2 * NSA Security-Enhanced Linux (SELinux) security module
4 * This file contains the SELinux hook function implementations.
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License version 2,
18 * as published by the Free Software Foundation.
21 #include <linux/config.h>
22 #include <linux/module.h>
23 #include <linux/init.h>
24 #include <linux/kernel.h>
25 #include <linux/ptrace.h>
26 #include <linux/errno.h>
27 #include <linux/sched.h>
28 #include <linux/security.h>
29 #include <linux/xattr.h>
30 #include <linux/capability.h>
31 #include <linux/unistd.h>
33 #include <linux/mman.h>
34 #include <linux/slab.h>
35 #include <linux/pagemap.h>
36 #include <linux/swap.h>
37 #include <linux/smp_lock.h>
38 #include <linux/spinlock.h>
39 #include <linux/syscalls.h>
40 #include <linux/file.h>
41 #include <linux/namei.h>
42 #include <linux/mount.h>
43 #include <linux/ext2_fs.h>
44 #include <linux/proc_fs.h>
46 #include <linux/netfilter_ipv4.h>
47 #include <linux/netfilter_ipv6.h>
48 #include <linux/tty.h>
50 #include <net/ip.h> /* for sysctl_local_port_range[] */
51 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
52 #include <asm/uaccess.h>
53 #include <asm/semaphore.h>
54 #include <asm/ioctls.h>
55 #include <linux/bitops.h>
56 #include <linux/interrupt.h>
57 #include <linux/netdevice.h> /* for network interface checks */
58 #include <linux/netlink.h>
59 #include <linux/tcp.h>
60 #include <linux/udp.h>
61 #include <linux/quota.h>
62 #include <linux/un.h> /* for Unix socket types */
63 #include <net/af_unix.h> /* for Unix socket types */
64 #include <linux/parser.h>
65 #include <linux/nfs_mount.h>
67 #include <linux/hugetlb.h>
68 #include <linux/personality.h>
69 #include <linux/sysctl.h>
70 #include <linux/audit.h>
71 #include <linux/string.h>
77 #define XATTR_SELINUX_SUFFIX "selinux"
78 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
80 extern unsigned int policydb_loaded_version;
81 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
83 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
84 int selinux_enforcing = 0;
86 static int __init enforcing_setup(char *str)
88 selinux_enforcing = simple_strtol(str,NULL,0);
91 __setup("enforcing=", enforcing_setup);
94 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
95 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
97 static int __init selinux_enabled_setup(char *str)
99 selinux_enabled = simple_strtol(str, NULL, 0);
102 __setup("selinux=", selinux_enabled_setup);
105 /* Original (dummy) security module. */
106 static struct security_operations *original_ops = NULL;
108 /* Minimal support for a secondary security module,
109 just to allow the use of the dummy or capability modules.
110 The owlsm module can alternatively be used as a secondary
111 module as long as CONFIG_OWLSM_FD is not enabled. */
112 static struct security_operations *secondary_ops = NULL;
114 /* Lists of inode and superblock security structures initialized
115 before the policy was loaded. */
116 static LIST_HEAD(superblock_security_head);
117 static DEFINE_SPINLOCK(sb_security_lock);
119 /* Allocate and free functions for each kind of security blob. */
121 static int task_alloc_security(struct task_struct *task)
123 struct task_security_struct *tsec;
125 tsec = kmalloc(sizeof(struct task_security_struct), GFP_KERNEL);
129 memset(tsec, 0, sizeof(struct task_security_struct));
130 tsec->magic = SELINUX_MAGIC;
132 tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
133 task->security = tsec;
138 static void task_free_security(struct task_struct *task)
140 struct task_security_struct *tsec = task->security;
142 if (!tsec || tsec->magic != SELINUX_MAGIC)
145 task->security = NULL;
149 static int inode_alloc_security(struct inode *inode)
151 struct task_security_struct *tsec = current->security;
152 struct inode_security_struct *isec;
154 isec = kmalloc(sizeof(struct inode_security_struct), GFP_KERNEL);
158 memset(isec, 0, sizeof(struct inode_security_struct));
159 init_MUTEX(&isec->sem);
160 INIT_LIST_HEAD(&isec->list);
161 isec->magic = SELINUX_MAGIC;
163 isec->sid = SECINITSID_UNLABELED;
164 isec->sclass = SECCLASS_FILE;
165 if (tsec && tsec->magic == SELINUX_MAGIC)
166 isec->task_sid = tsec->sid;
168 isec->task_sid = SECINITSID_UNLABELED;
169 inode->i_security = isec;
174 static void inode_free_security(struct inode *inode)
176 struct inode_security_struct *isec = inode->i_security;
177 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
179 if (!isec || isec->magic != SELINUX_MAGIC)
182 spin_lock(&sbsec->isec_lock);
183 if (!list_empty(&isec->list))
184 list_del_init(&isec->list);
185 spin_unlock(&sbsec->isec_lock);
187 inode->i_security = NULL;
191 static int file_alloc_security(struct file *file)
193 struct task_security_struct *tsec = current->security;
194 struct file_security_struct *fsec;
196 fsec = kmalloc(sizeof(struct file_security_struct), GFP_ATOMIC);
200 memset(fsec, 0, sizeof(struct file_security_struct));
201 fsec->magic = SELINUX_MAGIC;
203 if (tsec && tsec->magic == SELINUX_MAGIC) {
204 fsec->sid = tsec->sid;
205 fsec->fown_sid = tsec->sid;
207 fsec->sid = SECINITSID_UNLABELED;
208 fsec->fown_sid = SECINITSID_UNLABELED;
210 file->f_security = fsec;
215 static void file_free_security(struct file *file)
217 struct file_security_struct *fsec = file->f_security;
219 if (!fsec || fsec->magic != SELINUX_MAGIC)
222 file->f_security = NULL;
226 static int superblock_alloc_security(struct super_block *sb)
228 struct superblock_security_struct *sbsec;
230 sbsec = kmalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
234 memset(sbsec, 0, sizeof(struct superblock_security_struct));
235 init_MUTEX(&sbsec->sem);
236 INIT_LIST_HEAD(&sbsec->list);
237 INIT_LIST_HEAD(&sbsec->isec_head);
238 spin_lock_init(&sbsec->isec_lock);
239 sbsec->magic = SELINUX_MAGIC;
241 sbsec->sid = SECINITSID_UNLABELED;
242 sbsec->def_sid = SECINITSID_FILE;
243 sb->s_security = sbsec;
248 static void superblock_free_security(struct super_block *sb)
250 struct superblock_security_struct *sbsec = sb->s_security;
252 if (!sbsec || sbsec->magic != SELINUX_MAGIC)
255 spin_lock(&sb_security_lock);
256 if (!list_empty(&sbsec->list))
257 list_del_init(&sbsec->list);
258 spin_unlock(&sb_security_lock);
260 sb->s_security = NULL;
264 #ifdef CONFIG_SECURITY_NETWORK
265 static int sk_alloc_security(struct sock *sk, int family, int priority)
267 struct sk_security_struct *ssec;
269 if (family != PF_UNIX)
272 ssec = kmalloc(sizeof(*ssec), priority);
276 memset(ssec, 0, sizeof(*ssec));
277 ssec->magic = SELINUX_MAGIC;
279 ssec->peer_sid = SECINITSID_UNLABELED;
280 sk->sk_security = ssec;
285 static void sk_free_security(struct sock *sk)
287 struct sk_security_struct *ssec = sk->sk_security;
289 if (sk->sk_family != PF_UNIX || ssec->magic != SELINUX_MAGIC)
292 sk->sk_security = NULL;
295 #endif /* CONFIG_SECURITY_NETWORK */
297 /* The security server must be initialized before
298 any labeling or access decisions can be provided. */
299 extern int ss_initialized;
301 /* The file system's label must be initialized prior to use. */
303 static char *labeling_behaviors[6] = {
305 "uses transition SIDs",
307 "uses genfs_contexts",
308 "not configured for labeling",
309 "uses mountpoint labeling",
312 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
314 static inline int inode_doinit(struct inode *inode)
316 return inode_doinit_with_dentry(inode, NULL);
325 static match_table_t tokens = {
326 {Opt_context, "context=%s"},
327 {Opt_fscontext, "fscontext=%s"},
328 {Opt_defcontext, "defcontext=%s"},
331 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
333 static int try_context_mount(struct super_block *sb, void *data)
335 char *context = NULL, *defcontext = NULL;
338 int alloc = 0, rc = 0, seen = 0;
339 struct task_security_struct *tsec = current->security;
340 struct superblock_security_struct *sbsec = sb->s_security;
345 name = sb->s_type->name;
347 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
349 /* NFS we understand. */
350 if (!strcmp(name, "nfs")) {
351 struct nfs_mount_data *d = data;
353 if (d->version < NFS_MOUNT_VERSION)
357 context = d->context;
364 /* Standard string-based options. */
365 char *p, *options = data;
367 while ((p = strsep(&options, ",")) != NULL) {
369 substring_t args[MAX_OPT_ARGS];
374 token = match_token(p, tokens, args);
380 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
383 context = match_strdup(&args[0]);
394 if (seen & (Opt_context|Opt_fscontext)) {
396 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
399 context = match_strdup(&args[0]);
406 seen |= Opt_fscontext;
410 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
412 printk(KERN_WARNING "SELinux: "
413 "defcontext option is invalid "
414 "for this filesystem type\n");
417 if (seen & (Opt_context|Opt_defcontext)) {
419 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
422 defcontext = match_strdup(&args[0]);
429 seen |= Opt_defcontext;
434 printk(KERN_WARNING "SELinux: unknown mount "
446 rc = security_context_to_sid(context, strlen(context), &sid);
448 printk(KERN_WARNING "SELinux: security_context_to_sid"
449 "(%s) failed for (dev %s, type %s) errno=%d\n",
450 context, sb->s_id, name, rc);
454 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
455 FILESYSTEM__RELABELFROM, NULL);
459 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
460 FILESYSTEM__RELABELTO, NULL);
466 if (seen & Opt_context)
467 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
471 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
473 printk(KERN_WARNING "SELinux: security_context_to_sid"
474 "(%s) failed for (dev %s, type %s) errno=%d\n",
475 defcontext, sb->s_id, name, rc);
479 if (sid == sbsec->def_sid)
482 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
483 FILESYSTEM__RELABELFROM, NULL);
487 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
488 FILESYSTEM__ASSOCIATE, NULL);
492 sbsec->def_sid = sid;
504 static int superblock_doinit(struct super_block *sb, void *data)
506 struct superblock_security_struct *sbsec = sb->s_security;
507 struct dentry *root = sb->s_root;
508 struct inode *inode = root->d_inode;
512 if (sbsec->initialized)
515 if (!ss_initialized) {
516 /* Defer initialization until selinux_complete_init,
517 after the initial policy is loaded and the security
518 server is ready to handle calls. */
519 spin_lock(&sb_security_lock);
520 if (list_empty(&sbsec->list))
521 list_add(&sbsec->list, &superblock_security_head);
522 spin_unlock(&sb_security_lock);
526 /* Determine the labeling behavior to use for this filesystem type. */
527 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
529 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
530 __FUNCTION__, sb->s_type->name, rc);
534 rc = try_context_mount(sb, data);
538 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
539 /* Make sure that the xattr handler exists and that no
540 error other than -ENODATA is returned by getxattr on
541 the root directory. -ENODATA is ok, as this may be
542 the first boot of the SELinux kernel before we have
543 assigned xattr values to the filesystem. */
544 if (!inode->i_op->getxattr) {
545 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
546 "xattr support\n", sb->s_id, sb->s_type->name);
550 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
551 if (rc < 0 && rc != -ENODATA) {
552 if (rc == -EOPNOTSUPP)
553 printk(KERN_WARNING "SELinux: (dev %s, type "
554 "%s) has no security xattr handler\n",
555 sb->s_id, sb->s_type->name);
557 printk(KERN_WARNING "SELinux: (dev %s, type "
558 "%s) getxattr errno %d\n", sb->s_id,
559 sb->s_type->name, -rc);
564 if (strcmp(sb->s_type->name, "proc") == 0)
567 sbsec->initialized = 1;
569 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
570 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
571 sb->s_id, sb->s_type->name);
574 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
575 sb->s_id, sb->s_type->name,
576 labeling_behaviors[sbsec->behavior-1]);
579 /* Initialize the root inode. */
580 rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
582 /* Initialize any other inodes associated with the superblock, e.g.
