2 * NSA Security-Enhanced Linux (SELinux) security module
4 * This file contains the SELinux hook function implementations.
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License version 2,
18 * as published by the Free Software Foundation.
21 #include <linux/module.h>
22 #include <linux/init.h>
23 #include <linux/kernel.h>
24 #include <linux/ptrace.h>
25 #include <linux/errno.h>
26 #include <linux/sched.h>
27 #include <linux/security.h>
28 #include <linux/xattr.h>
29 #include <linux/capability.h>
30 #include <linux/unistd.h>
32 #include <linux/mman.h>
33 #include <linux/slab.h>
34 #include <linux/pagemap.h>
35 #include <linux/swap.h>
36 #include <linux/smp_lock.h>
37 #include <linux/spinlock.h>
38 #include <linux/syscalls.h>
39 #include <linux/file.h>
40 #include <linux/namei.h>
41 #include <linux/mount.h>
42 #include <linux/ext2_fs.h>
43 #include <linux/proc_fs.h>
45 #include <linux/netfilter_ipv4.h>
46 #include <linux/netfilter_ipv6.h>
47 #include <linux/tty.h>
49 #include <net/ip.h> /* for sysctl_local_port_range[] */
50 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
51 #include <asm/uaccess.h>
52 #include <asm/semaphore.h>
53 #include <asm/ioctls.h>
54 #include <linux/bitops.h>
55 #include <linux/interrupt.h>
56 #include <linux/netdevice.h> /* for network interface checks */
57 #include <linux/netlink.h>
58 #include <linux/tcp.h>
59 #include <linux/udp.h>
60 #include <linux/quota.h>
61 #include <linux/un.h> /* for Unix socket types */
62 #include <net/af_unix.h> /* for Unix socket types */
63 #include <linux/parser.h>
64 #include <linux/nfs_mount.h>
66 #include <linux/hugetlb.h>
67 #include <linux/personality.h>
68 #include <linux/sysctl.h>
69 #include <linux/audit.h>
70 #include <linux/string.h>
71 #include <linux/selinux.h>
78 #define XATTR_SELINUX_SUFFIX "selinux"
79 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
81 extern unsigned int policydb_loaded_version;
82 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
83 extern int selinux_compat_net;
85 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
86 int selinux_enforcing = 0;
88 static int __init enforcing_setup(char *str)
90 selinux_enforcing = simple_strtol(str,NULL,0);
93 __setup("enforcing=", enforcing_setup);
96 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
97 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
99 static int __init selinux_enabled_setup(char *str)
101 selinux_enabled = simple_strtol(str, NULL, 0);
104 __setup("selinux=", selinux_enabled_setup);
106 int selinux_enabled = 1;
109 /* Original (dummy) security module. */
110 static struct security_operations *original_ops = NULL;
112 /* Minimal support for a secondary security module,
113 just to allow the use of the dummy or capability modules.
114 The owlsm module can alternatively be used as a secondary
115 module as long as CONFIG_OWLSM_FD is not enabled. */
116 static struct security_operations *secondary_ops = NULL;
118 /* Lists of inode and superblock security structures initialized
119 before the policy was loaded. */
120 static LIST_HEAD(superblock_security_head);
121 static DEFINE_SPINLOCK(sb_security_lock);
123 static kmem_cache_t *sel_inode_cache;
125 /* Return security context for a given sid or just the context
126 length if the buffer is null or length is 0 */
127 static int selinux_getsecurity(u32 sid, void *buffer, size_t size)
133 rc = security_sid_to_context(sid, &context, &len);
137 if (!buffer || !size)
138 goto getsecurity_exit;
142 goto getsecurity_exit;
144 memcpy(buffer, context, len);
151 /* Allocate and free functions for each kind of security blob. */
153 static int task_alloc_security(struct task_struct *task)
155 struct task_security_struct *tsec;
157 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
162 tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
163 task->security = tsec;
168 static void task_free_security(struct task_struct *task)
170 struct task_security_struct *tsec = task->security;
171 task->security = NULL;
175 static int inode_alloc_security(struct inode *inode)
177 struct task_security_struct *tsec = current->security;
178 struct inode_security_struct *isec;
180 isec = kmem_cache_alloc(sel_inode_cache, SLAB_KERNEL);
184 memset(isec, 0, sizeof(*isec));
185 init_MUTEX(&isec->sem);
186 INIT_LIST_HEAD(&isec->list);
188 isec->sid = SECINITSID_UNLABELED;
189 isec->sclass = SECCLASS_FILE;
190 isec->task_sid = tsec->sid;
191 inode->i_security = isec;
196 static void inode_free_security(struct inode *inode)
198 struct inode_security_struct *isec = inode->i_security;
199 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
201 spin_lock(&sbsec->isec_lock);
202 if (!list_empty(&isec->list))
203 list_del_init(&isec->list);
204 spin_unlock(&sbsec->isec_lock);
206 inode->i_security = NULL;
207 kmem_cache_free(sel_inode_cache, isec);
210 static int file_alloc_security(struct file *file)
212 struct task_security_struct *tsec = current->security;
213 struct file_security_struct *fsec;
215 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
220 fsec->sid = tsec->sid;
221 fsec->fown_sid = tsec->sid;
222 file->f_security = fsec;
227 static void file_free_security(struct file *file)
229 struct file_security_struct *fsec = file->f_security;
230 file->f_security = NULL;
234 static int superblock_alloc_security(struct super_block *sb)
236 struct superblock_security_struct *sbsec;
238 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
242 init_MUTEX(&sbsec->sem);
243 INIT_LIST_HEAD(&sbsec->list);
244 INIT_LIST_HEAD(&sbsec->isec_head);
245 spin_lock_init(&sbsec->isec_lock);
247 sbsec->sid = SECINITSID_UNLABELED;
248 sbsec->def_sid = SECINITSID_FILE;
249 sb->s_security = sbsec;
254 static void superblock_free_security(struct super_block *sb)
256 struct superblock_security_struct *sbsec = sb->s_security;
258 spin_lock(&sb_security_lock);
259 if (!list_empty(&sbsec->list))
260 list_del_init(&sbsec->list);
261 spin_unlock(&sb_security_lock);
263 sb->s_security = NULL;
267 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
269 struct sk_security_struct *ssec;
271 if (family != PF_UNIX)
274 ssec = kzalloc(sizeof(*ssec), priority);
279 ssec->peer_sid = SECINITSID_UNLABELED;
280 sk->sk_security = ssec;
285 static void sk_free_security(struct sock *sk)
287 struct sk_security_struct *ssec = sk->sk_security;
289 if (sk->sk_family != PF_UNIX)
292 sk->sk_security = NULL;
296 /* The security server must be initialized before
297 any labeling or access decisions can be provided. */
298 extern int ss_initialized;
300 /* The file system's label must be initialized prior to use. */
302 static char *labeling_behaviors[6] = {
304 "uses transition SIDs",
306 "uses genfs_contexts",
307 "not configured for labeling",
308 "uses mountpoint labeling",
311 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
313 static inline int inode_doinit(struct inode *inode)
315 return inode_doinit_with_dentry(inode, NULL);
324 static match_table_t tokens = {
325 {Opt_context, "context=%s"},
326 {Opt_fscontext, "fscontext=%s"},
327 {Opt_defcontext, "defcontext=%s"},
330 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
332 static int try_context_mount(struct super_block *sb, void *data)
334 char *context = NULL, *defcontext = NULL;
337 int alloc = 0, rc = 0, seen = 0;
338 struct task_security_struct *tsec = current->security;
339 struct superblock_security_struct *sbsec = sb->s_security;
344 name = sb->s_type->name;
346 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
348 /* NFS we understand. */
349 if (!strcmp(name, "nfs")) {
350 struct nfs_mount_data *d = data;
352 if (d->version < NFS_MOUNT_VERSION)
356 context = d->context;
363 /* Standard string-based options. */
364 char *p, *options = data;
366 while ((p = strsep(&options, ",")) != NULL) {
368 substring_t args[MAX_OPT_ARGS];
373 token = match_token(p, tokens, args);
379 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
382 context = match_strdup(&args[0]);
393 if (seen & (Opt_context|Opt_fscontext)) {
395 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
398 context = match_strdup(&args[0]);
405 seen |= Opt_fscontext;
409 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
411 printk(KERN_WARNING "SELinux: "
412 "defcontext option is invalid "
413 "for this filesystem type\n");
416 if (seen & (Opt_context|Opt_defcontext)) {
418 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
421 defcontext = match_strdup(&args[0]);
428 seen |= Opt_defcontext;
433 printk(KERN_WARNING "SELinux: unknown mount "
445 rc = security_context_to_sid(context, strlen(context), &sid);
447 printk(KERN_WARNING "SELinux: security_context_to_sid"
448 "(%s) failed for (dev %s, type %s) errno=%d\n",
449 context, sb->s_id, name, rc);
453 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
454 FILESYSTEM__RELABELFROM, NULL);
458 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
459 FILESYSTEM__RELABELTO, NULL);
465 if (seen & Opt_context)
466 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
470 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
472 printk(KERN_WARNING "SELinux: security_context_to_sid"
473 "(%s) failed for (dev %s, type %s) errno=%d\n",
474 defcontext, sb->s_id, name, rc);
478 if (sid == sbsec->def_sid)
481 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
482 FILESYSTEM__RELABELFROM, NULL);
486 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
487 FILESYSTEM__ASSOCIATE, NULL);
491 sbsec->def_sid = sid;
503 static int superblock_doinit(struct super_block *sb, void *data)
505 struct superblock_security_struct *sbsec = sb->s_security;
506 struct dentry *root = sb->s_root;
507 struct inode *inode = root->d_inode;
511 if (sbsec->initialized)
514 if (!ss_initialized) {
515 /* Defer initialization until selinux_complete_init,
516 after the initial policy is loaded and the security
517 server is ready to handle calls. */
518 spin_lock(&sb_security_lock);
519 if (list_empty(&sbsec->list))
520 list_add(&sbsec->list, &superblock_security_head);
521 spin_unlock(&sb_security_lock);
525 /* Determine the labeling behavior to use for this filesystem type. */
526 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
528 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
529 __FUNCTION__, sb->s_type->name, rc);
533 rc = try_context_mount(sb, data);
537 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
538 /* Make sure that the xattr handler exists and that no
539 error other than -ENODATA is returned by getxattr on
540 the root directory. -ENODATA is ok, as this may be
541 the first boot of the SELinux kernel before we have
542 assigned xattr values to the filesystem. */
543 if (!inode->i_op->getxattr) {
544 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
545 "xattr support\n", sb->s_id, sb->s_type->name);
549 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
550 if (rc < 0 && rc != -ENODATA) {
551 if (rc == -EOPNOTSUPP)
552 printk(KERN_WARNING "SELinux: (dev %s, type "
553 "%s) has no security xattr handler\n",
554 sb->s_id, sb->s_type->name);
556 printk(KERN_WARNING "SELinux: (dev %s, type "
557 "%s) getxattr errno %d\n", sb->s_id,
558 sb->s_type->name, -rc);
563 if (strcmp(sb->s_type->name, "proc") == 0)
566 sbsec->initialized = 1;
568 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
569 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
570 sb->s_id, sb->s_type->name);
573 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
574 sb->s_id, sb->s_type->name,
575 labeling_behaviors[sbsec->behavior-1]);
578 /* Initialize the root inode. */
579 rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
581 /* Initialize any other inodes associated with the superblock, e.g.
