2 * NSA Security-Enhanced Linux (SELinux) security module
4 * This file contains the SELinux hook function implementations.
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License version 2,
18 * as published by the Free Software Foundation.
21 #include <linux/module.h>
22 #include <linux/init.h>
23 #include <linux/kernel.h>
24 #include <linux/ptrace.h>
25 #include <linux/errno.h>
26 #include <linux/sched.h>
27 #include <linux/security.h>
28 #include <linux/xattr.h>
29 #include <linux/capability.h>
30 #include <linux/unistd.h>
32 #include <linux/mman.h>
33 #include <linux/slab.h>
34 #include <linux/pagemap.h>
35 #include <linux/swap.h>
36 #include <linux/smp_lock.h>
37 #include <linux/spinlock.h>
38 #include <linux/syscalls.h>
39 #include <linux/file.h>
40 #include <linux/namei.h>
41 #include <linux/mount.h>
42 #include <linux/ext2_fs.h>
43 #include <linux/proc_fs.h>
45 #include <linux/netfilter_ipv4.h>
46 #include <linux/netfilter_ipv6.h>
47 #include <linux/tty.h>
49 #include <net/ip.h> /* for sysctl_local_port_range[] */
50 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
51 #include <asm/uaccess.h>
52 #include <asm/semaphore.h>
53 #include <asm/ioctls.h>
54 #include <linux/bitops.h>
55 #include <linux/interrupt.h>
56 #include <linux/netdevice.h> /* for network interface checks */
57 #include <linux/netlink.h>
58 #include <linux/tcp.h>
59 #include <linux/udp.h>
60 #include <linux/quota.h>
61 #include <linux/un.h> /* for Unix socket types */
62 #include <net/af_unix.h> /* for Unix socket types */
63 #include <linux/parser.h>
64 #include <linux/nfs_mount.h>
66 #include <linux/hugetlb.h>
67 #include <linux/personality.h>
68 #include <linux/sysctl.h>
69 #include <linux/audit.h>
70 #include <linux/string.h>
71 #include <linux/selinux.h>
78 #define XATTR_SELINUX_SUFFIX "selinux"
79 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
81 extern unsigned int policydb_loaded_version;
82 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
83 extern int selinux_compat_net;
85 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
86 int selinux_enforcing = 0;
88 static int __init enforcing_setup(char *str)
90 selinux_enforcing = simple_strtol(str,NULL,0);
93 __setup("enforcing=", enforcing_setup);
96 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
97 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
99 static int __init selinux_enabled_setup(char *str)
101 selinux_enabled = simple_strtol(str, NULL, 0);
104 __setup("selinux=", selinux_enabled_setup);
106 int selinux_enabled = 1;
109 /* Original (dummy) security module. */
110 static struct security_operations *original_ops = NULL;
112 /* Minimal support for a secondary security module,
113 just to allow the use of the dummy or capability modules.
114 The owlsm module can alternatively be used as a secondary
115 module as long as CONFIG_OWLSM_FD is not enabled. */
116 static struct security_operations *secondary_ops = NULL;
118 /* Lists of inode and superblock security structures initialized
119 before the policy was loaded. */
120 static LIST_HEAD(superblock_security_head);
121 static DEFINE_SPINLOCK(sb_security_lock);
123 static kmem_cache_t *sel_inode_cache;
125 /* Return security context for a given sid or just the context
126 length if the buffer is null or length is 0 */
127 static int selinux_getsecurity(u32 sid, void *buffer, size_t size)
133 rc = security_sid_to_context(sid, &context, &len);
137 if (!buffer || !size)
138 goto getsecurity_exit;
142 goto getsecurity_exit;
144 memcpy(buffer, context, len);
151 /* Allocate and free functions for each kind of security blob. */
153 static int task_alloc_security(struct task_struct *task)
155 struct task_security_struct *tsec;
157 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
162 tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
163 task->security = tsec;
168 static void task_free_security(struct task_struct *task)
170 struct task_security_struct *tsec = task->security;
171 task->security = NULL;
175 static int inode_alloc_security(struct inode *inode)
177 struct task_security_struct *tsec = current->security;
178 struct inode_security_struct *isec;
180 isec = kmem_cache_alloc(sel_inode_cache, SLAB_KERNEL);
184 memset(isec, 0, sizeof(*isec));
185 init_MUTEX(&isec->sem);
186 INIT_LIST_HEAD(&isec->list);
188 isec->sid = SECINITSID_UNLABELED;
189 isec->sclass = SECCLASS_FILE;
190 isec->task_sid = tsec->sid;
191 inode->i_security = isec;
196 static void inode_free_security(struct inode *inode)
198 struct inode_security_struct *isec = inode->i_security;
199 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
201 spin_lock(&sbsec->isec_lock);
202 if (!list_empty(&isec->list))
203 list_del_init(&isec->list);
204 spin_unlock(&sbsec->isec_lock);
206 inode->i_security = NULL;
207 kmem_cache_free(sel_inode_cache, isec);
210 static int file_alloc_security(struct file *file)
212 struct task_security_struct *tsec = current->security;
213 struct file_security_struct *fsec;
215 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
220 fsec->sid = tsec->sid;
221 fsec->fown_sid = tsec->sid;
222 file->f_security = fsec;
227 static void file_free_security(struct file *file)
229 struct file_security_struct *fsec = file->f_security;
230 file->f_security = NULL;
234 static int superblock_alloc_security(struct super_block *sb)
236 struct superblock_security_struct *sbsec;
238 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
242 init_MUTEX(&sbsec->sem);
243 INIT_LIST_HEAD(&sbsec->list);
244 INIT_LIST_HEAD(&sbsec->isec_head);
245 spin_lock_init(&sbsec->isec_lock);
247 sbsec->sid = SECINITSID_UNLABELED;
248 sbsec->def_sid = SECINITSID_FILE;
249 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
250 sb->s_security = sbsec;
255 static void superblock_free_security(struct super_block *sb)
257 struct superblock_security_struct *sbsec = sb->s_security;
259 spin_lock(&sb_security_lock);
260 if (!list_empty(&sbsec->list))
261 list_del_init(&sbsec->list);
262 spin_unlock(&sb_security_lock);
264 sb->s_security = NULL;
268 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
270 struct sk_security_struct *ssec;
272 if (family != PF_UNIX)
275 ssec = kzalloc(sizeof(*ssec), priority);
280 ssec->peer_sid = SECINITSID_UNLABELED;
281 sk->sk_security = ssec;
286 static void sk_free_security(struct sock *sk)
288 struct sk_security_struct *ssec = sk->sk_security;
290 if (sk->sk_family != PF_UNIX)
293 sk->sk_security = NULL;
297 /* The security server must be initialized before
298 any labeling or access decisions can be provided. */
299 extern int ss_initialized;
301 /* The file system's label must be initialized prior to use. */
303 static char *labeling_behaviors[6] = {
305 "uses transition SIDs",
307 "uses genfs_contexts",
308 "not configured for labeling",
309 "uses mountpoint labeling",
312 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
314 static inline int inode_doinit(struct inode *inode)
316 return inode_doinit_with_dentry(inode, NULL);
326 static match_table_t tokens = {
327 {Opt_context, "context=%s"},
328 {Opt_fscontext, "fscontext=%s"},
329 {Opt_defcontext, "defcontext=%s"},
330 {Opt_rootcontext, "rootcontext=%s"},
333 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
335 static int may_context_mount_sb_relabel(u32 sid,
336 struct superblock_security_struct *sbsec,
337 struct task_security_struct *tsec)
341 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
342 FILESYSTEM__RELABELFROM, NULL);
346 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
347 FILESYSTEM__RELABELTO, NULL);
351 static int may_context_mount_inode_relabel(u32 sid,
352 struct superblock_security_struct *sbsec,
353 struct task_security_struct *tsec)
356 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
357 FILESYSTEM__RELABELFROM, NULL);
361 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
362 FILESYSTEM__ASSOCIATE, NULL);
366 static int try_context_mount(struct super_block *sb, void *data)
368 char *context = NULL, *defcontext = NULL;
369 char *fscontext = NULL, *rootcontext = NULL;
372 int alloc = 0, rc = 0, seen = 0;
373 struct task_security_struct *tsec = current->security;
374 struct superblock_security_struct *sbsec = sb->s_security;
379 name = sb->s_type->name;
381 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
383 /* NFS we understand. */
384 if (!strcmp(name, "nfs")) {
385 struct nfs_mount_data *d = data;
387 if (d->version < NFS_MOUNT_VERSION)
391 context = d->context;
398 /* Standard string-based options. */
399 char *p, *options = data;
401 while ((p = strsep(&options, ",")) != NULL) {
403 substring_t args[MAX_OPT_ARGS];
408 token = match_token(p, tokens, args);
412 if (seen & (Opt_context|Opt_defcontext)) {
414 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
417 context = match_strdup(&args[0]);
428 if (seen & Opt_fscontext) {
430 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
433 fscontext = match_strdup(&args[0]);
440 seen |= Opt_fscontext;
443 case Opt_rootcontext:
444 if (seen & Opt_rootcontext) {
446 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
449 rootcontext = match_strdup(&args[0]);
456 seen |= Opt_rootcontext;
460 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
462 printk(KERN_WARNING "SELinux: "
463 "defcontext option is invalid "
464 "for this filesystem type\n");
467 if (seen & (Opt_context|Opt_defcontext)) {
469 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
472 defcontext = match_strdup(&args[0]);
479 seen |= Opt_defcontext;
484 printk(KERN_WARNING "SELinux: unknown mount "
495 /* sets the context of the superblock for the fs being mounted. */
497 rc = security_context_to_sid(fscontext, strlen(fscontext), &sid);
499 printk(KERN_WARNING "SELinux: security_context_to_sid"
500 "(%s) failed for (dev %s, type %s) errno=%d\n",
501 fscontext, sb->s_id, name, rc);
505 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
513 * Switch to using mount point labeling behavior.
514 * sets the label used on all file below the mountpoint, and will set
515 * the superblock context if not already set.
518 rc = security_context_to_sid(context, strlen(context), &sid);
520 printk(KERN_WARNING "SELinux: security_context_to_sid"
521 "(%s) failed for (dev %s, type %s) errno=%d\n",
522 context, sb->s_id, name, rc);
527 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
532 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
536 sbsec->mntpoint_sid = sid;
538 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
542 struct inode *inode = sb->s_root->d_inode;
543 struct inode_security_struct *isec = inode->i_security;
544 rc = security_context_to_sid(rootcontext, strlen(rootcontext), &sid);
546 printk(KERN_WARNING "SELinux: security_context_to_sid"
547 "(%s) failed for (dev %s, type %s) errno=%d\n",
548 rootcontext, sb->s_id, name, rc);
552 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
557 isec->initialized = 1;
561 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
563 printk(KERN_WARNING "SELinux: security_context_to_sid"
564 "(%s) failed for (dev %s, type %s) errno=%d\n",
565 defcontext, sb->s_id, name, rc);
569 if (sid == sbsec->def_sid)
572 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
576 sbsec->def_sid = sid;
590 static int superblock_doinit(struct super_block *sb, void *data)
592 struct superblock_security_struct *sbsec = sb->s_security;
593 struct dentry *root = sb->s_root;
594 struct inode *inode = root->d_inode;
598 if (sbsec->initialized)
601 if (!ss_initialized) {
602 /* Defer initialization until selinux_complete_init,
603 after the initial policy is loaded and the security
604 server is ready to handle calls. */
605 spin_lock(&sb_security_lock);
606 if (list_empty(&sbsec->list))
607 list_add(&sbsec->list, &superblock_security_head);
608 spin_unlock(&sb_security_lock);
612 /* Determine the labeling behavior to use for this filesystem type. */
613 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
615 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
616 __FUNCTION__, sb->s_type->name, rc);
620 rc = try_context_mount(sb, data);
624 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
625 /* Make sure that the xattr handler exists and that no
626 error other than -ENODATA is returned by getxattr on
627 the root directory. -ENODATA is ok, as this may be
628 the first boot of the SELinux kernel before we have
629 assigned xattr values to the filesystem. */
630 if (!inode->i_op->getxattr) {
631 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
632 "xattr support\n", sb->s_id, sb->s_type->name);
636 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
637 if (rc < 0 && rc != -ENODATA) {
638 if (rc == -EOPNOTSUPP)
639 printk(KERN_WARNING "SELinux: (dev %s, type "
640 "%s) has no security xattr handler\n",
641 sb->s_id, sb->s_type->name);
643 printk(KERN_WARNING "SELinux: (dev %s, type "
644 "%s) getxattr errno %d\n", sb->s_id,
645 sb->s_type->name, -rc);
650 if (strcmp(sb->s_type->name, "proc") == 0)
653 sbsec->initialized = 1;
655 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
656 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
657 sb->s_id, sb->s_type->name);
660 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
661 sb->s_id, sb->s_type->name,
662 labeling_behaviors[sbsec->behavior-1]);
665 /* Initialize the root inode. */
666 rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
668 /* Initialize any other inodes associated with the superblock, e.g.
