2 * NSA Security-Enhanced Linux (SELinux) security module
4 * This file contains the SELinux hook function implementations.
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License version 2,
18 * as published by the Free Software Foundation.
21 #include <linux/module.h>
22 #include <linux/init.h>
23 #include <linux/kernel.h>
24 #include <linux/ptrace.h>
25 #include <linux/errno.h>
26 #include <linux/sched.h>
27 #include <linux/security.h>
28 #include <linux/xattr.h>
29 #include <linux/capability.h>
30 #include <linux/unistd.h>
32 #include <linux/mman.h>
33 #include <linux/slab.h>
34 #include <linux/pagemap.h>
35 #include <linux/swap.h>
36 #include <linux/smp_lock.h>
37 #include <linux/spinlock.h>
38 #include <linux/syscalls.h>
39 #include <linux/file.h>
40 #include <linux/namei.h>
41 #include <linux/mount.h>
42 #include <linux/ext2_fs.h>
43 #include <linux/proc_fs.h>
45 #include <linux/netfilter_ipv4.h>
46 #include <linux/netfilter_ipv6.h>
47 #include <linux/tty.h>
49 #include <net/ip.h> /* for sysctl_local_port_range[] */
50 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
51 #include <asm/uaccess.h>
52 #include <asm/semaphore.h>
53 #include <asm/ioctls.h>
54 #include <linux/bitops.h>
55 #include <linux/interrupt.h>
56 #include <linux/netdevice.h> /* for network interface checks */
57 #include <linux/netlink.h>
58 #include <linux/tcp.h>
59 #include <linux/udp.h>
60 #include <linux/quota.h>
61 #include <linux/un.h> /* for Unix socket types */
62 #include <net/af_unix.h> /* for Unix socket types */
63 #include <linux/parser.h>
64 #include <linux/nfs_mount.h>
66 #include <linux/hugetlb.h>
67 #include <linux/personality.h>
68 #include <linux/sysctl.h>
69 #include <linux/audit.h>
70 #include <linux/string.h>
71 #include <linux/selinux.h>
78 #define XATTR_SELINUX_SUFFIX "selinux"
79 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
81 extern unsigned int policydb_loaded_version;
82 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
83 extern int selinux_compat_net;
85 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
86 int selinux_enforcing = 0;
88 static int __init enforcing_setup(char *str)
90 selinux_enforcing = simple_strtol(str,NULL,0);
93 __setup("enforcing=", enforcing_setup);
96 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
97 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
99 static int __init selinux_enabled_setup(char *str)
101 selinux_enabled = simple_strtol(str, NULL, 0);
104 __setup("selinux=", selinux_enabled_setup);
106 int selinux_enabled = 1;
109 /* Original (dummy) security module. */
110 static struct security_operations *original_ops = NULL;
112 /* Minimal support for a secondary security module,
113 just to allow the use of the dummy or capability modules.
114 The owlsm module can alternatively be used as a secondary
115 module as long as CONFIG_OWLSM_FD is not enabled. */
116 static struct security_operations *secondary_ops = NULL;
118 /* Lists of inode and superblock security structures initialized
119 before the policy was loaded. */
120 static LIST_HEAD(superblock_security_head);
121 static DEFINE_SPINLOCK(sb_security_lock);
123 static kmem_cache_t *sel_inode_cache;
125 /* Return security context for a given sid or just the context
126 length if the buffer is null or length is 0 */
127 static int selinux_getsecurity(u32 sid, void *buffer, size_t size)
133 rc = security_sid_to_context(sid, &context, &len);
137 if (!buffer || !size)
138 goto getsecurity_exit;
142 goto getsecurity_exit;
144 memcpy(buffer, context, len);
151 /* Allocate and free functions for each kind of security blob. */
153 static int task_alloc_security(struct task_struct *task)
155 struct task_security_struct *tsec;
157 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
162 tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
163 task->security = tsec;
168 static void task_free_security(struct task_struct *task)
170 struct task_security_struct *tsec = task->security;
171 task->security = NULL;
175 static int inode_alloc_security(struct inode *inode)
177 struct task_security_struct *tsec = current->security;
178 struct inode_security_struct *isec;
180 isec = kmem_cache_alloc(sel_inode_cache, SLAB_KERNEL);
184 memset(isec, 0, sizeof(*isec));
185 init_MUTEX(&isec->sem);
186 INIT_LIST_HEAD(&isec->list);
188 isec->sid = SECINITSID_UNLABELED;
189 isec->sclass = SECCLASS_FILE;
190 isec->task_sid = tsec->sid;
191 inode->i_security = isec;
196 static void inode_free_security(struct inode *inode)
198 struct inode_security_struct *isec = inode->i_security;
199 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
201 spin_lock(&sbsec->isec_lock);
202 if (!list_empty(&isec->list))
203 list_del_init(&isec->list);
204 spin_unlock(&sbsec->isec_lock);
206 inode->i_security = NULL;
207 kmem_cache_free(sel_inode_cache, isec);
210 static int file_alloc_security(struct file *file)
212 struct task_security_struct *tsec = current->security;
213 struct file_security_struct *fsec;