582 inodes created prior to initial policy load or inodes created
583 during get_sb by a pseudo filesystem that directly
585 spin_lock(&sbsec->isec_lock);
587 if (!list_empty(&sbsec->isec_head)) {
588 struct inode_security_struct *isec =
589 list_entry(sbsec->isec_head.next,
590 struct inode_security_struct, list);
591 struct inode *inode = isec->inode;
592 spin_unlock(&sbsec->isec_lock);
593 inode = igrab(inode);
595 if (!IS_PRIVATE (inode))
599 spin_lock(&sbsec->isec_lock);
600 list_del_init(&isec->list);
603 spin_unlock(&sbsec->isec_lock);
609 static inline u16 inode_mode_to_security_class(umode_t mode)
611 switch (mode & S_IFMT) {
613 return SECCLASS_SOCK_FILE;
615 return SECCLASS_LNK_FILE;
617 return SECCLASS_FILE;
619 return SECCLASS_BLK_FILE;
623 return SECCLASS_CHR_FILE;
625 return SECCLASS_FIFO_FILE;
629 return SECCLASS_FILE;
632 static inline int default_protocol_stream(int protocol)
634 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
637 static inline int default_protocol_dgram(int protocol)
639 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
642 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
649 return SECCLASS_UNIX_STREAM_SOCKET;
651 return SECCLASS_UNIX_DGRAM_SOCKET;
658 if (default_protocol_stream(protocol))
659 return SECCLASS_TCP_SOCKET;
661 return SECCLASS_RAWIP_SOCKET;
663 if (default_protocol_dgram(protocol))
664 return SECCLASS_UDP_SOCKET;
666 return SECCLASS_RAWIP_SOCKET;
668 return SECCLASS_RAWIP_SOCKET;
674 return SECCLASS_NETLINK_ROUTE_SOCKET;
675 case NETLINK_FIREWALL:
676 return SECCLASS_NETLINK_FIREWALL_SOCKET;
677 case NETLINK_INET_DIAG:
678 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
680 return SECCLASS_NETLINK_NFLOG_SOCKET;
682 return SECCLASS_NETLINK_XFRM_SOCKET;
683 case NETLINK_SELINUX:
684 return SECCLASS_NETLINK_SELINUX_SOCKET;
686 return SECCLASS_NETLINK_AUDIT_SOCKET;
688 return SECCLASS_NETLINK_IP6FW_SOCKET;
689 case NETLINK_DNRTMSG:
690 return SECCLASS_NETLINK_DNRT_SOCKET;
691 case NETLINK_KOBJECT_UEVENT:
692 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
694 return SECCLASS_NETLINK_SOCKET;
697 return SECCLASS_PACKET_SOCKET;
699 return SECCLASS_KEY_SOCKET;
701 return SECCLASS_APPLETALK_SOCKET;
704 return SECCLASS_SOCKET;
707 #ifdef CONFIG_PROC_FS
708 static int selinux_proc_get_sid(struct proc_dir_entry *de,
713 char *buffer, *path, *end;
715 buffer = (char*)__get_free_page(GFP_KERNEL);
725 while (de && de != de->parent) {
726 buflen -= de->namelen + 1;
730 memcpy(end, de->name, de->namelen);
735 rc = security_genfs_sid("proc", path, tclass, sid);
736 free_page((unsigned long)buffer);
740 static int selinux_proc_get_sid(struct proc_dir_entry *de,
748 /* The inode's security attributes must be initialized before first use. */
749 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
751 struct superblock_security_struct *sbsec = NULL;
752 struct inode_security_struct *isec = inode->i_security;
754 struct dentry *dentry;
755 #define INITCONTEXTLEN 255
756 char *context = NULL;
761 if (isec->initialized)
766 if (isec->initialized)
769 sbsec = inode->i_sb->s_security;
770 if (!sbsec->initialized) {
771 /* Defer initialization until selinux_complete_init,
772 after the initial policy is loaded and the security
773 server is ready to handle calls. */
774 spin_lock(&sbsec->isec_lock);
775 if (list_empty(&isec->list))
776 list_add(&isec->list, &sbsec->isec_head);
777 spin_unlock(&sbsec->isec_lock);
781 switch (sbsec->behavior) {
782 case SECURITY_FS_USE_XATTR:
783 if (!inode->i_op->getxattr) {
784 isec->sid = sbsec->def_sid;
788 /* Need a dentry, since the xattr API requires one.
789 Life would be simpler if we could just pass the inode. */
791 /* Called from d_instantiate or d_splice_alias. */
792 dentry = dget(opt_dentry);
794 /* Called from selinux_complete_init, try to find a dentry. */
795 dentry = d_find_alias(inode);
798 printk(KERN_WARNING "%s: no dentry for dev=%s "
799 "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
804 len = INITCONTEXTLEN;
805 context = kmalloc(len, GFP_KERNEL);
811 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
814 /* Need a larger buffer. Query for the right size. */
815 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
823 context = kmalloc(len, GFP_KERNEL);
829 rc = inode->i_op->getxattr(dentry,
835 if (rc != -ENODATA) {
836 printk(KERN_WARNING "%s: getxattr returned "
837 "%d for dev=%s ino=%ld\n", __FUNCTION__,
838 -rc, inode->i_sb->s_id, inode->i_ino);
842 /* Map ENODATA to the default file SID */
843 sid = sbsec->def_sid;
846 rc = security_context_to_sid_default(context, rc, &sid,
849 printk(KERN_WARNING "%s: context_to_sid(%s) "
850 "returned %d for dev=%s ino=%ld\n",
851 __FUNCTION__, context, -rc,
852 inode->i_sb->s_id, inode->i_ino);
854 /* Leave with the unlabeled SID */
862 case SECURITY_FS_USE_TASK:
863 isec->sid = isec->task_sid;
865 case SECURITY_FS_USE_TRANS:
866 /* Default to the fs SID. */
867 isec->sid = sbsec->sid;
869 /* Try to obtain a transition SID. */
870 isec->sclass = inode_mode_to_security_class(inode->i_mode);
871 rc = security_transition_sid(isec->task_sid,
880 /* Default to the fs SID. */
881 isec->sid = sbsec->sid;
884 struct proc_inode *proci = PROC_I(inode);
886 isec->sclass = inode_mode_to_security_class(inode->i_mode);
887 rc = selinux_proc_get_sid(proci->pde,
898 isec->initialized = 1;
901 if (isec->sclass == SECCLASS_FILE)
902 isec->sclass = inode_mode_to_security_class(inode->i_mode);
909 /* Convert a Linux signal to an access vector. */
910 static inline u32 signal_to_av(int sig)
916 /* Commonly granted from child to parent. */
917 perm = PROCESS__SIGCHLD;
920 /* Cannot be caught or ignored */
921 perm = PROCESS__SIGKILL;
924 /* Cannot be caught or ignored */
925 perm = PROCESS__SIGSTOP;
928 /* All other signals. */
929 perm = PROCESS__SIGNAL;
936 /* Check permission betweeen a pair of tasks, e.g. signal checks,
937 fork check, ptrace check, etc. */
938 static int task_has_perm(struct task_struct *tsk1,
939 struct task_struct *tsk2,
942 struct task_security_struct *tsec1, *tsec2;
944 tsec1 = tsk1->security;
945 tsec2 = tsk2->security;
946 return avc_has_perm(tsec1->sid, tsec2->sid,
947 SECCLASS_PROCESS, perms, NULL);
950 /* Check whether a task is allowed to use a capability. */
951 static int task_has_capability(struct task_struct *tsk,
954 struct task_security_struct *tsec;
955 struct avc_audit_data ad;
957 tsec = tsk->security;
959 AVC_AUDIT_DATA_INIT(&ad,CAP);
963 return avc_has_perm(tsec->sid, tsec->sid,
964 SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
967 /* Check whether a task is allowed to use a system operation. */
968 static int task_has_system(struct task_struct *tsk,
971 struct task_security_struct *tsec;
973 tsec = tsk->security;
975 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
976 SECCLASS_SYSTEM, perms, NULL);
979 /* Check whether a task has a particular permission to an inode.
980 The 'adp' parameter is optional and allows other audit
981 data to be passed (e.g. the dentry). */
982 static int inode_has_perm(struct task_struct *tsk,
985 struct avc_audit_data *adp)
987 struct task_security_struct *tsec;
988 struct inode_security_struct *isec;
989 struct avc_audit_data ad;
991 tsec = tsk->security;
992 isec = inode->i_security;
996 AVC_AUDIT_DATA_INIT(&ad, FS);
997 ad.u.fs.inode = inode;
1000 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1003 /* Same as inode_has_perm, but pass explicit audit data containing
1004 the dentry to help the auditing code to more easily generate the
1005 pathname if needed. */
1006 static inline int dentry_has_perm(struct task_struct *tsk,
1007 struct vfsmount *mnt,
1008 struct dentry *dentry,
1011 struct inode *inode = dentry->d_inode;
1012 struct avc_audit_data ad;
1013 AVC_AUDIT_DATA_INIT(&ad,FS);
1015 ad.u.fs.dentry = dentry;
1016 return inode_has_perm(tsk, inode, av, &ad);
1019 /* Check whether a task can use an open file descriptor to
1020 access an inode in a given way. Check access to the
1021 descriptor itself, and then use dentry_has_perm to
1022 check a particular permission to the file.
1023 Access to the descriptor is implicitly granted if it
1024 has the same SID as the process. If av is zero, then
1025 access to the file is not checked, e.g. for cases
1026 where only the descriptor is affected like seek. */
1027 static int file_has_perm(struct task_struct *tsk,
1031 struct task_security_struct *tsec = tsk->security;
1032 struct file_security_struct *fsec = file->f_security;
1033 struct vfsmount *mnt = file->f_vfsmnt;
1034 struct dentry *dentry = file->f_dentry;
1035 struct inode *inode = dentry->d_inode;
1036 struct avc_audit_data ad;
1039 AVC_AUDIT_DATA_INIT(&ad, FS);
1041 ad.u.fs.dentry = dentry;
1043 if (tsec->sid != fsec->sid) {
1044 rc = avc_has_perm(tsec->sid, fsec->sid,
1052 /* av is zero if only checking access to the descriptor. */
1054 return inode_has_perm(tsk, inode, av, &ad);
1059 /* Check whether a task can create a file. */
1060 static int may_create(struct inode *dir,
1061 struct dentry *dentry,
1064 struct task_security_struct *tsec;
1065 struct inode_security_struct *dsec;
1066 struct superblock_security_struct *sbsec;
1068 struct avc_audit_data ad;
1071 tsec = current->security;
1072 dsec = dir->i_security;
1073 sbsec = dir->i_sb->s_security;
1075 AVC_AUDIT_DATA_INIT(&ad, FS);
1076 ad.u.fs.dentry = dentry;
1078 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1079 DIR__ADD_NAME | DIR__SEARCH,
1084 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1085 newsid = tsec->create_sid;
1087 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1093 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1097 return avc_has_perm(newsid, sbsec->sid,
1098 SECCLASS_FILESYSTEM,
1099 FILESYSTEM__ASSOCIATE, &ad);
1102 /* Check whether a task can create a key. */
1103 static int may_create_key(u32 ksid,
1104 struct task_struct *ctx)
1106 struct task_security_struct *tsec;
1108 tsec = ctx->security;
1110 return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1114 #define MAY_UNLINK 1
1117 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1118 static int may_link(struct inode *dir,
1119 struct dentry *dentry,
1123 struct task_security_struct *tsec;
1124 struct inode_security_struct *dsec, *isec;
1125 struct avc_audit_data ad;
1129 tsec = current->security;
1130 dsec = dir->i_security;
1131 isec = dentry->d_inode->i_security;
1133 AVC_AUDIT_DATA_INIT(&ad, FS);
1134 ad.u.fs.dentry = dentry;
1137 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1138 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1153 printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
1157 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1161 static inline int may_rename(struct inode *old_dir,
1162 struct dentry *old_dentry,
1163 struct inode *new_dir,
1164 struct dentry *new_dentry)
1166 struct task_security_struct *tsec;
1167 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1168 struct avc_audit_data ad;
1170 int old_is_dir, new_is_dir;
1173 tsec = current->security;
1174 old_dsec = old_dir->i_security;
1175 old_isec = old_dentry->d_inode->i_security;
1176 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1177 new_dsec = new_dir->i_security;
1179 AVC_AUDIT_DATA_INIT(&ad, FS);
1181 ad.u.fs.dentry = old_dentry;
1182 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1183 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1186 rc = avc_has_perm(tsec->sid, old_isec->sid,
1187 old_isec->sclass, FILE__RENAME, &ad);
1190 if (old_is_dir && new_dir != old_dir) {
1191 rc = avc_has_perm(tsec->sid, old_isec->sid,
1192 old_isec->sclass, DIR__REPARENT, &ad);
1197 ad.u.fs.dentry = new_dentry;
1198 av = DIR__ADD_NAME | DIR__SEARCH;
1199 if (new_dentry->d_inode)
1200 av |= DIR__REMOVE_NAME;
1201 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1204 if (new_dentry->d_inode) {
1205 new_isec = new_dentry->d_inode->i_security;
1206 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1207 rc = avc_has_perm(tsec->sid, new_isec->sid,
1209 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1217 /* Check whether a task can perform a filesystem operation. */
1218 static int superblock_has_perm(struct task_struct *tsk,
1219 struct super_block *sb,
1221 struct avc_audit_data *ad)
1223 struct task_security_struct *tsec;
1224 struct superblock_security_struct *sbsec;
1226 tsec = tsk->security;
1227 sbsec = sb->s_security;
1228 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1232 /* Convert a Linux mode and permission mask to an access vector. */
1233 static inline u32 file_mask_to_av(int mode, int mask)
1237 if ((mode & S_IFMT) != S_IFDIR) {
1238 if (mask & MAY_EXEC)
1239 av |= FILE__EXECUTE;
1240 if (mask & MAY_READ)
1243 if (mask & MAY_APPEND)
1245 else if (mask & MAY_WRITE)
1249 if (mask & MAY_EXEC)
1251 if (mask & MAY_WRITE)
1253 if (mask & MAY_READ)
1260 /* Convert a Linux file to an access vector. */
1261 static inline u32 file_to_av(struct file *file)
1265 if (file->f_mode & FMODE_READ)
1267 if (file->f_mode & FMODE_WRITE) {
1268 if (file->f_flags & O_APPEND)
1277 /* Set an inode's SID to a specified value. */
1278 static int inode_security_set_sid(struct inode *inode, u32 sid)
1280 struct inode_security_struct *isec = inode->i_security;
1281 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
1283 if (!sbsec->initialized) {
1284 /* Defer initialization to selinux_complete_init. */
1289 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1291 isec->initialized = 1;
1296 /* Hook functions begin here. */
1298 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1300 struct task_security_struct *psec = parent->security;
1301 struct task_security_struct *csec = child->security;
1304 rc = secondary_ops->ptrace(parent,child);
1308 rc = task_has_perm(parent, child, PROCESS__PTRACE);
1309 /* Save the SID of the tracing process for later use in apply_creds. */
1310 if (!(child->ptrace & PT_PTRACED) && !rc)
1311 csec->ptrace_sid = psec->sid;
1315 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1316 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1320 error = task_has_perm(current, target, PROCESS__GETCAP);
1324 return secondary_ops->capget(target, effective, inheritable, permitted);
1327 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1328 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1332 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1336 return task_has_perm(current, target, PROCESS__SETCAP);
1339 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1340 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1342 secondary_ops->capset_set(target, effective, inheritable, permitted);
1345 static int selinux_capable(struct task_struct *tsk, int cap)
1349 rc = secondary_ops->capable(tsk, cap);
1353 return task_has_capability(tsk,cap);
1356 static int selinux_sysctl(ctl_table *table, int op)
1360 struct task_security_struct *tsec;
1364 rc = secondary_ops->sysctl(table, op);
1368 tsec = current->security;
1370 rc = selinux_proc_get_sid(table->de, (op == 001) ?