669 inodes created prior to initial policy load or inodes created
670 during get_sb by a pseudo filesystem that directly
672 spin_lock(&sbsec->isec_lock);
674 if (!list_empty(&sbsec->isec_head)) {
675 struct inode_security_struct *isec =
676 list_entry(sbsec->isec_head.next,
677 struct inode_security_struct, list);
678 struct inode *inode = isec->inode;
679 spin_unlock(&sbsec->isec_lock);
680 inode = igrab(inode);
682 if (!IS_PRIVATE (inode))
686 spin_lock(&sbsec->isec_lock);
687 list_del_init(&isec->list);
690 spin_unlock(&sbsec->isec_lock);
696 static inline u16 inode_mode_to_security_class(umode_t mode)
698 switch (mode & S_IFMT) {
700 return SECCLASS_SOCK_FILE;
702 return SECCLASS_LNK_FILE;
704 return SECCLASS_FILE;
706 return SECCLASS_BLK_FILE;
710 return SECCLASS_CHR_FILE;
712 return SECCLASS_FIFO_FILE;
716 return SECCLASS_FILE;
719 static inline int default_protocol_stream(int protocol)
721 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
724 static inline int default_protocol_dgram(int protocol)
726 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
729 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
736 return SECCLASS_UNIX_STREAM_SOCKET;
738 return SECCLASS_UNIX_DGRAM_SOCKET;
745 if (default_protocol_stream(protocol))
746 return SECCLASS_TCP_SOCKET;
748 return SECCLASS_RAWIP_SOCKET;
750 if (default_protocol_dgram(protocol))
751 return SECCLASS_UDP_SOCKET;
753 return SECCLASS_RAWIP_SOCKET;
755 return SECCLASS_RAWIP_SOCKET;
761 return SECCLASS_NETLINK_ROUTE_SOCKET;
762 case NETLINK_FIREWALL:
763 return SECCLASS_NETLINK_FIREWALL_SOCKET;
764 case NETLINK_INET_DIAG:
765 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
767 return SECCLASS_NETLINK_NFLOG_SOCKET;
769 return SECCLASS_NETLINK_XFRM_SOCKET;
770 case NETLINK_SELINUX:
771 return SECCLASS_NETLINK_SELINUX_SOCKET;
773 return SECCLASS_NETLINK_AUDIT_SOCKET;
775 return SECCLASS_NETLINK_IP6FW_SOCKET;
776 case NETLINK_DNRTMSG:
777 return SECCLASS_NETLINK_DNRT_SOCKET;
778 case NETLINK_KOBJECT_UEVENT:
779 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
781 return SECCLASS_NETLINK_SOCKET;
784 return SECCLASS_PACKET_SOCKET;
786 return SECCLASS_KEY_SOCKET;
788 return SECCLASS_APPLETALK_SOCKET;
791 return SECCLASS_SOCKET;
794 #ifdef CONFIG_PROC_FS
795 static int selinux_proc_get_sid(struct proc_dir_entry *de,
800 char *buffer, *path, *end;
802 buffer = (char*)__get_free_page(GFP_KERNEL);
812 while (de && de != de->parent) {
813 buflen -= de->namelen + 1;
817 memcpy(end, de->name, de->namelen);
822 rc = security_genfs_sid("proc", path, tclass, sid);
823 free_page((unsigned long)buffer);
827 static int selinux_proc_get_sid(struct proc_dir_entry *de,
835 /* The inode's security attributes must be initialized before first use. */
836 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
838 struct superblock_security_struct *sbsec = NULL;
839 struct inode_security_struct *isec = inode->i_security;
841 struct dentry *dentry;
842 #define INITCONTEXTLEN 255
843 char *context = NULL;
848 if (isec->initialized)
853 if (isec->initialized)
856 sbsec = inode->i_sb->s_security;
857 if (!sbsec->initialized) {
858 /* Defer initialization until selinux_complete_init,
859 after the initial policy is loaded and the security
860 server is ready to handle calls. */
861 spin_lock(&sbsec->isec_lock);
862 if (list_empty(&isec->list))
863 list_add(&isec->list, &sbsec->isec_head);
864 spin_unlock(&sbsec->isec_lock);
868 switch (sbsec->behavior) {
869 case SECURITY_FS_USE_XATTR:
870 if (!inode->i_op->getxattr) {
871 isec->sid = sbsec->def_sid;
875 /* Need a dentry, since the xattr API requires one.
876 Life would be simpler if we could just pass the inode. */
878 /* Called from d_instantiate or d_splice_alias. */
879 dentry = dget(opt_dentry);
881 /* Called from selinux_complete_init, try to find a dentry. */
882 dentry = d_find_alias(inode);
885 printk(KERN_WARNING "%s: no dentry for dev=%s "
886 "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
891 len = INITCONTEXTLEN;
892 context = kmalloc(len, GFP_KERNEL);
898 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
901 /* Need a larger buffer. Query for the right size. */
902 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
910 context = kmalloc(len, GFP_KERNEL);
916 rc = inode->i_op->getxattr(dentry,
922 if (rc != -ENODATA) {
923 printk(KERN_WARNING "%s: getxattr returned "
924 "%d for dev=%s ino=%ld\n", __FUNCTION__,
925 -rc, inode->i_sb->s_id, inode->i_ino);
929 /* Map ENODATA to the default file SID */
930 sid = sbsec->def_sid;
933 rc = security_context_to_sid_default(context, rc, &sid,
936 printk(KERN_WARNING "%s: context_to_sid(%s) "
937 "returned %d for dev=%s ino=%ld\n",
938 __FUNCTION__, context, -rc,
939 inode->i_sb->s_id, inode->i_ino);
941 /* Leave with the unlabeled SID */
949 case SECURITY_FS_USE_TASK:
950 isec->sid = isec->task_sid;
952 case SECURITY_FS_USE_TRANS:
953 /* Default to the fs SID. */
954 isec->sid = sbsec->sid;
956 /* Try to obtain a transition SID. */
957 isec->sclass = inode_mode_to_security_class(inode->i_mode);
958 rc = security_transition_sid(isec->task_sid,
966 case SECURITY_FS_USE_MNTPOINT:
967 isec->sid = sbsec->mntpoint_sid;
970 /* Default to the fs superblock SID. */
971 isec->sid = sbsec->sid;
974 struct proc_inode *proci = PROC_I(inode);
976 isec->sclass = inode_mode_to_security_class(inode->i_mode);
977 rc = selinux_proc_get_sid(proci->pde,
988 isec->initialized = 1;
991 if (isec->sclass == SECCLASS_FILE)
992 isec->sclass = inode_mode_to_security_class(inode->i_mode);
999 /* Convert a Linux signal to an access vector. */
1000 static inline u32 signal_to_av(int sig)
1006 /* Commonly granted from child to parent. */
1007 perm = PROCESS__SIGCHLD;
1010 /* Cannot be caught or ignored */
1011 perm = PROCESS__SIGKILL;
1014 /* Cannot be caught or ignored */
1015 perm = PROCESS__SIGSTOP;
1018 /* All other signals. */
1019 perm = PROCESS__SIGNAL;
1026 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1027 fork check, ptrace check, etc. */
1028 static int task_has_perm(struct task_struct *tsk1,
1029 struct task_struct *tsk2,
1032 struct task_security_struct *tsec1, *tsec2;
1034 tsec1 = tsk1->security;
1035 tsec2 = tsk2->security;
1036 return avc_has_perm(tsec1->sid, tsec2->sid,
1037 SECCLASS_PROCESS, perms, NULL);
1040 /* Check whether a task is allowed to use a capability. */
1041 static int task_has_capability(struct task_struct *tsk,
1044 struct task_security_struct *tsec;
1045 struct avc_audit_data ad;
1047 tsec = tsk->security;
1049 AVC_AUDIT_DATA_INIT(&ad,CAP);
1053 return avc_has_perm(tsec->sid, tsec->sid,
1054 SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
1057 /* Check whether a task is allowed to use a system operation. */
1058 static int task_has_system(struct task_struct *tsk,
1061 struct task_security_struct *tsec;
1063 tsec = tsk->security;
1065 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1066 SECCLASS_SYSTEM, perms, NULL);
1069 /* Check whether a task has a particular permission to an inode.
1070 The 'adp' parameter is optional and allows other audit
1071 data to be passed (e.g. the dentry). */
1072 static int inode_has_perm(struct task_struct *tsk,
1073 struct inode *inode,
1075 struct avc_audit_data *adp)
1077 struct task_security_struct *tsec;
1078 struct inode_security_struct *isec;
1079 struct avc_audit_data ad;
1081 tsec = tsk->security;
1082 isec = inode->i_security;
1086 AVC_AUDIT_DATA_INIT(&ad, FS);
1087 ad.u.fs.inode = inode;
1090 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1093 /* Same as inode_has_perm, but pass explicit audit data containing
1094 the dentry to help the auditing code to more easily generate the
1095 pathname if needed. */
1096 static inline int dentry_has_perm(struct task_struct *tsk,
1097 struct vfsmount *mnt,
1098 struct dentry *dentry,
1101 struct inode *inode = dentry->d_inode;
1102 struct avc_audit_data ad;
1103 AVC_AUDIT_DATA_INIT(&ad,FS);
1105 ad.u.fs.dentry = dentry;
1106 return inode_has_perm(tsk, inode, av, &ad);
1109 /* Check whether a task can use an open file descriptor to
1110 access an inode in a given way. Check access to the
1111 descriptor itself, and then use dentry_has_perm to
1112 check a particular permission to the file.
