);
2061 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2063 return may_link(dir, dentry, MAY_RMDIR);
2066 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2070 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2074 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2077 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2078 struct inode *new_inode, struct dentry *new_dentry)
2080 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2083 static int selinux_inode_readlink(struct dentry *dentry)
2085 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2088 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2092 rc = secondary_ops->inode_follow_link(dentry,nameidata);
2095 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2098 static int selinux_inode_permission(struct inode *inode, int mask,
2099 struct nameidata *nd)
2103 rc = secondary_ops->inode_permission(inode, mask, nd);
2108 /* No permission to check. Existence test. */
2112 return inode_has_perm(current, inode,
2113 file_mask_to_av(inode->i_mode, mask), NULL);
2116 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2120 rc = secondary_ops->inode_setattr(dentry, iattr);
2124 if (iattr->ia_valid & ATTR_FORCE)
2127 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2128 ATTR_ATIME_SET | ATTR_MTIME_SET))
2129 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2131 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2134 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2136 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2139 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2141 struct task_security_struct *tsec = current->security;
2142 struct inode *inode = dentry->d_inode;
2143 struct inode_security_struct *isec = inode->i_security;
2144 struct superblock_security_struct *sbsec;
2145 struct avc_audit_data ad;
2149 if (strcmp(name, XATTR_NAME_SELINUX)) {
2150 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2151 sizeof XATTR_SECURITY_PREFIX - 1) &&
2152 !capable(CAP_SYS_ADMIN)) {
2153 /* A different attribute in the security namespace.
2154 Restrict to administrator. */
2158 /* Not an attribute we recognize, so just check the
2159 ordinary setattr permission. */
2160 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2163 sbsec = inode->i_sb->s_security;
2164 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2167 if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2170 AVC_AUDIT_DATA_INIT(&ad,FS);
2171 ad.u.fs.dentry = dentry;
2173 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2174 FILE__RELABELFROM, &ad);
2178 rc = security_context_to_sid(value, size, &newsid);
2182 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2183 FILE__RELABELTO, &ad);
2187 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2192 return avc_has_perm(newsid,
2194 SECCLASS_FILESYSTEM,
2195 FILESYSTEM__ASSOCIATE,
2199 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2200 void *value, size_t size, int flags)
2202 struct inode *inode = dentry->d_inode;
2203 struct inode_security_struct *isec = inode->i_security;
2207 if (strcmp(name, XATTR_NAME_SELINUX)) {
2208 /* Not an attribute we recognize, so nothing to do. */
2212 rc = security_context_to_sid(value, size, &newsid);
2214 printk(KERN_WARNING "%s: unable to obtain SID for context "
2215 "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2223 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2225 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2228 static int selinux_inode_listxattr (struct dentry *dentry)
2230 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2233 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2235 if (strcmp(name, XATTR_NAME_SELINUX)) {
2236 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2237 sizeof XATTR_SECURITY_PREFIX - 1) &&
2238 !capable(CAP_SYS_ADMIN)) {
2239 /* A different attribute in the security namespace.
2240 Restrict to administrator. */
2244 /* Not an attribute we recognize, so just check the
2245 ordinary setattr permission. Might want a separate
2246 permission for removexattr. */
2247 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2250 /* No one is allowed to remove a SELinux security label.
2251 You can change the label, but all data must be labeled. */
2255 static const char *selinux_inode_xattr_getsuffix(void)
2257 return XATTR_SELINUX_SUFFIX;
2261 * Copy the in-core inode security context value to the user. If the
2262 * getxattr() prior to this succeeded, check to see if we need to
2263 * canonicalize the value to be finally returned to the user.
2265 * Permission check is handled by selinux_inode_getxattr hook.
2267 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void *buffer, size_t size, int err)
2269 struct inode_security_struct *isec = inode->i_security;
2271 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2274 return selinux_getsecurity(isec->sid, buffer, size);
2277 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2278 const void *value, size_t size, int flags)
2280 struct inode_security_struct *isec = inode->i_security;
2284 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2287 if (!value || !size)
2290 rc = security_context_to_sid((void*)value, size, &newsid);
2298 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2300 const int len = sizeof(XATTR_NAME_SELINUX);
2301 if (buffer && len <= buffer_size)
2302 memcpy(buffer, XATTR_NAME_SELINUX, len);
2306 /* file security operations */
2308 static int selinux_file_permission(struct file *file, int mask)
2310 struct inode *inode = file->f_dentry->d_inode;
2313 /* No permission to check. Existence test. */
2317 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2318 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2321 return file_has_perm(current, file,
2322 file_mask_to_av(inode->i_mode, mask));
2325 static int selinux_file_alloc_security(struct file *file)
2327 return file_alloc_security(file);
2330 static void selinux_file_free_security(struct file *file)
2332 file_free_security(file);
2335 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2347 case EXT2_IOC_GETFLAGS:
2349 case EXT2_IOC_GETVERSION:
2350 error = file_has_perm(current, file, FILE__GETATTR);
2353 case EXT2_IOC_SETFLAGS:
2355 case EXT2_IOC_SETVERSION:
2356 error = file_has_perm(current, file, FILE__SETATTR);
2359 /* sys_ioctl() checks */
2363 error = file_has_perm(current, file, 0);
2368 error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2371 /* default case assumes that the command will go
2372 * to the file's ioctl() function.
2375 error = file_has_perm(current, file, FILE__IOCTL);
2381 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2383 #ifndef CONFIG_PPC32
2384 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2386 * We are making executable an anonymous mapping or a
2387 * private file mapping that will also be writable.
2388 * This has an additional check.
2390 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2397 /* read access is always possible with a mapping */
2398 u32 av = FILE__READ;
2400 /* write access only matters if the mapping is shared */
2401 if (shared && (prot & PROT_WRITE))
2404 if (prot & PROT_EXEC)
2405 av |= FILE__EXECUTE;
2407 return file_has_perm(current, file, av);
2412 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2413 unsigned long prot, unsigned long flags)
2417 rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2421 if (selinux_checkreqprot)
2424 return file_map_prot_check(file, prot,
2425 (flags & MAP_TYPE) == MAP_SHARED);
2428 static int selinux_file_mprotect(struct vm_area_struct *vma,
2429 unsigned long reqprot,
2434 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2438 if (selinux_checkreqprot)
2441 #ifndef CONFIG_PPC32
2442 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2444 if (vma->vm_start >= vma->vm_mm->start_brk &&
2445 vma->vm_end <= vma->vm_mm->brk) {
2446 rc = task_has_perm(current, current,
2448 } else if (!vma->vm_file &&
2449 vma->vm_start <= vma->vm_mm->start_stack &&
2450 vma->vm_end >= vma->vm_mm->start_stack) {
2451 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2452 } else if (vma->vm_file && vma->anon_vma) {
2454 * We are making executable a file mapping that has
2455 * had some COW done. Since pages might have been
2456 * written, check ability to execute the possibly
2457 * modified content. This typically should only
2458 * occur for text relocations.