1371 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1373 /* Default to the well-defined sysctl SID. */
1374 tsid = SECINITSID_SYSCTL;
1377 /* The op values are "defined" in sysctl.c, thereby creating
1378 * a bad coupling between this module and sysctl.c */
1380 error = avc_has_perm(tsec->sid, tsid,
1381 SECCLASS_DIR, DIR__SEARCH, NULL);
1389 error = avc_has_perm(tsec->sid, tsid,
1390 SECCLASS_FILE, av, NULL);
1396 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1409 rc = superblock_has_perm(current,
1411 FILESYSTEM__QUOTAMOD, NULL);
1416 rc = superblock_has_perm(current,
1418 FILESYSTEM__QUOTAGET, NULL);
1421 rc = 0; /* let the kernel handle invalid cmds */
1427 static int selinux_quota_on(struct dentry *dentry)
1429 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1432 static int selinux_syslog(int type)
1436 rc = secondary_ops->syslog(type);
1441 case 3: /* Read last kernel messages */
1442 case 10: /* Return size of the log buffer */
1443 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1445 case 6: /* Disable logging to console */
1446 case 7: /* Enable logging to console */
1447 case 8: /* Set level of messages printed to console */
1448 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1450 case 0: /* Close log */
1451 case 1: /* Open log */
1452 case 2: /* Read from log */
1453 case 4: /* Read/clear last kernel messages */
1454 case 5: /* Clear ring buffer */
1456 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1463 * Check that a process has enough memory to allocate a new virtual
1464 * mapping. 0 means there is enough memory for the allocation to
1465 * succeed and -ENOMEM implies there is not.
1467 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1468 * if the capability is granted, but __vm_enough_memory requires 1 if
1469 * the capability is granted.
1471 * Do not audit the selinux permission check, as this is applied to all
1472 * processes that allocate mappings.
1474 static int selinux_vm_enough_memory(long pages)
1476 int rc, cap_sys_admin = 0;
1477 struct task_security_struct *tsec = current->security;
1479 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1481 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1482 SECCLASS_CAPABILITY,
1483 CAP_TO_MASK(CAP_SYS_ADMIN),
1489 return __vm_enough_memory(pages, cap_sys_admin);
1492 /* binprm security operations */
1494 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1496 struct bprm_security_struct *bsec;
1498 bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1503 bsec->sid = SECINITSID_UNLABELED;
1506 bprm->security = bsec;
1510 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1512 struct task_security_struct *tsec;
1513 struct inode *inode = bprm->file->f_dentry->d_inode;
1514 struct inode_security_struct *isec;
1515 struct bprm_security_struct *bsec;
1517 struct avc_audit_data ad;
1520 rc = secondary_ops->bprm_set_security(bprm);
1524 bsec = bprm->security;
1529 tsec = current->security;
1530 isec = inode->i_security;
1532 /* Default to the current task SID. */
1533 bsec->sid = tsec->sid;
1535 /* Reset fs, key, and sock SIDs on execve. */
1536 tsec->create_sid = 0;
1537 tsec->keycreate_sid = 0;
1538 tsec->sockcreate_sid = 0;
1540 if (tsec->exec_sid) {
1541 newsid = tsec->exec_sid;
1542 /* Reset exec SID on execve. */
1545 /* Check for a default transition on this program. */
1546 rc = security_transition_sid(tsec->sid, isec->sid,
1547 SECCLASS_PROCESS, &newsid);
1552 AVC_AUDIT_DATA_INIT(&ad, FS);
1553 ad.u.fs.mnt = bprm->file->f_vfsmnt;
1554 ad.u.fs.dentry = bprm->file->f_dentry;
1556 if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
1559 if (tsec->sid == newsid) {
1560 rc = avc_has_perm(tsec->sid, isec->sid,
1561 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1565 /* Check permissions for the transition. */
1566 rc = avc_has_perm(tsec->sid, newsid,
1567 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1571 rc = avc_has_perm(newsid, isec->sid,
1572 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1576 /* Clear any possibly unsafe personality bits on exec: */
1577 current->personality &= ~PER_CLEAR_ON_SETID;
1579 /* Set the security field to the new SID. */
1587 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1589 return secondary_ops->bprm_check_security(bprm);
1593 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1595 struct task_security_struct *tsec = current->security;
1598 if (tsec->osid != tsec->sid) {
1599 /* Enable secure mode for SIDs transitions unless
1600 the noatsecure permission is granted between
1601 the two SIDs, i.e. ahp returns 0. */
1602 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1604 PROCESS__NOATSECURE, NULL);
1607 return (atsecure || secondary_ops->bprm_secureexec(bprm));
1610 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1612 kfree(bprm->security);
1613 bprm->security = NULL;
1616 extern struct vfsmount *selinuxfs_mount;
1617 extern struct dentry *selinux_null;
1619 /* Derived from fs/exec.c:flush_old_files. */
1620 static inline void flush_unauthorized_files(struct files_struct * files)
1622 struct avc_audit_data ad;
1623 struct file *file, *devnull = NULL;
1624 struct tty_struct *tty = current->signal->tty;
1625 struct fdtable *fdt;
1630 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
1632 /* Revalidate access to controlling tty.
1633 Use inode_has_perm on the tty inode directly rather
1634 than using file_has_perm, as this particular open
1635 file may belong to another process and we are only
1636 interested in the inode-based check here. */
1637 struct inode *inode = file->f_dentry->d_inode;
1638 if (inode_has_perm(current, inode,
1639 FILE__READ | FILE__WRITE, NULL)) {
1640 /* Reset controlling tty. */
1641 current->signal->tty = NULL;
1642 current->signal->tty_old_pgrp = 0;
1648 /* Revalidate access to inherited open files. */
1650 AVC_AUDIT_DATA_INIT(&ad,FS);
1652 spin_lock(&files->file_lock);
1654 unsigned long set, i;
1659 fdt = files_fdtable(files);
1660 if (i >= fdt->max_fds || i >= fdt->max_fdset)
1662 set = fdt->open_fds->fds_bits[j];
1665 spin_unlock(&files->file_lock);
1666 for ( ; set ; i++,set >>= 1) {
1671 if (file_has_perm(current,
1673 file_to_av(file))) {
1675 fd = get_unused_fd();
1685 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1692 fd_install(fd, devnull);
1697 spin_lock(&files->file_lock);
1700 spin_unlock(&files->file_lock);
1703 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1705 struct task_security_struct *tsec;
1706 struct bprm_security_struct *bsec;
1710 secondary_ops->bprm_apply_creds(bprm, unsafe);
1712 tsec = current->security;
1714 bsec = bprm->security;
1717 tsec->osid = tsec->sid;
1719 if (tsec->sid != sid) {
1720 /* Check for shared state. If not ok, leave SID
1721 unchanged and kill. */
1722 if (unsafe & LSM_UNSAFE_SHARE) {
1723 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1724 PROCESS__SHARE, NULL);
1731 /* Check for ptracing, and update the task SID if ok.