1113 Access to the descriptor is implicitly granted if it
1114 has the same SID as the process. If av is zero, then
1115 access to the file is not checked, e.g. for cases
1116 where only the descriptor is affected like seek. */
1117 static int file_has_perm(struct task_struct *tsk,
1121 struct task_security_struct *tsec = tsk->security;
1122 struct file_security_struct *fsec = file->f_security;
1123 struct vfsmount *mnt = file->f_vfsmnt;
1124 struct dentry *dentry = file->f_dentry;
1125 struct inode *inode = dentry->d_inode;
1126 struct avc_audit_data ad;
1129 AVC_AUDIT_DATA_INIT(&ad, FS);
1131 ad.u.fs.dentry = dentry;
1133 if (tsec->sid != fsec->sid) {
1134 rc = avc_has_perm(tsec->sid, fsec->sid,
1142 /* av is zero if only checking access to the descriptor. */
1144 return inode_has_perm(tsk, inode, av, &ad);
1149 /* Check whether a task can create a file. */
1150 static int may_create(struct inode *dir,
1151 struct dentry *dentry,
1154 struct task_security_struct *tsec;
1155 struct inode_security_struct *dsec;
1156 struct superblock_security_struct *sbsec;
1158 struct avc_audit_data ad;
1161 tsec = current->security;
1162 dsec = dir->i_security;
1163 sbsec = dir->i_sb->s_security;
1165 AVC_AUDIT_DATA_INIT(&ad, FS);
1166 ad.u.fs.dentry = dentry;
1168 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1169 DIR__ADD_NAME | DIR__SEARCH,
1174 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1175 newsid = tsec->create_sid;
1177 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1183 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1187 return avc_has_perm(newsid, sbsec->sid,
1188 SECCLASS_FILESYSTEM,
1189 FILESYSTEM__ASSOCIATE, &ad);
1192 /* Check whether a task can create a key. */
1193 static int may_create_key(u32 ksid,
1194 struct task_struct *ctx)
1196 struct task_security_struct *tsec;
1198 tsec = ctx->security;
1200 return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1204 #define MAY_UNLINK 1
1207 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1208 static int may_link(struct inode *dir,
1209 struct dentry *dentry,
1213 struct task_security_struct *tsec;
1214 struct inode_security_struct *dsec, *isec;
1215 struct avc_audit_data ad;
1219 tsec = current->security;
1220 dsec = dir->i_security;
1221 isec = dentry->d_inode->i_security;
1223 AVC_AUDIT_DATA_INIT(&ad, FS);
1224 ad.u.fs.dentry = dentry;
1227 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1228 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1243 printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
1247 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1251 static inline int may_rename(struct inode *old_dir,
1252 struct dentry *old_dentry,
1253 struct inode *new_dir,
1254 struct dentry *new_dentry)
1256 struct task_security_struct *tsec;
1257 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1258 struct avc_audit_data ad;
1260 int old_is_dir, new_is_dir;
1263 tsec = current->security;
1264 old_dsec = old_dir->i_security;
1265 old_isec = old_dentry->d_inode->i_security;
1266 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1267 new_dsec = new_dir->i_security;
1269 AVC_AUDIT_DATA_INIT(&ad, FS);
1271 ad.u.fs.dentry = old_dentry;
1272 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1273 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1276 rc = avc_has_perm(tsec->sid, old_isec->sid,
1277 old_isec->sclass, FILE__RENAME, &ad);
1280 if (old_is_dir && new_dir != old_dir) {
1281 rc = avc_has_perm(tsec->sid, old_isec->sid,
1282 old_isec->sclass, DIR__REPARENT, &ad);
1287 ad.u.fs.dentry = new_dentry;
1288 av = DIR__ADD_NAME | DIR__SEARCH;
1289 if (new_dentry->d_inode)
1290 av |= DIR__REMOVE_NAME;
1291 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1294 if (new_dentry->d_inode) {
1295 new_isec = new_dentry->d_inode->i_security;
1296 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1297 rc = avc_has_perm(tsec->sid, new_isec->sid,
1299 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1307 /* Check whether a task can perform a filesystem operation. */
1308 static int superblock_has_perm(struct task_struct *tsk,
1309 struct super_block *sb,
1311 struct avc_audit_data *ad)
1313 struct task_security_struct *tsec;
1314 struct superblock_security_struct *sbsec;
1316 tsec = tsk->security;
1317 sbsec = sb->s_security;
1318 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1322 /* Convert a Linux mode and permission mask to an access vector. */
1323 static inline u32 file_mask_to_av(int mode, int mask)
1327 if ((mode & S_IFMT) != S_IFDIR) {
1328 if (mask & MAY_EXEC)
1329 av |= FILE__EXECUTE;
1330 if (mask & MAY_READ)
1333 if (mask & MAY_APPEND)
1335 else if (mask & MAY_WRITE)
1339 if (mask & MAY_EXEC)
1341 if (mask & MAY_WRITE)
1343 if (mask & MAY_READ)
1350 /* Convert a Linux file to an access vector. */
1351 static inline u32 file_to_av(struct file *file)
1355 if (file->f_mode & FMODE_READ)
1357 if (file->f_mode & FMODE_WRITE) {
1358 if (file->f_flags & O_APPEND)
1367 /* Set an inode's SID to a specified value. */
1368 static int inode_security_set_sid(struct inode *inode, u32 sid)
1370 struct inode_security_struct *isec = inode->i_security;
1371 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
1373 if (!sbsec->initialized) {
1374 /* Defer initialization to selinux_complete_init. */
1379 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1381 isec->initialized = 1;
1386 /* Hook functions begin here. */
1388 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1390 struct task_security_struct *psec = parent->security;
1391 struct task_security_struct *csec = child->security;
1394 rc = secondary_ops->ptrace(parent,child);
1398 rc = task_has_perm(parent, child, PROCESS__PTRACE);
1399 /* Save the SID of the tracing process for later use in apply_creds. */
1400 if (!(child->ptrace & PT_PTRACED) && !rc)
1401 csec->ptrace_sid = psec->sid;
1405 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1406 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1410 error = task_has_perm(current, target, PROCESS__GETCAP);
1414 return secondary_ops->capget(target, effective, inheritable, permitted);
1417 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1418 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1422 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1426 return task_has_perm(current, target, PROCESS__SETCAP);
1429 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1430 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1432 secondary_ops->capset_set(target, effective, inheritable, permitted);
1435 static int selinux_capable(struct task_struct *tsk, int cap)
1439 rc = secondary_ops->capable(tsk, cap);
1443 return task_has_capability(tsk,cap);
1446 static int selinux_sysctl(ctl_table *table, int op)
1450 struct task_security_struct *tsec;
1454 rc = secondary_ops->sysctl(table, op);
1458 tsec = current->security;
1460 rc = selinux_proc_get_sid(table->de, (op == 001) ?
1461 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1463 /* Default to the well-defined sysctl SID. */
1464 tsid = SECINITSID_SYSCTL;
1467 /* The op values are "defined" in sysctl.c, thereby creating
1468 * a bad coupling between this module and sysctl.c */
1470 error = avc_has_perm(tsec->sid, tsid,
1471 SECCLASS_DIR, DIR__SEARCH, NULL);
1479 error = avc_has_perm(tsec->sid, tsid,
1480 SECCLASS_FILE, av, NULL);
1486 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1499 rc = superblock_has_perm(current,
1501 FILESYSTEM__QUOTAMOD, NULL);
1506 rc = superblock_has_perm(current,
1508 FILESYSTEM__QUOTAGET, NULL);
1511 rc = 0; /* let the kernel handle invalid cmds */
1517 static int selinux_quota_on(struct dentry *dentry)
1519 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1522 static int selinux_syslog(int type)
1526 rc = secondary_ops->syslog(type);
1531 case 3: /* Read last kernel messages */
1532 case 10: /* Return size of the log buffer */
1533 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1535 case 6: /* Disable logging to console */
1536 case 7: /* Enable logging to console */
1537 case 8: /* Set level of messages printed to console */
1538 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1540 case 0: /* Close log */
1541 case 1: /* Open log */
1542 case 2: /* Read from log */
1543 case 4: /* Read/clear last kernel messages */
1544 case 5: /* Clear ring buffer */
1546 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1553 * Check that a process has enough memory to allocate a new virtual
1554 * mapping. 0 means there is enough memory for the allocation to
1555 * succeed and -ENOMEM implies there is not.
1557 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1558 * if the capability is granted, but __vm_enough_memory requires 1 if
1559 * the capability is granted.
1561 * Do not audit the selinux permission check, as this is applied to all
1562 * processes that allocate mappings.
1564 static int selinux_vm_enough_memory(long pages)
1566 int rc, cap_sys_admin = 0;
1567 struct task_security_struct *tsec = current->security;
1569 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1571 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1572 SECCLASS_CAPABILITY,
1573 CAP_TO_MASK(CAP_SYS_ADMIN),
1579 return __vm_enough_memory(pages, cap_sys_admin);
1582 /* binprm security operations */
1584 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1586 struct bprm_security_struct *bsec;
1588 bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1593 bsec->sid = SECINITSID_UNLABELED;
1596 bprm->security = bsec;
1600 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1602 struct task_security_struct *tsec;
1603 struct inode *inode = bprm->file->f_dentry->d_inode;
1604 struct inode_security_struct *isec;
1605 struct bprm_security_struct *bsec;
1607 struct avc_audit_data ad;
1610 rc = secondary_ops->bprm_set_security(bprm);
1614 bsec = bprm->security;
1619 tsec = current->security;
1620 isec = inode->i_security;
1622 /* Default to the current task SID. */
1623 bsec->sid = tsec->sid;
1625 /* Reset fs, key, and sock SIDs on execve. */
1626 tsec->create_sid = 0;
1627 tsec->keycreate_sid = 0;
1628 tsec->sockcreate_sid = 0;
1630 if (tsec->exec_sid) {
1631 newsid = tsec->exec_sid;
1632 /* Reset exec SID on execve. */
1635 /* Check for a default transition on this program. */
1636 rc = security_transition_sid(tsec->sid, isec->sid,
1637 SECCLASS_PROCESS, &newsid);
1642 AVC_AUDIT_DATA_INIT(&ad, FS);
1643 ad.u.fs.mnt = bprm->file->f_vfsmnt;
1644 ad.u.fs.dentry = bprm->file->f_dentry;
1646 if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
1649 if (tsec->sid == newsid) {
1650 rc = avc_has_perm(tsec->sid, isec->sid,
1651 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1655 /* Check permissions for the transition. */
1656 rc = avc_has_perm(tsec->sid, newsid,
1657 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1661 rc = avc_has_perm(newsid, isec->sid,
1662 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1666 /* Clear any possibly unsafe personality bits on exec: */
1667 current->personality &= ~PER_CLEAR_ON_SETID;
1669 /* Set the security field to the new SID. */
1677 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1679 return secondary_ops->bprm_check_security(bprm);
1683 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1685 struct task_security_struct *tsec = current->security;
1688 if (tsec->osid != tsec->sid) {
1689 /* Enable secure mode for SIDs transitions unless
1690 the noatsecure permission is granted between
1691 the two SIDs, i.e. ahp returns 0. */
1692 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1694 PROCESS__NOATSECURE, NULL);
1697 return (atsecure || secondary_ops->bprm_secureexec(bprm));
1700 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1702 kfree(bprm->security);
1703 bprm->security = NULL;
1706 extern struct vfsmount *selinuxfs_mount;
1707 extern struct dentry *selinux_null;
1709 /* Derived from fs/exec.c:flush_old_files. */
1710 static inline void flush_unauthorized_files(struct files_struct * files)
1712 struct avc_audit_data ad;
1713 struct file *file, *devnull = NULL;
1714 struct tty_struct *tty = current->signal->tty;
1715 struct fdtable *fdt;
1720 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
1722 /* Revalidate access to controlling tty.
1723 Use inode_has_perm on the tty inode directly rather
1724 than using file_has_perm, as this particular open
1725 file may belong to another process and we are only
1726 interested in the inode-based check here. */
1727 struct inode *inode = file->f_dentry->d_inode;
1728 if (inode_has_perm(current, inode,
1729 FILE__READ | FILE__WRITE, NULL)) {
1730 /* Reset controlling tty. */
1731 current->signal->tty = NULL;
1732 current->signal->tty_old_pgrp = 0;
1738 /* Revalidate access to inherited open files. */
1740 AVC_AUDIT_DATA_INIT(&ad,FS);
1742 spin_lock(&files->file_lock);
1744 unsigned long set, i;
1749 fdt = files_fdtable(files);
1750 if (i >= fdt->max_fds || i >= fdt->max_fdset)
1752 set = fdt->open_fds->fds_bits[j];
1755 spin_unlock(&files->file_lock);
1756 for ( ; set ; i++,set >>= 1) {
1761 if (file_has_perm(current,
1763 file_to_av(file))) {
1765 fd = get_unused_fd();
1775 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1782 fd_install(fd, devnull);
1787 spin_lock(&files->file_lock);
1790 spin_unlock(&files->file_lock);
1793 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1795 struct task_security_struct *tsec;
1796 struct bprm_security_struct *bsec;
1800 secondary_ops->bprm_apply_creds(bprm, unsafe);
1802 tsec = current->security;
1804 bsec = bprm->security;
1807 tsec->osid = tsec->sid;
1809 if (tsec->sid != sid) {
1810 /* Check for shared state. If not ok, leave SID
1811 unchanged and kill. */
1812 if (unsafe & LSM_UNSAFE_SHARE) {
1813 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1814 PROCESS__SHARE, NULL);
1821 /* Check for ptracing, and update the task SID if ok.