2460 rc = file_has_perm(current, vma->vm_file,
2468 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2471 static int selinux_file_lock(struct file *file, unsigned int cmd)
2473 return file_has_perm(current, file, FILE__LOCK);
2476 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2483 if (!file->f_dentry || !file->f_dentry->d_inode) {
2488 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2489 err = file_has_perm(current, file,FILE__WRITE);
2498 /* Just check FD__USE permission */
2499 err = file_has_perm(current, file, 0);
2504 #if BITS_PER_LONG == 32
2509 if (!file->f_dentry || !file->f_dentry->d_inode) {
2513 err = file_has_perm(current, file, FILE__LOCK);
2520 static int selinux_file_set_fowner(struct file *file)
2522 struct task_security_struct *tsec;
2523 struct file_security_struct *fsec;
2525 tsec = current->security;
2526 fsec = file->f_security;
2527 fsec->fown_sid = tsec->sid;
2532 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2533 struct fown_struct *fown, int signum)
2537 struct task_security_struct *tsec;
2538 struct file_security_struct *fsec;
2540 /* struct fown_struct is never outside the context of a struct file */
2541 file = (struct file *)((long)fown - offsetof(struct file,f_owner));
2543 tsec = tsk->security;
2544 fsec = file->f_security;
2547 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2549 perm = signal_to_av(signum);
2551 return avc_has_perm(fsec->fown_sid, tsec->sid,
2552 SECCLASS_PROCESS, perm, NULL);
2555 static int selinux_file_receive(struct file *file)
2557 return file_has_perm(current, file, file_to_av(file));
2560 /* task security operations */
2562 static int selinux_task_create(unsigned long clone_flags)
2566 rc = secondary_ops->task_create(clone_flags);
2570 return task_has_perm(current, current, PROCESS__FORK);
2573 static int selinux_task_alloc_security(struct task_struct *tsk)
2575 struct task_security_struct *tsec1, *tsec2;
2578 tsec1 = current->security;
2580 rc = task_alloc_security(tsk);
2583 tsec2 = tsk->security;
2585 tsec2->osid = tsec1->osid;
2586 tsec2->sid = tsec1->sid;
2588 /* Retain the exec and create SIDs across fork */
2589 tsec2->exec_sid = tsec1->exec_sid;
2590 tsec2->create_sid = tsec1->create_sid;
2592 /* Retain ptracer SID across fork, if any.
2593 This will be reset by the ptrace hook upon any
2594 subsequent ptrace_attach operations. */
2595 tsec2->ptrace_sid = tsec1->ptrace_sid;
2600 static void selinux_task_free_security(struct task_struct *tsk)
2602 task_free_security(tsk);
2605 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2607 /* Since setuid only affects the current process, and
2608 since the SELinux controls are not based on the Linux
2609 identity attributes, SELinux does not need to control
2610 this operation. However, SELinux does control the use
2611 of the CAP_SETUID and CAP_SETGID capabilities using the
2616 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2618 return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2621 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2623 /* See the comment for setuid above. */
2627 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2629 return task_has_perm(current, p, PROCESS__SETPGID);
2632 static int selinux_task_getpgid(struct task_struct *p)
2634 return task_has_perm(current, p, PROCESS__GETPGID);
2637 static int selinux_task_getsid(struct task_struct *p)
2639 return task_has_perm(current, p, PROCESS__GETSESSION);
2642 static int selinux_task_setgroups(struct group_info *group_info)
2644 /* See the comment for setuid above. */
2648 static int selinux_task_setnice(struct task_struct *p, int nice)
2652 rc = secondary_ops->task_setnice(p, nice);
2656 return task_has_perm(current,p, PROCESS__SETSCHED);
2659 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
2661 return task_has_perm(current, p, PROCESS__SETSCHED);
2664 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2666 struct rlimit *old_rlim = current->signal->rlim + resource;
2669 rc = secondary_ops->task_setrlimit(resource, new_rlim);
2673 /* Control the ability to change the hard limit (whether
2674 lowering or raising it), so that the hard limit can
2675 later be used as a safe reset point for the soft limit
2676 upon context transitions. See selinux_bprm_apply_creds. */
2677 if (old_rlim->rlim_max != new_rlim->rlim_max)
2678 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2683 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2685 return task_has_perm(current, p, PROCESS__SETSCHED);
2688 static int selinux_task_getscheduler(struct task_struct *p)
2690 return task_has_perm(current, p, PROCESS__GETSCHED);
2693 static int selinux_task_movememory(struct task_struct *p)
2695 return task_has_perm(current, p, PROCESS__SETSCHED);
2698 static int selinux_task_kill(struct task_struct *p, struct siginfo *info, int sig)
2703 rc = secondary_ops->task_kill(p, info, sig);
2707 if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
2711 perm = PROCESS__SIGNULL; /* null signal; existence test */
2713 perm = signal_to_av(sig);
2715 return task_has_perm(current, p, perm);
2718 static int selinux_task_prctl(int option,
2724 /* The current prctl operations do not appear to require
2725 any SELinux controls since they merely observe or modify
2726 the state of the current process. */
2730 static int selinux_task_wait(struct task_struct *p)
2734 perm = signal_to_av(p->exit_signal);
2736 return task_has_perm(p, current, perm);
2739 static void selinux_task_reparent_to_init(struct task_struct *p)
2741 struct task_security_struct *tsec;
2743 secondary_ops->task_reparent_to_init(p);
2746 tsec->osid = tsec->sid;
2747 tsec->sid = SECINITSID_KERNEL;
2751 static void selinux_task_to_inode(struct task_struct *p,
2752 struct inode *inode)
2754 struct task_security_struct *tsec = p->security;
2755 struct inode_security_struct *isec = inode->i_security;
2757 isec->sid = tsec->sid;
2758 isec->initialized = 1;
2762 /* Returns error only if unable to parse addresses */
2763 static int selinux_parse_skb_ipv4(struct sk_buff *skb, struct avc_audit_data *ad)
2765 int offset, ihlen, ret = -EINVAL;
2766 struct iphdr _iph, *ih;
2768 offset = skb->nh.raw - skb->data;
2769 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2773 ihlen = ih->ihl * 4;
2774 if (ihlen < sizeof(_iph))
2777 ad->u.net.v4info.saddr = ih->saddr;
2778 ad->u.net.v4info.daddr = ih->daddr;
2781 switch (ih->protocol) {
2783 struct tcphdr _tcph, *th;
2785 if (ntohs(ih->frag_off) & IP_OFFSET)
2789 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2793 ad->u.net.sport = th->source;
2794 ad->u.net.dport = th->dest;
2799 struct udphdr _udph, *uh;
2801 if (ntohs(ih->frag_off) & IP_OFFSET)
2805 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2809 ad->u.net.sport = uh->source;
2810 ad->u.net.dport = uh->dest;
2821 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2823 /* Returns error only if unable to parse addresses */
2824 static int selinux_parse_skb_ipv6(struct sk_buff *skb, struct avc_audit_data *ad)
2827 int ret = -EINVAL, offset;
2828 struct ipv6hdr _ipv6h, *ip6;
2830 offset = skb->nh.raw - skb->data;
2831 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
2835 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
2836 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
2839 nexthdr = ip6->nexthdr;
2840 offset += sizeof(_ipv6h);
2841 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
2847 struct tcphdr _tcph, *th;
2849 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2853 ad->u.net.sport = th->source;
2854 ad->u.net.dport = th->dest;
2859 struct udphdr _udph, *uh;
2861 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2865 ad->u.net.sport = uh->source;
2866 ad->u.net.dport = uh->dest;
2870 /* includes fragments */
2880 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
2881 char **addrp, int *len, int src)
2885 switch (ad->u.net.family) {
2887 ret = selinux_parse_skb_ipv4(skb, ad);
2891 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
2892 &ad->u.net.v4info.daddr);
2895 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2897 ret = selinux_parse_skb_ipv6(skb, ad);
2901 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
2902 &ad->u.net.v6info.daddr);
2912 /* socket security operations */
2913 static int socket_has_perm(struct task_struct *task, struct socket *sock,
2916 struct inode_security_struct *isec;
2917 struct task_security_struct *tsec;
2918 struct avc_audit_data ad;
2921 tsec = task->security;
2922 isec = SOCK_INODE(sock)->i_security;
2924 if (isec->sid == SECINITSID_KERNEL)
2927 AVC_AUDIT_DATA_INIT(&ad,NET);
2928 ad.u.net.sk = sock->sk;
2929 err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
2935 static int selinux_socket_create(int family, int type,
2936 int protocol, int kern)
2939 struct task_security_struct *tsec;
2944 tsec = current->security;
2945 err = avc_has_perm(tsec->sid, tsec->sid,
2946 socket_type_to_security_class(family, type,
2947 protocol), SOCKET__CREATE, NULL);
2953 static void selinux_socket_post_create(struct socket *sock, int family,
2954 int type, int protocol, int kern)
2956 struct inode_security_struct *isec;
2957 struct task_security_struct *tsec;
2959 isec = SOCK_INODE(sock)->i_security;
2961 tsec = current->security;
2962 isec->sclass = socket_type_to_security_class(family, type, protocol);
2963 isec->sid = kern ? SECINITSID_KERNEL : tsec->sid;
2964 isec->initialized = 1;
2969 /* Range of port numbers used to automatically bind.