1732 Otherwise, leave SID unchanged and kill. */
1733 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1734 rc = avc_has_perm(tsec->ptrace_sid, sid,
1735 SECCLASS_PROCESS, PROCESS__PTRACE,
1747 * called after apply_creds without the task lock held
1749 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1751 struct task_security_struct *tsec;
1752 struct rlimit *rlim, *initrlim;
1753 struct itimerval itimer;
1754 struct bprm_security_struct *bsec;
1757 tsec = current->security;
1758 bsec = bprm->security;
1761 force_sig_specific(SIGKILL, current);
1764 if (tsec->osid == tsec->sid)
1767 /* Close files for which the new task SID is not authorized. */
1768 flush_unauthorized_files(current->files);
1770 /* Check whether the new SID can inherit signal state
1771 from the old SID. If not, clear itimers to avoid
1772 subsequent signal generation and flush and unblock
1773 signals. This must occur _after_ the task SID has
1774 been updated so that any kill done after the flush
1775 will be checked against the new SID. */
1776 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1777 PROCESS__SIGINH, NULL);
1779 memset(&itimer, 0, sizeof itimer);
1780 for (i = 0; i < 3; i++)
1781 do_setitimer(i, &itimer, NULL);
1782 flush_signals(current);
1783 spin_lock_irq(¤t->sighand->siglock);
1784 flush_signal_handlers(current, 1);
1785 sigemptyset(¤t->blocked);
1786 recalc_sigpending();
1787 spin_unlock_irq(¤t->sighand->siglock);
1790 /* Check whether the new SID can inherit resource limits
1791 from the old SID. If not, reset all soft limits to
1792 the lower of the current task's hard limit and the init
1793 task's soft limit. Note that the setting of hard limits
1794 (even to lower them) can be controlled by the setrlimit
1795 check. The inclusion of the init task's soft limit into
1796 the computation is to avoid resetting soft limits higher
1797 than the default soft limit for cases where the default
1798 is lower than the hard limit, e.g. RLIMIT_CORE or
1800 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1801 PROCESS__RLIMITINH, NULL);
1803 for (i = 0; i < RLIM_NLIMITS; i++) {
1804 rlim = current->signal->rlim + i;
1805 initrlim = init_task.signal->rlim+i;
1806 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1808 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1810 * This will cause RLIMIT_CPU calculations
1813 current->it_prof_expires = jiffies_to_cputime(1);
1817 /* Wake up the parent if it is waiting so that it can
1818 recheck wait permission to the new task SID. */
1819 wake_up_interruptible(¤t->parent->signal->wait_chldexit);
1822 /* superblock security operations */
1824 static int selinux_sb_alloc_security(struct super_block *sb)
1826 return superblock_alloc_security(sb);
1829 static void selinux_sb_free_security(struct super_block *sb)
1831 superblock_free_security(sb);
1834 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1839 return !memcmp(prefix, option, plen);
1842 static inline int selinux_option(char *option, int len)
1844 return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1845 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1846 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len));
1849 static inline void take_option(char **to, char *from, int *first, int len)
1857 memcpy(*to, from, len);
1861 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
1863 int fnosec, fsec, rc = 0;
1864 char *in_save, *in_curr, *in_end;
1865 char *sec_curr, *nosec_save, *nosec;
1870 /* Binary mount data: just copy */
1871 if (type->fs_flags & FS_BINARY_MOUNTDATA) {
1872 copy_page(sec_curr, in_curr);
1876 nosec = (char *)get_zeroed_page(GFP_KERNEL);
1884 in_save = in_end = orig;
1887 if (*in_end == ',' || *in_end == '\0') {
1888 int len = in_end - in_curr;
1890 if (selinux_option(in_curr, len))
1891 take_option(&sec_curr, in_curr, &fsec, len);
1893 take_option(&nosec, in_curr, &fnosec, len);
1895 in_curr = in_end + 1;
1897 } while (*in_end++);
1899 strcpy(in_save, nosec_save);
1900 free_page((unsigned long)nosec_save);
1905 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
1907 struct avc_audit_data ad;
1910 rc = superblock_doinit(sb, data);
1914 AVC_AUDIT_DATA_INIT(&ad,FS);
1915 ad.u.fs.dentry = sb->s_root;
1916 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
1919 static int selinux_sb_statfs(struct dentry *dentry)
1921 struct avc_audit_data ad;
1923 AVC_AUDIT_DATA_INIT(&ad,FS);
1924 ad.u.fs.dentry = dentry->d_sb->s_root;
1925 return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
1928 static int selinux_mount(char * dev_name,
1929 struct nameidata *nd,
1931 unsigned long flags,
1936 rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
1940 if (flags & MS_REMOUNT)
1941 return superblock_has_perm(current, nd->mnt->mnt_sb,
1942 FILESYSTEM__REMOUNT, NULL);
1944 return dentry_has_perm(current, nd->mnt, nd->dentry,
1948 static int selinux_umount(struct vfsmount *mnt, int flags)
1952 rc = secondary_ops->sb_umount(mnt, flags);
1956 return superblock_has_perm(current,mnt->mnt_sb,
1957 FILESYSTEM__UNMOUNT,NULL);
1960 /* inode security operations */
1962 static int selinux_inode_alloc_security(struct inode *inode)
1964 return inode_alloc_security(inode);
1967 static void selinux_inode_free_security(struct inode *inode)
1969 inode_free_security(inode);
1972 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
1973 char **name, void **value,
1976 struct task_security_struct *tsec;
1977 struct inode_security_struct *dsec;
1978 struct superblock_security_struct *sbsec;
1981 char *namep = NULL, *context;
1983 tsec = current->security;
1984 dsec = dir->i_security;
1985 sbsec = dir->i_sb->s_security;
1987 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1988 newsid = tsec->create_sid;
1990 rc = security_transition_sid(tsec->sid, dsec->sid,
1991 inode_mode_to_security_class(inode->i_mode),
1994 printk(KERN_WARNING "%s: "
1995 "security_transition_sid failed, rc=%d (dev=%s "
1998 -rc, inode->i_sb->s_id, inode->i_ino);
2003 inode_security_set_sid(inode, newsid);
2005 if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2009 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
2016 rc = security_sid_to_context(newsid, &context, &clen);
2028 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2030 return may_create(dir, dentry, SECCLASS_FILE);
2033 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2037 rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2040 return may_link(dir, old_dentry, MAY_LINK);
2043 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2047 rc = secondary_ops->inode_unlink(dir, dentry);
2050 return may_link(dir, dentry, MAY_UNLINK);
2053 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2055 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2058 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2060 return may_create(dir, dentry, SECCLASS_DIR);
2063 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2065 return may_link(dir, dentry, MAY_RMDIR);
2068 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2072 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2076 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2079 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2080 struct inode *new_inode, struct dentry *new_dentry)
2082 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2085 static int selinux_inode_readlink(struct dentry *dentry)
2087 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2090 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2094 rc = secondary_ops->inode_follow_link(dentry,nameidata);
2097 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2100 static int selinux_inode_permission(struct inode *inode, int mask,
2101 struct nameidata *nd)
2105 rc = secondary_ops->inode_permission(inode, mask, nd);
2110 /* No permission to check. Existence test. */
2114 return inode_has_perm(current, inode,
2115 file_mask_to_av(inode->i_mode, mask), NULL);
2118 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2122 rc = secondary_ops->inode_setattr(dentry, iattr);
2126 if (iattr->ia_valid & ATTR_FORCE)
2129 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2130 ATTR_ATIME_SET | ATTR_MTIME_SET))
2131 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2133 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2136 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2138 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2141 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2143 struct task_security_struct *tsec = current->security;
2144 struct inode *inode = dentry->d_inode;
2145 struct inode_security_struct *isec = inode->i_security;
2146 struct superblock_security_struct *sbsec;
2147 struct avc_audit_data ad;
2151 if (strcmp(name, XATTR_NAME_SELINUX)) {
2152 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2153 sizeof XATTR_SECURITY_PREFIX - 1) &&
2154 !capable(CAP_SYS_ADMIN)) {
2155 /* A different attribute in the security namespace.
2156 Restrict to administrator. */
2160 /* Not an attribute we recognize, so just check the
2161 ordinary setattr permission. */
2162 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2165 sbsec = inode->i_sb->s_security;
2166 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2169 if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2172 AVC_AUDIT_DATA_INIT(&ad,FS);
2173 ad.u.fs.dentry = dentry;
2175 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2176 FILE__RELABELFROM, &ad);
2180 rc = security_context_to_sid(value, size, &newsid);
2184 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2185 FILE__RELABELTO, &ad);
2189 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2194 return avc_has_perm(newsid,
2196 SECCLASS_FILESYSTEM,
2197 FILESYSTEM__ASSOCIATE,
2201 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2202 void *value, size_t size, int flags)
2204 struct inode *inode = dentry->d_inode;
2205 struct inode_security_struct *isec = inode->i_security;
2209 if (strcmp(name, XATTR_NAME_SELINUX)) {
2210 /* Not an attribute we recognize, so nothing to do. */
2214 rc = security_context_to_sid(value, size, &newsid);
2216 printk(KERN_WARNING "%s: unable to obtain SID for context "
2217 "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2225 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2227 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2230 static int selinux_inode_listxattr (struct dentry *dentry)
2232 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2235 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2237 if (strcmp(name, XATTR_NAME_SELINUX)) {
2238 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2239 sizeof XATTR_SECURITY_PREFIX - 1) &&
2240 !capable(CAP_SYS_ADMIN)) {
2241 /* A different attribute in the security namespace.
2242 Restrict to administrator. */
2246 /* Not an attribute we recognize, so just check the
2247 ordinary setattr permission. Might want a separate
2248 permission for removexattr. */
2249 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2252 /* No one is allowed to remove a SELinux security label.
2253 You can change the label, but all data must be labeled. */
2257 static const char *selinux_inode_xattr_getsuffix(void)
2259 return XATTR_SELINUX_SUFFIX;
2263 * Copy the in-core inode security context value to the user. If the
2264 * getxattr() prior to this succeeded, check to see if we need to
2265 * canonicalize the value to be finally returned to the user.
2267 * Permission check is handled by selinux_inode_getxattr hook.
2269 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void *buffer, size_t size, int err)
2271 struct inode_security_struct *isec = inode->i_security;
2273 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2276 return selinux_getsecurity(isec->sid, buffer, size);
2279 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2280 const void *value, size_t size, int flags)
2282 struct inode_security_struct *isec = inode->i_security;
2286 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2289 if (!value || !size)
2292 rc = security_context_to_sid((void*)value, size, &newsid);
2300 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2302 const int len = sizeof(XATTR_NAME_SELINUX);
2303 if (buffer && len <= buffer_size)
2304 memcpy(buffer, XATTR_NAME_SELINUX, len);
2308 /* file security operations */
2310 static int selinux_file_permission(struct file *file, int mask)
2312 struct inode *inode = file->f_dentry->d_inode;
2315 /* No permission to check. Existence test. */
2319 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2320 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2323 return file_has_perm(current, file,
2324 file_mask_to_av(inode->i_mode, mask));
2327 static int selinux_file_alloc_security(struct file *file)
2329 return file_alloc_security(file);
2332 static void selinux_file_free_security(struct file *file)
2334 file_free_security(file);
2337 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2349 case EXT2_IOC_GETFLAGS:
2351 case EXT2_IOC_GETVERSION:
2352 error = file_has_perm(current, file, FILE__GETATTR);
2355 case EXT2_IOC_SETFLAGS:
2357 case EXT2_IOC_SETVERSION:
2358 error = file_has_perm(current, file, FILE__SETATTR);
2361 /* sys_ioctl() checks */
2365 error = file_has_perm(current, file, 0);
2370 error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2373 /* default case assumes that the command will go
2374 * to the file's ioctl() function.
2377 error = file_has_perm(current, file, FILE__IOCTL);
2383 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2385 #ifndef CONFIG_PPC32
2386 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2388 * We are making executable an anonymous mapping or a
2389 * private file mapping that will also be writable.
2390 * This has an additional check.
2392 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2399 /* read access is always possible with a mapping */
2400 u32 av = FILE__READ;
2402 /* write access only matters if the mapping is shared */
2403 if (shared && (prot & PROT_WRITE))
2406 if (prot & PROT_EXEC)
2407 av |= FILE__EXECUTE;
2409 return file_has_perm(current, file, av);
2414 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2415 unsigned long prot, unsigned long flags)
2419 rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2423 if (selinux_checkreqprot)
2426 return file_map_prot_check(file, prot,
2427 (flags & MAP_TYPE) == MAP_SHARED);
2430 static int selinux_file_mprotect(struct vm_area_struct *vma,
2431 unsigned long reqprot,
2436 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2440 if (selinux_checkreqprot)
2443 #ifndef CONFIG_PPC32
2444 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2446 if (vma->vm_start >= vma->vm_mm->start_brk &&
2447 vma->vm_end <= vma->vm_mm->brk) {
2448 rc = task_has_perm(current, current,
2450 } else if (!vma->vm_file &&
2451 vma->vm_start <= vma->vm_mm->start_stack &&
2452 vma->vm_end >= vma->vm_mm->start_stack) {
2453 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2454 } else if (vma->vm_file && vma->anon_vma) {
2456 * We are making executable a file mapping that has
2457 * had some COW done. Since pages might have been
2458 * written, check ability to execute the possibly
2459 * modified content. This typically should only
2460 * occur for text relocations.