215 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
220 fsec->sid = tsec->sid;
221 fsec->fown_sid = tsec->sid;
222 file->f_security = fsec;
227 static void file_free_security(struct file *file)
229 struct file_security_struct *fsec = file->f_security;
230 file->f_security = NULL;
234 static int superblock_alloc_security(struct super_block *sb)
236 struct superblock_security_struct *sbsec;
238 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
242 init_MUTEX(&sbsec->sem);
243 INIT_LIST_HEAD(&sbsec->list);
244 INIT_LIST_HEAD(&sbsec->isec_head);
245 spin_lock_init(&sbsec->isec_lock);
247 sbsec->sid = SECINITSID_UNLABELED;
248 sbsec->def_sid = SECINITSID_FILE;
249 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
250 sb->s_security = sbsec;
255 static void superblock_free_security(struct super_block *sb)
257 struct superblock_security_struct *sbsec = sb->s_security;
259 spin_lock(&sb_security_lock);
260 if (!list_empty(&sbsec->list))
261 list_del_init(&sbsec->list);
262 spin_unlock(&sb_security_lock);
264 sb->s_security = NULL;
268 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
270 struct sk_security_struct *ssec;
272 if (family != PF_UNIX)
275 ssec = kzalloc(sizeof(*ssec), priority);
280 ssec->peer_sid = SECINITSID_UNLABELED;
281 sk->sk_security = ssec;
286 static void sk_free_security(struct sock *sk)
288 struct sk_security_struct *ssec = sk->sk_security;
290 if (sk->sk_family != PF_UNIX)
293 sk->sk_security = NULL;
297 /* The security server must be initialized before
298 any labeling or access decisions can be provided. */
299 extern int ss_initialized;
301 /* The file system's label must be initialized prior to use. */
303 static char *labeling_behaviors[6] = {
305 "uses transition SIDs",
307 "uses genfs_contexts",
308 "not configured for labeling",
309 "uses mountpoint labeling",
312 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
314 static inline int inode_doinit(struct inode *inode)
316 return inode_doinit_with_dentry(inode, NULL);
326 static match_table_t tokens = {
327 {Opt_context, "context=%s"},
328 {Opt_fscontext, "fscontext=%s"},
329 {Opt_defcontext, "defcontext=%s"},
330 {Opt_rootcontext, "rootcontext=%s"},
333 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
335 static int may_context_mount_sb_relabel(u32 sid,
336 struct superblock_security_struct *sbsec,
337 struct task_security_struct *tsec)
341 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
342 FILESYSTEM__RELABELFROM, NULL);
346 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
347 FILESYSTEM__RELABELTO, NULL);
351 static int may_context_mount_inode_relabel(u32 sid,
352 struct superblock_security_struct *sbsec,
353 struct task_security_struct *tsec)
356 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
357 FILESYSTEM__RELABELFROM, NULL);
361 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
362 FILESYSTEM__ASSOCIATE, NULL);
366 static int try_context_mount(struct super_block *sb, void *data)
368 char *context = NULL, *defcontext = NULL;
369 char *fscontext = NULL, *rootcontext = NULL;
372 int alloc = 0, rc = 0, seen = 0;
373 struct task_security_struct *tsec = current->security;
374 struct superblock_security_struct *sbsec = sb->s_security;
379 name = sb->s_type->name;
381 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
383 /* NFS we understand. */
384 if (!strcmp(name, "nfs")) {
385 struct nfs_mount_data *d = data;
387 if (d->version < NFS_MOUNT_VERSION)
391 context = d->context;
398 /* Standard string-based options. */
399 char *p, *options = data;
401 while ((p = strsep(&options, ",")) != NULL) {
403 substring_t args[MAX_OPT_ARGS];
408 token = match_token(p, tokens, args);
412 if (seen & (Opt_context|Opt_defcontext)) {
414 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
417 context = match_strdup(&args[0]);
428 if (seen & Opt_fscontext) {
430 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
433 fscontext = match_strdup(&args[0]);
440 seen |= Opt_fscontext;
443 case Opt_rootcontext:
444 if (seen & Opt_rootcontext) {
446 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
449 rootcontext = match_strdup(&args[0]);
456 seen |= Opt_rootcontext;
460 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
462 printk(KERN_WARNING "SELinux: "
463 "defcontext option is invalid "
464 "for this filesystem type\n");
467 if (seen & (Opt_context|Opt_defcontext)) {
469 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
472 defcontext = match_strdup(&args[0]);
479 seen |= Opt_defcontext;
484 printk(KERN_WARNING "SELinux: unknown mount "
495 /* sets the context of the superblock for the fs being mounted. */
497 rc = security_context_to_sid(fscontext, strlen(fscontext), &sid);
499 printk(KERN_WARNING "SELinux: security_context_to_sid"
500 "(%s) failed for (dev %s, type %s) errno=%d\n",
501 fscontext, sb->s_id, name, rc);
505 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
513 * Switch to using mount point labeling behavior.