583 inodes created prior to initial policy load or inodes created
584 during get_sb by a pseudo filesystem that directly
586 spin_lock(&sbsec->isec_lock);
588 if (!list_empty(&sbsec->isec_head)) {
589 struct inode_security_struct *isec =
590 list_entry(sbsec->isec_head.next,
591 struct inode_security_struct, list);
592 struct inode *inode = isec->inode;
593 spin_unlock(&sbsec->isec_lock);
594 inode = igrab(inode);
596 if (!IS_PRIVATE (inode))
600 spin_lock(&sbsec->isec_lock);
601 list_del_init(&isec->list);
604 spin_unlock(&sbsec->isec_lock);
610 static inline u16 inode_mode_to_security_class(umode_t mode)
612 switch (mode & S_IFMT) {
614 return SECCLASS_SOCK_FILE;
616 return SECCLASS_LNK_FILE;
618 return SECCLASS_FILE;
620 return SECCLASS_BLK_FILE;
624 return SECCLASS_CHR_FILE;
626 return SECCLASS_FIFO_FILE;
630 return SECCLASS_FILE;
633 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
640 return SECCLASS_UNIX_STREAM_SOCKET;
642 return SECCLASS_UNIX_DGRAM_SOCKET;
649 return SECCLASS_TCP_SOCKET;
651 return SECCLASS_UDP_SOCKET;
653 return SECCLASS_RAWIP_SOCKET;
659 return SECCLASS_NETLINK_ROUTE_SOCKET;
660 case NETLINK_FIREWALL:
661 return SECCLASS_NETLINK_FIREWALL_SOCKET;
662 case NETLINK_TCPDIAG:
663 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
665 return SECCLASS_NETLINK_NFLOG_SOCKET;
667 return SECCLASS_NETLINK_XFRM_SOCKET;
668 case NETLINK_SELINUX:
669 return SECCLASS_NETLINK_SELINUX_SOCKET;
671 return SECCLASS_NETLINK_AUDIT_SOCKET;
673 return SECCLASS_NETLINK_IP6FW_SOCKET;
674 case NETLINK_DNRTMSG:
675 return SECCLASS_NETLINK_DNRT_SOCKET;
676 case NETLINK_KOBJECT_UEVENT:
677 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
679 return SECCLASS_NETLINK_SOCKET;
682 return SECCLASS_PACKET_SOCKET;
684 return SECCLASS_KEY_SOCKET;
687 return SECCLASS_SOCKET;
690 #ifdef CONFIG_PROC_FS
691 static int selinux_proc_get_sid(struct proc_dir_entry *de,
696 char *buffer, *path, *end;
698 buffer = (char*)__get_free_page(GFP_KERNEL);
708 while (de && de != de->parent) {
709 buflen -= de->namelen + 1;
713 memcpy(end, de->name, de->namelen);
718 rc = security_genfs_sid("proc", path, tclass, sid);
719 free_page((unsigned long)buffer);
723 static int selinux_proc_get_sid(struct proc_dir_entry *de,
731 /* The inode's security attributes must be initialized before first use. */
732 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
734 struct superblock_security_struct *sbsec = NULL;
735 struct inode_security_struct *isec = inode->i_security;
737 struct dentry *dentry;
738 #define INITCONTEXTLEN 255
739 char *context = NULL;
744 if (isec->initialized)
749 if (isec->initialized)
752 sbsec = inode->i_sb->s_security;
753 if (!sbsec->initialized) {
754 /* Defer initialization until selinux_complete_init,
755 after the initial policy is loaded and the security
756 server is ready to handle calls. */
757 spin_lock(&sbsec->isec_lock);
758 if (list_empty(&isec->list))
759 list_add(&isec->list, &sbsec->isec_head);
760 spin_unlock(&sbsec->isec_lock);
764 switch (sbsec->behavior) {
765 case SECURITY_FS_USE_XATTR:
766 if (!inode->i_op->getxattr) {
767 isec->sid = sbsec->def_sid;
771 /* Need a dentry, since the xattr API requires one.
772 Life would be simpler if we could just pass the inode. */
774 /* Called from d_instantiate or d_splice_alias. */
775 dentry = dget(opt_dentry);
777 /* Called from selinux_complete_init, try to find a dentry. */
778 dentry = d_find_alias(inode);
781 printk(KERN_WARNING "%s: no dentry for dev=%s "
782 "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
787 len = INITCONTEXTLEN;
788 context = kmalloc(len, GFP_KERNEL);
794 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
797 /* Need a larger buffer. Query for the right size. */
798 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
806 context = kmalloc(len, GFP_KERNEL);
812 rc = inode->i_op->getxattr(dentry,
818 if (rc != -ENODATA) {
819 printk(KERN_WARNING "%s: getxattr returned "
820 "%d for dev=%s ino=%ld\n", __FUNCTION__,
821 -rc, inode->i_sb->s_id, inode->i_ino);
825 /* Map ENODATA to the default file SID */
826 sid = sbsec->def_sid;
829 rc = security_context_to_sid(context, rc, &sid);
831 printk(KERN_WARNING "%s: context_to_sid(%s) "
832 "returned %d for dev=%s ino=%ld\n",
833 __FUNCTION__, context, -rc,
834 inode->i_sb->s_id, inode->i_ino);
836 /* Leave with the unlabeled SID */
844 case SECURITY_FS_USE_TASK:
845 isec->sid = isec->task_sid;
847 case SECURITY_FS_USE_TRANS:
848 /* Default to the fs SID. */
849 isec->sid = sbsec->sid;
851 /* Try to obtain a transition SID. */
852 isec->sclass = inode_mode_to_security_class(inode->i_mode);
853 rc = security_transition_sid(isec->task_sid,
862 /* Default to the fs SID. */
863 isec->sid = sbsec->sid;
866 struct proc_inode *proci = PROC_I(inode);
868 isec->sclass = inode_mode_to_security_class(inode->i_mode);
869 rc = selinux_proc_get_sid(proci->pde,
880 isec->initialized = 1;
883 if (isec->sclass == SECCLASS_FILE)
884 isec->sclass = inode_mode_to_security_class(inode->i_mode);
891 /* Convert a Linux signal to an access vector. */
892 static inline u32 signal_to_av(int sig)
898 /* Commonly granted from child to parent. */
899 perm = PROCESS__SIGCHLD;
902 /* Cannot be caught or ignored */
903 perm = PROCESS__SIGKILL;
906 /* Cannot be caught or ignored */
907 perm = PROCESS__SIGSTOP;
910 /* All other signals. */
911 perm = PROCESS__SIGNAL;
918 /* Check permission betweeen a pair of tasks, e.g. signal checks,
919 fork check, ptrace check, etc. */
920 static int task_has_perm(struct task_struct *tsk1,
921 struct task_struct *tsk2,
924 struct task_security_struct *tsec1, *tsec2;
926 tsec1 = tsk1->security;
927 tsec2 = tsk2->security;
928 return avc_has_perm(tsec1->sid, tsec2->sid,
929 SECCLASS_PROCESS, perms, NULL);
932 /* Check whether a task is allowed to use a capability. */
933 static int task_has_capability(struct task_struct *tsk,
936 struct task_security_struct *tsec;
937 struct avc_audit_data ad;
939 tsec = tsk->security;
941 AVC_AUDIT_DATA_INIT(&ad,CAP);
945 return avc_has_perm(tsec->sid, tsec->sid,
946 SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
949 /* Check whether a task is allowed to use a system operation. */
950 static int task_has_system(struct task_struct *tsk,
953 struct task_security_struct *tsec;
955 tsec = tsk->security;
957 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
958 SECCLASS_SYSTEM, perms, NULL);
961 /* Check whether a task has a particular permission to an inode.
962 The 'adp' parameter is optional and allows other audit
963 data to be passed (e.g. the dentry). */
964 static int inode_has_perm(struct task_struct *tsk,
967 struct avc_audit_data *adp)
969 struct task_security_struct *tsec;
970 struct inode_security_struct *isec;
971 struct avc_audit_data ad;
973 tsec = tsk->security;
974 isec = inode->i_security;
978 AVC_AUDIT_DATA_INIT(&ad, FS);
979 ad.u.fs.inode = inode;
982 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
985 /* Same as inode_has_perm, but pass explicit audit data containing
986 the dentry to help the auditing code to more easily generate the
987 pathname if needed. */
988 static inline int dentry_has_perm(struct task_struct *tsk,
989 struct vfsmount *mnt,
990 struct dentry *dentry,
993 struct inode *inode = dentry->d_inode;
994 struct avc_audit_data ad;
995 AVC_AUDIT_DATA_INIT(&ad,FS);
997 ad.u.fs.dentry = dentry;
998 return inode_has_perm(tsk, inode, av, &ad);
1001 /* Check whether a task can use an open file descriptor to
1002 access an inode in a given way. Check access to the
1003 descriptor itself, and then use dentry_has_perm to
1004 check a particular permission to the file.