2462 rc = file_has_perm(current, vma->vm_file,
2470 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2473 static int selinux_file_lock(struct file *file, unsigned int cmd)
2475 return file_has_perm(current, file, FILE__LOCK);
2478 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2485 if (!file->f_dentry || !file->f_dentry->d_inode) {
2490 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2491 err = file_has_perm(current, file,FILE__WRITE);
2500 /* Just check FD__USE permission */
2501 err = file_has_perm(current, file, 0);
2506 #if BITS_PER_LONG == 32
2511 if (!file->f_dentry || !file->f_dentry->d_inode) {
2515 err = file_has_perm(current, file, FILE__LOCK);
2522 static int selinux_file_set_fowner(struct file *file)
2524 struct task_security_struct *tsec;
2525 struct file_security_struct *fsec;
2527 tsec = current->security;
2528 fsec = file->f_security;
2529 fsec->fown_sid = tsec->sid;
2534 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2535 struct fown_struct *fown, int signum)
2539 struct task_security_struct *tsec;
2540 struct file_security_struct *fsec;
2542 /* struct fown_struct is never outside the context of a struct file */
2543 file = (struct file *)((long)fown - offsetof(struct file,f_owner));
2545 tsec = tsk->security;
2546 fsec = file->f_security;
2549 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2551 perm = signal_to_av(signum);
2553 return avc_has_perm(fsec->fown_sid, tsec->sid,
2554 SECCLASS_PROCESS, perm, NULL);
2557 static int selinux_file_receive(struct file *file)
2559 return file_has_perm(current, file, file_to_av(file));
2562 /* task security operations */
2564 static int selinux_task_create(unsigned long clone_flags)
2568 rc = secondary_ops->task_create(clone_flags);
2572 return task_has_perm(current, current, PROCESS__FORK);
2575 static int selinux_task_alloc_security(struct task_struct *tsk)
2577 struct task_security_struct *tsec1, *tsec2;
2580 tsec1 = current->security;
2582 rc = task_alloc_security(tsk);
2585 tsec2 = tsk->security;
2587 tsec2->osid = tsec1->osid;
2588 tsec2->sid = tsec1->sid;
2590 /* Retain the exec, fs, key, and sock SIDs across fork */
2591 tsec2->exec_sid = tsec1->exec_sid;
2592 tsec2->create_sid = tsec1->create_sid;
2593 tsec2->keycreate_sid = tsec1->keycreate_sid;
2594 tsec2->sockcreate_sid = tsec1->sockcreate_sid;
2596 /* Retain ptracer SID across fork, if any.
2597 This will be reset by the ptrace hook upon any
2598 subsequent ptrace_attach operations. */
2599 tsec2->ptrace_sid = tsec1->ptrace_sid;
2604 static void selinux_task_free_security(struct task_struct *tsk)
2606 task_free_security(tsk);
2609 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2611 /* Since setuid only affects the current process, and
2612 since the SELinux controls are not based on the Linux
2613 identity attributes, SELinux does not need to control
2614 this operation. However, SELinux does control the use
2615 of the CAP_SETUID and CAP_SETGID capabilities using the
2620 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2622 return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2625 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2627 /* See the comment for setuid above. */
2631 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2633 return task_has_perm(current, p, PROCESS__SETPGID);
2636 static int selinux_task_getpgid(struct task_struct *p)
2638 return task_has_perm(current, p, PROCESS__GETPGID);
2641 static int selinux_task_getsid(struct task_struct *p)
2643 return task_has_perm(current, p, PROCESS__GETSESSION);
2646 static int selinux_task_setgroups(struct group_info *group_info)
2648 /* See the comment for setuid above. */
2652 static int selinux_task_setnice(struct task_struct *p, int nice)
2656 rc = secondary_ops->task_setnice(p, nice);
2660 return task_has_perm(current,p, PROCESS__SETSCHED);
2663 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
2665 return task_has_perm(current, p, PROCESS__SETSCHED);
2668 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2670 struct rlimit *old_rlim = current->signal->rlim + resource;
2673 rc = secondary_ops->task_setrlimit(resource, new_rlim);
2677 /* Control the ability to change the hard limit (whether
2678 lowering or raising it), so that the hard limit can
2679 later be used as a safe reset point for the soft limit
2680 upon context transitions. See selinux_bprm_apply_creds. */
2681 if (old_rlim->rlim_max != new_rlim->rlim_max)
2682 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2687 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2689 return task_has_perm(current, p, PROCESS__SETSCHED);
2692 static int selinux_task_getscheduler(struct task_struct *p)
2694 return task_has_perm(current, p, PROCESS__GETSCHED);
2697 static int selinux_task_movememory(struct task_struct *p)
2699 return task_has_perm(current, p, PROCESS__SETSCHED);
2702 static int selinux_task_kill(struct task_struct *p, struct siginfo *info, int sig)
2707 rc = secondary_ops->task_kill(p, info, sig);
2711 if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
2715 perm = PROCESS__SIGNULL; /* null signal; existence test */
2717 perm = signal_to_av(sig);
2719 return task_has_perm(current, p, perm);
2722 static int selinux_task_prctl(int option,
2728 /* The current prctl operations do not appear to require
2729 any SELinux controls since they merely observe or modify
2730 the state of the current process. */
2734 static int selinux_task_wait(struct task_struct *p)
2738 perm = signal_to_av(p->exit_signal);
2740 return task_has_perm(p, current, perm);
2743 static void selinux_task_reparent_to_init(struct task_struct *p)
2745 struct task_security_struct *tsec;
2747 secondary_ops->task_reparent_to_init(p);
2750 tsec->osid = tsec->sid;
2751 tsec->sid = SECINITSID_KERNEL;
2755 static void selinux_task_to_inode(struct task_struct *p,
2756 struct inode *inode)
2758 struct task_security_struct *tsec = p->security;
2759 struct inode_security_struct *isec = inode->i_security;
2761 isec->sid = tsec->sid;
2762 isec->initialized = 1;
2766 /* Returns error only if unable to parse addresses */
2767 static int selinux_parse_skb_ipv4(struct sk_buff *skb, struct avc_audit_data *ad)
2769 int offset, ihlen, ret = -EINVAL;
2770 struct iphdr _iph, *ih;
2772 offset = skb->nh.raw - skb->data;
2773 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2777 ihlen = ih->ihl * 4;
2778 if (ihlen < sizeof(_iph))
2781 ad->u.net.v4info.saddr = ih->saddr;
2782 ad->u.net.v4info.daddr = ih->daddr;
2785 switch (ih->protocol) {
2787 struct tcphdr _tcph, *th;
2789 if (ntohs(ih->frag_off) & IP_OFFSET)
2793 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2797 ad->u.net.sport = th->source;
2798 ad->u.net.dport = th->dest;
2803 struct udphdr _udph, *uh;
2805 if (ntohs(ih->frag_off) & IP_OFFSET)
2809 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2813 ad->u.net.sport = uh->source;
2814 ad->u.net.dport = uh->dest;
2825 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2827 /* Returns error only if unable to parse addresses */
2828 static int selinux_parse_skb_ipv6(struct sk_buff *skb, struct avc_audit_data *ad)
2831 int ret = -EINVAL, offset;
2832 struct ipv6hdr _ipv6h, *ip6;
2834 offset = skb->nh.raw - skb->data;
2835 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
2839 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
2840 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
2843 nexthdr = ip6->nexthdr;
2844 offset += sizeof(_ipv6h);
2845 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
2851 struct tcphdr _tcph, *th;
2853 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2857 ad->u.net.sport = th->source;
2858 ad->u.net.dport = th->dest;
2863 struct udphdr _udph, *uh;
2865 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2869 ad->u.net.sport = uh->source;
2870 ad->u.net.dport = uh->dest;
2874 /* includes fragments */
2884 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
2885 char **addrp, int *len, int src)
2889 switch (ad->u.net.family) {
2891 ret = selinux_parse_skb_ipv4(skb, ad);
2895 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
2896 &ad->u.net.v4info.daddr);
2899 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2901 ret = selinux_parse_skb_ipv6(skb, ad);
2905 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
2906 &ad->u.net.v6info.daddr);
2916 /* socket security operations */
2917 static int socket_has_perm(struct task_struct *task, struct socket *sock,
2920 struct inode_security_struct *isec;
2921 struct task_security_struct *tsec;
2922 struct avc_audit_data ad;
2925 tsec = task->security;
2926 isec = SOCK_INODE(sock)->i_security;
2928 if (isec->sid == SECINITSID_KERNEL)
2931 AVC_AUDIT_DATA_INIT(&ad,NET);
2932 ad.u.net.sk = sock->sk;
2933 err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
2939 static int selinux_socket_create(int family, int type,
2940 int protocol, int kern)
2943 struct task_security_struct *tsec;
2949 tsec = current->security;
2950 newsid = tsec->sockcreate_sid ? : tsec->sid;
2951 err = avc_has_perm(tsec->sid, newsid,
2952 socket_type_to_security_class(family, type,
2953 protocol), SOCKET__CREATE, NULL);
2959 static void selinux_socket_post_create(struct socket *sock, int family,
2960 int type, int protocol, int kern)
2962 struct inode_security_struct *isec;
2963 struct task_security_struct *tsec;
2966 isec = SOCK_INODE(sock)->i_security;
2968 tsec = current->security;
2969 newsid = tsec->sockcreate_sid ? : tsec->sid;
2970 isec->sclass = socket_type_to_security_class(family, type, protocol);
2971 isec->sid = kern ? SECINITSID_KERNEL : newsid;
2972 isec->initialized = 1;
2977 /* Range of port numbers used to automatically bind.
2978 Need to determine whether we should perform a name_bind
2979 permission check between the socket and the port number. */
2980 #define ip_local_port_range_0 sysctl_local_port_range[0]
2981 #define ip_local_port_range_1 sysctl_local_port_range[1]
2983 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
2988 err = socket_has_perm(current, sock, SOCKET__BIND);
2993 * If PF_INET or PF_INET6, check name_bind permission for the port.
2994 * Multiple address binding for SCTP is not supported yet: we just
2995 * check the first address now.
2997 family = sock->sk->sk_family;
2998 if (family == PF_INET || family == PF_INET6) {
3000 struct inode_security_struct *isec;
3001 struct task_security_struct *tsec;
3002 struct avc_audit_data ad;
3003 struct sockaddr_in *addr4 = NULL;
3004 struct sockaddr_in6 *addr6 = NULL;
3005 unsigned short snum;
3006 struct sock *sk = sock->sk;
3007 u32 sid, node_perm, addrlen;
3009 tsec = current->security;
3010 isec = SOCK_INODE(sock)->i_security;
3012 if (family == PF_INET) {
3013 addr4 = (struct sockaddr_in *)address;
3014 snum = ntohs(addr4->sin_port);
3015 addrlen = sizeof(addr4->sin_addr.s_addr);
3016 addrp = (char *)&addr4->sin_addr.s_addr;
3018 addr6 = (struct sockaddr_in6 *)address;
3019 snum = ntohs(addr6->sin6_port);
3020 addrlen = sizeof(addr6->sin6_addr.s6_addr);
3021 addrp = (char *)&addr6->sin6_addr.s6_addr;
3024 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3025 snum > ip_local_port_range_1)) {
3026 err = security_port_sid(sk->sk_family, sk->sk_type,
3027 sk->sk_protocol, snum, &sid);
3030 AVC_AUDIT_DATA_INIT(&ad,NET);
3031 ad.u.net.sport = htons(snum);
3032 ad.u.net.family = family;
3033 err = avc_has_perm(isec->sid, sid,
3035 SOCKET__NAME_BIND, &ad);
3040 switch(isec->sclass) {
3041 case SECCLASS_TCP_SOCKET:
3042 node_perm = TCP_SOCKET__NODE_BIND;
3045 case SECCLASS_UDP_SOCKET:
3046 node_perm = UDP_SOCKET__NODE_BIND;
3050 node_perm = RAWIP_SOCKET__NODE_BIND;
3054 err = security_node_sid(family, addrp, addrlen, &sid);
3058 AVC_AUDIT_DATA_INIT(&ad,NET);
3059 ad.u.net.sport = htons(snum);
3060 ad.u.net.family = family;
3062 if (family == PF_INET)
3063 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3065 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3067 err = avc_has_perm(isec->sid, sid,
3068 isec->sclass, node_perm, &ad);
3076 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3078 struct inode_security_struct *isec;
3081 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3086 * If a TCP socket, check name_connect permission for the port.