514 * sets the label used on all file below the mountpoint, and will set
515 * the superblock context if not already set.
518 rc = security_context_to_sid(context, strlen(context), &sid);
520 printk(KERN_WARNING "SELinux: security_context_to_sid"
521 "(%s) failed for (dev %s, type %s) errno=%d\n",
522 context, sb->s_id, name, rc);
526 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
532 sbsec->mntpoint_sid = sid;
534 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
538 struct inode *inode = sb->s_root->d_inode;
539 struct inode_security_struct *isec = inode->i_security;
540 rc = security_context_to_sid(rootcontext, strlen(rootcontext), &sid);
542 printk(KERN_WARNING "SELinux: security_context_to_sid"
543 "(%s) failed for (dev %s, type %s) errno=%d\n",
544 rootcontext, sb->s_id, name, rc);
548 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
553 isec->initialized = 1;
557 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
559 printk(KERN_WARNING "SELinux: security_context_to_sid"
560 "(%s) failed for (dev %s, type %s) errno=%d\n",
561 defcontext, sb->s_id, name, rc);
565 if (sid == sbsec->def_sid)
568 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
572 sbsec->def_sid = sid;
586 static int superblock_doinit(struct super_block *sb, void *data)
588 struct superblock_security_struct *sbsec = sb->s_security;
589 struct dentry *root = sb->s_root;
590 struct inode *inode = root->d_inode;
594 if (sbsec->initialized)
597 if (!ss_initialized) {
598 /* Defer initialization until selinux_complete_init,
599 after the initial policy is loaded and the security
600 server is ready to handle calls. */
601 spin_lock(&sb_security_lock);
602 if (list_empty(&sbsec->list))
603 list_add(&sbsec->list, &superblock_security_head);
604 spin_unlock(&sb_security_lock);
608 /* Determine the labeling behavior to use for this filesystem type. */
609 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
611 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
612 __FUNCTION__, sb->s_type->name, rc);
616 rc = try_context_mount(sb, data);
620 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
621 /* Make sure that the xattr handler exists and that no
622 error other than -ENODATA is returned by getxattr on
623 the root directory. -ENODATA is ok, as this may be
624 the first boot of the SELinux kernel before we have
625 assigned xattr values to the filesystem. */
626 if (!inode->i_op->getxattr) {
627 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
628 "xattr support\n", sb->s_id, sb->s_type->name);
632 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
633 if (rc < 0 && rc != -ENODATA) {
634 if (rc == -EOPNOTSUPP)
635 printk(KERN_WARNING "SELinux: (dev %s, type "
636 "%s) has no security xattr handler\n",
637 sb->s_id, sb->s_type->name);
639 printk(KERN_WARNING "SELinux: (dev %s, type "
640 "%s) getxattr errno %d\n", sb->s_id,
641 sb->s_type->name, -rc);
646 if (strcmp(sb->s_type->name, "proc") == 0)
649 sbsec->initialized = 1;
651 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
652 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
653 sb->s_id, sb->s_type->name);
656 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
657 sb->s_id, sb->s_type->name,
658 labeling_behaviors[sbsec->behavior-1]);
661 /* Initialize the root inode. */
662 rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
664 /* Initialize any other inodes associated with the superblock, e.g.