2970 Need to determine whether we should perform a name_bind
2971 permission check between the socket and the port number. */
2972 #define ip_local_port_range_0 sysctl_local_port_range[0]
2973 #define ip_local_port_range_1 sysctl_local_port_range[1]
2975 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
2980 err = socket_has_perm(current, sock, SOCKET__BIND);
2985 * If PF_INET or PF_INET6, check name_bind permission for the port.
2986 * Multiple address binding for SCTP is not supported yet: we just
2987 * check the first address now.
2989 family = sock->sk->sk_family;
2990 if (family == PF_INET || family == PF_INET6) {
2992 struct inode_security_struct *isec;
2993 struct task_security_struct *tsec;
2994 struct avc_audit_data ad;
2995 struct sockaddr_in *addr4 = NULL;
2996 struct sockaddr_in6 *addr6 = NULL;
2997 unsigned short snum;
2998 struct sock *sk = sock->sk;
2999 u32 sid, node_perm, addrlen;
3001 tsec = current->security;
3002 isec = SOCK_INODE(sock)->i_security;
3004 if (family == PF_INET) {
3005 addr4 = (struct sockaddr_in *)address;
3006 snum = ntohs(addr4->sin_port);
3007 addrlen = sizeof(addr4->sin_addr.s_addr);
3008 addrp = (char *)&addr4->sin_addr.s_addr;
3010 addr6 = (struct sockaddr_in6 *)address;
3011 snum = ntohs(addr6->sin6_port);
3012 addrlen = sizeof(addr6->sin6_addr.s6_addr);
3013 addrp = (char *)&addr6->sin6_addr.s6_addr;
3016 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3017 snum > ip_local_port_range_1)) {
3018 err = security_port_sid(sk->sk_family, sk->sk_type,
3019 sk->sk_protocol, snum, &sid);
3022 AVC_AUDIT_DATA_INIT(&ad,NET);
3023 ad.u.net.sport = htons(snum);
3024 ad.u.net.family = family;
3025 err = avc_has_perm(isec->sid, sid,
3027 SOCKET__NAME_BIND, &ad);
3032 switch(isec->sclass) {
3033 case SECCLASS_TCP_SOCKET:
3034 node_perm = TCP_SOCKET__NODE_BIND;
3037 case SECCLASS_UDP_SOCKET:
3038 node_perm = UDP_SOCKET__NODE_BIND;
3042 node_perm = RAWIP_SOCKET__NODE_BIND;
3046 err = security_node_sid(family, addrp, addrlen, &sid);
3050 AVC_AUDIT_DATA_INIT(&ad,NET);
3051 ad.u.net.sport = htons(snum);
3052 ad.u.net.family = family;
3054 if (family == PF_INET)
3055 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3057 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3059 err = avc_has_perm(isec->sid, sid,
3060 isec->sclass, node_perm, &ad);
3068 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3070 struct inode_security_struct *isec;
3073 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3078 * If a TCP socket, check name_connect permission for the port.