3088 isec = SOCK_INODE(sock)->i_security;
3089 if (isec->sclass == SECCLASS_TCP_SOCKET) {
3090 struct sock *sk = sock->sk;
3091 struct avc_audit_data ad;
3092 struct sockaddr_in *addr4 = NULL;
3093 struct sockaddr_in6 *addr6 = NULL;
3094 unsigned short snum;
3097 if (sk->sk_family == PF_INET) {
3098 addr4 = (struct sockaddr_in *)address;
3099 if (addrlen < sizeof(struct sockaddr_in))
3101 snum = ntohs(addr4->sin_port);
3103 addr6 = (struct sockaddr_in6 *)address;
3104 if (addrlen < SIN6_LEN_RFC2133)
3106 snum = ntohs(addr6->sin6_port);
3109 err = security_port_sid(sk->sk_family, sk->sk_type,
3110 sk->sk_protocol, snum, &sid);
3114 AVC_AUDIT_DATA_INIT(&ad,NET);
3115 ad.u.net.dport = htons(snum);
3116 ad.u.net.family = sk->sk_family;
3117 err = avc_has_perm(isec->sid, sid, isec->sclass,
3118 TCP_SOCKET__NAME_CONNECT, &ad);
3127 static int selinux_socket_listen(struct socket *sock, int backlog)
3129 return socket_has_perm(current, sock, SOCKET__LISTEN);
3132 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3135 struct inode_security_struct *isec;
3136 struct inode_security_struct *newisec;
3138 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3142 newisec = SOCK_INODE(newsock)->i_security;
3144 isec = SOCK_INODE(sock)->i_security;
3145 newisec->sclass = isec->sclass;
3146 newisec->sid = isec->sid;
3147 newisec->initialized = 1;
3152 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3155 return socket_has_perm(current, sock, SOCKET__WRITE);
3158 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3159 int size, int flags)
3161 return socket_has_perm(current, sock, SOCKET__READ);
3164 static int selinux_socket_getsockname(struct socket *sock)
3166 return socket_has_perm(current, sock, SOCKET__GETATTR);
3169 static int selinux_socket_getpeername(struct socket *sock)
3171 return socket_has_perm(current, sock, SOCKET__GETATTR);
3174 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3176 return socket_has_perm(current, sock, SOCKET__SETOPT);
3179 static int selinux_socket_getsockopt(struct socket *sock, int level,
3182 return socket_has_perm(current, sock, SOCKET__GETOPT);
3185 static int selinux_socket_shutdown(struct socket *sock, int how)
3187 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3190 static int selinux_socket_unix_stream_connect(struct socket *sock,
3191 struct socket *other,
3194 struct sk_security_struct *ssec;
3195 struct inode_security_struct *isec;
3196 struct inode_security_struct *other_isec;
3197 struct avc_audit_data ad;
3200 err = secondary_ops->unix_stream_connect(sock, other, newsk);
3204 isec = SOCK_INODE(sock)->i_security;
3205 other_isec = SOCK_INODE(other)->i_security;
3207 AVC_AUDIT_DATA_INIT(&ad,NET);
3208 ad.u.net.sk = other->sk;
3210 err = avc_has_perm(isec->sid, other_isec->sid,
3212 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3216 /* connecting socket */
3217 ssec = sock->sk->sk_security;
3218 ssec->peer_sid = other_isec->sid;
3220 /* server child socket */
3221 ssec = newsk->sk_security;
3222 ssec->peer_sid = isec->sid;
3227 static int selinux_socket_unix_may_send(struct socket *sock,
3228 struct socket *other)
3230 struct inode_security_struct *isec;
3231 struct inode_security_struct *other_isec;
3232 struct avc_audit_data ad;
3235 isec = SOCK_INODE(sock)->i_security;
3236 other_isec = SOCK_INODE(other)->i_security;
3238 AVC_AUDIT_DATA_INIT(&ad,NET);
3239 ad.u.net.sk = other->sk;
3241 err = avc_has_perm(isec->sid, other_isec->sid,
3242 isec->sclass, SOCKET__SENDTO, &ad);
3249 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
3250 struct avc_audit_data *ad, u32 sock_sid, u16 sock_class,
3251 u16 family, char *addrp, int len)
3254 u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3259 err = sel_netif_sids(skb->dev, &if_sid, NULL);
3263 switch (sock_class) {
3264 case SECCLASS_UDP_SOCKET:
3265 netif_perm = NETIF__UDP_RECV;
3266 node_perm = NODE__UDP_RECV;
3267 recv_perm = UDP_SOCKET__RECV_MSG;
3270 case SECCLASS_TCP_SOCKET:
3271 netif_perm = NETIF__TCP_RECV;
3272 node_perm = NODE__TCP_RECV;
3273 recv_perm = TCP_SOCKET__RECV_MSG;
3277 netif_perm = NETIF__RAWIP_RECV;
3278 node_perm = NODE__RAWIP_RECV;
3282 err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3286 err = security_node_sid(family, addrp, len, &node_sid);
3290 err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, ad);
3297 err = security_port_sid(sk->sk_family, sk->sk_type,
3298 sk->sk_protocol, ntohs(ad->u.net.sport),
3303 err = avc_has_perm(sock_sid, port_sid,
3304 sock_class, recv_perm, ad);
3311 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3318 struct socket *sock;
3319 struct avc_audit_data ad;
3321 family = sk->sk_family;
3322 if (family != PF_INET && family != PF_INET6)
3325 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3326 if (family == PF_INET6 && skb->protocol == ntohs(ETH_P_IP))
3329 read_lock_bh(&sk->sk_callback_lock);
3330 sock = sk->sk_socket;
3332 struct inode *inode;
3333 inode = SOCK_INODE(sock);
3335 struct inode_security_struct *isec;
3336 isec = inode->i_security;
3337 sock_sid = isec->sid;
3338 sock_class = isec->sclass;
3341 read_unlock_bh(&sk->sk_callback_lock);
3345 AVC_AUDIT_DATA_INIT(&ad, NET);
3346 ad.u.net.netif = skb->dev ? skb->dev->name : "[unknown]";
3347 ad.u.net.family = family;
3349 err = selinux_parse_skb(skb, &ad, &addrp, &len, 1);
3353 if (selinux_compat_net)
3354 err = selinux_sock_rcv_skb_compat(sk, skb, &ad, sock_sid,
3358 err = avc_has_perm(sock_sid, skb->secmark, SECCLASS_PACKET,
3363 err = selinux_xfrm_sock_rcv_skb(sock_sid, skb);
3368 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
3369 int __user *optlen, unsigned len)
3374 struct sk_security_struct *ssec;
3375 struct inode_security_struct *isec;
3378 isec = SOCK_INODE(sock)->i_security;
3380 /* if UNIX_STREAM check peer_sid, if TCP check dst for labelled sa */
3381 if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET) {
3382 ssec = sock->sk->sk_security;
3383 peer_sid = ssec->peer_sid;
3385 else if (isec->sclass == SECCLASS_TCP_SOCKET) {
3386 peer_sid = selinux_socket_getpeer_stream(sock->sk);
3388 if (peer_sid == SECSID_NULL) {
3398 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
3403 if (scontext_len > len) {
3408 if (copy_to_user(optval, scontext, scontext_len))
3412 if (put_user(scontext_len, optlen))
3420 static int selinux_socket_getpeersec_dgram(struct sk_buff *skb, char **secdata, u32 *seclen)
3425 if (skb->sk->sk_family == PF_UNIX)
3426 selinux_get_inode_sid(SOCK_INODE(skb->sk->sk_socket),
3429 peer_sid = selinux_socket_getpeer_dgram(skb);
3431 if (peer_sid == SECSID_NULL)
3434 err = security_sid_to_context(peer_sid, secdata, seclen);
3441 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
3443 return sk_alloc_security(sk, family, priority);
3446 static void selinux_sk_free_security(struct sock *sk)
3448 sk_free_security(sk);
3451 static unsigned int selinux_sk_getsid_security(struct sock *sk, struct flowi *fl, u8 dir)
3453 struct inode_security_struct *isec;
3454 u32 sock_sid = SECINITSID_ANY_SOCKET;
3457 return selinux_no_sk_sid(fl);
3459 read_lock_bh(&sk->sk_callback_lock);
3460 isec = get_sock_isec(sk);
3463 sock_sid = isec->sid;
3465 read_unlock_bh(&sk->sk_callback_lock);
3469 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3473 struct nlmsghdr *nlh;
3474 struct socket *sock = sk->sk_socket;
3475 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3477 if (skb->len < NLMSG_SPACE(0)) {
3481 nlh = (struct nlmsghdr *)skb->data;
3483 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3485 if (err == -EINVAL) {
3486 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
3487 "SELinux: unrecognized netlink message"
3488 " type=%hu for sclass=%hu\n",
3489 nlh->nlmsg_type, isec->sclass);
3490 if (!selinux_enforcing)
3500 err = socket_has_perm(current, sock, perm);
3505 #ifdef CONFIG_NETFILTER
3507 static int selinux_ip_postroute_last_compat(struct sock *sk, struct net_device *dev,
3508 struct inode_security_struct *isec,
3509 struct avc_audit_data *ad,
3510 u16 family, char *addrp, int len)
3513 u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
3515 err = sel_netif_sids(dev, &if_sid, NULL);
3519 switch (isec->sclass) {
3520 case SECCLASS_UDP_SOCKET:
3521 netif_perm = NETIF__UDP_SEND;
3522 node_perm = NODE__UDP_SEND;
3523 send_perm = UDP_SOCKET__SEND_MSG;
3526 case SECCLASS_TCP_SOCKET:
3527 netif_perm = NETIF__TCP_SEND;
3528 node_perm = NODE__TCP_SEND;
3529 send_perm = TCP_SOCKET__SEND_MSG;
3533 netif_perm = NETIF__RAWIP_SEND;
3534 node_perm = NODE__RAWIP_SEND;
3538 err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3542 err = security_node_sid(family, addrp, len, &node_sid);
3546 err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE, node_perm, ad);
3553 err = security_port_sid(sk->sk_family,
3556 ntohs(ad->u.net.dport),
3561 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3568 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3569 struct sk_buff **pskb,
3570 const struct net_device *in,
3571 const struct net_device *out,
3572 int (*okfn)(struct sk_buff *),
3578 struct socket *sock;
3579 struct inode *inode;
3580 struct sk_buff *skb = *pskb;
3581 struct inode_security_struct *isec;
3582 struct avc_audit_data ad;
3583 struct net_device *dev = (struct net_device *)out;
3589 sock = sk->sk_socket;
3593 inode = SOCK_INODE(sock);
3597 isec = inode->i_security;
3599 AVC_AUDIT_DATA_INIT(&ad, NET);
3600 ad.u.net.netif = dev->name;
3601 ad.u.net.family = family;
3603 err = selinux_parse_skb(skb, &ad, &addrp, &len, 0);
3607 if (selinux_compat_net)
3608 err = selinux_ip_postroute_last_compat(sk, dev, isec, &ad,
3609 family, addrp, len);
3611 err = avc_has_perm(isec->sid, skb->secmark, SECCLASS_PACKET,
3617 err = selinux_xfrm_postroute_last(isec->sid, skb);
3619 return err ? NF_DROP : NF_ACCEPT;
3622 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3623 struct sk_buff **pskb,
3624 const struct net_device *in,
3625 const struct net_device *out,
3626 int (*okfn)(struct sk_buff *))
3628 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3631 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3633 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3634 struct sk_buff **pskb,
3635 const struct net_device *in,
3636 const struct net_device *out,
3637 int (*okfn)(struct sk_buff *))
3639 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3644 #endif /* CONFIG_NETFILTER */
3646 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3650 err = secondary_ops->netlink_send(sk, skb);
3654 if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
3655 err = selinux_nlmsg_perm(sk, skb);
3660 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
3663 struct avc_audit_data ad;
3665 err = secondary_ops->netlink_recv(skb, capability);
3669 AVC_AUDIT_DATA_INIT(&ad, CAP);
3670 ad.u.cap = capability;
3672 return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
3673 SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
3676 static int ipc_alloc_security(struct task_struct *task,
3677 struct kern_ipc_perm *perm,
3680 struct task_security_struct *tsec = task->security;
3681 struct ipc_security_struct *isec;
3683 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
3687 isec->sclass = sclass;
3688 isec->ipc_perm = perm;
3689 isec->sid = tsec->sid;
3690 perm->security = isec;