1822 Otherwise, leave SID unchanged and kill. */
1823 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1824 rc = avc_has_perm(tsec->ptrace_sid, sid,
1825 SECCLASS_PROCESS, PROCESS__PTRACE,
1837 * called after apply_creds without the task lock held
1839 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1841 struct task_security_struct *tsec;
1842 struct rlimit *rlim, *initrlim;
1843 struct itimerval itimer;
1844 struct bprm_security_struct *bsec;
1847 tsec = current->security;
1848 bsec = bprm->security;
1851 force_sig_specific(SIGKILL, current);
1854 if (tsec->osid == tsec->sid)
1857 /* Close files for which the new task SID is not authorized. */
1858 flush_unauthorized_files(current->files);
1860 /* Check whether the new SID can inherit signal state
1861 from the old SID. If not, clear itimers to avoid
1862 subsequent signal generation and flush and unblock
1863 signals. This must occur _after_ the task SID has
1864 been updated so that any kill done after the flush
1865 will be checked against the new SID. */
1866 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1867 PROCESS__SIGINH, NULL);
1869 memset(&itimer, 0, sizeof itimer);
1870 for (i = 0; i < 3; i++)
1871 do_setitimer(i, &itimer, NULL);
1872 flush_signals(current);
1873 spin_lock_irq(¤t->sighand->siglock);
1874 flush_signal_handlers(current, 1);
1875 sigemptyset(¤t->blocked);
1876 recalc_sigpending();
1877 spin_unlock_irq(¤t->sighand->siglock);
1880 /* Check whether the new SID can inherit resource limits
1881 from the old SID. If not, reset all soft limits to
1882 the lower of the current task's hard limit and the init
1883 task's soft limit. Note that the setting of hard limits
1884 (even to lower them) can be controlled by the setrlimit
1885 check. The inclusion of the init task's soft limit into
1886 the computation is to avoid resetting soft limits higher
1887 than the default soft limit for cases where the default
1888 is lower than the hard limit, e.g. RLIMIT_CORE or
1890 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1891 PROCESS__RLIMITINH, NULL);
1893 for (i = 0; i < RLIM_NLIMITS; i++) {
1894 rlim = current->signal->rlim + i;
1895 initrlim = init_task.signal->rlim+i;
1896 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1898 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1900 * This will cause RLIMIT_CPU calculations
1903 current->it_prof_expires = jiffies_to_cputime(1);
1907 /* Wake up the parent if it is waiting so that it can
1908 recheck wait permission to the new task SID. */
1909 wake_up_interruptible(¤t->parent->signal->wait_chldexit);
1912 /* superblock security operations */
1914 static int selinux_sb_alloc_security(struct super_block *sb)
1916 return superblock_alloc_security(sb);
1919 static void selinux_sb_free_security(struct super_block *sb)
1921 superblock_free_security(sb);
1924 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1929 return !memcmp(prefix, option, plen);
1932 static inline int selinux_option(char *option, int len)
1934 return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1935 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1936 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len) ||
1937 match_prefix("rootcontext=", sizeof("rootcontext=")-1, option, len));
1940 static inline void take_option(char **to, char *from, int *first, int len)
1948 memcpy(*to, from, len);
1952 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
1954 int fnosec, fsec, rc = 0;
1955 char *in_save, *in_curr, *in_end;
1956 char *sec_curr, *nosec_save, *nosec;
1961 /* Binary mount data: just copy */
1962 if (type->fs_flags & FS_BINARY_MOUNTDATA) {
1963 copy_page(sec_curr, in_curr);
1967 nosec = (char *)get_zeroed_page(GFP_KERNEL);
1975 in_save = in_end = orig;
1978 if (*in_end == ',' || *in_end == '\0') {
1979 int len = in_end - in_curr;
1981 if (selinux_option(in_curr, len))
1982 take_option(&sec_curr, in_curr, &fsec, len);
1984 take_option(&nosec, in_curr, &fnosec, len);
1986 in_curr = in_end + 1;
1988 } while (*in_end++);
1990 strcpy(in_save, nosec_save);
1991 free_page((unsigned long)nosec_save);
1996 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
1998 struct avc_audit_data ad;
2001 rc = superblock_doinit(sb, data);
2005 AVC_AUDIT_DATA_INIT(&ad,FS);
2006 ad.u.fs.dentry = sb->s_root;
2007 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2010 static int selinux_sb_statfs(struct dentry *dentry)
2012 struct avc_audit_data ad;
2014 AVC_AUDIT_DATA_INIT(&ad,FS);
2015 ad.u.fs.dentry = dentry->d_sb->s_root;
2016 return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2019 static int selinux_mount(char * dev_name,
2020 struct nameidata *nd,
2022 unsigned long flags,
2027 rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2031 if (flags & MS_REMOUNT)
2032 return superblock_has_perm(current, nd->mnt->mnt_sb,
2033 FILESYSTEM__REMOUNT, NULL);
2035 return dentry_has_perm(current, nd->mnt, nd->dentry,
2039 static int selinux_umount(struct vfsmount *mnt, int flags)
2043 rc = secondary_ops->sb_umount(mnt, flags);
2047 return superblock_has_perm(current,mnt->mnt_sb,
2048 FILESYSTEM__UNMOUNT,NULL);
2051 /* inode security operations */
2053 static int selinux_inode_alloc_security(struct inode *inode)
2055 return inode_alloc_security(inode);
2058 static void selinux_inode_free_security(struct inode *inode)
2060 inode_free_security(inode);
2063 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2064 char **name, void **value,
2067 struct task_security_struct *tsec;
2068 struct inode_security_struct *dsec;
2069 struct superblock_security_struct *sbsec;
2072 char *namep = NULL, *context;
2074 tsec = current->security;
2075 dsec = dir->i_security;
2076 sbsec = dir->i_sb->s_security;
2078 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2079 newsid = tsec->create_sid;
2081 rc = security_transition_sid(tsec->sid, dsec->sid,
2082 inode_mode_to_security_class(inode->i_mode),
2085 printk(KERN_WARNING "%s: "
2086 "security_transition_sid failed, rc=%d (dev=%s "
2089 -rc, inode->i_sb->s_id, inode->i_ino);
2094 inode_security_set_sid(inode, newsid);
2096 if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2100 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
2107 rc = security_sid_to_context(newsid, &context, &clen);
2119 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2121 return may_create(dir, dentry, SECCLASS_FILE);
2124 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2128 rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2131 return may_link(dir, old_dentry, MAY_LINK);
2134 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2138 rc = secondary_ops->inode_unlink(dir, dentry);
2141 return may_link(dir, dentry, MAY_UNLINK);
2144 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2146 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2149 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2151 return may_create(dir, dentry, SECCLASS_DIR);
2154 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2156 return may_link(dir, dentry, MAY_RMDIR);
2159 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2163 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2167 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2170 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2171 struct inode *new_inode, struct dentry *new_dentry)
2173 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2176 static int selinux_inode_readlink(struct dentry *dentry)
2178 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2181 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2185 rc = secondary_ops->inode_follow_link(dentry,nameidata);
2188 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2191 static int selinux_inode_permission(struct inode *inode, int mask,
2192 struct nameidata *nd)
2196 rc = secondary_ops->inode_permission(inode, mask, nd);
2201 /* No permission to check. Existence test. */
2205 return inode_has_perm(current, inode,
2206 file_mask_to_av(inode->i_mode, mask), NULL);
2209 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2213 rc = secondary_ops->inode_setattr(dentry, iattr);
2217 if (iattr->ia_valid & ATTR_FORCE)
2220 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2221 ATTR_ATIME_SET | ATTR_MTIME_SET))
2222 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2224 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2227 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2229 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2232 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2234 struct task_security_struct *tsec = current->security;
2235 struct inode *inode = dentry->d_inode;
2236 struct inode_security_struct *isec = inode->i_security;
2237 struct superblock_security_struct *sbsec;
2238 struct avc_audit_data ad;
2242 if (strcmp(name, XATTR_NAME_SELINUX)) {
2243 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2244 sizeof XATTR_SECURITY_PREFIX - 1) &&
2245 !capable(CAP_SYS_ADMIN)) {
2246 /* A different attribute in the security namespace.
2247 Restrict to administrator. */
2251 /* Not an attribute we recognize, so just check the
2252 ordinary setattr permission. */
2253 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2256 sbsec = inode->i_sb->s_security;
2257 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2260 if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2263 AVC_AUDIT_DATA_INIT(&ad,FS);
2264 ad.u.fs.dentry = dentry;
2266 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2267 FILE__RELABELFROM, &ad);
2271 rc = security_context_to_sid(value, size, &newsid);
2275 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2276 FILE__RELABELTO, &ad);
2280 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2285 return avc_has_perm(newsid,
2287 SECCLASS_FILESYSTEM,
2288 FILESYSTEM__ASSOCIATE,
2292 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2293 void *value, size_t size, int flags)
2295 struct inode *inode = dentry->d_inode;
2296 struct inode_security_struct *isec = inode->i_security;
2300 if (strcmp(name, XATTR_NAME_SELINUX)) {
2301 /* Not an attribute we recognize, so nothing to do. */
2305 rc = security_context_to_sid(value, size, &newsid);
2307 printk(KERN_WARNING "%s: unable to obtain SID for context "
2308 "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2316 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2318 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2321 static int selinux_inode_listxattr (struct dentry *dentry)
2323 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2326 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2328 if (strcmp(name, XATTR_NAME_SELINUX)) {
2329 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2330 sizeof XATTR_SECURITY_PREFIX - 1) &&
2331 !capable(CAP_SYS_ADMIN)) {
2332 /* A different attribute in the security namespace.
2333 Restrict to administrator. */
2337 /* Not an attribute we recognize, so just check the
2338 ordinary setattr permission. Might want a separate
2339 permission for removexattr. */
2340 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2343 /* No one is allowed to remove a SELinux security label.
2344 You can change the label, but all data must be labeled. */
2348 static const char *selinux_inode_xattr_getsuffix(void)
2350 return XATTR_SELINUX_SUFFIX;
2354 * Copy the in-core inode security context value to the user. If the
2355 * getxattr() prior to this succeeded, check to see if we need to
2356 * canonicalize the value to be finally returned to the user.
2358 * Permission check is handled by selinux_inode_getxattr hook.
2360 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void *buffer, size_t size, int err)
2362 struct inode_security_struct *isec = inode->i_security;
2364 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2367 return selinux_getsecurity(isec->sid, buffer, size);
2370 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2371 const void *value, size_t size, int flags)
2373 struct inode_security_struct *isec = inode->i_security;
2377 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2380 if (!value || !size)
2383 rc = security_context_to_sid((void*)value, size, &newsid);
2391 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2393 const int len = sizeof(XATTR_NAME_SELINUX);
2394 if (buffer && len <= buffer_size)
2395 memcpy(buffer, XATTR_NAME_SELINUX, len);
2399 /* file security operations */
2401 static int selinux_file_permission(struct file *file, int mask)
2403 struct inode *inode = file->f_dentry->d_inode;
2406 /* No permission to check. Existence test. */
2410 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2411 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2414 return file_has_perm(current, file,
2415 file_mask_to_av(inode->i_mode, mask));
2418 static int selinux_file_alloc_security(struct file *file)
2420 return file_alloc_security(file);
2423 static void selinux_file_free_security(struct file *file)
2425 file_free_security(file);
2428 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2440 case EXT2_IOC_GETFLAGS:
2442 case EXT2_IOC_GETVERSION:
2443 error = file_has_perm(current, file, FILE__GETATTR);
2446 case EXT2_IOC_SETFLAGS:
2448 case EXT2_IOC_SETVERSION:
2449 error = file_has_perm(current, file, FILE__SETATTR);
2452 /* sys_ioctl() checks */
2456 error = file_has_perm(current, file, 0);
2461 error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2464 /* default case assumes that the command will go
2465 * to the file's ioctl() function.
2468 error = file_has_perm(current, file, FILE__IOCTL);
2474 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2476 #ifndef CONFIG_PPC32
2477 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2479 * We are making executable an anonymous mapping or a
2480 * private file mapping that will also be writable.
2481 * This has an additional check.
2483 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2490 /* read access is always possible with a mapping */
2491 u32 av = FILE__READ;
2493 /* write access only matters if the mapping is shared */
2494 if (shared && (prot & PROT_WRITE))
2497 if (prot & PROT_EXEC)
2498 av |= FILE__EXECUTE;
2500 return file_has_perm(current, file, av);
2505 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2506 unsigned long prot, unsigned long flags)
2510 rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2514 if (selinux_checkreqprot)
2517 return file_map_prot_check(file, prot,
2518 (flags & MAP_TYPE) == MAP_SHARED);
2521 static int selinux_file_mprotect(struct vm_area_struct *vma,
2522 unsigned long reqprot,
2527 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2531 if (selinux_checkreqprot)
2534 #ifndef CONFIG_PPC32
2535 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2537 if (vma->vm_start >= vma->vm_mm->start_brk &&
2538 vma->vm_end <= vma->vm_mm->brk) {
2539 rc = task_has_perm(current, current,
2541 } else if (!vma->vm_file &&
2542 vma->vm_start <= vma->vm_mm->start_stack &&
2543 vma->vm_end >= vma->vm_mm->start_stack) {
2544 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2545 } else if (vma->vm_file && vma->anon_vma) {
2547 * We are making executable a file mapping that has
2548 * had some COW done. Since pages might have been
2549 * written, check ability to execute the possibly
2550 * modified content. This typically should only
2551 * occur for text relocations.