3080 isec = SOCK_INODE(sock)->i_security;
3081 if (isec->sclass == SECCLASS_TCP_SOCKET) {
3082 struct sock *sk = sock->sk;
3083 struct avc_audit_data ad;
3084 struct sockaddr_in *addr4 = NULL;
3085 struct sockaddr_in6 *addr6 = NULL;
3086 unsigned short snum;
3089 if (sk->sk_family == PF_INET) {
3090 addr4 = (struct sockaddr_in *)address;
3091 if (addrlen < sizeof(struct sockaddr_in))
3093 snum = ntohs(addr4->sin_port);
3095 addr6 = (struct sockaddr_in6 *)address;
3096 if (addrlen < SIN6_LEN_RFC2133)
3098 snum = ntohs(addr6->sin6_port);
3101 err = security_port_sid(sk->sk_family, sk->sk_type,
3102 sk->sk_protocol, snum, &sid);
3106 AVC_AUDIT_DATA_INIT(&ad,NET);
3107 ad.u.net.dport = htons(snum);
3108 ad.u.net.family = sk->sk_family;
3109 err = avc_has_perm(isec->sid, sid, isec->sclass,
3110 TCP_SOCKET__NAME_CONNECT, &ad);
3119 static int selinux_socket_listen(struct socket *sock, int backlog)
3121 return socket_has_perm(current, sock, SOCKET__LISTEN);
3124 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3127 struct inode_security_struct *isec;
3128 struct inode_security_struct *newisec;
3130 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3134 newisec = SOCK_INODE(newsock)->i_security;
3136 isec = SOCK_INODE(sock)->i_security;
3137 newisec->sclass = isec->sclass;
3138 newisec->sid = isec->sid;
3139 newisec->initialized = 1;
3144 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3147 return socket_has_perm(current, sock, SOCKET__WRITE);
3150 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3151 int size, int flags)
3153 return socket_has_perm(current, sock, SOCKET__READ);
3156 static int selinux_socket_getsockname(struct socket *sock)
3158 return socket_has_perm(current, sock, SOCKET__GETATTR);
3161 static int selinux_socket_getpeername(struct socket *sock)
3163 return socket_has_perm(current, sock, SOCKET__GETATTR);
3166 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3168 return socket_has_perm(current, sock, SOCKET__SETOPT);
3171 static int selinux_socket_getsockopt(struct socket *sock, int level,
3174 return socket_has_perm(current, sock, SOCKET__GETOPT);
3177 static int selinux_socket_shutdown(struct socket *sock, int how)
3179 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3182 static int selinux_socket_unix_stream_connect(struct socket *sock,
3183 struct socket *other,
3186 struct sk_security_struct *ssec;
3187 struct inode_security_struct *isec;
3188 struct inode_security_struct *other_isec;
3189 struct avc_audit_data ad;
3192 err = secondary_ops->unix_stream_connect(sock, other, newsk);
3196 isec = SOCK_INODE(sock)->i_security;
3197 other_isec = SOCK_INODE(other)->i_security;
3199 AVC_AUDIT_DATA_INIT(&ad,NET);
3200 ad.u.net.sk = other->sk;
3202 err = avc_has_perm(isec->sid, other_isec->sid,
3204 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3208 /* connecting socket */
3209 ssec = sock->sk->sk_security;
3210 ssec->peer_sid = other_isec->sid;
3212 /* server child socket */
3213 ssec = newsk->sk_security;
3214 ssec->peer_sid = isec->sid;
3219 static int selinux_socket_unix_may_send(struct socket *sock,
3220 struct socket *other)
3222 struct inode_security_struct *isec;
3223 struct inode_security_struct *other_isec;
3224 struct avc_audit_data ad;
3227 isec = SOCK_INODE(sock)->i_security;
3228 other_isec = SOCK_INODE(other)->i_security;
3230 AVC_AUDIT_DATA_INIT(&ad,NET);
3231 ad.u.net.sk = other->sk;
3233 err = avc_has_perm(isec->sid, other_isec->sid,
3234 isec->sclass, SOCKET__SENDTO, &ad);
3241 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
3242 struct avc_audit_data *ad, u32 sock_sid, u16 sock_class,
3243 u16 family, char *addrp, int len)
3246 u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3251 err = sel_netif_sids(skb->dev, &if_sid, NULL);
3255 switch (sock_class) {
3256 case SECCLASS_UDP_SOCKET:
3257 netif_perm = NETIF__UDP_RECV;
3258 node_perm = NODE__UDP_RECV;
3259 recv_perm = UDP_SOCKET__RECV_MSG;
3262 case SECCLASS_TCP_SOCKET:
3263 netif_perm = NETIF__TCP_RECV;
3264 node_perm = NODE__TCP_RECV;
3265 recv_perm = TCP_SOCKET__RECV_MSG;
3269 netif_perm = NETIF__RAWIP_RECV;
3270 node_perm = NODE__RAWIP_RECV;
3274 err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3278 err = security_node_sid(family, addrp, len, &node_sid);
3282 err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, ad);
3289 err = security_port_sid(sk->sk_family, sk->sk_type,
3290 sk->sk_protocol, ntohs(ad->u.net.sport),
3295 err = avc_has_perm(sock_sid, port_sid,
3296 sock_class, recv_perm, ad);
3303 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3310 struct socket *sock;
3311 struct avc_audit_data ad;
3313 family = sk->sk_family;
3314 if (family != PF_INET && family != PF_INET6)
3317 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3318 if (family == PF_INET6 && skb->protocol == ntohs(ETH_P_IP))
3321 read_lock_bh(&sk->sk_callback_lock);
3322 sock = sk->sk_socket;
3324 struct inode *inode;
3325 inode = SOCK_INODE(sock);
3327 struct inode_security_struct *isec;
3328 isec = inode->i_security;
3329 sock_sid = isec->sid;
3330 sock_class = isec->sclass;
3333 read_unlock_bh(&sk->sk_callback_lock);
3337 AVC_AUDIT_DATA_INIT(&ad, NET);
3338 ad.u.net.netif = skb->dev ? skb->dev->name : "[unknown]";
3339 ad.u.net.family = family;
3341 err = selinux_parse_skb(skb, &ad, &addrp, &len, 1);
3345 if (selinux_compat_net)
3346 err = selinux_sock_rcv_skb_compat(sk, skb, &ad, sock_sid,
3350 err = avc_has_perm(sock_sid, skb->secmark, SECCLASS_PACKET,
3355 err = selinux_xfrm_sock_rcv_skb(sock_sid, skb);
3360 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
3361 int __user *optlen, unsigned len)
3366 struct sk_security_struct *ssec;
3367 struct inode_security_struct *isec;
3370 isec = SOCK_INODE(sock)->i_security;
3372 /* if UNIX_STREAM check peer_sid, if TCP check dst for labelled sa */
3373 if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET) {
3374 ssec = sock->sk->sk_security;
3375 peer_sid = ssec->peer_sid;
3377 else if (isec->sclass == SECCLASS_TCP_SOCKET) {
3378 peer_sid = selinux_socket_getpeer_stream(sock->sk);
3380 if (peer_sid == SECSID_NULL) {
3390 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
3395 if (scontext_len > len) {
3400 if (copy_to_user(optval, scontext, scontext_len))
3404 if (put_user(scontext_len, optlen))
3412 static int selinux_socket_getpeersec_dgram(struct sk_buff *skb, char **secdata, u32 *seclen)
3415 u32 peer_sid = selinux_socket_getpeer_dgram(skb);
3417 if (peer_sid == SECSID_NULL)
3420 err = security_sid_to_context(peer_sid, secdata, seclen);
3429 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
3431 return sk_alloc_security(sk, family, priority);
3434 static void selinux_sk_free_security(struct sock *sk)
3436 sk_free_security(sk);
3439 static unsigned int selinux_sk_getsid_security(struct sock *sk, struct flowi *fl, u8 dir)
3441 struct inode_security_struct *isec;
3442 u32 sock_sid = SECINITSID_ANY_SOCKET;
3445 return selinux_no_sk_sid(fl);
3447 read_lock_bh(&sk->sk_callback_lock);
3448 isec = get_sock_isec(sk);
3451 sock_sid = isec->sid;
3453 read_unlock_bh(&sk->sk_callback_lock);
3457 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3461 struct nlmsghdr *nlh;
3462 struct socket *sock = sk->sk_socket;
3463 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3465 if (skb->len < NLMSG_SPACE(0)) {
3469 nlh = (struct nlmsghdr *)skb->data;
3471 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3473 if (err == -EINVAL) {