1005 Access to the descriptor is implicitly granted if it
1006 has the same SID as the process. If av is zero, then
1007 access to the file is not checked, e.g. for cases
1008 where only the descriptor is affected like seek. */
1009 static inline int file_has_perm(struct task_struct *tsk,
1013 struct task_security_struct *tsec = tsk->security;
1014 struct file_security_struct *fsec = file->f_security;
1015 struct vfsmount *mnt = file->f_vfsmnt;
1016 struct dentry *dentry = file->f_dentry;
1017 struct inode *inode = dentry->d_inode;
1018 struct avc_audit_data ad;
1021 AVC_AUDIT_DATA_INIT(&ad, FS);
1023 ad.u.fs.dentry = dentry;
1025 if (tsec->sid != fsec->sid) {
1026 rc = avc_has_perm(tsec->sid, fsec->sid,
1034 /* av is zero if only checking access to the descriptor. */
1036 return inode_has_perm(tsk, inode, av, &ad);
1041 /* Check whether a task can create a file. */
1042 static int may_create(struct inode *dir,
1043 struct dentry *dentry,
1046 struct task_security_struct *tsec;
1047 struct inode_security_struct *dsec;
1048 struct superblock_security_struct *sbsec;
1050 struct avc_audit_data ad;
1053 tsec = current->security;
1054 dsec = dir->i_security;
1055 sbsec = dir->i_sb->s_security;
1057 AVC_AUDIT_DATA_INIT(&ad, FS);
1058 ad.u.fs.dentry = dentry;
1060 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1061 DIR__ADD_NAME | DIR__SEARCH,
1066 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1067 newsid = tsec->create_sid;
1069 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1075 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1079 return avc_has_perm(newsid, sbsec->sid,
1080 SECCLASS_FILESYSTEM,
1081 FILESYSTEM__ASSOCIATE, &ad);
1085 #define MAY_UNLINK 1
1088 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1089 static int may_link(struct inode *dir,
1090 struct dentry *dentry,
1094 struct task_security_struct *tsec;
1095 struct inode_security_struct *dsec, *isec;
1096 struct avc_audit_data ad;
1100 tsec = current->security;
1101 dsec = dir->i_security;
1102 isec = dentry->d_inode->i_security;
1104 AVC_AUDIT_DATA_INIT(&ad, FS);
1105 ad.u.fs.dentry = dentry;
1108 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1109 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1124 printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
1128 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1132 static inline int may_rename(struct inode *old_dir,
1133 struct dentry *old_dentry,
1134 struct inode *new_dir,
1135 struct dentry *new_dentry)
1137 struct task_security_struct *tsec;
1138 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1139 struct avc_audit_data ad;
1141 int old_is_dir, new_is_dir;
1144 tsec = current->security;
1145 old_dsec = old_dir->i_security;
1146 old_isec = old_dentry->d_inode->i_security;
1147 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1148 new_dsec = new_dir->i_security;
1150 AVC_AUDIT_DATA_INIT(&ad, FS);
1152 ad.u.fs.dentry = old_dentry;
1153 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1154 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1157 rc = avc_has_perm(tsec->sid, old_isec->sid,
1158 old_isec->sclass, FILE__RENAME, &ad);
1161 if (old_is_dir && new_dir != old_dir) {
1162 rc = avc_has_perm(tsec->sid, old_isec->sid,
1163 old_isec->sclass, DIR__REPARENT, &ad);
1168 ad.u.fs.dentry = new_dentry;
1169 av = DIR__ADD_NAME | DIR__SEARCH;
1170 if (new_dentry->d_inode)
1171 av |= DIR__REMOVE_NAME;
1172 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1175 if (new_dentry->d_inode) {
1176 new_isec = new_dentry->d_inode->i_security;
1177 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1178 rc = avc_has_perm(tsec->sid, new_isec->sid,
1180 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1188 /* Check whether a task can perform a filesystem operation. */
1189 static int superblock_has_perm(struct task_struct *tsk,
1190 struct super_block *sb,
1192 struct avc_audit_data *ad)
1194 struct task_security_struct *tsec;
1195 struct superblock_security_struct *sbsec;
1197 tsec = tsk->security;
1198 sbsec = sb->s_security;
1199 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1203 /* Convert a Linux mode and permission mask to an access vector. */
1204 static inline u32 file_mask_to_av(int mode, int mask)
1208 if ((mode & S_IFMT) != S_IFDIR) {
1209 if (mask & MAY_EXEC)
1210 av |= FILE__EXECUTE;
1211 if (mask & MAY_READ)
1214 if (mask & MAY_APPEND)
1216 else if (mask & MAY_WRITE)
1220 if (mask & MAY_EXEC)
1222 if (mask & MAY_WRITE)
1224 if (mask & MAY_READ)
1231 /* Convert a Linux file to an access vector. */
1232 static inline u32 file_to_av(struct file *file)
1236 if (file->f_mode & FMODE_READ)
1238 if (file->f_mode & FMODE_WRITE) {
1239 if (file->f_flags & O_APPEND)
1248 /* Set an inode's SID to a specified value. */
1249 static int inode_security_set_sid(struct inode *inode, u32 sid)
1251 struct inode_security_struct *isec = inode->i_security;
1252 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
1254 if (!sbsec->initialized) {
1255 /* Defer initialization to selinux_complete_init. */
1260 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1262 isec->initialized = 1;
1267 /* Set the security attributes on a newly created file. */
1268 static int post_create(struct inode *dir,
1269 struct dentry *dentry)
1272 struct task_security_struct *tsec;
1273 struct inode *inode;
1274 struct inode_security_struct *dsec;
1275 struct superblock_security_struct *sbsec;
1281 tsec = current->security;
1282 dsec = dir->i_security;
1283 sbsec = dir->i_sb->s_security;
1285 inode = dentry->d_inode;
1287 /* Some file system types (e.g. NFS) may not instantiate
1288 a dentry for all create operations (e.g. symlink),
1289 so we have to check to see if the inode is non-NULL. */
1290 printk(KERN_WARNING "post_create: no inode, dir (dev=%s, "
1291 "ino=%ld)\n", dir->i_sb->s_id, dir->i_ino);
1295 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1296 newsid = tsec->create_sid;
1298 rc = security_transition_sid(tsec->sid, dsec->sid,
1299 inode_mode_to_security_class(inode->i_mode),
1302 printk(KERN_WARNING "post_create: "
1303 "security_transition_sid failed, rc=%d (dev=%s "
1305 -rc, inode->i_sb->s_id, inode->i_ino);
1310 rc = inode_security_set_sid(inode, newsid);
1312 printk(KERN_WARNING "post_create: inode_security_set_sid "
1313 "failed, rc=%d (dev=%s ino=%ld)\n",
1314 -rc, inode->i_sb->s_id, inode->i_ino);
1318 if (sbsec->behavior == SECURITY_FS_USE_XATTR &&
1319 inode->i_op->setxattr) {
1320 /* Use extended attributes. */
1321 rc = security_sid_to_context(newsid, &context, &len);
1323 printk(KERN_WARNING "post_create: sid_to_context "
1324 "failed, rc=%d (dev=%s ino=%ld)\n",
1325 -rc, inode->i_sb->s_id, inode->i_ino);
1328 down(&inode->i_sem);
1329 rc = inode->i_op->setxattr(dentry,
1335 printk(KERN_WARNING "post_create: setxattr failed, "
1336 "rc=%d (dev=%s ino=%ld)\n",
1337 -rc, inode->i_sb->s_id, inode->i_ino);
1346 /* Hook functions begin here. */
1348 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1350 struct task_security_struct *psec = parent->security;
1351 struct task_security_struct *csec = child->security;
1354 rc = secondary_ops->ptrace(parent,child);
1358 rc = task_has_perm(parent, child, PROCESS__PTRACE);
1359 /* Save the SID of the tracing process for later use in apply_creds. */
1361 csec->ptrace_sid = psec->sid;
1365 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1366 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1370 error = task_has_perm(current, target, PROCESS__GETCAP);
1374 return secondary_ops->capget(target, effective, inheritable, permitted);
1377 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1378 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1382 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1386 return task_has_perm(current, target, PROCESS__SETCAP);
1389 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1390 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1392 secondary_ops->capset_set(target, effective, inheritable, permitted);
1395 static int selinux_capable(struct task_struct *tsk, int cap)
1399 rc = secondary_ops->capable(tsk, cap);
1403 return task_has_capability(tsk,cap);
1406 static int selinux_sysctl(ctl_table *table, int op)
1410 struct task_security_struct *tsec;
1414 rc = secondary_ops->sysctl(table, op);
1418 tsec = current->security;
1420 rc = selinux_proc_get_sid(table->de, (op == 001) ?
1421 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1423 /* Default to the well-defined sysctl SID. */
1424 tsid = SECINITSID_SYSCTL;
1427 /* The op values are "defined" in sysctl.c, thereby creating
1428 * a bad coupling between this module and sysctl.c */
1430 error = avc_has_perm(tsec->sid, tsid,
1431 SECCLASS_DIR, DIR__SEARCH, NULL);
1439 error = avc_has_perm(tsec->sid, tsid,
1440 SECCLASS_FILE, av, NULL);
1446 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1459 rc = superblock_has_perm(current,
1461 FILESYSTEM__QUOTAMOD, NULL);
1466 rc = superblock_has_perm(current,
1468 FILESYSTEM__QUOTAGET, NULL);
1471 rc = 0; /* let the kernel handle invalid cmds */
1477 static int selinux_quota_on(struct dentry *dentry)
1479 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1482 static int selinux_syslog(int type)
1486 rc = secondary_ops->syslog(type);
1491 case 3: /* Read last kernel messages */
1492 case 10: /* Return size of the log buffer */
1493 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1495 case 6: /* Disable logging to console */
1496 case 7: /* Enable logging to console */
1497 case 8: /* Set level of messages printed to console */
1498 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1500 case 0: /* Close log */
1501 case 1: /* Open log */
1502 case 2: /* Read from log */
1503 case 4: /* Read/clear last kernel messages */
1504 case 5: /* Clear ring buffer */
1506 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1513 * Check that a process has enough memory to allocate a new virtual
1514 * mapping. 0 means there is enough memory for the allocation to
1515 * succeed and -ENOMEM implies there is not.
1517 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1518 * if the capability is granted, but __vm_enough_memory requires 1 if
1519 * the capability is granted.
1521 * Do not audit the selinux permission check, as this is applied to all
1522 * processes that allocate mappings.
1524 static int selinux_vm_enough_memory(long pages)
1526 int rc, cap_sys_admin = 0;
1527 struct task_security_struct *tsec = current->security;
1529 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1531 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1532 SECCLASS_CAPABILITY,
1533 CAP_TO_MASK(CAP_SYS_ADMIN),
1539 return __vm_enough_memory(pages, cap_sys_admin);
1542 /* binprm security operations */
1544 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1546 struct bprm_security_struct *bsec;
1548 bsec = kmalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1552 memset(bsec, 0, sizeof *bsec);
1553 bsec->magic = SELINUX_MAGIC;
1555 bsec->sid = SECINITSID_UNLABELED;
1558 bprm->security = bsec;
1562 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1564 struct task_security_struct *tsec;
1565 struct inode *inode = bprm->file->f_dentry->d_inode;
1566 struct inode_security_struct *isec;
1567 struct bprm_security_struct *bsec;
1569 struct avc_audit_data ad;
1572 rc = secondary_ops->bprm_set_security(bprm);
1576 bsec = bprm->security;
1581 tsec = current->security;
1582 isec = inode->i_security;
1584 /* Default to the current task SID. */
1585 bsec->sid = tsec->sid;
1587 /* Reset create SID on execve. */
1588 tsec->create_sid = 0;
1590 if (tsec->exec_sid) {
1591 newsid = tsec->exec_sid;
1592 /* Reset exec SID on execve. */
1595 /* Check for a default transition on this program. */
1596 rc = security_transition_sid(tsec->sid, isec->sid,
1597 SECCLASS_PROCESS, &newsid);
1602 AVC_AUDIT_DATA_INIT(&ad, FS);
1603 ad.u.fs.mnt = bprm->file->f_vfsmnt;
1604 ad.u.fs.dentry = bprm->file->f_dentry;
1606 if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
1609 if (tsec->sid == newsid) {
1610 rc = avc_has_perm(tsec->sid, isec->sid,
1611 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1615 /* Check permissions for the transition. */
1616 rc = avc_has_perm(tsec->sid, newsid,
1617 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1621 rc = avc_has_perm(newsid, isec->sid,
1622 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1626 /* Clear any possibly unsafe personality bits on exec: */
1627 current->personality &= ~PER_CLEAR_ON_SETID;
1629 /* Set the security field to the new SID. */
1637 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1639 return secondary_ops->bprm_check_security(bprm);
1643 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1645 struct task_security_struct *tsec = current->security;
1648 if (tsec->osid != tsec->sid) {
1649 /* Enable secure mode for SIDs transitions unless
1650 the noatsecure permission is granted between
1651 the two SIDs, i.e. ahp returns 0. */
1652 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1654 PROCESS__NOATSECURE, NULL);
1657 return (atsecure || secondary_ops->bprm_secureexec(bprm));
1660 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1662 kfree(bprm->security);
1663 bprm->security = NULL;
1666 extern struct vfsmount *selinuxfs_mount;
1667 extern struct dentry *selinux_null;
1669 /* Derived from fs/exec.c:flush_old_files. */
1670 static inline void flush_unauthorized_files(struct files_struct * files)
1672 struct avc_audit_data ad;
1673 struct file *file, *devnull = NULL;
1674 struct tty_struct *tty = current->signal->tty;
1679 file = list_entry(tty->tty_files.next, typeof(*file), f_list);
1681 /* Revalidate access to controlling tty.
1682 Use inode_has_perm on the tty inode directly rather
1683 than using file_has_perm, as this particular open
1684 file may belong to another process and we are only
1685 interested in the inode-based check here. */
1686 struct inode *inode = file->f_dentry->d_inode;
1687 if (inode_has_perm(current, inode,
1688 FILE__READ | FILE__WRITE, NULL)) {
1689 /* Reset controlling tty. */
1690 current->signal->tty = NULL;
1691 current->signal->tty_old_pgrp = 0;
1697 /* Revalidate access to inherited open files. */
1699 AVC_AUDIT_DATA_INIT(&ad,FS);
1701 spin_lock(&files->file_lock);
1703 unsigned long set, i;
1708 if (i >= files->max_fds || i >= files->max_fdset)
1710 set = files->open_fds->fds_bits[j];
1713 spin_unlock(&files->file_lock);
1714 for ( ; set ; i++,set >>= 1) {
1719 if (file_has_perm(current,
1721 file_to_av(file))) {
1723 fd = get_unused_fd();
1731 atomic_inc(&devnull->f_count);
1733 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1740 fd_install(fd, devnull);
1745 spin_lock(&files->file_lock);
1748 spin_unlock(&files->file_lock);
1751 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1753 struct task_security_struct *tsec;
1754 struct bprm_security_struct *bsec;
1758 secondary_ops->bprm_apply_creds(bprm, unsafe);
1760 tsec = current->security;
1762 bsec = bprm->security;
1765 tsec->osid = tsec->sid;
1767 if (tsec->sid != sid) {
1768 /* Check for shared state. If not ok, leave SID
1769 unchanged and kill. */
1770 if (unsafe & LSM_UNSAFE_SHARE) {
1771 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1772 PROCESS__SHARE, NULL);
1779 /* Check for ptracing, and update the task SID if ok.