2553 rc = file_has_perm(current, vma->vm_file,
2561 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2564 static int selinux_file_lock(struct file *file, unsigned int cmd)
2566 return file_has_perm(current, file, FILE__LOCK);
2569 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2576 if (!file->f_dentry || !file->f_dentry->d_inode) {
2581 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2582 err = file_has_perm(current, file,FILE__WRITE);
2591 /* Just check FD__USE permission */
2592 err = file_has_perm(current, file, 0);
2597 #if BITS_PER_LONG == 32
2602 if (!file->f_dentry || !file->f_dentry->d_inode) {
2606 err = file_has_perm(current, file, FILE__LOCK);
2613 static int selinux_file_set_fowner(struct file *file)
2615 struct task_security_struct *tsec;
2616 struct file_security_struct *fsec;
2618 tsec = current->security;
2619 fsec = file->f_security;
2620 fsec->fown_sid = tsec->sid;
2625 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2626 struct fown_struct *fown, int signum)
2630 struct task_security_struct *tsec;
2631 struct file_security_struct *fsec;
2633 /* struct fown_struct is never outside the context of a struct file */
2634 file = (struct file *)((long)fown - offsetof(struct file,f_owner));
2636 tsec = tsk->security;
2637 fsec = file->f_security;
2640 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2642 perm = signal_to_av(signum);
2644 return avc_has_perm(fsec->fown_sid, tsec->sid,
2645 SECCLASS_PROCESS, perm, NULL);
2648 static int selinux_file_receive(struct file *file)
2650 return file_has_perm(current, file, file_to_av(file));
2653 /* task security operations */
2655 static int selinux_task_create(unsigned long clone_flags)
2659 rc = secondary_ops->task_create(clone_flags);
2663 return task_has_perm(current, current, PROCESS__FORK);
2666 static int selinux_task_alloc_security(struct task_struct *tsk)
2668 struct task_security_struct *tsec1, *tsec2;
2671 tsec1 = current->security;
2673 rc = task_alloc_security(tsk);
2676 tsec2 = tsk->security;
2678 tsec2->osid = tsec1->osid;
2679 tsec2->sid = tsec1->sid;
2681 /* Retain the exec, fs, key, and sock SIDs across fork */
2682 tsec2->exec_sid = tsec1->exec_sid;
2683 tsec2->create_sid = tsec1->create_sid;
2684 tsec2->keycreate_sid = tsec1->keycreate_sid;
2685 tsec2->sockcreate_sid = tsec1->sockcreate_sid;
2687 /* Retain ptracer SID across fork, if any.
2688 This will be reset by the ptrace hook upon any
2689 subsequent ptrace_attach operations. */
2690 tsec2->ptrace_sid = tsec1->ptrace_sid;
2695 static void selinux_task_free_security(struct task_struct *tsk)
2697 task_free_security(tsk);
2700 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2702 /* Since setuid only affects the current process, and
2703 since the SELinux controls are not based on the Linux
2704 identity attributes, SELinux does not need to control
2705 this operation. However, SELinux does control the use
2706 of the CAP_SETUID and CAP_SETGID capabilities using the
2711 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2713 return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2716 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2718 /* See the comment for setuid above. */
2722 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2724 return task_has_perm(current, p, PROCESS__SETPGID);
2727 static int selinux_task_getpgid(struct task_struct *p)
2729 return task_has_perm(current, p, PROCESS__GETPGID);
2732 static int selinux_task_getsid(struct task_struct *p)
2734 return task_has_perm(current, p, PROCESS__GETSESSION);
2737 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
2739 selinux_get_task_sid(p, secid);
2742 static int selinux_task_setgroups(struct group_info *group_info)
2744 /* See the comment for setuid above. */
2748 static int selinux_task_setnice(struct task_struct *p, int nice)
2752 rc = secondary_ops->task_setnice(p, nice);
2756 return task_has_perm(current,p, PROCESS__SETSCHED);
2759 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
2761 return task_has_perm(current, p, PROCESS__SETSCHED);
2764 static int selinux_task_getioprio(struct task_struct *p)
2766 return task_has_perm(current, p, PROCESS__GETSCHED);
2769 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2771 struct rlimit *old_rlim = current->signal->rlim + resource;
2774 rc = secondary_ops->task_setrlimit(resource, new_rlim);
2778 /* Control the ability to change the hard limit (whether
2779 lowering or raising it), so that the hard limit can
2780 later be used as a safe reset point for the soft limit
2781 upon context transitions. See selinux_bprm_apply_creds. */
2782 if (old_rlim->rlim_max != new_rlim->rlim_max)
2783 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2788 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2790 return task_has_perm(current, p, PROCESS__SETSCHED);
2793 static int selinux_task_getscheduler(struct task_struct *p)
2795 return task_has_perm(current, p, PROCESS__GETSCHED);
2798 static int selinux_task_movememory(struct task_struct *p)
2800 return task_has_perm(current, p, PROCESS__SETSCHED);
2803 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
2808 struct task_security_struct *tsec;
2810 rc = secondary_ops->task_kill(p, info, sig, secid);
2814 if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
2818 perm = PROCESS__SIGNULL; /* null signal; existence test */
2820 perm = signal_to_av(sig);
2823 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
2825 rc = task_has_perm(current, p, perm);
2829 static int selinux_task_prctl(int option,
2835 /* The current prctl operations do not appear to require
2836 any SELinux controls since they merely observe or modify
2837 the state of the current process. */
2841 static int selinux_task_wait(struct task_struct *p)
2845 perm = signal_to_av(p->exit_signal);
2847 return task_has_perm(p, current, perm);
2850 static void selinux_task_reparent_to_init(struct task_struct *p)
2852 struct task_security_struct *tsec;
2854 secondary_ops->task_reparent_to_init(p);
2857 tsec->osid = tsec->sid;
2858 tsec->sid = SECINITSID_KERNEL;
2862 static void selinux_task_to_inode(struct task_struct *p,
2863 struct inode *inode)
2865 struct task_security_struct *tsec = p->security;
2866 struct inode_security_struct *isec = inode->i_security;
2868 isec->sid = tsec->sid;
2869 isec->initialized = 1;
2873 /* Returns error only if unable to parse addresses */
2874 static int selinux_parse_skb_ipv4(struct sk_buff *skb, struct avc_audit_data *ad)
2876 int offset, ihlen, ret = -EINVAL;
2877 struct iphdr _iph, *ih;
2879 offset = skb->nh.raw - skb->data;
2880 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2884 ihlen = ih->ihl * 4;
2885 if (ihlen < sizeof(_iph))
2888 ad->u.net.v4info.saddr = ih->saddr;
2889 ad->u.net.v4info.daddr = ih->daddr;
2892 switch (ih->protocol) {
2894 struct tcphdr _tcph, *th;
2896 if (ntohs(ih->frag_off) & IP_OFFSET)
2900 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2904 ad->u.net.sport = th->source;
2905 ad->u.net.dport = th->dest;
2910 struct udphdr _udph, *uh;
2912 if (ntohs(ih->frag_off) & IP_OFFSET)
2916 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2920 ad->u.net.sport = uh->source;
2921 ad->u.net.dport = uh->dest;
2932 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2934 /* Returns error only if unable to parse addresses */
2935 static int selinux_parse_skb_ipv6(struct sk_buff *skb, struct avc_audit_data *ad)
2938 int ret = -EINVAL, offset;
2939 struct ipv6hdr _ipv6h, *ip6;
2941 offset = skb->nh.raw - skb->data;
2942 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
2946 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
2947 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
2950 nexthdr = ip6->nexthdr;
2951 offset += sizeof(_ipv6h);
2952 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
2958 struct tcphdr _tcph, *th;
2960 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2964 ad->u.net.sport = th->source;
2965 ad->u.net.dport = th->dest;
2970 struct udphdr _udph, *uh;
2972 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2976 ad->u.net.sport = uh->source;
2977 ad->u.net.dport = uh->dest;
2981 /* includes fragments */
2991 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
2992 char **addrp, int *len, int src)
2996 switch (ad->u.net.family) {
2998 ret = selinux_parse_skb_ipv4(skb, ad);
3002 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3003 &ad->u.net.v4info.daddr);
3006 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3008 ret = selinux_parse_skb_ipv6(skb, ad);
3012 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3013 &ad->u.net.v6info.daddr);
3023 /* socket security operations */
3024 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3027 struct inode_security_struct *isec;
3028 struct task_security_struct *tsec;
3029 struct avc_audit_data ad;
3032 tsec = task->security;
3033 isec = SOCK_INODE(sock)->i_security;
3035 if (isec->sid == SECINITSID_KERNEL)
3038 AVC_AUDIT_DATA_INIT(&ad,NET);
3039 ad.u.net.sk = sock->sk;
3040 err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3046 static int selinux_socket_create(int family, int type,
3047 int protocol, int kern)
3050 struct task_security_struct *tsec;
3056 tsec = current->security;
3057 newsid = tsec->sockcreate_sid ? : tsec->sid;
3058 err = avc_has_perm(tsec->sid, newsid,
3059 socket_type_to_security_class(family, type,
3060 protocol), SOCKET__CREATE, NULL);
3066 static void selinux_socket_post_create(struct socket *sock, int family,
3067 int type, int protocol, int kern)
3069 struct inode_security_struct *isec;
3070 struct task_security_struct *tsec;
3073 isec = SOCK_INODE(sock)->i_security;
3075 tsec = current->security;
3076 newsid = tsec->sockcreate_sid ? : tsec->sid;
3077 isec->sclass = socket_type_to_security_class(family, type, protocol);
3078 isec->sid = kern ? SECINITSID_KERNEL : newsid;
3079 isec->initialized = 1;
3084 /* Range of port numbers used to automatically bind.
3085 Need to determine whether we should perform a name_bind
3086 permission check between the socket and the port number. */
3087 #define ip_local_port_range_0 sysctl_local_port_range[0]
3088 #define ip_local_port_range_1 sysctl_local_port_range[1]
3090 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3095 err = socket_has_perm(current, sock, SOCKET__BIND);
3100 * If PF_INET or PF_INET6, check name_bind permission for the port.
3101 * Multiple address binding for SCTP is not supported yet: we just
3102 * check the first address now.
3104 family = sock->sk->sk_family;
3105 if (family == PF_INET || family == PF_INET6) {
3107 struct inode_security_struct *isec;
3108 struct task_security_struct *tsec;
3109 struct avc_audit_data ad;
3110 struct sockaddr_in *addr4 = NULL;
3111 struct sockaddr_in6 *addr6 = NULL;
3112 unsigned short snum;
3113 struct sock *sk = sock->sk;
3114 u32 sid, node_perm, addrlen;
3116 tsec = current->security;
3117 isec = SOCK_INODE(sock)->i_security;
3119 if (family == PF_INET) {
3120 addr4 = (struct sockaddr_in *)address;
3121 snum = ntohs(addr4->sin_port);
3122 addrlen = sizeof(addr4->sin_addr.s_addr);
3123 addrp = (char *)&addr4->sin_addr.s_addr;
3125 addr6 = (struct sockaddr_in6 *)address;
3126 snum = ntohs(addr6->sin6_port);
3127 addrlen = sizeof(addr6->sin6_addr.s6_addr);
3128 addrp = (char *)&addr6->sin6_addr.s6_addr;
3131 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3132 snum > ip_local_port_range_1)) {
3133 err = security_port_sid(sk->sk_family, sk->sk_type,
3134 sk->sk_protocol, snum, &sid);
3137 AVC_AUDIT_DATA_INIT(&ad,NET);
3138 ad.u.net.sport = htons(snum);
3139 ad.u.net.family = family;
3140 err = avc_has_perm(isec->sid, sid,
3142 SOCKET__NAME_BIND, &ad);
3147 switch(isec->sclass) {
3148 case SECCLASS_TCP_SOCKET:
3149 node_perm = TCP_SOCKET__NODE_BIND;
3152 case SECCLASS_UDP_SOCKET:
3153 node_perm = UDP_SOCKET__NODE_BIND;
3157 node_perm = RAWIP_SOCKET__NODE_BIND;
3161 err = security_node_sid(family, addrp, addrlen, &sid);
3165 AVC_AUDIT_DATA_INIT(&ad,NET);
3166 ad.u.net.sport = htons(snum);
3167 ad.u.net.family = family;
3169 if (family == PF_INET)
3170 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3172 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3174 err = avc_has_perm(isec->sid, sid,
3175 isec->sclass, node_perm, &ad);
3183 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3185 struct inode_security_struct *isec;
3188 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3193 * If a TCP socket, check name_connect permission for the port.