3474 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
3475 "SELinux: unrecognized netlink message"
3476 " type=%hu for sclass=%hu\n",
3477 nlh->nlmsg_type, isec->sclass);
3478 if (!selinux_enforcing)
3488 err = socket_has_perm(current, sock, perm);
3493 #ifdef CONFIG_NETFILTER
3495 static int selinux_ip_postroute_last_compat(struct sock *sk, struct net_device *dev,
3496 struct inode_security_struct *isec,
3497 struct avc_audit_data *ad,
3498 u16 family, char *addrp, int len)
3501 u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
3503 err = sel_netif_sids(dev, &if_sid, NULL);
3507 switch (isec->sclass) {
3508 case SECCLASS_UDP_SOCKET:
3509 netif_perm = NETIF__UDP_SEND;
3510 node_perm = NODE__UDP_SEND;
3511 send_perm = UDP_SOCKET__SEND_MSG;
3514 case SECCLASS_TCP_SOCKET:
3515 netif_perm = NETIF__TCP_SEND;
3516 node_perm = NODE__TCP_SEND;
3517 send_perm = TCP_SOCKET__SEND_MSG;
3521 netif_perm = NETIF__RAWIP_SEND;
3522 node_perm = NODE__RAWIP_SEND;
3526 err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3530 err = security_node_sid(family, addrp, len, &node_sid);
3534 err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE, node_perm, ad);
3541 err = security_port_sid(sk->sk_family,
3544 ntohs(ad->u.net.dport),
3549 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3556 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3557 struct sk_buff **pskb,
3558 const struct net_device *in,
3559 const struct net_device *out,
3560 int (*okfn)(struct sk_buff *),
3566 struct socket *sock;
3567 struct inode *inode;
3568 struct sk_buff *skb = *pskb;
3569 struct inode_security_struct *isec;
3570 struct avc_audit_data ad;
3571 struct net_device *dev = (struct net_device *)out;
3577 sock = sk->sk_socket;
3581 inode = SOCK_INODE(sock);
3585 isec = inode->i_security;
3587 AVC_AUDIT_DATA_INIT(&ad, NET);
3588 ad.u.net.netif = dev->name;
3589 ad.u.net.family = family;
3591 err = selinux_parse_skb(skb, &ad, &addrp, &len, 0);
3595 if (selinux_compat_net)
3596 err = selinux_ip_postroute_last_compat(sk, dev, isec, &ad,
3597 family, addrp, len);
3599 err = avc_has_perm(isec->sid, skb->secmark, SECCLASS_PACKET,
3605 err = selinux_xfrm_postroute_last(isec->sid, skb);
3607 return err ? NF_DROP : NF_ACCEPT;
3610 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3611 struct sk_buff **pskb,
3612 const struct net_device *in,
3613 const struct net_device *out,
3614 int (*okfn)(struct sk_buff *))
3616 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3619 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3621 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3622 struct sk_buff **pskb,
3623 const struct net_device *in,
3624 const struct net_device *out,
3625 int (*okfn)(struct sk_buff *))
3627 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3632 #endif /* CONFIG_NETFILTER */
3634 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3636 struct task_security_struct *tsec;
3637 struct av_decision avd;
3640 err = secondary_ops->netlink_send(sk, skb);
3644 tsec = current->security;
3647 avc_has_perm_noaudit(tsec->sid, tsec->sid,
3648 SECCLASS_CAPABILITY, ~0, &avd);
3649 cap_mask(NETLINK_CB(skb).eff_cap, avd.allowed);
3651 if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
3652 err = selinux_nlmsg_perm(sk, skb);
3657 static int selinux_netlink_recv(struct sk_buff *skb)
3659 if (!cap_raised(NETLINK_CB(skb).eff_cap, CAP_NET_ADMIN))
3664 static int ipc_alloc_security(struct task_struct *task,
3665 struct kern_ipc_perm *perm,
3668 struct task_security_struct *tsec = task->security;
3669 struct ipc_security_struct *isec;
3671 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
3675 isec->sclass = sclass;
3676 isec->ipc_perm = perm;
3677 isec->sid = tsec->sid;
3678 perm->security = isec;
3683 static void ipc_free_security(struct kern_ipc_perm *perm)
3685 struct ipc_security_struct *isec = perm->security;
3686 perm->security = NULL;
3690 static int msg_msg_alloc_security(struct msg_msg *msg)
3692 struct msg_security_struct *msec;
3694 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
3699 msec->sid = SECINITSID_UNLABELED;
3700 msg->security = msec;
3705 static void msg_msg_free_security(struct msg_msg *msg)
3707 struct msg_security_struct *msec = msg->security;
3709 msg->security = NULL;
3713 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
3716 struct task_security_struct *tsec;
3717 struct ipc_security_struct *isec;
3718 struct avc_audit_data ad;
3720 tsec = current->security;
3721 isec = ipc_perms->security;
3723 AVC_AUDIT_DATA_INIT(&ad, IPC);
3724 ad.u.ipc_id = ipc_perms->key;
3726 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3729 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
3731 return msg_msg_alloc_security(msg);
3734 static void selinux_msg_msg_free_security(struct msg_msg *msg)
3736 msg_msg_free_security(msg);
3739 /* message queue security operations */
3740 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
3742 struct task_security_struct *tsec;
3743 struct ipc_security_struct *isec;
3744 struct avc_audit_data ad;
3747 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
3751 tsec = current->security;
3752 isec = msq->q_perm.security;
3754 AVC_AUDIT_DATA_INIT(&ad, IPC);
3755 ad.u.ipc_id = msq->q_perm.key;
3757 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3760 ipc_free_security(&msq->q_perm);
3766 static void selinux_msg_queue_free_security(struct msg_queue *msq)
3768 ipc_free_security(&msq->q_perm);
3771 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
3773 struct task_security_struct *tsec;
3774 struct ipc_security_struct *isec;
3775 struct avc_audit_data ad;
3777 tsec = current->security;
3778 isec = msq->q_perm.security;
3780 AVC_AUDIT_DATA_INIT(&ad, IPC);
3781 ad.u.ipc_id = msq->q_perm.key;
3783 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3784 MSGQ__ASSOCIATE, &ad);
3787 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
3795 /* No specific object, just general system-wide information. */
3796 return task_has_system(current, SYSTEM__IPC_INFO);
3799 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
3802 perms = MSGQ__SETATTR;
3805 perms = MSGQ__DESTROY;
3811 err = ipc_has_perm(&msq->q_perm, perms);
3815 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
3817 struct task_security_struct *tsec;
3818 struct ipc_security_struct *isec;
3819 struct msg_security_struct *msec;
3820 struct avc_audit_data ad;
3823 tsec = current->security;
3824 isec = msq->q_perm.security;
3825 msec = msg->security;
3828 * First time through, need to assign label to the message
3830 if (msec->sid == SECINITSID_UNLABELED) {
3832 * Compute new sid based on current process and
3833 * message queue this message will be stored in
3835 rc = security_transition_sid(tsec->sid,
3843 AVC_AUDIT_DATA_INIT(&ad, IPC);
3844 ad.u.ipc_id = msq->q_perm.key;
3846 /* Can this process write to the queue? */
3847 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3850 /* Can this process send the message */
3851 rc = avc_has_perm(tsec->sid, msec->sid,
3852 SECCLASS_MSG, MSG__SEND, &ad);
3854 /* Can the message be put in the queue? */
3855 rc = avc_has_perm(msec->sid, isec->sid,
3856 SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
3861 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
3862 struct task_struct *target,
3863 long type, int mode)
3865 struct task_security_struct *tsec;