1780 Otherwise, leave SID unchanged and kill. */
1781 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1782 rc = avc_has_perm(tsec->ptrace_sid, sid,
1783 SECCLASS_PROCESS, PROCESS__PTRACE,
1795 * called after apply_creds without the task lock held
1797 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1799 struct task_security_struct *tsec;
1800 struct rlimit *rlim, *initrlim;
1801 struct itimerval itimer;
1802 struct bprm_security_struct *bsec;
1805 tsec = current->security;
1806 bsec = bprm->security;
1809 force_sig_specific(SIGKILL, current);
1812 if (tsec->osid == tsec->sid)
1815 /* Close files for which the new task SID is not authorized. */
1816 flush_unauthorized_files(current->files);
1818 /* Check whether the new SID can inherit signal state
1819 from the old SID. If not, clear itimers to avoid
1820 subsequent signal generation and flush and unblock
1821 signals. This must occur _after_ the task SID has
1822 been updated so that any kill done after the flush
1823 will be checked against the new SID. */
1824 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1825 PROCESS__SIGINH, NULL);
1827 memset(&itimer, 0, sizeof itimer);
1828 for (i = 0; i < 3; i++)
1829 do_setitimer(i, &itimer, NULL);
1830 flush_signals(current);
1831 spin_lock_irq(¤t->sighand->siglock);
1832 flush_signal_handlers(current, 1);
1833 sigemptyset(¤t->blocked);
1834 recalc_sigpending();
1835 spin_unlock_irq(¤t->sighand->siglock);
1838 /* Check whether the new SID can inherit resource limits
1839 from the old SID. If not, reset all soft limits to
1840 the lower of the current task's hard limit and the init
1841 task's soft limit. Note that the setting of hard limits
1842 (even to lower them) can be controlled by the setrlimit
1843 check. The inclusion of the init task's soft limit into
1844 the computation is to avoid resetting soft limits higher
1845 than the default soft limit for cases where the default
1846 is lower than the hard limit, e.g. RLIMIT_CORE or
1848 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1849 PROCESS__RLIMITINH, NULL);
1851 for (i = 0; i < RLIM_NLIMITS; i++) {
1852 rlim = current->signal->rlim + i;
1853 initrlim = init_task.signal->rlim+i;
1854 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1856 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1858 * This will cause RLIMIT_CPU calculations
1861 current->it_prof_expires = jiffies_to_cputime(1);
1865 /* Wake up the parent if it is waiting so that it can
1866 recheck wait permission to the new task SID. */
1867 wake_up_interruptible(¤t->parent->signal->wait_chldexit);
1870 /* superblock security operations */
1872 static int selinux_sb_alloc_security(struct super_block *sb)
1874 return superblock_alloc_security(sb);
1877 static void selinux_sb_free_security(struct super_block *sb)
1879 superblock_free_security(sb);
1882 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1887 return !memcmp(prefix, option, plen);
1890 static inline int selinux_option(char *option, int len)
1892 return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1893 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1894 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len));
1897 static inline void take_option(char **to, char *from, int *first, int len)
1905 memcpy(*to, from, len);
1909 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
1911 int fnosec, fsec, rc = 0;
1912 char *in_save, *in_curr, *in_end;
1913 char *sec_curr, *nosec_save, *nosec;
1918 /* Binary mount data: just copy */
1919 if (type->fs_flags & FS_BINARY_MOUNTDATA) {
1920 copy_page(sec_curr, in_curr);
1924 nosec = (char *)get_zeroed_page(GFP_KERNEL);
1932 in_save = in_end = orig;
1935 if (*in_end == ',' || *in_end == '\0') {
1936 int len = in_end - in_curr;
1938 if (selinux_option(in_curr, len))
1939 take_option(&sec_curr, in_curr, &fsec, len);
1941 take_option(&nosec, in_curr, &fnosec, len);
1943 in_curr = in_end + 1;
1945 } while (*in_end++);
1947 strcpy(in_save, nosec_save);
1948 free_page((unsigned long)nosec_save);
1953 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
1955 struct avc_audit_data ad;
1958 rc = superblock_doinit(sb, data);
1962 AVC_AUDIT_DATA_INIT(&ad,FS);
1963 ad.u.fs.dentry = sb->s_root;
1964 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
1967 static int selinux_sb_statfs(struct super_block *sb)
1969 struct avc_audit_data ad;
1971 AVC_AUDIT_DATA_INIT(&ad,FS);
1972 ad.u.fs.dentry = sb->s_root;
1973 return superblock_has_perm(current, sb, FILESYSTEM__GETATTR, &ad);
1976 static int selinux_mount(char * dev_name,
1977 struct nameidata *nd,
1979 unsigned long flags,
1984 rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
1988 if (flags & MS_REMOUNT)
1989 return superblock_has_perm(current, nd->mnt->mnt_sb,
1990 FILESYSTEM__REMOUNT, NULL);
1992 return dentry_has_perm(current, nd->mnt, nd->dentry,
1996 static int selinux_umount(struct vfsmount *mnt, int flags)
2000 rc = secondary_ops->sb_umount(mnt, flags);
2004 return superblock_has_perm(current,mnt->mnt_sb,
2005 FILESYSTEM__UNMOUNT,NULL);
2008 /* inode security operations */
2010 static int selinux_inode_alloc_security(struct inode *inode)
2012 return inode_alloc_security(inode);
2015 static void selinux_inode_free_security(struct inode *inode)
2017 inode_free_security(inode);
2020 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2022 return may_create(dir, dentry, SECCLASS_FILE);
2025 static void selinux_inode_post_create(struct inode *dir, struct dentry *dentry, int mask)
2027 post_create(dir, dentry);
2030 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2034 rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2037 return may_link(dir, old_dentry, MAY_LINK);
2040 static void selinux_inode_post_link(struct dentry *old_dentry, struct inode *inode, struct dentry *new_dentry)
2045 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2049 rc = secondary_ops->inode_unlink(dir, dentry);
2052 return may_link(dir, dentry, MAY_UNLINK);
2055 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2057 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2060 static void selinux_inode_post_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2062 post_create(dir, dentry);
2065 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2067 return may_create(dir, dentry, SECCLASS_DIR);
2070 static void selinux_inode_post_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2072 post_create(dir, dentry);
2075 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2077 return may_link(dir, dentry, MAY_RMDIR);
2080 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2084 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2088 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2091 static void selinux_inode_post_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2093 post_create(dir, dentry);
2096 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2097 struct inode *new_inode, struct dentry *new_dentry)
2099 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2102 static void selinux_inode_post_rename(struct inode *old_inode, struct dentry *old_dentry,
2103 struct inode *new_inode, struct dentry *new_dentry)
2108 static int selinux_inode_readlink(struct dentry *dentry)
2110 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2113 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2117 rc = secondary_ops->inode_follow_link(dentry,nameidata);
2120 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2123 static int selinux_inode_permission(struct inode *inode, int mask,
2124 struct nameidata *nd)
2128 rc = secondary_ops->inode_permission(inode, mask, nd);
2133 /* No permission to check. Existence test. */
2137 return inode_has_perm(current, inode,
2138 file_mask_to_av(inode->i_mode, mask), NULL);
2141 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2145 rc = secondary_ops->inode_setattr(dentry, iattr);
2149 if (iattr->ia_valid & ATTR_FORCE)
2152 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2153 ATTR_ATIME_SET | ATTR_MTIME_SET))
2154 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2156 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2159 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2161 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2164 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2166 struct task_security_struct *tsec = current->security;
2167 struct inode *inode = dentry->d_inode;
2168 struct inode_security_struct *isec = inode->i_security;
2169 struct superblock_security_struct *sbsec;
2170 struct avc_audit_data ad;
2174 if (strcmp(name, XATTR_NAME_SELINUX)) {
2175 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2176 sizeof XATTR_SECURITY_PREFIX - 1) &&
2177 !capable(CAP_SYS_ADMIN)) {
2178 /* A different attribute in the security namespace.
2179 Restrict to administrator. */
2183 /* Not an attribute we recognize, so just check the
2184 ordinary setattr permission. */
2185 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2188 sbsec = inode->i_sb->s_security;
2189 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2192 if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2195 AVC_AUDIT_DATA_INIT(&ad,FS);
2196 ad.u.fs.dentry = dentry;
2198 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2199 FILE__RELABELFROM, &ad);
2203 rc = security_context_to_sid(value, size, &newsid);
2207 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2208 FILE__RELABELTO, &ad);
2212 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2217 return avc_has_perm(newsid,
2219 SECCLASS_FILESYSTEM,
2220 FILESYSTEM__ASSOCIATE,
2224 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2225 void *value, size_t size, int flags)
2227 struct inode *inode = dentry->d_inode;
2228 struct inode_security_struct *isec = inode->i_security;
2232 if (strcmp(name, XATTR_NAME_SELINUX)) {
2233 /* Not an attribute we recognize, so nothing to do. */
2237 rc = security_context_to_sid(value, size, &newsid);
2239 printk(KERN_WARNING "%s: unable to obtain SID for context "
2240 "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2248 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2250 struct inode *inode = dentry->d_inode;
2251 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
2253 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2256 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2259 static int selinux_inode_listxattr (struct dentry *dentry)
2261 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2264 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2266 if (strcmp(name, XATTR_NAME_SELINUX)) {
2267 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2268 sizeof XATTR_SECURITY_PREFIX - 1) &&
2269 !capable(CAP_SYS_ADMIN)) {
2270 /* A different attribute in the security namespace.
2271 Restrict to administrator. */
2275 /* Not an attribute we recognize, so just check the
2276 ordinary setattr permission. Might want a separate
2277 permission for removexattr. */
2278 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2281 /* No one is allowed to remove a SELinux security label.
2282 You can change the label, but all data must be labeled. */
2286 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void *buffer, size_t size)
2288 struct inode_security_struct *isec = inode->i_security;
2293 /* Permission check handled by selinux_inode_getxattr hook.*/
2295 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2298 rc = security_sid_to_context(isec->sid, &context, &len);
2302 if (!buffer || !size) {
2310 memcpy(buffer, context, len);
2315 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2316 const void *value, size_t size, int flags)
2318 struct inode_security_struct *isec = inode->i_security;
2322 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2325 if (!value || !size)
2328 rc = security_context_to_sid((void*)value, size, &newsid);
2336 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2338 const int len = sizeof(XATTR_NAME_SELINUX);
2339 if (buffer && len <= buffer_size)
2340 memcpy(buffer, XATTR_NAME_SELINUX, len);
2344 /* file security operations */
2346 static int selinux_file_permission(struct file *file, int mask)
2348 struct inode *inode = file->f_dentry->d_inode;
2351 /* No permission to check. Existence test. */
2355 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2356 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2359 return file_has_perm(current, file,
2360 file_mask_to_av(inode->i_mode, mask));
2363 static int selinux_file_alloc_security(struct file *file)
2365 return file_alloc_security(file);
2368 static void selinux_file_free_security(struct file *file)
2370 file_free_security(file);
2373 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2385 case EXT2_IOC_GETFLAGS:
2387 case EXT2_IOC_GETVERSION:
2388 error = file_has_perm(current, file, FILE__GETATTR);
2391 case EXT2_IOC_SETFLAGS:
2393 case EXT2_IOC_SETVERSION:
2394 error = file_has_perm(current, file, FILE__SETATTR);
2397 /* sys_ioctl() checks */
2401 error = file_has_perm(current, file, 0);
2406 error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2409 /* default case assumes that the command will go
2410 * to the file's ioctl() function.
2413 error = file_has_perm(current, file, FILE__IOCTL);
2419 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2421 #ifndef CONFIG_PPC32
2422 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2424 * We are making executable an anonymous mapping or a
2425 * private file mapping that will also be writable.
2426 * This has an additional check.