3195 isec = SOCK_INODE(sock)->i_security;
3196 if (isec->sclass == SECCLASS_TCP_SOCKET) {
3197 struct sock *sk = sock->sk;
3198 struct avc_audit_data ad;
3199 struct sockaddr_in *addr4 = NULL;
3200 struct sockaddr_in6 *addr6 = NULL;
3201 unsigned short snum;
3204 if (sk->sk_family == PF_INET) {
3205 addr4 = (struct sockaddr_in *)address;
3206 if (addrlen < sizeof(struct sockaddr_in))
3208 snum = ntohs(addr4->sin_port);
3210 addr6 = (struct sockaddr_in6 *)address;
3211 if (addrlen < SIN6_LEN_RFC2133)
3213 snum = ntohs(addr6->sin6_port);
3216 err = security_port_sid(sk->sk_family, sk->sk_type,
3217 sk->sk_protocol, snum, &sid);
3221 AVC_AUDIT_DATA_INIT(&ad,NET);
3222 ad.u.net.dport = htons(snum);
3223 ad.u.net.family = sk->sk_family;
3224 err = avc_has_perm(isec->sid, sid, isec->sclass,
3225 TCP_SOCKET__NAME_CONNECT, &ad);
3234 static int selinux_socket_listen(struct socket *sock, int backlog)
3236 return socket_has_perm(current, sock, SOCKET__LISTEN);
3239 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3242 struct inode_security_struct *isec;
3243 struct inode_security_struct *newisec;
3245 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3249 newisec = SOCK_INODE(newsock)->i_security;
3251 isec = SOCK_INODE(sock)->i_security;
3252 newisec->sclass = isec->sclass;
3253 newisec->sid = isec->sid;
3254 newisec->initialized = 1;
3259 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3262 return socket_has_perm(current, sock, SOCKET__WRITE);
3265 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3266 int size, int flags)
3268 return socket_has_perm(current, sock, SOCKET__READ);
3271 static int selinux_socket_getsockname(struct socket *sock)
3273 return socket_has_perm(current, sock, SOCKET__GETATTR);
3276 static int selinux_socket_getpeername(struct socket *sock)
3278 return socket_has_perm(current, sock, SOCKET__GETATTR);
3281 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3283 return socket_has_perm(current, sock, SOCKET__SETOPT);
3286 static int selinux_socket_getsockopt(struct socket *sock, int level,
3289 return socket_has_perm(current, sock, SOCKET__GETOPT);
3292 static int selinux_socket_shutdown(struct socket *sock, int how)
3294 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3297 static int selinux_socket_unix_stream_connect(struct socket *sock,
3298 struct socket *other,
3301 struct sk_security_struct *ssec;
3302 struct inode_security_struct *isec;
3303 struct inode_security_struct *other_isec;
3304 struct avc_audit_data ad;
3307 err = secondary_ops->unix_stream_connect(sock, other, newsk);
3311 isec = SOCK_INODE(sock)->i_security;
3312 other_isec = SOCK_INODE(other)->i_security;
3314 AVC_AUDIT_DATA_INIT(&ad,NET);
3315 ad.u.net.sk = other->sk;
3317 err = avc_has_perm(isec->sid, other_isec->sid,
3319 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3323 /* connecting socket */
3324 ssec = sock->sk->sk_security;
3325 ssec->peer_sid = other_isec->sid;
3327 /* server child socket */
3328 ssec = newsk->sk_security;
3329 ssec->peer_sid = isec->sid;
3334 static int selinux_socket_unix_may_send(struct socket *sock,
3335 struct socket *other)
3337 struct inode_security_struct *isec;
3338 struct inode_security_struct *other_isec;
3339 struct avc_audit_data ad;
3342 isec = SOCK_INODE(sock)->i_security;
3343 other_isec = SOCK_INODE(other)->i_security;
3345 AVC_AUDIT_DATA_INIT(&ad,NET);
3346 ad.u.net.sk = other->sk;
3348 err = avc_has_perm(isec->sid, other_isec->sid,
3349 isec->sclass, SOCKET__SENDTO, &ad);
3356 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
3357 struct avc_audit_data *ad, u32 sock_sid, u16 sock_class,
3358 u16 family, char *addrp, int len)
3361 u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3366 err = sel_netif_sids(skb->dev, &if_sid, NULL);
3370 switch (sock_class) {
3371 case SECCLASS_UDP_SOCKET:
3372 netif_perm = NETIF__UDP_RECV;
3373 node_perm = NODE__UDP_RECV;
3374 recv_perm = UDP_SOCKET__RECV_MSG;
3377 case SECCLASS_TCP_SOCKET:
3378 netif_perm = NETIF__TCP_RECV;
3379 node_perm = NODE__TCP_RECV;
3380 recv_perm = TCP_SOCKET__RECV_MSG;
3384 netif_perm = NETIF__RAWIP_RECV;
3385 node_perm = NODE__RAWIP_RECV;
3389 err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3393 err = security_node_sid(family, addrp, len, &node_sid);
3397 err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, ad);
3404 err = security_port_sid(sk->sk_family, sk->sk_type,
3405 sk->sk_protocol, ntohs(ad->u.net.sport),
3410 err = avc_has_perm(sock_sid, port_sid,
3411 sock_class, recv_perm, ad);
3418 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3425 struct socket *sock;
3426 struct avc_audit_data ad;
3428 family = sk->sk_family;
3429 if (family != PF_INET && family != PF_INET6)
3432 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3433 if (family == PF_INET6 && skb->protocol == ntohs(ETH_P_IP))
3436 read_lock_bh(&sk->sk_callback_lock);
3437 sock = sk->sk_socket;
3439 struct inode *inode;
3440 inode = SOCK_INODE(sock);
3442 struct inode_security_struct *isec;
3443 isec = inode->i_security;
3444 sock_sid = isec->sid;
3445 sock_class = isec->sclass;
3448 read_unlock_bh(&sk->sk_callback_lock);
3452 AVC_AUDIT_DATA_INIT(&ad, NET);
3453 ad.u.net.netif = skb->dev ? skb->dev->name : "[unknown]";
3454 ad.u.net.family = family;
3456 err = selinux_parse_skb(skb, &ad, &addrp, &len, 1);
3460 if (selinux_compat_net)
3461 err = selinux_sock_rcv_skb_compat(sk, skb, &ad, sock_sid,
3465 err = avc_has_perm(sock_sid, skb->secmark, SECCLASS_PACKET,
3470 err = selinux_xfrm_sock_rcv_skb(sock_sid, skb);
3475 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
3476 int __user *optlen, unsigned len)
3481 struct sk_security_struct *ssec;
3482 struct inode_security_struct *isec;
3485 isec = SOCK_INODE(sock)->i_security;
3487 /* if UNIX_STREAM check peer_sid, if TCP check dst for labelled sa */
3488 if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET) {
3489 ssec = sock->sk->sk_security;
3490 peer_sid = ssec->peer_sid;
3492 else if (isec->sclass == SECCLASS_TCP_SOCKET) {
3493 peer_sid = selinux_socket_getpeer_stream(sock->sk);
3495 if (peer_sid == SECSID_NULL) {
3505 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
3510 if (scontext_len > len) {
3515 if (copy_to_user(optval, scontext, scontext_len))
3519 if (put_user(scontext_len, optlen))
3527 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
3529 u32 peer_secid = SECSID_NULL;
3532 if (sock && (sock->sk->sk_family == PF_UNIX))
3533 selinux_get_inode_sid(SOCK_INODE(sock), &peer_secid);
3535 peer_secid = selinux_socket_getpeer_dgram(skb);
3537 if (peer_secid == SECSID_NULL)
3539 *secid = peer_secid;
3544 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
3546 return sk_alloc_security(sk, family, priority);
3549 static void selinux_sk_free_security(struct sock *sk)
3551 sk_free_security(sk);
3554 static unsigned int selinux_sk_getsid_security(struct sock *sk, struct flowi *fl, u8 dir)
3556 struct inode_security_struct *isec;
3557 u32 sock_sid = SECINITSID_ANY_SOCKET;
3560 return selinux_no_sk_sid(fl);
3562 read_lock_bh(&sk->sk_callback_lock);
3563 isec = get_sock_isec(sk);
3566 sock_sid = isec->sid;
3568 read_unlock_bh(&sk->sk_callback_lock);
3572 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3576 struct nlmsghdr *nlh;
3577 struct socket *sock = sk->sk_socket;
3578 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3580 if (skb->len < NLMSG_SPACE(0)) {
3584 nlh = (struct nlmsghdr *)skb->data;
3586 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3588 if (err == -EINVAL) {
3589 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
3590 "SELinux: unrecognized netlink message"
3591 " type=%hu for sclass=%hu\n",
3592 nlh->nlmsg_type, isec->sclass);
3593 if (!selinux_enforcing)
3603 err = socket_has_perm(current, sock, perm);
3608 #ifdef CONFIG_NETFILTER
3610 static int selinux_ip_postroute_last_compat(struct sock *sk, struct net_device *dev,
3611 struct inode_security_struct *isec,
3612 struct avc_audit_data *ad,
3613 u16 family, char *addrp, int len)
3616 u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
3618 err = sel_netif_sids(dev, &if_sid, NULL);
3622 switch (isec->sclass) {
3623 case SECCLASS_UDP_SOCKET:
3624 netif_perm = NETIF__UDP_SEND;
3625 node_perm = NODE__UDP_SEND;
3626 send_perm = UDP_SOCKET__SEND_MSG;
3629 case SECCLASS_TCP_SOCKET:
3630 netif_perm = NETIF__TCP_SEND;
3631 node_perm = NODE__TCP_SEND;
3632 send_perm = TCP_SOCKET__SEND_MSG;
3636 netif_perm = NETIF__RAWIP_SEND;
3637 node_perm = NODE__RAWIP_SEND;
3641 err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3645 err = security_node_sid(family, addrp, len, &node_sid);
3649 err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE, node_perm, ad);
3656 err = security_port_sid(sk->sk_family,
3659 ntohs(ad->u.net.dport),
3664 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3671 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3672 struct sk_buff **pskb,
3673 const struct net_device *in,
3674 const struct net_device *out,
3675 int (*okfn)(struct sk_buff *),
3681 struct socket *sock;
3682 struct inode *inode;
3683 struct sk_buff *skb = *pskb;
3684 struct inode_security_struct *isec;
3685 struct avc_audit_data ad;
3686 struct net_device *dev = (struct net_device *)out;
3692 sock = sk->sk_socket;
3696 inode = SOCK_INODE(sock);
3700 isec = inode->i_security;
3702 AVC_AUDIT_DATA_INIT(&ad, NET);
3703 ad.u.net.netif = dev->name;
3704 ad.u.net.family = family;
3706 err = selinux_parse_skb(skb, &ad, &addrp, &len, 0);
3710 if (selinux_compat_net)
3711 err = selinux_ip_postroute_last_compat(sk, dev, isec, &ad,
3712 family, addrp, len);
3714 err = avc_has_perm(isec->sid, skb->secmark, SECCLASS_PACKET,
3720 err = selinux_xfrm_postroute_last(isec->sid, skb);
3722 return err ? NF_DROP : NF_ACCEPT;
3725 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3726 struct sk_buff **pskb,
3727 const struct net_device *in,
3728 const struct net_device *out,
3729 int (*okfn)(struct sk_buff *))
3731 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3734 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3736 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3737 struct sk_buff **pskb,
3738 const struct net_device *in,
3739 const struct net_device *out,
3740 int (*okfn)(struct sk_buff *))
3742 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3747 #endif /* CONFIG_NETFILTER */
3749 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3753 err = secondary_ops->netlink_send(sk, skb);
3757 if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
3758 err = selinux_nlmsg_perm(sk, skb);
3763 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
3766 struct avc_audit_data ad;
3768 err = secondary_ops->netlink_recv(skb, capability);
3772 AVC_AUDIT_DATA_INIT(&ad, CAP);
3773 ad.u.cap = capability;
3775 return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
3776 SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
3779 static int ipc_alloc_security(struct task_struct *task,
3780 struct kern_ipc_perm *perm,
3783 struct task_security_struct *tsec = task->security;
3784 struct ipc_security_struct *isec;
3786 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
3790 isec->sclass = sclass;
3791 isec->ipc_perm = perm;
3792 isec->sid = tsec->sid;
3793 perm->security = isec;