3695 static void ipc_free_security(struct kern_ipc_perm *perm)
3697 struct ipc_security_struct *isec = perm->security;
3698 perm->security = NULL;
3702 static int msg_msg_alloc_security(struct msg_msg *msg)
3704 struct msg_security_struct *msec;
3706 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
3711 msec->sid = SECINITSID_UNLABELED;
3712 msg->security = msec;
3717 static void msg_msg_free_security(struct msg_msg *msg)
3719 struct msg_security_struct *msec = msg->security;
3721 msg->security = NULL;
3725 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
3728 struct task_security_struct *tsec;
3729 struct ipc_security_struct *isec;
3730 struct avc_audit_data ad;
3732 tsec = current->security;
3733 isec = ipc_perms->security;
3735 AVC_AUDIT_DATA_INIT(&ad, IPC);
3736 ad.u.ipc_id = ipc_perms->key;
3738 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3741 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
3743 return msg_msg_alloc_security(msg);
3746 static void selinux_msg_msg_free_security(struct msg_msg *msg)
3748 msg_msg_free_security(msg);
3751 /* message queue security operations */
3752 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
3754 struct task_security_struct *tsec;
3755 struct ipc_security_struct *isec;
3756 struct avc_audit_data ad;
3759 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
3763 tsec = current->security;
3764 isec = msq->q_perm.security;
3766 AVC_AUDIT_DATA_INIT(&ad, IPC);
3767 ad.u.ipc_id = msq->q_perm.key;
3769 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3772 ipc_free_security(&msq->q_perm);
3778 static void selinux_msg_queue_free_security(struct msg_queue *msq)
3780 ipc_free_security(&msq->q_perm);
3783 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
3785 struct task_security_struct *tsec;
3786 struct ipc_security_struct *isec;
3787 struct avc_audit_data ad;
3789 tsec = current->security;
3790 isec = msq->q_perm.security;
3792 AVC_AUDIT_DATA_INIT(&ad, IPC);
3793 ad.u.ipc_id = msq->q_perm.key;
3795 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3796 MSGQ__ASSOCIATE, &ad);
3799 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
3807 /* No specific object, just general system-wide information. */
3808 return task_has_system(current, SYSTEM__IPC_INFO);
3811 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
3814 perms = MSGQ__SETATTR;
3817 perms = MSGQ__DESTROY;
3823 err = ipc_has_perm(&msq->q_perm, perms);
3827 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
3829 struct task_security_struct *tsec;
3830 struct ipc_security_struct *isec;
3831 struct msg_security_struct *msec;
3832 struct avc_audit_data ad;
3835 tsec = current->security;
3836 isec = msq->q_perm.security;
3837 msec = msg->security;
3840 * First time through, need to assign label to the message
3842 if (msec->sid == SECINITSID_UNLABELED) {
3844 * Compute new sid based on current process and
3845 * message queue this message will be stored in
3847 rc = security_transition_sid(tsec->sid,
3855 AVC_AUDIT_DATA_INIT(&ad, IPC);
3856 ad.u.ipc_id = msq->q_perm.key;
3858 /* Can this process write to the queue? */
3859 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3862 /* Can this process send the message */
3863 rc = avc_has_perm(tsec->sid, msec->sid,
3864 SECCLASS_MSG, MSG__SEND, &ad);
3866 /* Can the message be put in the queue? */
3867 rc = avc_has_perm(msec->sid, isec->sid,
3868 SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
3873 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
3874 struct task_struct *target,
3875 long type, int mode)
3877 struct task_security_struct *tsec;
3878 struct ipc_security_struct *isec;
3879 struct msg_security_struct *msec;
3880 struct avc_audit_data ad;
3883 tsec = target->security;
3884 isec = msq->q_perm.security;
3885 msec = msg->security;
3887 AVC_AUDIT_DATA_INIT(&ad, IPC);
3888 ad.u.ipc_id = msq->q_perm.key;
3890 rc = avc_has_perm(tsec->sid, isec->sid,
3891 SECCLASS_MSGQ, MSGQ__READ, &ad);
3893 rc = avc_has_perm(tsec->sid, msec->sid,
3894 SECCLASS_MSG, MSG__RECEIVE, &ad);
3898 /* Shared Memory security operations */
3899 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
3901 struct task_security_struct *tsec;
3902 struct ipc_security_struct *isec;
3903 struct avc_audit_data ad;
3906 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
3910 tsec = current->security;
3911 isec = shp->shm_perm.security;
3913 AVC_AUDIT_DATA_INIT(&ad, IPC);
3914 ad.u.ipc_id = shp->shm_perm.key;
3916 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3919 ipc_free_security(&shp->shm_perm);
3925 static void selinux_shm_free_security(struct shmid_kernel *shp)
3927 ipc_free_security(&shp->shm_perm);
3930 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
3932 struct task_security_struct *tsec;
3933 struct ipc_security_struct *isec;
3934 struct avc_audit_data ad;
3936 tsec = current->security;
3937 isec = shp->shm_perm.security;
3939 AVC_AUDIT_DATA_INIT(&ad, IPC);
3940 ad.u.ipc_id = shp->shm_perm.key;
3942 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3943 SHM__ASSOCIATE, &ad);
3946 /* Note, at this point, shp is locked down */
3947 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
3955 /* No specific object, just general system-wide information. */
3956 return task_has_system(current, SYSTEM__IPC_INFO);
3959 perms = SHM__GETATTR | SHM__ASSOCIATE;
3962 perms = SHM__SETATTR;
3969 perms = SHM__DESTROY;
3975 err = ipc_has_perm(&shp->shm_perm, perms);
3979 static int selinux_shm_shmat(struct shmid_kernel *shp,
3980 char __user *shmaddr, int shmflg)
3985 rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
3989 if (shmflg & SHM_RDONLY)
3992 perms = SHM__READ | SHM__WRITE;
3994 return ipc_has_perm(&shp->shm_perm, perms);
3997 /* Semaphore security operations */
3998 static int selinux_sem_alloc_security(struct sem_array *sma)
4000 struct task_security_struct *tsec;
4001 struct ipc_security_struct *isec;
4002 struct avc_audit_data ad;
4005 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4009 tsec = current->security;
4010 isec = sma->sem_perm.security;
4012 AVC_AUDIT_DATA_INIT(&ad, IPC);
4013 ad.u.ipc_id = sma->sem_perm.key;
4015 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4018 ipc_free_security(&sma->sem_perm);
4024 static void selinux_sem_free_security(struct sem_array *sma)
4026 ipc_free_security(&sma->sem_perm);
4029 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4031 struct task_security_struct *tsec;
4032 struct ipc_security_struct *isec;
4033 struct avc_audit_data ad;
4035 tsec = current->security;
4036 isec = sma->sem_perm.security;
4038 AVC_AUDIT_DATA_INIT(&ad, IPC);
4039 ad.u.ipc_id = sma->sem_perm.key;
4041 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4042 SEM__ASSOCIATE, &ad);
4045 /* Note, at this point, sma is locked down */
4046 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4054 /* No specific object, just general system-wide information. */
4055 return task_has_system(current, SYSTEM__IPC_INFO);
4059 perms = SEM__GETATTR;
4070 perms = SEM__DESTROY;
4073 perms = SEM__SETATTR;
4077 perms = SEM__GETATTR | SEM__ASSOCIATE;
4083 err = ipc_has_perm(&sma->sem_perm, perms);
4087 static int selinux_sem_semop(struct sem_array *sma,
4088 struct sembuf *sops, unsigned nsops, int alter)
4093 perms = SEM__READ | SEM__WRITE;
4097 return ipc_has_perm(&sma->sem_perm, perms);
4100 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4106 av |= IPC__UNIX_READ;
4108 av |= IPC__UNIX_WRITE;
4113 return ipc_has_perm(ipcp, av);
4116 /* module stacking operations */
4117 static int selinux_register_security (const char *name, struct security_operations *ops)
4119 if (secondary_ops != original_ops) {
4120 printk(KERN_INFO "%s: There is already a secondary security "
4121 "module registered.\n", __FUNCTION__);
4125 secondary_ops = ops;
4127 printk(KERN_INFO "%s: Registering secondary module %s\n",
4134 static int selinux_unregister_security (const char *name, struct security_operations *ops)
4136 if (ops != secondary_ops) {
4137 printk (KERN_INFO "%s: trying to unregister a security module "
4138 "that is not registered.\n", __FUNCTION__);
4142 secondary_ops = original_ops;
4147 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4150 inode_doinit_with_dentry(inode, dentry);
4153 static int selinux_getprocattr(struct task_struct *p,
4154 char *name, void *value, size_t size)
4156 struct task_security_struct *tsec;
4161 error = task_has_perm(current, p, PROCESS__GETATTR);
4168 if (!strcmp(name, "current"))
4170 else if (!strcmp(name, "prev"))
4172 else if (!strcmp(name, "exec"))
4173 sid = tsec->exec_sid;
4174 else if (!strcmp(name, "fscreate"))
4175 sid = tsec->create_sid;
4176 else if (!strcmp(name, "keycreate"))
4177 sid = tsec->keycreate_sid;
4178 else if (!strcmp(name, "sockcreate"))
4179 sid = tsec->sockcreate_sid;
4186 return selinux_getsecurity(sid, value, size);
4189 static int selinux_setprocattr(struct task_struct *p,
4190 char *name, void *value, size_t size)
4192 struct task_security_struct *tsec;
4198 /* SELinux only allows a process to change its own
4199 security attributes. */
4204 * Basic control over ability to set these attributes at all.
4205 * current == p, but we'll pass them separately in case the
4206 * above restriction is ever removed.
4208 if (!strcmp(name, "exec"))
4209 error = task_has_perm(current, p, PROCESS__SETEXEC);
4210 else if (!strcmp(name, "fscreate"))
4211 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4212 else if (!strcmp(name, "keycreate"))
4213 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
4214 else if (!strcmp(name, "sockcreate"))
4215 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
4216 else if (!strcmp(name, "current"))
4217 error = task_has_perm(current, p, PROCESS__SETCURRENT);
4223 /* Obtain a SID for the context, if one was specified. */
4224 if (size && str[1] && str[1] != '\n') {
4225 if (str[size-1] == '\n') {
4229 error = security_context_to_sid(value, size, &sid);
4234 /* Permission checking based on the specified context is
4235 performed during the actual operation (execve,
4236 open/mkdir/...), when we know the full context of the
4237 operation. See selinux_bprm_set_security for the execve
4238 checks and may_create for the file creation checks. The
4239 operation will then fail if the context is not permitted. */
4241 if (!strcmp(name, "exec"))
4242 tsec->exec_sid = sid;
4243 else if (!strcmp(name, "fscreate"))
4244 tsec->create_sid = sid;
4245 else if (!strcmp(name, "keycreate")) {
4246 error = may_create_key(sid, p);
4249 tsec->keycreate_sid = sid;
4250 } else if (!strcmp(name, "sockcreate"))
4251 tsec->sockcreate_sid = sid;
4252 else if (!strcmp(name, "current")) {
4253 struct av_decision avd;
4258 /* Only allow single threaded processes to change context */
4259 if (atomic_read(&p->mm->mm_users) != 1) {
4260 struct task_struct *g, *t;
4261 struct mm_struct *mm = p->mm;
4262 read_lock(&tasklist_lock);
4263 do_each_thread(g, t)
4264 if (t->mm == mm && t != p) {
4265 read_unlock(&tasklist_lock);
4268 while_each_thread(g, t);
4269 read_unlock(&tasklist_lock);
4272 /* Check permissions for the transition. */
4273 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
4274 PROCESS__DYNTRANSITION, NULL);
4278 /* Check for ptracing, and update the task SID if ok.