2428 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2435 /* read access is always possible with a mapping */
2436 u32 av = FILE__READ;
2438 /* write access only matters if the mapping is shared */
2439 if (shared && (prot & PROT_WRITE))
2442 if (prot & PROT_EXEC)
2443 av |= FILE__EXECUTE;
2445 return file_has_perm(current, file, av);
2450 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2451 unsigned long prot, unsigned long flags)
2455 rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2459 if (selinux_checkreqprot)
2462 return file_map_prot_check(file, prot,
2463 (flags & MAP_TYPE) == MAP_SHARED);
2466 static int selinux_file_mprotect(struct vm_area_struct *vma,
2467 unsigned long reqprot,
2472 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2476 if (selinux_checkreqprot)
2479 #ifndef CONFIG_PPC32
2480 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXECUTABLE) &&
2481 (vma->vm_start >= vma->vm_mm->start_brk &&
2482 vma->vm_end <= vma->vm_mm->brk)) {
2484 * We are making an executable mapping in the brk region.
2485 * This has an additional execheap check.
2487 rc = task_has_perm(current, current, PROCESS__EXECHEAP);
2491 if (vma->vm_file != NULL && vma->anon_vma != NULL && (prot & PROT_EXEC)) {
2493 * We are making executable a file mapping that has
2494 * had some COW done. Since pages might have been written,
2495 * check ability to execute the possibly modified content.
2496 * This typically should only occur for text relocations.
2498 int rc = file_has_perm(current, vma->vm_file, FILE__EXECMOD);
2502 if (!vma->vm_file && (prot & PROT_EXEC) &&
2503 vma->vm_start <= vma->vm_mm->start_stack &&
2504 vma->vm_end >= vma->vm_mm->start_stack) {
2505 /* Attempt to make the process stack executable.
2506 * This has an additional execstack check.
2508 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2514 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2517 static int selinux_file_lock(struct file *file, unsigned int cmd)
2519 return file_has_perm(current, file, FILE__LOCK);
2522 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2529 if (!file->f_dentry || !file->f_dentry->d_inode) {
2534 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2535 err = file_has_perm(current, file,FILE__WRITE);
2544 /* Just check FD__USE permission */
2545 err = file_has_perm(current, file, 0);
2550 #if BITS_PER_LONG == 32
2555 if (!file->f_dentry || !file->f_dentry->d_inode) {
2559 err = file_has_perm(current, file, FILE__LOCK);
2566 static int selinux_file_set_fowner(struct file *file)
2568 struct task_security_struct *tsec;
2569 struct file_security_struct *fsec;
2571 tsec = current->security;
2572 fsec = file->f_security;
2573 fsec->fown_sid = tsec->sid;
2578 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2579 struct fown_struct *fown, int signum)
2583 struct task_security_struct *tsec;
2584 struct file_security_struct *fsec;
2586 /* struct fown_struct is never outside the context of a struct file */
2587 file = (struct file *)((long)fown - offsetof(struct file,f_owner));
2589 tsec = tsk->security;
2590 fsec = file->f_security;
2593 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2595 perm = signal_to_av(signum);
2597 return avc_has_perm(fsec->fown_sid, tsec->sid,
2598 SECCLASS_PROCESS, perm, NULL);
2601 static int selinux_file_receive(struct file *file)
2603 return file_has_perm(current, file, file_to_av(file));
2606 /* task security operations */
2608 static int selinux_task_create(unsigned long clone_flags)
2612 rc = secondary_ops->task_create(clone_flags);
2616 return task_has_perm(current, current, PROCESS__FORK);
2619 static int selinux_task_alloc_security(struct task_struct *tsk)
2621 struct task_security_struct *tsec1, *tsec2;
2624 tsec1 = current->security;
2626 rc = task_alloc_security(tsk);
2629 tsec2 = tsk->security;
2631 tsec2->osid = tsec1->osid;
2632 tsec2->sid = tsec1->sid;
2634 /* Retain the exec and create SIDs across fork */
2635 tsec2->exec_sid = tsec1->exec_sid;
2636 tsec2->create_sid = tsec1->create_sid;
2638 /* Retain ptracer SID across fork, if any.
2639 This will be reset by the ptrace hook upon any
2640 subsequent ptrace_attach operations. */
2641 tsec2->ptrace_sid = tsec1->ptrace_sid;
2646 static void selinux_task_free_security(struct task_struct *tsk)
2648 task_free_security(tsk);
2651 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2653 /* Since setuid only affects the current process, and
2654 since the SELinux controls are not based on the Linux
2655 identity attributes, SELinux does not need to control
2656 this operation. However, SELinux does control the use
2657 of the CAP_SETUID and CAP_SETGID capabilities using the
2662 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2664 return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2667 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2669 /* See the comment for setuid above. */
2673 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2675 return task_has_perm(current, p, PROCESS__SETPGID);
2678 static int selinux_task_getpgid(struct task_struct *p)
2680 return task_has_perm(current, p, PROCESS__GETPGID);
2683 static int selinux_task_getsid(struct task_struct *p)
2685 return task_has_perm(current, p, PROCESS__GETSESSION);
2688 static int selinux_task_setgroups(struct group_info *group_info)
2690 /* See the comment for setuid above. */
2694 static int selinux_task_setnice(struct task_struct *p, int nice)
2698 rc = secondary_ops->task_setnice(p, nice);
2702 return task_has_perm(current,p, PROCESS__SETSCHED);
2705 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2707 struct rlimit *old_rlim = current->signal->rlim + resource;
2710 rc = secondary_ops->task_setrlimit(resource, new_rlim);
2714 /* Control the ability to change the hard limit (whether
2715 lowering or raising it), so that the hard limit can
2716 later be used as a safe reset point for the soft limit
2717 upon context transitions. See selinux_bprm_apply_creds. */
2718 if (old_rlim->rlim_max != new_rlim->rlim_max)
2719 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2724 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2726 return task_has_perm(current, p, PROCESS__SETSCHED);
2729 static int selinux_task_getscheduler(struct task_struct *p)
2731 return task_has_perm(current, p, PROCESS__GETSCHED);
2734 static int selinux_task_kill(struct task_struct *p, struct siginfo *info, int sig)
2739 rc = secondary_ops->task_kill(p, info, sig);
2743 if (info && ((unsigned long)info == 1 ||
2744 (unsigned long)info == 2 || SI_FROMKERNEL(info)))
2748 perm = PROCESS__SIGNULL; /* null signal; existence test */
2750 perm = signal_to_av(sig);
2752 return task_has_perm(current, p, perm);
2755 static int selinux_task_prctl(int option,
2761 /* The current prctl operations do not appear to require
2762 any SELinux controls since they merely observe or modify
2763 the state of the current process. */
2767 static int selinux_task_wait(struct task_struct *p)
2771 perm = signal_to_av(p->exit_signal);
2773 return task_has_perm(p, current, perm);
2776 static void selinux_task_reparent_to_init(struct task_struct *p)
2778 struct task_security_struct *tsec;
2780 secondary_ops->task_reparent_to_init(p);
2783 tsec->osid = tsec->sid;
2784 tsec->sid = SECINITSID_KERNEL;
2788 static void selinux_task_to_inode(struct task_struct *p,
2789 struct inode *inode)
2791 struct task_security_struct *tsec = p->security;
2792 struct inode_security_struct *isec = inode->i_security;
2794 isec->sid = tsec->sid;
2795 isec->initialized = 1;
2799 #ifdef CONFIG_SECURITY_NETWORK
2801 /* Returns error only if unable to parse addresses */
2802 static int selinux_parse_skb_ipv4(struct sk_buff *skb, struct avc_audit_data *ad)
2804 int offset, ihlen, ret = -EINVAL;
2805 struct iphdr _iph, *ih;
2807 offset = skb->nh.raw - skb->data;
2808 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2812 ihlen = ih->ihl * 4;
2813 if (ihlen < sizeof(_iph))
2816 ad->u.net.v4info.saddr = ih->saddr;
2817 ad->u.net.v4info.daddr = ih->daddr;
2820 switch (ih->protocol) {
2822 struct tcphdr _tcph, *th;
2824 if (ntohs(ih->frag_off) & IP_OFFSET)
2828 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2832 ad->u.net.sport = th->source;
2833 ad->u.net.dport = th->dest;
2838 struct udphdr _udph, *uh;
2840 if (ntohs(ih->frag_off) & IP_OFFSET)
2844 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2848 ad->u.net.sport = uh->source;
2849 ad->u.net.dport = uh->dest;
2860 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2862 /* Returns error only if unable to parse addresses */
2863 static int selinux_parse_skb_ipv6(struct sk_buff *skb, struct avc_audit_data *ad)
2866 int ret = -EINVAL, offset;
2867 struct ipv6hdr _ipv6h, *ip6;
2869 offset = skb->nh.raw - skb->data;
2870 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
2874 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
2875 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
2878 nexthdr = ip6->nexthdr;
2879 offset += sizeof(_ipv6h);
2880 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
2886 struct tcphdr _tcph, *th;
2888 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2892 ad->u.net.sport = th->source;
2893 ad->u.net.dport = th->dest;
2898 struct udphdr _udph, *uh;
2900 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2904 ad->u.net.sport = uh->source;
2905 ad->u.net.dport = uh->dest;
2909 /* includes fragments */
2919 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
2920 char **addrp, int *len, int src)
2924 switch (ad->u.net.family) {
2926 ret = selinux_parse_skb_ipv4(skb, ad);
2930 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
2931 &ad->u.net.v4info.daddr);
2934 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2936 ret = selinux_parse_skb_ipv6(skb, ad);
2940 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
2941 &ad->u.net.v6info.daddr);
2951 /* socket security operations */
2952 static int socket_has_perm(struct task_struct *task, struct socket *sock,
2955 struct inode_security_struct *isec;
2956 struct task_security_struct *tsec;
2957 struct avc_audit_data ad;
2960 tsec = task->security;
2961 isec = SOCK_INODE(sock)->i_security;
2963 if (isec->sid == SECINITSID_KERNEL)
2966 AVC_AUDIT_DATA_INIT(&ad,NET);
2967 ad.u.net.sk = sock->sk;
2968 err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
2974 static int selinux_socket_create(int family, int type,
2975 int protocol, int kern)
2978 struct task_security_struct *tsec;
2983 tsec = current->security;
2984 err = avc_has_perm(tsec->sid, tsec->sid,
2985 socket_type_to_security_class(family, type,
2986 protocol), SOCKET__CREATE, NULL);
2992 static void selinux_socket_post_create(struct socket *sock, int family,
2993 int type, int protocol, int kern)
2995 struct inode_security_struct *isec;
2996 struct task_security_struct *tsec;
2998 isec = SOCK_INODE(sock)->i_security;
3000 tsec = current->security;
3001 isec->sclass = socket_type_to_security_class(family, type, protocol);
3002 isec->sid = kern ? SECINITSID_KERNEL : tsec->sid;
3003 isec->initialized = 1;
3008 /* Range of port numbers used to automatically bind.
3009 Need to determine whether we should perform a name_bind
3010 permission check between the socket and the port number. */
3011 #define ip_local_port_range_0 sysctl_local_port_range[0]
3012 #define ip_local_port_range_1 sysctl_local_port_range[1]
3014 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3019 err = socket_has_perm(current, sock, SOCKET__BIND);
3024 * If PF_INET or PF_INET6, check name_bind permission for the port.