3866 struct ipc_security_struct *isec;
3867 struct msg_security_struct *msec;
3868 struct avc_audit_data ad;
3871 tsec = target->security;
3872 isec = msq->q_perm.security;
3873 msec = msg->security;
3875 AVC_AUDIT_DATA_INIT(&ad, IPC);
3876 ad.u.ipc_id = msq->q_perm.key;
3878 rc = avc_has_perm(tsec->sid, isec->sid,
3879 SECCLASS_MSGQ, MSGQ__READ, &ad);
3881 rc = avc_has_perm(tsec->sid, msec->sid,
3882 SECCLASS_MSG, MSG__RECEIVE, &ad);
3886 /* Shared Memory security operations */
3887 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
3889 struct task_security_struct *tsec;
3890 struct ipc_security_struct *isec;
3891 struct avc_audit_data ad;
3894 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
3898 tsec = current->security;
3899 isec = shp->shm_perm.security;
3901 AVC_AUDIT_DATA_INIT(&ad, IPC);
3902 ad.u.ipc_id = shp->shm_perm.key;
3904 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3907 ipc_free_security(&shp->shm_perm);
3913 static void selinux_shm_free_security(struct shmid_kernel *shp)
3915 ipc_free_security(&shp->shm_perm);
3918 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
3920 struct task_security_struct *tsec;
3921 struct ipc_security_struct *isec;
3922 struct avc_audit_data ad;
3924 tsec = current->security;
3925 isec = shp->shm_perm.security;
3927 AVC_AUDIT_DATA_INIT(&ad, IPC);
3928 ad.u.ipc_id = shp->shm_perm.key;
3930 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3931 SHM__ASSOCIATE, &ad);
3934 /* Note, at this point, shp is locked down */
3935 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
3943 /* No specific object, just general system-wide information. */
3944 return task_has_system(current, SYSTEM__IPC_INFO);
3947 perms = SHM__GETATTR | SHM__ASSOCIATE;
3950 perms = SHM__SETATTR;
3957 perms = SHM__DESTROY;
3963 err = ipc_has_perm(&shp->shm_perm, perms);
3967 static int selinux_shm_shmat(struct shmid_kernel *shp,
3968 char __user *shmaddr, int shmflg)
3973 rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
3977 if (shmflg & SHM_RDONLY)
3980 perms = SHM__READ | SHM__WRITE;
3982 return ipc_has_perm(&shp->shm_perm, perms);
3985 /* Semaphore security operations */
3986 static int selinux_sem_alloc_security(struct sem_array *sma)
3988 struct task_security_struct *tsec;
3989 struct ipc_security_struct *isec;
3990 struct avc_audit_data ad;
3993 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
3997 tsec = current->security;
3998 isec = sma->sem_perm.security;
4000 AVC_AUDIT_DATA_INIT(&ad, IPC);
4001 ad.u.ipc_id = sma->sem_perm.key;
4003 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4006 ipc_free_security(&sma->sem_perm);
4012 static void selinux_sem_free_security(struct sem_array *sma)
4014 ipc_free_security(&sma->sem_perm);
4017 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4019 struct task_security_struct *tsec;
4020 struct ipc_security_struct *isec;
4021 struct avc_audit_data ad;
4023 tsec = current->security;
4024 isec = sma->sem_perm.security;
4026 AVC_AUDIT_DATA_INIT(&ad, IPC);
4027 ad.u.ipc_id = sma->sem_perm.key;
4029 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4030 SEM__ASSOCIATE, &ad);
4033 /* Note, at this point, sma is locked down */
4034 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4042 /* No specific object, just general system-wide information. */
4043 return task_has_system(current, SYSTEM__IPC_INFO);
4047 perms = SEM__GETATTR;
4058 perms = SEM__DESTROY;
4061 perms = SEM__SETATTR;
4065 perms = SEM__GETATTR | SEM__ASSOCIATE;
4071 err = ipc_has_perm(&sma->sem_perm, perms);
4075 static int selinux_sem_semop(struct sem_array *sma,
4076 struct sembuf *sops, unsigned nsops, int alter)
4081 perms = SEM__READ | SEM__WRITE;
4085 return ipc_has_perm(&sma->sem_perm, perms);
4088 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4094 av |= IPC__UNIX_READ;
4096 av |= IPC__UNIX_WRITE;
4101 return ipc_has_perm(ipcp, av);
4104 /* module stacking operations */
4105 static int selinux_register_security (const char *name, struct security_operations *ops)
4107 if (secondary_ops != original_ops) {
4108 printk(KERN_INFO "%s: There is already a secondary security "
4109 "module registered.\n", __FUNCTION__);
4113 secondary_ops = ops;
4115 printk(KERN_INFO "%s: Registering secondary module %s\n",
4122 static int selinux_unregister_security (const char *name, struct security_operations *ops)
4124 if (ops != secondary_ops) {
4125 printk (KERN_INFO "%s: trying to unregister a security module "
4126 "that is not registered.\n", __FUNCTION__);
4130 secondary_ops = original_ops;
4135 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4138 inode_doinit_with_dentry(inode, dentry);
4141 static int selinux_getprocattr(struct task_struct *p,
4142 char *name, void *value, size_t size)
4144 struct task_security_struct *tsec;
4149 error = task_has_perm(current, p, PROCESS__GETATTR);
4156 if (!strcmp(name, "current"))
4158 else if (!strcmp(name, "prev"))
4160 else if (!strcmp(name, "exec"))
4161 sid = tsec->exec_sid;
4162 else if (!strcmp(name, "fscreate"))
4163 sid = tsec->create_sid;
4164 else if (!strcmp(name, "keycreate"))
4165 sid = tsec->keycreate_sid;
4172 return selinux_getsecurity(sid, value, size);
4175 static int selinux_setprocattr(struct task_struct *p,
4176 char *name, void *value, size_t size)
4178 struct task_security_struct *tsec;
4184 /* SELinux only allows a process to change its own
4185 security attributes. */
4190 * Basic control over ability to set these attributes at all.
4191 * current == p, but we'll pass them separately in case the
4192 * above restriction is ever removed.
4194 if (!strcmp(name, "exec"))
4195 error = task_has_perm(current, p, PROCESS__SETEXEC);
4196 else if (!strcmp(name, "fscreate"))
4197 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4198 else if (!strcmp(name, "keycreate"))
4199 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
4200 else if (!strcmp(name, "current"))
4201 error = task_has_perm(current, p, PROCESS__SETCURRENT);
4207 /* Obtain a SID for the context, if one was specified. */
4208 if (size && str[1] && str[1] != '\n') {
4209 if (str[size-1] == '\n') {
4213 error = security_context_to_sid(value, size, &sid);
4218 /* Permission checking based on the specified context is
4219 performed during the actual operation (execve,
4220 open/mkdir/...), when we know the full context of the
4221 operation. See selinux_bprm_set_security for the execve
4222 checks and may_create for the file creation checks. The
4223 operation will then fail if the context is not permitted. */
4225 if (!strcmp(name, "exec"))
4226 tsec->exec_sid = sid;
4227 else if (!strcmp(name, "fscreate"))
4228 tsec->create_sid = sid;
4229 else if (!strcmp(name, "keycreate")) {
4230 error = may_create_key(sid, p);
4233 tsec->keycreate_sid = sid;
4234 } else if (!strcmp(name, "current")) {
4235 struct av_decision avd;
4240 /* Only allow single threaded processes to change context */
4241 if (atomic_read(&p->mm->mm_users) != 1) {
4242 struct task_struct *g, *t;
4243 struct mm_struct *mm = p->mm;
4244 read_lock(&tasklist_lock);
4245 do_each_thread(g, t)
4246 if (t->mm == mm && t != p) {
4247 read_unlock(&tasklist_lock);
4250 while_each_thread(g, t);
4251 read_unlock(&tasklist_lock);
4254 /* Check permissions for the transition. */
4255 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
4256 PROCESS__DYNTRANSITION, NULL);
4260 /* Check for ptracing, and update the task SID if ok.