4279 Otherwise, leave SID unchanged and fail. */
4281 if (p->ptrace & PT_PTRACED) {
4282 error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
4284 PROCESS__PTRACE, &avd);
4288 avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
4289 PROCESS__PTRACE, &avd, error, NULL);
4305 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
4306 unsigned long flags)
4308 struct task_security_struct *tsec = tsk->security;
4309 struct key_security_struct *ksec;
4311 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
4316 if (tsec->keycreate_sid)
4317 ksec->sid = tsec->keycreate_sid;
4319 ksec->sid = tsec->sid;
4325 static void selinux_key_free(struct key *k)
4327 struct key_security_struct *ksec = k->security;
4333 static int selinux_key_permission(key_ref_t key_ref,
4334 struct task_struct *ctx,
4338 struct task_security_struct *tsec;
4339 struct key_security_struct *ksec;
4341 key = key_ref_to_ptr(key_ref);
4343 tsec = ctx->security;
4344 ksec = key->security;
4346 /* if no specific permissions are requested, we skip the
4347 permission check. No serious, additional covert channels
4348 appear to be created. */
4352 return avc_has_perm(tsec->sid, ksec->sid,
4353 SECCLASS_KEY, perm, NULL);
4358 static struct security_operations selinux_ops = {
4359 .ptrace = selinux_ptrace,
4360 .capget = selinux_capget,
4361 .capset_check = selinux_capset_check,
4362 .capset_set = selinux_capset_set,
4363 .sysctl = selinux_sysctl,
4364 .capable = selinux_capable,
4365 .quotactl = selinux_quotactl,
4366 .quota_on = selinux_quota_on,
4367 .syslog = selinux_syslog,
4368 .vm_enough_memory = selinux_vm_enough_memory,
4370 .netlink_send = selinux_netlink_send,
4371 .netlink_recv = selinux_netlink_recv,
4373 .bprm_alloc_security = selinux_bprm_alloc_security,
4374 .bprm_free_security = selinux_bprm_free_security,
4375 .bprm_apply_creds = selinux_bprm_apply_creds,
4376 .bprm_post_apply_creds = selinux_bprm_post_apply_creds,
4377 .bprm_set_security = selinux_bprm_set_security,
4378 .bprm_check_security = selinux_bprm_check_security,
4379 .bprm_secureexec = selinux_bprm_secureexec,
4381 .sb_alloc_security = selinux_sb_alloc_security,
4382 .sb_free_security = selinux_sb_free_security,
4383 .sb_copy_data = selinux_sb_copy_data,
4384 .sb_kern_mount = selinux_sb_kern_mount,
4385 .sb_statfs = selinux_sb_statfs,
4386 .sb_mount = selinux_mount,
4387 .sb_umount = selinux_umount,
4389 .inode_alloc_security = selinux_inode_alloc_security,
4390 .inode_free_security = selinux_inode_free_security,
4391 .inode_init_security = selinux_inode_init_security,
4392 .inode_create = selinux_inode_create,
4393 .inode_link = selinux_inode_link,
4394 .inode_unlink = selinux_inode_unlink,
4395 .inode_symlink = selinux_inode_symlink,
4396 .inode_mkdir = selinux_inode_mkdir,
4397 .inode_rmdir = selinux_inode_rmdir,
4398 .inode_mknod = selinux_inode_mknod,
4399 .inode_rename = selinux_inode_rename,
4400 .inode_readlink = selinux_inode_readlink,
4401 .inode_follow_link = selinux_inode_follow_link,
4402 .inode_permission = selinux_inode_permission,
4403 .inode_setattr = selinux_inode_setattr,
4404 .inode_getattr = selinux_inode_getattr,
4405 .inode_setxattr = selinux_inode_setxattr,
4406 .inode_post_setxattr = selinux_inode_post_setxattr,
4407 .inode_getxattr = selinux_inode_getxattr,
4408 .inode_listxattr = selinux_inode_listxattr,
4409 .inode_removexattr = selinux_inode_removexattr,
4410 .inode_xattr_getsuffix = selinux_inode_xattr_getsuffix,
4411 .inode_getsecurity = selinux_inode_getsecurity,
4412 .inode_setsecurity = selinux_inode_setsecurity,
4413 .inode_listsecurity = selinux_inode_listsecurity,
4415 .file_permission = selinux_file_permission,
4416 .file_alloc_security = selinux_file_alloc_security,
4417 .file_free_security = selinux_file_free_security,
4418 .file_ioctl = selinux_file_ioctl,
4419 .file_mmap = selinux_file_mmap,
4420 .file_mprotect = selinux_file_mprotect,
4421 .file_lock = selinux_file_lock,
4422 .file_fcntl = selinux_file_fcntl,
4423 .file_set_fowner = selinux_file_set_fowner,
4424 .file_send_sigiotask = selinux_file_send_sigiotask,
4425 .file_receive = selinux_file_receive,
4427 .task_create = selinux_task_create,
4428 .task_alloc_security = selinux_task_alloc_security,
4429 .task_free_security = selinux_task_free_security,
4430 .task_setuid = selinux_task_setuid,
4431 .task_post_setuid = selinux_task_post_setuid,
4432 .task_setgid = selinux_task_setgid,
4433 .task_setpgid = selinux_task_setpgid,
4434 .task_getpgid = selinux_task_getpgid,
4435 .task_getsid = selinux_task_getsid,
4436 .task_setgroups = selinux_task_setgroups,
4437 .task_setnice = selinux_task_setnice,
4438 .task_setioprio = selinux_task_setioprio,
4439 .task_setrlimit = selinux_task_setrlimit,
4440 .task_setscheduler = selinux_task_setscheduler,
4441 .task_getscheduler = selinux_task_getscheduler,
4442 .task_movememory = selinux_task_movememory,
4443 .task_kill = selinux_task_kill,
4444 .task_wait = selinux_task_wait,
4445 .task_prctl = selinux_task_prctl,
4446 .task_reparent_to_init = selinux_task_reparent_to_init,
4447 .task_to_inode = selinux_task_to_inode,
4449 .ipc_permission = selinux_ipc_permission,
4451 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
4452 .msg_msg_free_security = selinux_msg_msg_free_security,
4454 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
4455 .msg_queue_free_security = selinux_msg_queue_free_security,
4456 .msg_queue_associate = selinux_msg_queue_associate,
4457 .msg_queue_msgctl = selinux_msg_queue_msgctl,
4458 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
4459 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
4461 .shm_alloc_security = selinux_shm_alloc_security,
4462 .shm_free_security = selinux_shm_free_security,
4463 .shm_associate = selinux_shm_associate,
4464 .shm_shmctl = selinux_shm_shmctl,
4465 .shm_shmat = selinux_shm_shmat,
4467 .sem_alloc_security = selinux_sem_alloc_security,
4468 .sem_free_security = selinux_sem_free_security,
4469 .sem_associate = selinux_sem_associate,
4470 .sem_semctl = selinux_sem_semctl,
4471 .sem_semop = selinux_sem_semop,
4473 .register_security = selinux_register_security,
4474 .unregister_security = selinux_unregister_security,
4476 .d_instantiate = selinux_d_instantiate,
4478 .getprocattr = selinux_getprocattr,
4479 .setprocattr = selinux_setprocattr,
4481 .unix_stream_connect = selinux_socket_unix_stream_connect,
4482 .unix_may_send = selinux_socket_unix_may_send,
4484 .socket_create = selinux_socket_create,
4485 .socket_post_create = selinux_socket_post_create,
4486 .socket_bind = selinux_socket_bind,
4487 .socket_connect = selinux_socket_connect,
4488 .socket_listen = selinux_socket_listen,
4489 .socket_accept = selinux_socket_accept,
4490 .socket_sendmsg = selinux_socket_sendmsg,
4491 .socket_recvmsg = selinux_socket_recvmsg,
4492 .socket_getsockname = selinux_socket_getsockname,
4493 .socket_getpeername = selinux_socket_getpeername,
4494 .socket_getsockopt = selinux_socket_getsockopt,
4495 .socket_setsockopt = selinux_socket_setsockopt,
4496 .socket_shutdown = selinux_socket_shutdown,
4497 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
4498 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
4499 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
4500 .sk_alloc_security = selinux_sk_alloc_security,
4501 .sk_free_security = selinux_sk_free_security,
4502 .sk_getsid = selinux_sk_getsid_security,
4504 #ifdef CONFIG_SECURITY_NETWORK_XFRM
4505 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
4506 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
4507 .xfrm_policy_free_security = selinux_xfrm_policy_free,
4508 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
4509 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
4510 .xfrm_state_free_security = selinux_xfrm_state_free,
4511 .xfrm_state_delete_security = selinux_xfrm_state_delete,
4512 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
4516 .key_alloc = selinux_key_alloc,
4517 .key_free = selinux_key_free,
4518 .key_permission = selinux_key_permission,
4522 static __init int selinux_init(void)
4524 struct task_security_struct *tsec;
4526 if (!selinux_enabled) {
4527 printk(KERN_INFO "SELinux: Disabled at boot.\n");
4531 printk(KERN_INFO "SELinux: Initializing.\n");
4533 /* Set the security state for the initial task. */
4534 if (task_alloc_security(current))
4535 panic("SELinux: Failed to initialize initial task.\n");
4536 tsec = current->security;
4537 tsec->osid = tsec->sid = SECINITSID_KERNEL;
4539 sel_inode_cache = kmem_cache_create("selinux_inode_security",
4540 sizeof(struct inode_security_struct),
4541 0, SLAB_PANIC, NULL, NULL);
4544 original_ops = secondary_ops = security_ops;
4546 panic ("SELinux: No initial security operations\n");
4547 if (register_security (&selinux_ops))
4548 panic("SELinux: Unable to register with kernel.\n");
4550 if (selinux_enforcing) {
4551 printk(KERN_INFO "SELinux: Starting in enforcing mode\n");
4553 printk(KERN_INFO "SELinux: Starting in permissive mode\n");
4557 /* Add security information to initial keyrings */
4558 selinux_key_alloc(&root_user_keyring, current,
4559 KEY_ALLOC_NOT_IN_QUOTA);
4560 selinux_key_alloc(&root_session_keyring, current,
4561 KEY_ALLOC_NOT_IN_QUOTA);
4567 void selinux_complete_init(void)
4569 printk(KERN_INFO "SELinux: Completing initialization.\n");
4571 /* Set up any superblocks initialized prior to the policy load. */
4572 printk(KERN_INFO "SELinux: Setting up existing superblocks.\n");
4573 spin_lock(&sb_lock);
4574 spin_lock(&sb_security_lock);
4576 if (!list_empty(&superblock_security_head)) {
4577 struct superblock_security_struct *sbsec =
4578 list_entry(superblock_security_head.next,
4579 struct superblock_security_struct,
4581 struct super_block *sb = sbsec->sb;
4583 spin_unlock(&sb_security_lock);
4584 spin_unlock(&sb_lock);
4585 down_read(&sb->s_umount);
4587 superblock_doinit(sb, NULL);
4589 spin_lock(&sb_lock);
4590 spin_lock(&sb_security_lock);
4591 list_del_init(&sbsec->list);
4594 spin_unlock(&sb_security_lock);
4595 spin_unlock(&sb_lock);
4598 /* SELinux requires early initialization in order to label
4599 all processes and objects when they are created. */
4600 security_initcall(selinux_init);
4602 #if defined(CONFIG_NETFILTER)
4604 static struct nf_hook_ops selinux_ipv4_op = {
4605 .hook = selinux_ipv4_postroute_last,
4606 .owner = THIS_MODULE,
4608 .hooknum = NF_IP_POST_ROUTING,
4609 .priority = NF_IP_PRI_SELINUX_LAST,
4612 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4614 static struct nf_hook_ops selinux_ipv6_op = {
4615 .hook = selinux_ipv6_postroute_last,
4616 .owner = THIS_MODULE,
4618 .hooknum = NF_IP6_POST_ROUTING,
4619 .priority = NF_IP6_PRI_SELINUX_LAST,
4624 static int __init selinux_nf_ip_init(void)
4628 if (!selinux_enabled)
4631 printk(KERN_INFO "SELinux: Registering netfilter hooks\n");
4633 err = nf_register_hook(&selinux_ipv4_op);
4635 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
4637 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4639 err = nf_register_hook(&selinux_ipv6_op);
4641 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
4649 __initcall(selinux_nf_ip_init);
4651 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4652 static void selinux_nf_ip_exit(void)
4654 printk(KERN_INFO "SELinux: Unregistering netfilter hooks\n");
4656 nf_unregister_hook(&selinux_ipv4_op);
4657 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4658 nf_unregister_hook(&selinux_ipv6_op);
4663 #else /* CONFIG_NETFILTER */
4665 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4666 #define selinux_nf_ip_exit()
4669 #endif /* CONFIG_NETFILTER */
4671 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4672 int selinux_disable(void)
4674 extern void exit_sel_fs(void);
4675 static int selinux_disabled = 0;
4677 if (ss_initialized) {
4678 /* Not permitted after initial policy load. */
4682 if (selinux_disabled) {
4683 /* Only do this once. */
4687 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
4689 selinux_disabled = 1;
4690 selinux_enabled = 0;
4692 /* Reset security_ops to the secondary module, dummy or capability. */
4693 security_ops = secondary_ops;
4695 /* Unregister netfilter hooks. */
4696 selinux_nf_ip_exit();
4698 /* Unregister selinuxfs. */