665 inodes created prior to initial policy load or inodes created
666 during get_sb by a pseudo filesystem that directly
668 spin_lock(&sbsec->isec_lock);
670 if (!list_empty(&sbsec->isec_head)) {
671 struct inode_security_struct *isec =
672 list_entry(sbsec->isec_head.next,
673 struct inode_security_struct, list);
674 struct inode *inode = isec->inode;
675 spin_unlock(&sbsec->isec_lock);
676 inode = igrab(inode);
678 if (!IS_PRIVATE (inode))
682 spin_lock(&sbsec->isec_lock);
683 list_del_init(&isec->list);
686 spin_unlock(&sbsec->isec_lock);
692 static inline u16 inode_mode_to_security_class(umode_t mode)
694 switch (mode & S_IFMT) {
696 return SECCLASS_SOCK_FILE;
698 return SECCLASS_LNK_FILE;
700 return SECCLASS_FILE;
702 return SECCLASS_BLK_FILE;
706 return SECCLASS_CHR_FILE;
708 return SECCLASS_FIFO_FILE;
712 return SECCLASS_FILE;
715 static inline int default_protocol_stream(int protocol)
717 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
720 static inline int default_protocol_dgram(int protocol)
722 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
725 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
732 return SECCLASS_UNIX_STREAM_SOCKET;
734 return SECCLASS_UNIX_DGRAM_SOCKET;
741 if (default_protocol_stream(protocol))
742 return SECCLASS_TCP_SOCKET;
744 return SECCLASS_RAWIP_SOCKET;
746 if (default_protocol_dgram(protocol))
747 return SECCLASS_UDP_SOCKET;
749 return SECCLASS_RAWIP_SOCKET;
751 return SECCLASS_RAWIP_SOCKET;
757 return SECCLASS_NETLINK_ROUTE_SOCKET;
758 case NETLINK_FIREWALL:
759 return SECCLASS_NETLINK_FIREWALL_SOCKET;
760 case NETLINK_INET_DIAG:
761 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
763 return SECCLASS_NETLINK_NFLOG_SOCKET;
765 return SECCLASS_NETLINK_XFRM_SOCKET;
766 case NETLINK_SELINUX:
767 return SECCLASS_NETLINK_SELINUX_SOCKET;
769 return SECCLASS_NETLINK_AUDIT_SOCKET;
771 return SECCLASS_NETLINK_IP6FW_SOCKET;
772 case NETLINK_DNRTMSG:
773 return SECCLASS_NETLINK_DNRT_SOCKET;
774 case NETLINK_KOBJECT_UEVENT:
775 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
777 return SECCLASS_NETLINK_SOCKET;
780 return SECCLASS_PACKET_SOCKET;
782 return SECCLASS_KEY_SOCKET;
784 return SECCLASS_APPLETALK_SOCKET;
787 return SECCLASS_SOCKET;
790 #ifdef CONFIG_PROC_FS
791 static int selinux_proc_get_sid(struct proc_dir_entry *de,
796 char *buffer, *path, *end;
798 buffer = (char*)__get_free_page(GFP_KERNEL);
808 while (de && de != de->parent) {
809 buflen -= de->namelen + 1;
813 memcpy(end, de->name, de->namelen);
818 rc = security_genfs_sid("proc", path, tclass, sid);
819 free_page((unsigned long)buffer);
823 static int selinux_proc_get_sid(struct proc_dir_entry *de,
831 /* The inode's security attributes must be initialized before first use. */
832 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
834 struct superblock_security_struct *sbsec = NULL;
835 struct inode_security_struct *isec = inode->i_security;
837 struct dentry *dentry;
838 #define INITCONTEXTLEN 255
839 char *context = NULL;
844 if (isec->initialized)
849 if (isec->initialized)
852 sbsec = inode->i_sb->s_security;
853 if (!sbsec->initialized) {
854 /* Defer initialization until selinux_complete_init,
855 after the initial policy is loaded and the security
856 server is ready to handle calls. */
857 spin_lock(&sbsec->isec_lock);
858 if (list_empty(&isec->list))
859 list_add(&isec->list, &sbsec->isec_head);
860 spin_unlock(&sbsec->isec_lock);
864 switch (sbsec->behavior) {
865 case SECURITY_FS_USE_XATTR:
866 if (!inode->i_op->getxattr) {
867 isec->sid = sbsec->def_sid;
871 /* Need a dentry, since the xattr API requires one.