4261 Otherwise, leave SID unchanged and fail. */
4263 if (p->ptrace & PT_PTRACED) {
4264 error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
4266 PROCESS__PTRACE, &avd);
4270 avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
4271 PROCESS__PTRACE, &avd, error, NULL);
4287 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
4288 unsigned long flags)
4290 struct task_security_struct *tsec = tsk->security;
4291 struct key_security_struct *ksec;
4293 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
4298 if (tsec->keycreate_sid)
4299 ksec->sid = tsec->keycreate_sid;
4301 ksec->sid = tsec->sid;
4307 static void selinux_key_free(struct key *k)
4309 struct key_security_struct *ksec = k->security;
4315 static int selinux_key_permission(key_ref_t key_ref,
4316 struct task_struct *ctx,
4320 struct task_security_struct *tsec;
4321 struct key_security_struct *ksec;
4323 key = key_ref_to_ptr(key_ref);
4325 tsec = ctx->security;
4326 ksec = key->security;
4328 /* if no specific permissions are requested, we skip the
4329 permission check. No serious, additional covert channels
4330 appear to be created. */
4334 return avc_has_perm(tsec->sid, ksec->sid,
4335 SECCLASS_KEY, perm, NULL);
4340 static struct security_operations selinux_ops = {
4341 .ptrace = selinux_ptrace,
4342 .capget = selinux_capget,
4343 .capset_check = selinux_capset_check,
4344 .capset_set = selinux_capset_set,
4345 .sysctl = selinux_sysctl,
4346 .capable = selinux_capable,
4347 .quotactl = selinux_quotactl,
4348 .quota_on = selinux_quota_on,
4349 .syslog = selinux_syslog,
4350 .vm_enough_memory = selinux_vm_enough_memory,
4352 .netlink_send = selinux_netlink_send,
4353 .netlink_recv = selinux_netlink_recv,
4355 .bprm_alloc_security = selinux_bprm_alloc_security,
4356 .bprm_free_security = selinux_bprm_free_security,
4357 .bprm_apply_creds = selinux_bprm_apply_creds,
4358 .bprm_post_apply_creds = selinux_bprm_post_apply_creds,
4359 .bprm_set_security = selinux_bprm_set_security,
4360 .bprm_check_security = selinux_bprm_check_security,
4361 .bprm_secureexec = selinux_bprm_secureexec,
4363 .sb_alloc_security = selinux_sb_alloc_security,
4364 .sb_free_security = selinux_sb_free_security,
4365 .sb_copy_data = selinux_sb_copy_data,
4366 .sb_kern_mount = selinux_sb_kern_mount,
4367 .sb_statfs = selinux_sb_statfs,
4368 .sb_mount = selinux_mount,
4369 .sb_umount = selinux_umount,
4371 .inode_alloc_security = selinux_inode_alloc_security,
4372 .inode_free_security = selinux_inode_free_security,
4373 .inode_init_security = selinux_inode_init_security,
4374 .inode_create = selinux_inode_create,
4375 .inode_link = selinux_inode_link,
4376 .inode_unlink = selinux_inode_unlink,
4377 .inode_symlink = selinux_inode_symlink,
4378 .inode_mkdir = selinux_inode_mkdir,
4379 .inode_rmdir = selinux_inode_rmdir,
4380 .inode_mknod = selinux_inode_mknod,
4381 .inode_rename = selinux_inode_rename,
4382 .inode_readlink = selinux_inode_readlink,
4383 .inode_follow_link = selinux_inode_follow_link,
4384 .inode_permission = selinux_inode_permission,
4385 .inode_setattr = selinux_inode_setattr,
4386 .inode_getattr = selinux_inode_getattr,
4387 .inode_setxattr = selinux_inode_setxattr,
4388 .inode_post_setxattr = selinux_inode_post_setxattr,
4389 .inode_getxattr = selinux_inode_getxattr,
4390 .inode_listxattr = selinux_inode_listxattr,
4391 .inode_removexattr = selinux_inode_removexattr,
4392 .inode_xattr_getsuffix = selinux_inode_xattr_getsuffix,
4393 .inode_getsecurity = selinux_inode_getsecurity,
4394 .inode_setsecurity = selinux_inode_setsecurity,
4395 .inode_listsecurity = selinux_inode_listsecurity,
4397 .file_permission = selinux_file_permission,
4398 .file_alloc_security = selinux_file_alloc_security,
4399 .file_free_security = selinux_file_free_security,
4400 .file_ioctl = selinux_file_ioctl,
4401 .file_mmap = selinux_file_mmap,
4402 .file_mprotect = selinux_file_mprotect,
4403 .file_lock = selinux_file_lock,
4404 .file_fcntl = selinux_file_fcntl,
4405 .file_set_fowner = selinux_file_set_fowner,
4406 .file_send_sigiotask = selinux_file_send_sigiotask,
4407 .file_receive = selinux_file_receive,
4409 .task_create = selinux_task_create,
4410 .task_alloc_security = selinux_task_alloc_security,
4411 .task_free_security = selinux_task_free_security,
4412 .task_setuid = selinux_task_setuid,
4413 .task_post_setuid = selinux_task_post_setuid,
4414 .task_setgid = selinux_task_setgid,
4415 .task_setpgid = selinux_task_setpgid,
4416 .task_getpgid = selinux_task_getpgid,
4417 .task_getsid = selinux_task_getsid,
4418 .task_setgroups = selinux_task_setgroups,
4419 .task_setnice = selinux_task_setnice,
4420 .task_setioprio = selinux_task_setioprio,
4421 .task_setrlimit = selinux_task_setrlimit,
4422 .task_setscheduler = selinux_task_setscheduler,
4423 .task_getscheduler = selinux_task_getscheduler,
4424 .task_movememory = selinux_task_movememory,
4425 .task_kill = selinux_task_kill,
4426 .task_wait = selinux_task_wait,
4427 .task_prctl = selinux_task_prctl,
4428 .task_reparent_to_init = selinux_task_reparent_to_init,
4429 .task_to_inode = selinux_task_to_inode,
4431 .ipc_permission = selinux_ipc_permission,
4433 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
4434 .msg_msg_free_security = selinux_msg_msg_free_security,
4436 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
4437 .msg_queue_free_security = selinux_msg_queue_free_security,
4438 .msg_queue_associate = selinux_msg_queue_associate,
4439 .msg_queue_msgctl = selinux_msg_queue_msgctl,
4440 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
4441 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
4443 .shm_alloc_security = selinux_shm_alloc_security,
4444 .shm_free_security = selinux_shm_free_security,
4445 .shm_associate = selinux_shm_associate,
4446 .shm_shmctl = selinux_shm_shmctl,
4447 .shm_shmat = selinux_shm_shmat,
4449 .sem_alloc_security = selinux_sem_alloc_security,
4450 .sem_free_security = selinux_sem_free_security,
4451 .sem_associate = selinux_sem_associate,
4452 .sem_semctl = selinux_sem_semctl,
4453 .sem_semop = selinux_sem_semop,
4455 .register_security = selinux_register_security,