3798 static void ipc_free_security(struct kern_ipc_perm *perm)
3800 struct ipc_security_struct *isec = perm->security;
3801 perm->security = NULL;
3805 static int msg_msg_alloc_security(struct msg_msg *msg)
3807 struct msg_security_struct *msec;
3809 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
3814 msec->sid = SECINITSID_UNLABELED;
3815 msg->security = msec;
3820 static void msg_msg_free_security(struct msg_msg *msg)
3822 struct msg_security_struct *msec = msg->security;
3824 msg->security = NULL;
3828 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
3831 struct task_security_struct *tsec;
3832 struct ipc_security_struct *isec;
3833 struct avc_audit_data ad;
3835 tsec = current->security;
3836 isec = ipc_perms->security;
3838 AVC_AUDIT_DATA_INIT(&ad, IPC);
3839 ad.u.ipc_id = ipc_perms->key;
3841 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3844 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
3846 return msg_msg_alloc_security(msg);
3849 static void selinux_msg_msg_free_security(struct msg_msg *msg)
3851 msg_msg_free_security(msg);
3854 /* message queue security operations */
3855 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
3857 struct task_security_struct *tsec;
3858 struct ipc_security_struct *isec;
3859 struct avc_audit_data ad;
3862 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
3866 tsec = current->security;
3867 isec = msq->q_perm.security;
3869 AVC_AUDIT_DATA_INIT(&ad, IPC);
3870 ad.u.ipc_id = msq->q_perm.key;
3872 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3875 ipc_free_security(&msq->q_perm);
3881 static void selinux_msg_queue_free_security(struct msg_queue *msq)
3883 ipc_free_security(&msq->q_perm);
3886 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
3888 struct task_security_struct *tsec;
3889 struct ipc_security_struct *isec;
3890 struct avc_audit_data ad;
3892 tsec = current->security;
3893 isec = msq->q_perm.security;
3895 AVC_AUDIT_DATA_INIT(&ad, IPC);
3896 ad.u.ipc_id = msq->q_perm.key;
3898 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3899 MSGQ__ASSOCIATE, &ad);
3902 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
3910 /* No specific object, just general system-wide information. */
3911 return task_has_system(current, SYSTEM__IPC_INFO);
3914 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
3917 perms = MSGQ__SETATTR;
3920 perms = MSGQ__DESTROY;
3926 err = ipc_has_perm(&msq->q_perm, perms);
3930 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
3932 struct task_security_struct *tsec;
3933 struct ipc_security_struct *isec;
3934 struct msg_security_struct *msec;
3935 struct avc_audit_data ad;
3938 tsec = current->security;
3939 isec = msq->q_perm.security;
3940 msec = msg->security;
3943 * First time through, need to assign label to the message
3945 if (msec->sid == SECINITSID_UNLABELED) {
3947 * Compute new sid based on current process and
3948 * message queue this message will be stored in
3950 rc = security_transition_sid(tsec->sid,
3958 AVC_AUDIT_DATA_INIT(&ad, IPC);
3959 ad.u.ipc_id = msq->q_perm.key;
3961 /* Can this process write to the queue? */
3962 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3965 /* Can this process send the message */
3966 rc = avc_has_perm(tsec->sid, msec->sid,
3967 SECCLASS_MSG, MSG__SEND, &ad);
3969 /* Can the message be put in the queue? */
3970 rc = avc_has_perm(msec->sid, isec->sid,
3971 SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
3976 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
3977 struct task_struct *target,
3978 long type, int mode)
3980 struct task_security_struct *tsec;
3981 struct ipc_security_struct *isec;
3982 struct msg_security_struct *msec;
3983 struct avc_audit_data ad;
3986 tsec = target->security;
3987 isec = msq->q_perm.security;
3988 msec = msg->security;
3990 AVC_AUDIT_DATA_INIT(&ad, IPC);
3991 ad.u.ipc_id = msq->q_perm.key;
3993 rc = avc_has_perm(tsec->sid, isec->sid,
3994 SECCLASS_MSGQ, MSGQ__READ, &ad);
3996 rc = avc_has_perm(tsec->sid, msec->sid,
3997 SECCLASS_MSG, MSG__RECEIVE, &ad);
4001 /* Shared Memory security operations */
4002 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4004 struct task_security_struct *tsec;
4005 struct ipc_security_struct *isec;
4006 struct avc_audit_data ad;
4009 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4013 tsec = current->security;
4014 isec = shp->shm_perm.security;
4016 AVC_AUDIT_DATA_INIT(&ad, IPC);
4017 ad.u.ipc_id = shp->shm_perm.key;
4019 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4022 ipc_free_security(&shp->shm_perm);
4028 static void selinux_shm_free_security(struct shmid_kernel *shp)
4030 ipc_free_security(&shp->shm_perm);
4033 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4035 struct task_security_struct *tsec;
4036 struct ipc_security_struct *isec;
4037 struct avc_audit_data ad;
4039 tsec = current->security;
4040 isec = shp->shm_perm.security;
4042 AVC_AUDIT_DATA_INIT(&ad, IPC);
4043 ad.u.ipc_id = shp->shm_perm.key;
4045 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4046 SHM__ASSOCIATE, &ad);
4049 /* Note, at this point, shp is locked down */
4050 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4058 /* No specific object, just general system-wide information. */
4059 return task_has_system(current, SYSTEM__IPC_INFO);
4062 perms = SHM__GETATTR | SHM__ASSOCIATE;
4065 perms = SHM__SETATTR;
4072 perms = SHM__DESTROY;
4078 err = ipc_has_perm(&shp->shm_perm, perms);
4082 static int selinux_shm_shmat(struct shmid_kernel *shp,
4083 char __user *shmaddr, int shmflg)
4088 rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4092 if (shmflg & SHM_RDONLY)
4095 perms = SHM__READ | SHM__WRITE;
4097 return ipc_has_perm(&shp->shm_perm, perms);
4100 /* Semaphore security operations */
4101 static int selinux_sem_alloc_security(struct sem_array *sma)
4103 struct task_security_struct *tsec;
4104 struct ipc_security_struct *isec;
4105 struct avc_audit_data ad;
4108 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4112 tsec = current->security;
4113 isec = sma->sem_perm.security;
4115 AVC_AUDIT_DATA_INIT(&ad, IPC);
4116 ad.u.ipc_id = sma->sem_perm.key;
4118 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4121 ipc_free_security(&sma->sem_perm);
4127 static void selinux_sem_free_security(struct sem_array *sma)
4129 ipc_free_security(&sma->sem_perm);
4132 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4134 struct task_security_struct *tsec;
4135 struct ipc_security_struct *isec;
4136 struct avc_audit_data ad;
4138 tsec = current->security;
4139 isec = sma->sem_perm.security;
4141 AVC_AUDIT_DATA_INIT(&ad, IPC);
4142 ad.u.ipc_id = sma->sem_perm.key;
4144 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4145 SEM__ASSOCIATE, &ad);
4148 /* Note, at this point, sma is locked down */
4149 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4157 /* No specific object, just general system-wide information. */
4158 return task_has_system(current, SYSTEM__IPC_INFO);
4162 perms = SEM__GETATTR;
4173 perms = SEM__DESTROY;
4176 perms = SEM__SETATTR;
4180 perms = SEM__GETATTR | SEM__ASSOCIATE;
4186 err = ipc_has_perm(&sma->sem_perm, perms);
4190 static int selinux_sem_semop(struct sem_array *sma,
4191 struct sembuf *sops, unsigned nsops, int alter)
4196 perms = SEM__READ | SEM__WRITE;
4200 return ipc_has_perm(&sma->sem_perm, perms);
4203 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4209 av |= IPC__UNIX_READ;
4211 av |= IPC__UNIX_WRITE;
4216 return ipc_has_perm(ipcp, av);
4219 /* module stacking operations */
4220 static int selinux_register_security (const char *name, struct security_operations *ops)
4222 if (secondary_ops != original_ops) {
4223 printk(KERN_INFO "%s: There is already a secondary security "
4224 "module registered.\n", __FUNCTION__);
4228 secondary_ops = ops;
4230 printk(KERN_INFO "%s: Registering secondary module %s\n",
4237 static int selinux_unregister_security (const char *name, struct security_operations *ops)
4239 if (ops != secondary_ops) {
4240 printk (KERN_INFO "%s: trying to unregister a security module "
4241 "that is not registered.\n", __FUNCTION__);
4245 secondary_ops = original_ops;
4250 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4253 inode_doinit_with_dentry(inode, dentry);
4256 static int selinux_getprocattr(struct task_struct *p,
4257 char *name, void *value, size_t size)
4259 struct task_security_struct *tsec;
4264 error = task_has_perm(current, p, PROCESS__GETATTR);
4271 if (!strcmp(name, "current"))
4273 else if (!strcmp(name, "prev"))
4275 else if (!strcmp(name, "exec"))
4276 sid = tsec->exec_sid;
4277 else if (!strcmp(name, "fscreate"))
4278 sid = tsec->create_sid;
4279 else if (!strcmp(name, "keycreate"))
4280 sid = tsec->keycreate_sid;
4281 else if (!strcmp(name, "sockcreate"))
4282 sid = tsec->sockcreate_sid;
4289 return selinux_getsecurity(sid, value, size);
4292 static int selinux_setprocattr(struct task_struct *p,
4293 char *name, void *value, size_t size)
4295 struct task_security_struct *tsec;
4301 /* SELinux only allows a process to change its own
4302 security attributes. */
4307 * Basic control over ability to set these attributes at all.
4308 * current == p, but we'll pass them separately in case the
4309 * above restriction is ever removed.
4311 if (!strcmp(name, "exec"))
4312 error = task_has_perm(current, p, PROCESS__SETEXEC);
4313 else if (!strcmp(name, "fscreate"))
4314 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4315 else if (!strcmp(name, "keycreate"))
4316 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
4317 else if (!strcmp(name, "sockcreate"))
4318 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
4319 else if (!strcmp(name, "current"))
4320 error = task_has_perm(current, p, PROCESS__SETCURRENT);
4326 /* Obtain a SID for the context, if one was specified. */
4327 if (size && str[1] && str[1] != '\n') {
4328 if (str[size-1] == '\n') {
4332 error = security_context_to_sid(value, size, &sid);
4337 /* Permission checking based on the specified context is
4338 performed during the actual operation (execve,
4339 open/mkdir/...), when we know the full context of the
4340 operation. See selinux_bprm_set_security for the execve
4341 checks and may_create for the file creation checks. The
4342 operation will then fail if the context is not permitted. */
4344 if (!strcmp(name, "exec"))
4345 tsec->exec_sid = sid;
4346 else if (!strcmp(name, "fscreate"))
4347 tsec->create_sid = sid;
4348 else if (!strcmp(name, "keycreate")) {
4349 error = may_create_key(sid, p);
4352 tsec->keycreate_sid = sid;
4353 } else if (!strcmp(name, "sockcreate"))
4354 tsec->sockcreate_sid = sid;
4355 else if (!strcmp(name, "current")) {
4356 struct av_decision avd;
4361 /* Only allow single threaded processes to change context */
4362 if (atomic_read(&p->mm->mm_users) != 1) {
4363 struct task_struct *g, *t;
4364 struct mm_struct *mm = p->mm;
4365 read_lock(&tasklist_lock);
4366 do_each_thread(g, t)
4367 if (t->mm == mm && t != p) {
4368 read_unlock(&tasklist_lock);
4371 while_each_thread(g, t);
4372 read_unlock(&tasklist_lock);
4375 /* Check permissions for the transition. */
4376 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
4377 PROCESS__DYNTRANSITION, NULL);
4381 /* Check for ptracing, and update the task SID if ok.