3026 family = sock->sk->sk_family;
3027 if (family == PF_INET || family == PF_INET6) {
3029 struct inode_security_struct *isec;
3030 struct task_security_struct *tsec;
3031 struct avc_audit_data ad;
3032 struct sockaddr_in *addr4 = NULL;
3033 struct sockaddr_in6 *addr6 = NULL;
3034 unsigned short snum;
3035 struct sock *sk = sock->sk;
3036 u32 sid, node_perm, addrlen;
3038 tsec = current->security;
3039 isec = SOCK_INODE(sock)->i_security;
3041 if (family == PF_INET) {
3042 addr4 = (struct sockaddr_in *)address;
3043 snum = ntohs(addr4->sin_port);
3044 addrlen = sizeof(addr4->sin_addr.s_addr);
3045 addrp = (char *)&addr4->sin_addr.s_addr;
3047 addr6 = (struct sockaddr_in6 *)address;
3048 snum = ntohs(addr6->sin6_port);
3049 addrlen = sizeof(addr6->sin6_addr.s6_addr);
3050 addrp = (char *)&addr6->sin6_addr.s6_addr;
3053 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3054 snum > ip_local_port_range_1)) {
3055 err = security_port_sid(sk->sk_family, sk->sk_type,
3056 sk->sk_protocol, snum, &sid);
3059 AVC_AUDIT_DATA_INIT(&ad,NET);
3060 ad.u.net.sport = htons(snum);
3061 ad.u.net.family = family;
3062 err = avc_has_perm(isec->sid, sid,
3064 SOCKET__NAME_BIND, &ad);
3069 switch(sk->sk_protocol) {
3071 node_perm = TCP_SOCKET__NODE_BIND;
3075 node_perm = UDP_SOCKET__NODE_BIND;
3079 node_perm = RAWIP_SOCKET__NODE_BIND;
3083 err = security_node_sid(family, addrp, addrlen, &sid);
3087 AVC_AUDIT_DATA_INIT(&ad,NET);
3088 ad.u.net.sport = htons(snum);
3089 ad.u.net.family = family;
3091 if (family == PF_INET)
3092 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3094 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3096 err = avc_has_perm(isec->sid, sid,
3097 isec->sclass, node_perm, &ad);
3105 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3107 struct inode_security_struct *isec;
3110 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3115 * If a TCP socket, check name_connect permission for the port.
3117 isec = SOCK_INODE(sock)->i_security;
3118 if (isec->sclass == SECCLASS_TCP_SOCKET) {
3119 struct sock *sk = sock->sk;
3120 struct avc_audit_data ad;
3121 struct sockaddr_in *addr4 = NULL;
3122 struct sockaddr_in6 *addr6 = NULL;
3123 unsigned short snum;
3126 if (sk->sk_family == PF_INET) {
3127 addr4 = (struct sockaddr_in *)address;
3128 if (addrlen != sizeof(struct sockaddr_in))
3130 snum = ntohs(addr4->sin_port);
3132 addr6 = (struct sockaddr_in6 *)address;
3133 if (addrlen != sizeof(struct sockaddr_in6))
3135 snum = ntohs(addr6->sin6_port);
3138 err = security_port_sid(sk->sk_family, sk->sk_type,
3139 sk->sk_protocol, snum, &sid);
3143 AVC_AUDIT_DATA_INIT(&ad,NET);
3144 ad.u.net.dport = htons(snum);
3145 ad.u.net.family = sk->sk_family;
3146 err = avc_has_perm(isec->sid, sid, isec->sclass,
3147 TCP_SOCKET__NAME_CONNECT, &ad);
3156 static int selinux_socket_listen(struct socket *sock, int backlog)
3158 return socket_has_perm(current, sock, SOCKET__LISTEN);
3161 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3164 struct inode_security_struct *isec;
3165 struct inode_security_struct *newisec;
3167 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3171 newisec = SOCK_INODE(newsock)->i_security;
3173 isec = SOCK_INODE(sock)->i_security;
3174 newisec->sclass = isec->sclass;
3175 newisec->sid = isec->sid;
3176 newisec->initialized = 1;
3181 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3184 return socket_has_perm(current, sock, SOCKET__WRITE);
3187 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3188 int size, int flags)
3190 return socket_has_perm(current, sock, SOCKET__READ);
3193 static int selinux_socket_getsockname(struct socket *sock)
3195 return socket_has_perm(current, sock, SOCKET__GETATTR);
3198 static int selinux_socket_getpeername(struct socket *sock)
3200 return socket_has_perm(current, sock, SOCKET__GETATTR);
3203 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3205 return socket_has_perm(current, sock, SOCKET__SETOPT);
3208 static int selinux_socket_getsockopt(struct socket *sock, int level,
3211 return socket_has_perm(current, sock, SOCKET__GETOPT);
3214 static int selinux_socket_shutdown(struct socket *sock, int how)
3216 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3219 static int selinux_socket_unix_stream_connect(struct socket *sock,
3220 struct socket *other,
3223 struct sk_security_struct *ssec;
3224 struct inode_security_struct *isec;
3225 struct inode_security_struct *other_isec;
3226 struct avc_audit_data ad;
3229 err = secondary_ops->unix_stream_connect(sock, other, newsk);
3233 isec = SOCK_INODE(sock)->i_security;
3234 other_isec = SOCK_INODE(other)->i_security;
3236 AVC_AUDIT_DATA_INIT(&ad,NET);
3237 ad.u.net.sk = other->sk;
3239 err = avc_has_perm(isec->sid, other_isec->sid,
3241 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3245 /* connecting socket */
3246 ssec = sock->sk->sk_security;
3247 ssec->peer_sid = other_isec->sid;
3249 /* server child socket */
3250 ssec = newsk->sk_security;
3251 ssec->peer_sid = isec->sid;
3256 static int selinux_socket_unix_may_send(struct socket *sock,
3257 struct socket *other)
3259 struct inode_security_struct *isec;
3260 struct inode_security_struct *other_isec;
3261 struct avc_audit_data ad;
3264 isec = SOCK_INODE(sock)->i_security;
3265 other_isec = SOCK_INODE(other)->i_security;
3267 AVC_AUDIT_DATA_INIT(&ad,NET);
3268 ad.u.net.sk = other->sk;
3270 err = avc_has_perm(isec->sid, other_isec->sid,
3271 isec->sclass, SOCKET__SENDTO, &ad);
3278 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3283 u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3286 struct socket *sock;
3287 struct net_device *dev;
3288 struct avc_audit_data ad;
3290 family = sk->sk_family;
3291 if (family != PF_INET && family != PF_INET6)
3294 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3295 if (family == PF_INET6 && skb->protocol == ntohs(ETH_P_IP))
3298 read_lock_bh(&sk->sk_callback_lock);
3299 sock = sk->sk_socket;
3301 struct inode *inode;
3302 inode = SOCK_INODE(sock);
3304 struct inode_security_struct *isec;
3305 isec = inode->i_security;
3306 sock_sid = isec->sid;
3307 sock_class = isec->sclass;
3310 read_unlock_bh(&sk->sk_callback_lock);
3318 err = sel_netif_sids(dev, &if_sid, NULL);
3322 switch (sock_class) {
3323 case SECCLASS_UDP_SOCKET:
3324 netif_perm = NETIF__UDP_RECV;
3325 node_perm = NODE__UDP_RECV;
3326 recv_perm = UDP_SOCKET__RECV_MSG;
3329 case SECCLASS_TCP_SOCKET:
3330 netif_perm = NETIF__TCP_RECV;
3331 node_perm = NODE__TCP_RECV;
3332 recv_perm = TCP_SOCKET__RECV_MSG;
3336 netif_perm = NETIF__RAWIP_RECV;
3337 node_perm = NODE__RAWIP_RECV;
3341 AVC_AUDIT_DATA_INIT(&ad, NET);
3342 ad.u.net.netif = dev->name;
3343 ad.u.net.family = family;
3345 err = selinux_parse_skb(skb, &ad, &addrp, &len, 1);
3349 err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, &ad);
3353 /* Fixme: this lookup is inefficient */
3354 err = security_node_sid(family, addrp, len, &node_sid);
3358 err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, &ad);
3365 /* Fixme: make this more efficient */
3366 err = security_port_sid(sk->sk_family, sk->sk_type,
3367 sk->sk_protocol, ntohs(ad.u.net.sport),
3372 err = avc_has_perm(sock_sid, port_sid,
3373 sock_class, recv_perm, &ad);
3379 static int selinux_socket_getpeersec(struct socket *sock, char __user *optval,
3380 int __user *optlen, unsigned len)
3385 struct sk_security_struct *ssec;
3386 struct inode_security_struct *isec;
3388 isec = SOCK_INODE(sock)->i_security;
3389 if (isec->sclass != SECCLASS_UNIX_STREAM_SOCKET) {
3394 ssec = sock->sk->sk_security;
3396 err = security_sid_to_context(ssec->peer_sid, &scontext, &scontext_len);
3400 if (scontext_len > len) {
3405 if (copy_to_user(optval, scontext, scontext_len))
3409 if (put_user(scontext_len, optlen))
3417 static int selinux_sk_alloc_security(struct sock *sk, int family, int priority)
3419 return sk_alloc_security(sk, family, priority);
3422 static void selinux_sk_free_security(struct sock *sk)
3424 sk_free_security(sk);
3427 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3431 struct nlmsghdr *nlh;
3432 struct socket *sock = sk->sk_socket;
3433 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3435 if (skb->len < NLMSG_SPACE(0)) {
3439 nlh = (struct nlmsghdr *)skb->data;
3441 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3443 if (err == -EINVAL) {
3444 audit_log(current->audit_context, AUDIT_SELINUX_ERR,
3445 "SELinux: unrecognized netlink message"
3446 " type=%hu for sclass=%hu\n",
3447 nlh->nlmsg_type, isec->sclass);
3448 if (!selinux_enforcing)
3458 err = socket_has_perm(current, sock, perm);
3463 #ifdef CONFIG_NETFILTER
3465 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3466 struct sk_buff **pskb,
3467 const struct net_device *in,
3468 const struct net_device *out,
3469 int (*okfn)(struct sk_buff *),
3473 int len, err = NF_ACCEPT;
3474 u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
3476 struct socket *sock;
3477 struct inode *inode;
3478 struct sk_buff *skb = *pskb;
3479 struct inode_security_struct *isec;
3480 struct avc_audit_data ad;
3481 struct net_device *dev = (struct net_device *)out;
3487 sock = sk->sk_socket;
3491 inode = SOCK_INODE(sock);
3495 err = sel_netif_sids(dev, &if_sid, NULL);
3499 isec = inode->i_security;
3501 switch (isec->sclass) {
3502 case SECCLASS_UDP_SOCKET:
3503 netif_perm = NETIF__UDP_SEND;
3504 node_perm = NODE__UDP_SEND;
3505 send_perm = UDP_SOCKET__SEND_MSG;
3508 case SECCLASS_TCP_SOCKET:
3509 netif_perm = NETIF__TCP_SEND;
3510 node_perm = NODE__TCP_SEND;
3511 send_perm = TCP_SOCKET__SEND_MSG;
3515 netif_perm = NETIF__RAWIP_SEND;
3516 node_perm = NODE__RAWIP_SEND;
3521 AVC_AUDIT_DATA_INIT(&ad, NET);
3522 ad.u.net.netif = dev->name;
3523 ad.u.net.family = family;
3525 err = selinux_parse_skb(skb, &ad, &addrp,
3526 &len, 0) ? NF_DROP : NF_ACCEPT;
3527 if (err != NF_ACCEPT)
3530 err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF,
3531 netif_perm, &ad) ? NF_DROP : NF_ACCEPT;
3532 if (err != NF_ACCEPT)
3535 /* Fixme: this lookup is inefficient */
3536 err = security_node_sid(family, addrp, len,
3537 &node_sid) ? NF_DROP : NF_ACCEPT;
3538 if (err != NF_ACCEPT)
3541 err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE,
3542 node_perm, &ad) ? NF_DROP : NF_ACCEPT;
3543 if (err != NF_ACCEPT)
3549 /* Fixme: make this more efficient */
3550 err = security_port_sid(sk->sk_family,
3553 ntohs(ad.u.net.dport),
3554 &port_sid) ? NF_DROP : NF_ACCEPT;
3555 if (err != NF_ACCEPT)
3558 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3559 send_perm, &ad) ? NF_DROP : NF_ACCEPT;
3566 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3567 struct sk_buff **pskb,
3568 const struct net_device *in,
3569 const struct net_device *out,
3570 int (*okfn)(struct sk_buff *))
3572 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3575 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3577 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3578 struct sk_buff **pskb,
3579 const struct net_device *in,
3580 const struct net_device *out,
3581 int (*okfn)(struct sk_buff *))
3583 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3588 #endif /* CONFIG_NETFILTER */
3592 static inline int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3597 #endif /* CONFIG_SECURITY_NETWORK */
3599 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3601 struct task_security_struct *tsec;
3602 struct av_decision avd;
3605 err = secondary_ops->netlink_send(sk, skb);
3609 tsec = current->security;
3612 avc_has_perm_noaudit(tsec->sid, tsec->sid,
3613 SECCLASS_CAPABILITY, ~0, &avd);
3614 cap_mask(NETLINK_CB(skb).eff_cap, avd.allowed);
3616 if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