4456 .unregister_security = selinux_unregister_security,
4458 .d_instantiate = selinux_d_instantiate,
4460 .getprocattr = selinux_getprocattr,
4461 .setprocattr = selinux_setprocattr,
4463 .unix_stream_connect = selinux_socket_unix_stream_connect,
4464 .unix_may_send = selinux_socket_unix_may_send,
4466 .socket_create = selinux_socket_create,
4467 .socket_post_create = selinux_socket_post_create,
4468 .socket_bind = selinux_socket_bind,
4469 .socket_connect = selinux_socket_connect,
4470 .socket_listen = selinux_socket_listen,
4471 .socket_accept = selinux_socket_accept,
4472 .socket_sendmsg = selinux_socket_sendmsg,
4473 .socket_recvmsg = selinux_socket_recvmsg,
4474 .socket_getsockname = selinux_socket_getsockname,
4475 .socket_getpeername = selinux_socket_getpeername,
4476 .socket_getsockopt = selinux_socket_getsockopt,
4477 .socket_setsockopt = selinux_socket_setsockopt,
4478 .socket_shutdown = selinux_socket_shutdown,
4479 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
4480 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
4481 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
4482 .sk_alloc_security = selinux_sk_alloc_security,
4483 .sk_free_security = selinux_sk_free_security,
4484 .sk_getsid = selinux_sk_getsid_security,
4486 #ifdef CONFIG_SECURITY_NETWORK_XFRM
4487 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
4488 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
4489 .xfrm_policy_free_security = selinux_xfrm_policy_free,
4490 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
4491 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
4492 .xfrm_state_free_security = selinux_xfrm_state_free,
4493 .xfrm_state_delete_security = selinux_xfrm_state_delete,
4494 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
4498 .key_alloc = selinux_key_alloc,
4499 .key_free = selinux_key_free,
4500 .key_permission = selinux_key_permission,
4504 static __init int selinux_init(void)
4506 struct task_security_struct *tsec;
4508 if (!selinux_enabled) {
4509 printk(KERN_INFO "SELinux: Disabled at boot.\n");
4513 printk(KERN_INFO "SELinux: Initializing.\n");
4515 /* Set the security state for the initial task. */
4516 if (task_alloc_security(current))
4517 panic("SELinux: Failed to initialize initial task.\n");
4518 tsec = current->security;
4519 tsec->osid = tsec->sid = SECINITSID_KERNEL;
4521 sel_inode_cache = kmem_cache_create("selinux_inode_security",
4522 sizeof(struct inode_security_struct),
4523 0, SLAB_PANIC, NULL, NULL);
4526 original_ops = secondary_ops = security_ops;
4528 panic ("SELinux: No initial security operations\n");
4529 if (register_security (&selinux_ops))
4530 panic("SELinux: Unable to register with kernel.\n");
4532 if (selinux_enforcing) {
4533 printk(KERN_INFO "SELinux: Starting in enforcing mode\n");
4535 printk(KERN_INFO "SELinux: Starting in permissive mode\n");
4539 /* Add security information to initial keyrings */
4540 selinux_key_alloc(&root_user_keyring, current,
4541 KEY_ALLOC_NOT_IN_QUOTA);
4542 selinux_key_alloc(&root_session_keyring, current,
4543 KEY_ALLOC_NOT_IN_QUOTA);
4549 void selinux_complete_init(void)
4551 printk(KERN_INFO "SELinux: Completing initialization.\n");
4553 /* Set up any superblocks initialized prior to the policy load. */
4554 printk(KERN_INFO "SELinux: Setting up existing superblocks.\n");
4555 spin_lock(&sb_lock);
4556 spin_lock(&sb_security_lock);
4558 if (!list_empty(&superblock_security_head)) {
4559 struct superblock_security_struct *sbsec =
4560 list_entry(superblock_security_head.next,
4561 struct superblock_security_struct,
4563 struct super_block *sb = sbsec->sb;
4565 spin_unlock(&sb_security_lock);
4566 spin_unlock(&sb_lock);
4567 down_read(&sb->s_umount);
4569 superblock_doinit(sb, NULL);
4571 spin_lock(&sb_lock);
4572 spin_lock(&sb_security_lock);
4573 list_del_init(&sbsec->list);
4576 spin_unlock(&sb_security_lock);
4577 spin_unlock(&sb_lock);
4580 /* SELinux requires early initialization in order to label
4581 all processes and objects when they are created. */
4582 security_initcall(selinux_init);
4584 #if defined(CONFIG_NETFILTER)
4586 static struct nf_hook_ops selinux_ipv4_op = {
4587 .hook = selinux_ipv4_postroute_last,
4588 .owner = THIS_MODULE,
4590 .hooknum = NF_IP_POST_ROUTING,
4591 .priority = NF_IP_PRI_SELINUX_LAST,
4594 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4596 static struct nf_hook_ops selinux_ipv6_op = {
4597 .hook = selinux_ipv6_postroute_last,
4598 .owner = THIS_MODULE,
4600 .hooknum = NF_IP6_POST_ROUTING,
4601 .priority = NF_IP6_PRI_SELINUX_LAST,
4606 static int __init selinux_nf_ip_init(void)
4610 if (!selinux_enabled)
4613 printk(KERN_INFO "SELinux: Registering netfilter hooks\n");
4615 err = nf_register_hook(&selinux_ipv4_op);
4617 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
4619 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4621 err = nf_register_hook(&selinux_ipv6_op);
4623 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
4631 __initcall(selinux_nf_ip_init);
4633 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4634 static void selinux_nf_ip_exit(void)
4636 printk(KERN_INFO "SELinux: Unregistering netfilter hooks\n");
4638 nf_unregister_hook(&selinux_ipv4_op);
4639 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4640 nf_unregister_hook(&selinux_ipv6_op);
4645 #else /* CONFIG_NETFILTER */
4647 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4648 #define selinux_nf_ip_exit()
4651 #endif /* CONFIG_NETFILTER */
4653 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4654 int selinux_disable(void)
4656 extern void exit_sel_fs(void);
4657 static int selinux_disabled = 0;
4659 if (ss_initialized) {
4660 /* Not permitted after initial policy load. */
4664 if (selinux_disabled) {
4665 /* Only do this once. */
4669 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
4671 selinux_disabled = 1;
4672 selinux_enabled = 0;
4674 /* Reset security_ops to the secondary module, dummy or capability. */
4675 security_ops = secondary_ops;
4677 /* Unregister netfilter hooks. */
4678 selinux_nf_ip_exit();
4680 /* Unregister selinuxfs. */