4382 Otherwise, leave SID unchanged and fail. */
4384 if (p->ptrace & PT_PTRACED) {
4385 error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
4387 PROCESS__PTRACE, &avd);
4391 avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
4392 PROCESS__PTRACE, &avd, error, NULL);
4406 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
4408 return security_sid_to_context(secid, secdata, seclen);
4411 static void selinux_release_secctx(char *secdata, u32 seclen)
4419 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
4420 unsigned long flags)
4422 struct task_security_struct *tsec = tsk->security;
4423 struct key_security_struct *ksec;
4425 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
4430 if (tsec->keycreate_sid)
4431 ksec->sid = tsec->keycreate_sid;
4433 ksec->sid = tsec->sid;
4439 static void selinux_key_free(struct key *k)
4441 struct key_security_struct *ksec = k->security;
4447 static int selinux_key_permission(key_ref_t key_ref,
4448 struct task_struct *ctx,
4452 struct task_security_struct *tsec;
4453 struct key_security_struct *ksec;
4455 key = key_ref_to_ptr(key_ref);
4457 tsec = ctx->security;
4458 ksec = key->security;
4460 /* if no specific permissions are requested, we skip the
4461 permission check. No serious, additional covert channels
4462 appear to be created. */
4466 return avc_has_perm(tsec->sid, ksec->sid,
4467 SECCLASS_KEY, perm, NULL);
4472 static struct security_operations selinux_ops = {
4473 .ptrace = selinux_ptrace,
4474 .capget = selinux_capget,
4475 .capset_check = selinux_capset_check,
4476 .capset_set = selinux_capset_set,
4477 .sysctl = selinux_sysctl,
4478 .capable = selinux_capable,
4479 .quotactl = selinux_quotactl,
4480 .quota_on = selinux_quota_on,
4481 .syslog = selinux_syslog,
4482 .vm_enough_memory = selinux_vm_enough_memory,
4484 .netlink_send = selinux_netlink_send,
4485 .netlink_recv = selinux_netlink_recv,
4487 .bprm_alloc_security = selinux_bprm_alloc_security,
4488 .bprm_free_security = selinux_bprm_free_security,
4489 .bprm_apply_creds = selinux_bprm_apply_creds,
4490 .bprm_post_apply_creds = selinux_bprm_post_apply_creds,
4491 .bprm_set_security = selinux_bprm_set_security,
4492 .bprm_check_security = selinux_bprm_check_security,
4493 .bprm_secureexec = selinux_bprm_secureexec,
4495 .sb_alloc_security = selinux_sb_alloc_security,
4496 .sb_free_security = selinux_sb_free_security,
4497 .sb_copy_data = selinux_sb_copy_data,
4498 .sb_kern_mount = selinux_sb_kern_mount,
4499 .sb_statfs = selinux_sb_statfs,
4500 .sb_mount = selinux_mount,
4501 .sb_umount = selinux_umount,
4503 .inode_alloc_security = selinux_inode_alloc_security,
4504 .inode_free_security = selinux_inode_free_security,
4505 .inode_init_security = selinux_inode_init_security,
4506 .inode_create = selinux_inode_create,
4507 .inode_link = selinux_inode_link,
4508 .inode_unlink = selinux_inode_unlink,
4509 .inode_symlink = selinux_inode_symlink,
4510 .inode_mkdir = selinux_inode_mkdir,
4511 .inode_rmdir = selinux_inode_rmdir,
4512 .inode_mknod = selinux_inode_mknod,
4513 .inode_rename = selinux_inode_rename,
4514 .inode_readlink = selinux_inode_readlink,
4515 .inode_follow_link = selinux_inode_follow_link,
4516 .inode_permission = selinux_inode_permission,
4517 .inode_setattr = selinux_inode_setattr,
4518 .inode_getattr = selinux_inode_getattr,
4519 .inode_setxattr = selinux_inode_setxattr,
4520 .inode_post_setxattr = selinux_inode_post_setxattr,
4521 .inode_getxattr = selinux_inode_getxattr,
4522 .inode_listxattr = selinux_inode_listxattr,
4523 .inode_removexattr = selinux_inode_removexattr,
4524 .inode_xattr_getsuffix = selinux_inode_xattr_getsuffix,
4525 .inode_getsecurity = selinux_inode_getsecurity,
4526 .inode_setsecurity = selinux_inode_setsecurity,
4527 .inode_listsecurity = selinux_inode_listsecurity,
4529 .file_permission = selinux_file_permission,
4530 .file_alloc_security = selinux_file_alloc_security,
4531 .file_free_security = selinux_file_free_security,
4532 .file_ioctl = selinux_file_ioctl,
4533 .file_mmap = selinux_file_mmap,
4534 .file_mprotect = selinux_file_mprotect,
4535 .file_lock = selinux_file_lock,
4536 .file_fcntl = selinux_file_fcntl,
4537 .file_set_fowner = selinux_file_set_fowner,
4538 .file_send_sigiotask = selinux_file_send_sigiotask,
4539 .file_receive = selinux_file_receive,
4541 .task_create = selinux_task_create,
4542 .task_alloc_security = selinux_task_alloc_security,
4543 .task_free_security = selinux_task_free_security,
4544 .task_setuid = selinux_task_setuid,
4545 .task_post_setuid = selinux_task_post_setuid,
4546 .task_setgid = selinux_task_setgid,
4547 .task_setpgid = selinux_task_setpgid,
4548 .task_getpgid = selinux_task_getpgid,
4549 .task_getsid = selinux_task_getsid,
4550 .task_getsecid = selinux_task_getsecid,
4551 .task_setgroups = selinux_task_setgroups,
4552 .task_setnice = selinux_task_setnice,
4553 .task_setioprio = selinux_task_setioprio,
4554 .task_getioprio = selinux_task_getioprio,
4555 .task_setrlimit = selinux_task_setrlimit,
4556 .task_setscheduler = selinux_task_setscheduler,
4557 .task_getscheduler = selinux_task_getscheduler,
4558 .task_movememory = selinux_task_movememory,
4559 .task_kill = selinux_task_kill,
4560 .task_wait = selinux_task_wait,
4561 .task_prctl = selinux_task_prctl,
4562 .task_reparent_to_init = selinux_task_reparent_to_init,
4563 .task_to_inode = selinux_task_to_inode,
4565 .ipc_permission = selinux_ipc_permission,
4567 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
4568 .msg_msg_free_security = selinux_msg_msg_free_security,
4570 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
4571 .msg_queue_free_security = selinux_msg_queue_free_security,
4572 .msg_queue_associate = selinux_msg_queue_associate,
4573 .msg_queue_msgctl = selinux_msg_queue_msgctl,
4574 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
4575 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
4577 .shm_alloc_security = selinux_shm_alloc_security,
4578 .shm_free_security = selinux_shm_free_security,
4579 .shm_associate = selinux_shm_associate,
4580 .shm_shmctl = selinux_shm_shmctl,
4581 .shm_shmat = selinux_shm_shmat,
4583 .sem_alloc_security = selinux_sem_alloc_security,
4584 .sem_free_security = selinux_sem_free_security,
4585 .sem_associate = selinux_sem_associate,
4586 .sem_semctl = selinux_sem_semctl,
4587 .sem_semop = selinux_sem_semop,
4589 .register_security = selinux_register_security,
4590 .unregister_security = selinux_unregister_security,
4592 .d_instantiate = selinux_d_instantiate,
4594 .getprocattr = selinux_getprocattr,
4595 .setprocattr = selinux_setprocattr,
4597 .secid_to_secctx = selinux_secid_to_secctx,
4598 .release_secctx = selinux_release_secctx,
4600 .unix_stream_connect = selinux_socket_unix_stream_connect,
4601 .unix_may_send = selinux_socket_unix_may_send,
4603 .socket_create = selinux_socket_create,
4604 .socket_post_create = selinux_socket_post_create,
4605 .socket_bind = selinux_socket_bind,
4606 .socket_connect = selinux_socket_connect,
4607 .socket_listen = selinux_socket_listen,
4608 .socket_accept = selinux_socket_accept,
4609 .socket_sendmsg = selinux_socket_sendmsg,
4610 .socket_recvmsg = selinux_socket_recvmsg,
4611 .socket_getsockname = selinux_socket_getsockname,
4612 .socket_getpeername = selinux_socket_getpeername,
4613 .socket_getsockopt = selinux_socket_getsockopt,
4614 .socket_setsockopt = selinux_socket_setsockopt,
4615 .socket_shutdown = selinux_socket_shutdown,
4616 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
4617 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
4618 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
4619 .sk_alloc_security = selinux_sk_alloc_security,
4620 .sk_free_security = selinux_sk_free_security,
4621 .sk_getsid = selinux_sk_getsid_security,
4623 #ifdef CONFIG_SECURITY_NETWORK_XFRM
4624 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
4625 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
4626 .xfrm_policy_free_security = selinux_xfrm_policy_free,
4627 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
4628 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
4629 .xfrm_state_free_security = selinux_xfrm_state_free,
4630 .xfrm_state_delete_security = selinux_xfrm_state_delete,
4631 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
4635 .key_alloc = selinux_key_alloc,
4636 .key_free = selinux_key_free,
4637 .key_permission = selinux_key_permission,
4641 static __init int selinux_init(void)
4643 struct task_security_struct *tsec;
4645 if (!selinux_enabled) {
4646 printk(KERN_INFO "SELinux: Disabled at boot.\n");
4650 printk(KERN_INFO "SELinux: Initializing.\n");
4652 /* Set the security state for the initial task. */
4653 if (task_alloc_security(current))
4654 panic("SELinux: Failed to initialize initial task.\n");
4655 tsec = current->security;
4656 tsec->osid = tsec->sid = SECINITSID_KERNEL;
4658 sel_inode_cache = kmem_cache_create("selinux_inode_security",
4659 sizeof(struct inode_security_struct),
4660 0, SLAB_PANIC, NULL, NULL);
4663 original_ops = secondary_ops = security_ops;
4665 panic ("SELinux: No initial security operations\n");
4666 if (register_security (&selinux_ops))
4667 panic("SELinux: Unable to register with kernel.\n");
4669 if (selinux_enforcing) {
4670 printk(KERN_INFO "SELinux: Starting in enforcing mode\n");
4672 printk(KERN_INFO "SELinux: Starting in permissive mode\n");
4676 /* Add security information to initial keyrings */
4677 selinux_key_alloc(&root_user_keyring, current,
4678 KEY_ALLOC_NOT_IN_QUOTA);
4679 selinux_key_alloc(&root_session_keyring, current,
4680 KEY_ALLOC_NOT_IN_QUOTA);
4686 void selinux_complete_init(void)
4688 printk(KERN_INFO "SELinux: Completing initialization.\n");
4690 /* Set up any superblocks initialized prior to the policy load. */
4691 printk(KERN_INFO "SELinux: Setting up existing superblocks.\n");
4692 spin_lock(&sb_lock);
4693 spin_lock(&sb_security_lock);
4695 if (!list_empty(&superblock_security_head)) {
4696 struct superblock_security_struct *sbsec =
4697 list_entry(superblock_security_head.next,
4698 struct superblock_security_struct,
4700 struct super_block *sb = sbsec->sb;
4702 spin_unlock(&sb_security_lock);
4703 spin_unlock(&sb_lock);
4704 down_read(&sb->s_umount);
4706 superblock_doinit(sb, NULL);
4708 spin_lock(&sb_lock);
4709 spin_lock(&sb_security_lock);
4710 list_del_init(&sbsec->list);
4713 spin_unlock(&sb_security_lock);
4714 spin_unlock(&sb_lock);
4717 /* SELinux requires early initialization in order to label
4718 all processes and objects when they are created. */
4719 security_initcall(selinux_init);
4721 #if defined(CONFIG_NETFILTER)
4723 static struct nf_hook_ops selinux_ipv4_op = {
4724 .hook = selinux_ipv4_postroute_last,
4725 .owner = THIS_MODULE,
4727 .hooknum = NF_IP_POST_ROUTING,
4728 .priority = NF_IP_PRI_SELINUX_LAST,
4731 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4733 static struct nf_hook_ops selinux_ipv6_op = {
4734 .hook = selinux_ipv6_postroute_last,
4735 .owner = THIS_MODULE,
4737 .hooknum = NF_IP6_POST_ROUTING,
4738 .priority = NF_IP6_PRI_SELINUX_LAST,
4743 static int __init selinux_nf_ip_init(void)
4747 if (!selinux_enabled)
4750 printk(KERN_INFO "SELinux: Registering netfilter hooks\n");
4752 err = nf_register_hook(&selinux_ipv4_op);
4754 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
4756 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4758 err = nf_register_hook(&selinux_ipv6_op);
4760 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
4768 __initcall(selinux_nf_ip_init);
4770 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4771 static void selinux_nf_ip_exit(void)
4773 printk(KERN_INFO "SELinux: Unregistering netfilter hooks\n");
4775 nf_unregister_hook(&selinux_ipv4_op);
4776 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4777 nf_unregister_hook(&selinux_ipv6_op);
4782 #else /* CONFIG_NETFILTER */
4784 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4785 #define selinux_nf_ip_exit()
4788 #endif /* CONFIG_NETFILTER */
4790 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4791 int selinux_disable(void)
4793 extern void exit_sel_fs(void);
4794 static int selinux_disabled = 0;
4796 if (ss_initialized) {
4797 /* Not permitted after initial policy load. */
4801 if (selinux_disabled) {
4802 /* Only do this once. */
4806 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
4808 selinux_disabled = 1;
4809 selinux_enabled = 0;
4811 /* Reset security_ops to the secondary module, dummy or capability. */
4812 security_ops = secondary_ops;
4814 /* Unregister netfilter hooks. */
4815 selinux_nf_ip_exit();
4817 /* Unregister selinuxfs. */