3617 err = selinux_nlmsg_perm(sk, skb);
3622 static int selinux_netlink_recv(struct sk_buff *skb)
3624 if (!cap_raised(NETLINK_CB(skb).eff_cap, CAP_NET_ADMIN))
3629 static int ipc_alloc_security(struct task_struct *task,
3630 struct kern_ipc_perm *perm,
3633 struct task_security_struct *tsec = task->security;
3634 struct ipc_security_struct *isec;
3636 isec = kmalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
3640 memset(isec, 0, sizeof(struct ipc_security_struct));
3641 isec->magic = SELINUX_MAGIC;
3642 isec->sclass = sclass;
3643 isec->ipc_perm = perm;
3645 isec->sid = tsec->sid;
3647 isec->sid = SECINITSID_UNLABELED;
3649 perm->security = isec;
3654 static void ipc_free_security(struct kern_ipc_perm *perm)
3656 struct ipc_security_struct *isec = perm->security;
3657 if (!isec || isec->magic != SELINUX_MAGIC)
3660 perm->security = NULL;
3664 static int msg_msg_alloc_security(struct msg_msg *msg)
3666 struct msg_security_struct *msec;
3668 msec = kmalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
3672 memset(msec, 0, sizeof(struct msg_security_struct));
3673 msec->magic = SELINUX_MAGIC;
3675 msec->sid = SECINITSID_UNLABELED;
3676 msg->security = msec;
3681 static void msg_msg_free_security(struct msg_msg *msg)
3683 struct msg_security_struct *msec = msg->security;
3684 if (!msec || msec->magic != SELINUX_MAGIC)
3687 msg->security = NULL;
3691 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
3694 struct task_security_struct *tsec;
3695 struct ipc_security_struct *isec;
3696 struct avc_audit_data ad;
3698 tsec = current->security;
3699 isec = ipc_perms->security;
3701 AVC_AUDIT_DATA_INIT(&ad, IPC);
3702 ad.u.ipc_id = ipc_perms->key;
3704 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3707 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
3709 return msg_msg_alloc_security(msg);
3712 static void selinux_msg_msg_free_security(struct msg_msg *msg)
3714 msg_msg_free_security(msg);
3717 /* message queue security operations */
3718 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
3720 struct task_security_struct *tsec;
3721 struct ipc_security_struct *isec;
3722 struct avc_audit_data ad;
3725 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
3729 tsec = current->security;
3730 isec = msq->q_perm.security;
3732 AVC_AUDIT_DATA_INIT(&ad, IPC);
3733 ad.u.ipc_id = msq->q_perm.key;
3735 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3738 ipc_free_security(&msq->q_perm);
3744 static void selinux_msg_queue_free_security(struct msg_queue *msq)
3746 ipc_free_security(&msq->q_perm);
3749 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
3751 struct task_security_struct *tsec;
3752 struct ipc_security_struct *isec;
3753 struct avc_audit_data ad;
3755 tsec = current->security;
3756 isec = msq->q_perm.security;
3758 AVC_AUDIT_DATA_INIT(&ad, IPC);
3759 ad.u.ipc_id = msq->q_perm.key;
3761 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3762 MSGQ__ASSOCIATE, &ad);
3765 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
3773 /* No specific object, just general system-wide information. */
3774 return task_has_system(current, SYSTEM__IPC_INFO);
3777 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
3780 perms = MSGQ__SETATTR;
3783 perms = MSGQ__DESTROY;
3789 err = ipc_has_perm(&msq->q_perm, perms);
3793 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
3795 struct task_security_struct *tsec;
3796 struct ipc_security_struct *isec;
3797 struct msg_security_struct *msec;
3798 struct avc_audit_data ad;
3801 tsec = current->security;
3802 isec = msq->q_perm.security;
3803 msec = msg->security;
3806 * First time through, need to assign label to the message
3808 if (msec->sid == SECINITSID_UNLABELED) {
3810 * Compute new sid based on current process and
3811 * message queue this message will be stored in
3813 rc = security_transition_sid(tsec->sid,
3821 AVC_AUDIT_DATA_INIT(&ad, IPC);
3822 ad.u.ipc_id = msq->q_perm.key;
3824 /* Can this process write to the queue? */
3825 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3828 /* Can this process send the message */
3829 rc = avc_has_perm(tsec->sid, msec->sid,
3830 SECCLASS_MSG, MSG__SEND, &ad);
3832 /* Can the message be put in the queue? */
3833 rc = avc_has_perm(msec->sid, isec->sid,
3834 SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
3839 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
3840 struct task_struct *target,
3841 long type, int mode)
3843 struct task_security_struct *tsec;
3844 struct ipc_security_struct *isec;
3845 struct msg_security_struct *msec;
3846 struct avc_audit_data ad;
3849 tsec = target->security;
3850 isec = msq->q_perm.security;
3851 msec = msg->security;
3853 AVC_AUDIT_DATA_INIT(&ad, IPC);
3854 ad.u.ipc_id = msq->q_perm.key;
3856 rc = avc_has_perm(tsec->sid, isec->sid,
3857 SECCLASS_MSGQ, MSGQ__READ, &ad);
3859 rc = avc_has_perm(tsec->sid, msec->sid,
3860 SECCLASS_MSG, MSG__RECEIVE, &ad);
3864 /* Shared Memory security operations */
3865 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
3867 struct task_security_struct *tsec;
3868 struct ipc_security_struct *isec;
3869 struct avc_audit_data ad;
3872 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
3876 tsec = current->security;
3877 isec = shp->shm_perm.security;
3879 AVC_AUDIT_DATA_INIT(&ad, IPC);
3880 ad.u.ipc_id = shp->shm_perm.key;
3882 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3885 ipc_free_security(&shp->shm_perm);
3891 static void selinux_shm_free_security(struct shmid_kernel *shp)
3893 ipc_free_security(&shp->shm_perm);
3896 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
3898 struct task_security_struct *tsec;
3899 struct ipc_security_struct *isec;
3900 struct avc_audit_data ad;
3902 tsec = current->security;
3903 isec = shp->shm_perm.security;
3905 AVC_AUDIT_DATA_INIT(&ad, IPC);
3906 ad.u.ipc_id = shp->shm_perm.key;
3908 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3909 SHM__ASSOCIATE, &ad);
3912 /* Note, at this point, shp is locked down */
3913 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
3921 /* No specific object, just general system-wide information. */
3922 return task_has_system(current, SYSTEM__IPC_INFO);
3925 perms = SHM__GETATTR | SHM__ASSOCIATE;
3928 perms = SHM__SETATTR;
3935 perms = SHM__DESTROY;
3941 err = ipc_has_perm(&shp->shm_perm, perms);
3945 static int selinux_shm_shmat(struct shmid_kernel *shp,
3946 char __user *shmaddr, int shmflg)
3951 rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
3955 if (shmflg & SHM_RDONLY)
3958 perms = SHM__READ | SHM__WRITE;
3960 return ipc_has_perm(&shp->shm_perm, perms);
3963 /* Semaphore security operations */
3964 static int selinux_sem_alloc_security(struct sem_array *sma)
3966 struct task_security_struct *tsec;
3967 struct ipc_security_struct *isec;
3968 struct avc_audit_data ad;
3971 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
3975 tsec = current->security;
3976 isec = sma->sem_perm.security;
3978 AVC_AUDIT_DATA_INIT(&ad, IPC);
3979 ad.u.ipc_id = sma->sem_perm.key;
3981 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
3984 ipc_free_security(&sma->sem_perm);
3990 static void selinux_sem_free_security(struct sem_array *sma)
3992 ipc_free_security(&sma->sem_perm);
3995 static int selinux_sem_associate(struct sem_array *sma, int semflg)
3997 struct task_security_struct *tsec;
3998 struct ipc_security_struct *isec;
3999 struct avc_audit_data ad;
4001 tsec = current->security;
4002 isec = sma->sem_perm.security;
4004 AVC_AUDIT_DATA_INIT(&ad, IPC);
4005 ad.u.ipc_id = sma->sem_perm.key;
4007 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4008 SEM__ASSOCIATE, &ad);
4011 /* Note, at this point, sma is locked down */
4012 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4020 /* No specific object, just general system-wide information. */
4021 return task_has_system(current, SYSTEM__IPC_INFO);
4025 perms = SEM__GETATTR;
4036 perms = SEM__DESTROY;
4039 perms = SEM__SETATTR;
4043 perms = SEM__GETATTR | SEM__ASSOCIATE;
4049 err = ipc_has_perm(&sma->sem_perm, perms);
4053 static int selinux_sem_semop(struct sem_array *sma,
4054 struct sembuf *sops, unsigned nsops, int alter)
4059 perms = SEM__READ | SEM__WRITE;
4063 return ipc_has_perm(&sma->sem_perm, perms);
4066 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4072 av |= IPC__UNIX_READ;
4074 av |= IPC__UNIX_WRITE;
4079 return ipc_has_perm(ipcp, av);
4082 /* module stacking operations */
4083 static int selinux_register_security (const char *name, struct security_operations *ops)
4085 if (secondary_ops != original_ops) {
4086 printk(KERN_INFO "%s: There is already a secondary security "
4087 "module registered.\n", __FUNCTION__);
4091 secondary_ops = ops;
4093 printk(KERN_INFO "%s: Registering secondary module %s\n",
4100 static int selinux_unregister_security (const char *name, struct security_operations *ops)
4102 if (ops != secondary_ops) {
4103 printk (KERN_INFO "%s: trying to unregister a security module "
4104 "that is not registered.\n", __FUNCTION__);
4108 secondary_ops = original_ops;
4113 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4116 inode_doinit_with_dentry(inode, dentry);
4119 static int selinux_getprocattr(struct task_struct *p,
4120 char *name, void *value, size_t size)
4122 struct task_security_struct *tsec;
4128 error = task_has_perm(current, p, PROCESS__GETATTR);
4138 if (!strcmp(name, "current"))
4140 else if (!strcmp(name, "prev"))
4142 else if (!strcmp(name, "exec"))
4143 sid = tsec->exec_sid;
4144 else if (!strcmp(name, "fscreate"))
4145 sid = tsec->create_sid;
4152 error = security_sid_to_context(sid, &context, &len);
4159 memcpy(value, context, len);
4164 static int selinux_setprocattr(struct task_struct *p,
4165 char *name, void *value, size_t size)
4167 struct task_security_struct *tsec;
4173 /* SELinux only allows a process to change its own
4174 security attributes. */
4179 * Basic control over ability to set these attributes at all.
4180 * current == p, but we'll pass them separately in case the
4181 * above restriction is ever removed.
4183 if (!strcmp(name, "exec"))
4184 error = task_has_perm(current, p, PROCESS__SETEXEC);
4185 else if (!strcmp(name, "fscreate"))
4186 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4187 else if (!strcmp(name, "current"))
4188 error = task_has_perm(current, p, PROCESS__SETCURRENT);
4194 /* Obtain a SID for the context, if one was specified. */
4195 if (size && str[1] && str[1] != '\n') {
4196 if (str[size-1] == '\n') {
4200 error = security_context_to_sid(value, size, &sid);
4205 /* Permission checking based on the specified context is
4206 performed during the actual operation (execve,
4207 open/mkdir/...), when we know the full context of the
4208 operation. See selinux_bprm_set_security for the execve
4209 checks and may_create for the file creation checks. The
4210 operation will then fail if the context is not permitted. */
4212 if (!strcmp(name, "exec"))
4213 tsec->exec_sid = sid;
4214 else if (!strcmp(name, "fscreate"))
4215 tsec->create_sid = sid;
4216 else if (!strcmp(name, "current")) {
4217 struct av_decision avd;
4222 /* Only allow single threaded processes to change context */
4223 if (atomic_read(&p->mm->mm_users) != 1) {
4224 struct task_struct *g, *t;
4225 struct mm_struct *mm = p->mm;
4226 read_lock(&tasklist_lock);
4227 do_each_thread(g, t)
4228 if (t->mm == mm && t != p) {
4229 read_unlock(&tasklist_lock);
4232 while_each_thread(g, t);
4233 read_unlock(&tasklist_lock);
4236 /* Check permissions for the transition. */
4237 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
4238 PROCESS__DYNTRANSITION, NULL);
4242 /* Check for ptracing, and update the task SID if ok.
4243 Otherwise, leave SID unchanged and fail. */
4245 if (p->ptrace & PT_PTRACED) {
4246 error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
4248 PROCESS__PTRACE, &avd);
4252 avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
4253 PROCESS__PTRACE, &avd, error, NULL);
4267 static struct security_operations selinux_ops = {
4268 .ptrace = selinux_ptrace,
4269 .capget = selinux_capget,
4270 .capset_check = selinux_capset_check,
4271 .capset_set = selinux_capset_set,
4272 .sysctl = selinux_sysctl,
4273 .capable = selinux_capable,
4274 .quotactl = selinux_quotactl,
4275 .quota_on = selinux_quota_on,
4276 .syslog = selinux_syslog,
4277 .vm_enough_memory = selinux_vm_enough_memory,
4279 .netlink_send = selinux_netlink_send,
4280 .netlink_recv = selinux_netlink_recv,
4282 .bprm_alloc_security = selinux_bprm_alloc_security,
4283 .bprm_free_security = selinux_bprm_free_security,
4284 .bprm_apply_creds = selinux_bprm_apply_creds,
4285 .bprm_post_apply_creds = selinux_bprm_post_apply_creds,
4286 .bprm_set_security = selinux_bprm_set_security,
4287 .bprm_check_security = selinux_bprm_check_security,
4288 .bprm_secureexec = selinux_bprm_secureexec,
4290 .sb_alloc_security = selinux_sb_alloc_security,
4291 .sb_free_security = selinux_sb_free_security,
4292 .sb_copy_data = selinux_sb_copy_data,
4293 .sb_kern_mount = selinux_sb_kern_mount,
4294 .sb_statfs = selinux_sb_statfs,
4295 .sb_mount = selinux_mount,
4296 .sb_umount = selinux_umount,
4298 .inode_alloc_security = selinux_inode_alloc_security,
4299 .inode_free_security = selinux_inode_free_security,
4300 .inode_create = selinux_inode_create,
4301 .inode_post_create = selinux_inode_post_create,
4302 .inode_link = selinux_inode_link,
4303 .inode_post_link = selinux_inode_post_link,
4304 .inode_unlink = selinux_inode_unlink,
4305 .inode_symlink = selinux_inode_symlink,
4306 .inode_post_symlink = selinux_inode_post_symlink,
4307 .inode_mkdir = selinux_inode_mkdir,
4308 .inode_post_mkdir = selinux_inode_post_mkdir,
4309 .inode_rmdir = selinux_inode_rmdir,
4310 .inode_mknod = selinux_inode_mknod,
4311 .inode_post_mknod = selinux_inode_post_mknod,
4312 .inode_rename = selinux_inode_rename,
4313 .inode_post_rename = selinux_inode_post_rename,
4314 .inode_readlink = selinux_inode_readlink,
4315 .inode_follow_link = selinux_inode_follow_link,
4316 .inode_permission = selinux_inode_permission,
4317 .inode_setattr = selinux_inode_setattr,
4318 .inode_getattr = selinux_inode_getattr,
4319 .inode_setxattr = selinux_inode_setxattr,
4320 .inode_post_setxattr = selinux_inode_post_setxattr,
4321 .inode_getxattr = selinux_inode_getxattr,
4322 .inode_listxattr = selinux_inode_listxattr,
4323 .inode_removexattr = selinux_inode_removexattr,
4324 .inode_getsecurity = selinux_inode_getsecurity,
4325 .inode_setsecurity = selinux_inode_setsecurity,
4326 .inode_listsecurity = selinux_inode_listsecurity,
4328 .file_permission = selinux_file_permission,
4329 .file_alloc_security = selinux_file_alloc_security,
4330 .file_free_security = selinux_file_free_security,
4331 .file_ioctl = selinux_file_ioctl,
4332 .file_mmap = selinux_file_mmap,
4333 .file_mprotect = selinux_file_mprotect,
4334 .file_lock = selinux_file_lock,
4335 .file_fcntl = selinux_file_fcntl,
4336 .file_set_fowner = selinux_file_set_fowner,
4337 .file_send_sigiotask = selinux_file_send_sigiotask,
4338 .file_receive = selinux_file_receive,
4340 .task_create = selinux_task_create,
4341 .task_alloc_security = selinux_task_alloc_security,
4342 .task_free_security = selinux_task_free_security,
4343 .task_setuid = selinux_task_setuid,
4344 .task_post_setuid = selinux_task_post_setuid,
4345 .task_setgid = selinux_task_setgid,
4346 .task_setpgid = selinux_task_setpgid,
4347 .task_getpgid = selinux_task_getpgid,
4348 .task_getsid = selinux_task_getsid,
4349 .task_setgroups = selinux_task_setgroups,
4350 .task_setnice = selinux_task_setnice,
4351 .task_setrlimit = selinux_task_setrlimit,
4352 .task_setscheduler = selinux_task_setscheduler,
4353 .task_getscheduler = selinux_task_getscheduler,
4354 .task_kill = selinux_task_kill,
4355 .task_wait = selinux_task_wait,
4356 .task_prctl = selinux_task_prctl,
4357 .task_reparent_to_init = selinux_task_reparent_to_init,
4358 .task_to_inode = selinux_task_to_inode,
4360 .ipc_permission = selinux_ipc_permission,
4362 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
4363 .msg_msg_free_security = selinux_msg_msg_free_security,
4365 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
4366 .msg_queue_free_security = selinux_msg_queue_free_security,
4367 .msg_queue_associate = selinux_msg_queue_associate,
4368 .msg_queue_msgctl = selinux_msg_queue_msgctl,
4369 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
4370 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
4372 .shm_alloc_security = selinux_shm_alloc_security,
4373 .shm_free_security = selinux_shm_free_security,
4374 .shm_associate = selinux_shm_associate,
4375 .shm_shmctl = selinux_shm_shmctl,
4376 .shm_shmat = selinux_shm_shmat,
4378 .sem_alloc_security = selinux_sem_alloc_security,
4379 .sem_free_security = selinux_sem_free_security,
4380 .sem_associate = selinux_sem_associate,
4381 .sem_semctl = selinux_sem_semctl,
4382 .sem_semop = selinux_sem_semop,
4384 .register_security = selinux_register_security,
4385 .unregister_security = selinux_unregister_security,
4387 .d_instantiate = selinux_d_instantiate,
4389 .getprocattr = selinux_getprocattr,
4390 .setprocattr = selinux_setprocattr,
4392 #ifdef CONFIG_SECURITY_NETWORK
4393 .unix_stream_connect = selinux_socket_unix_stream_connect,
4394 .unix_may_send = selinux_socket_unix_may_send,
4396 .socket_create = selinux_socket_create,
4397 .socket_post_create = selinux_socket_post_create,
4398 .socket_bind = selinux_socket_bind,
4399 .socket_connect = selinux_socket_connect,
4400 .socket_listen = selinux_socket_listen,
4401 .socket_accept = selinux_socket_accept,
4402 .socket_sendmsg = selinux_socket_sendmsg,
4403 .socket_recvmsg = selinux_socket_recvmsg,
4404 .socket_getsockname = selinux_socket_getsockname,
4405 .socket_getpeername = selinux_socket_getpeername,
4406 .socket_getsockopt = selinux_socket_getsockopt,
4407 .socket_setsockopt = selinux_socket_setsockopt,
4408 .socket_shutdown = selinux_socket_shutdown,
4409 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
4410 .socket_getpeersec = selinux_socket_getpeersec,
4411 .sk_alloc_security = selinux_sk_alloc_security,
4412 .sk_free_security = selinux_sk_free_security,
4416 static __init int selinux_init(void)
4418 struct task_security_struct *tsec;
4420 if (!selinux_enabled) {
4421 printk(KERN_INFO "SELinux: Disabled at boot.\n");
4425 printk(KERN_INFO "SELinux: Initializing.\n");
4427 /* Set the security state for the initial task. */
4428 if (task_alloc_security(current))
4429 panic("SELinux: Failed to initialize initial task.\n");
4430 tsec = current->security;
4431 tsec->osid = tsec->sid = SECINITSID_KERNEL;
4435 original_ops = secondary_ops = security_ops;
4437 panic ("SELinux: No initial security operations\n");
4438 if (register_security (&selinux_ops))
4439 panic("SELinux: Unable to register with kernel.\n");
4441 if (selinux_enforcing) {
4442 printk(KERN_INFO "SELinux: Starting in enforcing mode\n");
4444 printk(KERN_INFO "SELinux: Starting in permissive mode\n");
4449 void selinux_complete_init(void)
4451 printk(KERN_INFO "SELinux: Completing initialization.\n");
4453 /* Set up any superblocks initialized prior to the policy load. */
4454 printk(KERN_INFO "SELinux: Setting up existing superblocks.\n");
4455 spin_lock(&sb_security_lock);
4457 if (!list_empty(&superblock_security_head)) {
4458 struct superblock_security_struct *sbsec =
4459 list_entry(superblock_security_head.next,
4460 struct superblock_security_struct,
4462 struct super_block *sb = sbsec->sb;
4463 spin_lock(&sb_lock);
4465 spin_unlock(&sb_lock);
4466 spin_unlock(&sb_security_lock);
4467 down_read(&sb->s_umount);
4469 superblock_doinit(sb, NULL);
4471 spin_lock(&sb_security_lock);
4472 list_del_init(&sbsec->list);
4475 spin_unlock(&sb_security_lock);
4478 /* SELinux requires early initialization in order to label
4479 all processes and objects when they are created. */
4480 security_initcall(selinux_init);
4482 #if defined(CONFIG_SECURITY_NETWORK) && defined(CONFIG_NETFILTER)
4484 static struct nf_hook_ops selinux_ipv4_op = {
4485 .hook = selinux_ipv4_postroute_last,
4486 .owner = THIS_MODULE,
4488 .hooknum = NF_IP_POST_ROUTING,
4489 .priority = NF_IP_PRI_SELINUX_LAST,
4492 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4494 static struct nf_hook_ops selinux_ipv6_op = {
4495 .hook = selinux_ipv6_postroute_last,
4496 .owner = THIS_MODULE,
4498 .hooknum = NF_IP6_POST_ROUTING,
4499 .priority = NF_IP6_PRI_SELINUX_LAST,
4504 static int __init selinux_nf_ip_init(void)
4508 if (!selinux_enabled)
4511 printk(KERN_INFO "SELinux: Registering netfilter hooks\n");
4513 err = nf_register_hook(&selinux_ipv4_op);
4515 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
4517 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4519 err = nf_register_hook(&selinux_ipv6_op);
4521 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
4528 __initcall(selinux_nf_ip_init);
4530 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4531 static void selinux_nf_ip_exit(void)
4533 printk(KERN_INFO "SELinux: Unregistering netfilter hooks\n");
4535 nf_unregister_hook(&selinux_ipv4_op);
4536 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4537 nf_unregister_hook(&selinux_ipv6_op);
4542 #else /* CONFIG_SECURITY_NETWORK && CONFIG_NETFILTER */
4544 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4545 #define selinux_nf_ip_exit()
4548 #endif /* CONFIG_SECURITY_NETWORK && CONFIG_NETFILTER */
4550 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4551 int selinux_disable(void)
4553 extern void exit_sel_fs(void);
4554 static int selinux_disabled = 0;
4556 if (ss_initialized) {
4557 /* Not permitted after initial policy load. */
4561 if (selinux_disabled) {
4562 /* Only do this once. */
4566 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
4568 selinux_disabled = 1;
4570 /* Reset security_ops to the secondary module, dummy or capability. */
4571 security_ops = secondary_ops;
4573 /* Unregister netfilter hooks. */
4574 selinux_nf_ip_exit();
4576 /* Unregister selinuxfs. */