872 Life would be simpler if we could just pass the inode. */
874 /* Called from d_instantiate or d_splice_alias. */
875 dentry = dget(opt_dentry);
877 /* Called from selinux_complete_init, try to find a dentry. */
878 dentry = d_find_alias(inode);
881 printk(KERN_WARNING "%s: no dentry for dev=%s "
882 "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
887 len = INITCONTEXTLEN;
888 context = kmalloc(len, GFP_KERNEL);
894 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
897 /* Need a larger buffer. Query for the right size. */
898 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
906 context = kmalloc(len, GFP_KERNEL);
912 rc = inode->i_op->getxattr(dentry,
918 if (rc != -ENODATA) {
919 printk(KERN_WARNING "%s: getxattr returned "
920 "%d for dev=%s ino=%ld\n", __FUNCTION__,
921 -rc, inode->i_sb->s_id, inode->i_ino);
925 /* Map ENODATA to the default file SID */
926 sid = sbsec->def_sid;
929 rc = security_context_to_sid_default(context, rc, &sid,
932 printk(KERN_WARNING "%s: context_to_sid(%s) "
933 "returned %d for dev=%s ino=%ld\n",
934 __FUNCTION__, context, -rc,
935 inode->i_sb->s_id, inode->i_ino);
937 /* Leave with the unlabeled SID */
945 case SECURITY_FS_USE_TASK:
946 isec->sid = isec->task_sid;
948 case SECURITY_FS_USE_TRANS:
949 /* Default to the fs SID. */
950 isec->sid = sbsec->sid;
952 /* Try to obtain a transition SID. */
953 isec->sclass = inode_mode_to_security_class(inode->i_mode);
954 rc = security_transition_sid(isec->task_sid,
962 case SECURITY_FS_USE_MNTPOINT:
963 isec->sid = sbsec->mntpoint_sid;
966 /* Default to the fs superblock SID. */
967 isec->sid = sbsec->sid;
970 struct proc_inode *proci = PROC_I(inode);
972 isec->sclass = inode_mode_to_security_class(inode->i_mode);
973 rc = selinux_proc_get_sid(proci->pde,
984 isec->initialized = 1;
987 if (isec->sclass == SECCLASS_FILE)
988 isec->sclass = inode_mode_to_security_class(inode->i_mode);
995 /* Convert a Linux signal to an access vector. */
996 static inline u32 signal_to_av(int sig)
1002 /* Commonly granted from child to parent. */
1003 perm = PROCESS__SIGCHLD;
1006 /* Cannot be caught or ignored */
1007 perm = PROCESS__SIGKILL;
1010 /* Cannot be caught or ignored */
1011 perm = PROCESS__SIGSTOP;
1014 /* All other signals. */
1015 perm = PROCESS__SIGNAL;
1022 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1023 fork check, ptrace check, etc. */
1024 static int task_has_perm(struct task_struct *tsk1,
1025 struct task_struct *tsk2,
1028 struct task_security_struct *tsec1, *tsec2;
1030 tsec1 = tsk1->security;
1031 tsec2 = tsk2->security;
1032 return avc_has_perm(tsec1->sid, tsec2->sid,
1033 SECCLASS_PROCESS, perms, NULL);
1036 /* Check whether a task is allowed to use a capability. */
1037 static int task_has_capability(struct task_struct *tsk,
1040 struct task_security_struct *tsec;
1041 struct avc_audit_data ad;
1043 tsec = tsk->security;
1045 AVC_AUDIT_DATA_INIT(&ad,CAP);
1049 return avc_has_perm(tsec->sid, tsec->sid,
1050 SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
1053 /* Check whether a task is allowed to use a system operation. */
1054 static int task_has_system(struct task_struct *tsk,
1057 struct task_security_struct *tsec;
1059 tsec = tsk->security;
1061 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1062 SECCLASS_SYSTEM, perms, NULL);
1065 /* Check whether a task has a particular permission to an inode.
1066 The 'adp' parameter is optional and allows other audit
1067 data to be passed (e.g. the dentry). */
1068 static int inode_has_perm(struct task_struct *tsk,
1069 struct inode *inode,
1071 struct avc_audit_data *adp)
1073 struct task_security_struct *tsec;
1074 struct inode_security_struct *isec;
1075 struct avc_audit_data ad;
1077 tsec = tsk->security;
1078 isec = inode->i_security;
1082 AVC_AUDIT_DATA_INIT(&ad, FS);
1083 ad.u.fs.inode = inode;
1086 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1089 /* Same as inode_has_perm, but pass explicit audit data containing
1090 the dentry to help the auditing code to more easily generate the
1091 pathname if needed. */
1092 static inline int dentry_has_perm(struct task_struct *tsk,
1093 struct vfsmount *mnt,
1094 struct dentry *dentry,
1097 struct inode *inode = dentry->d_inode;
1098 struct avc_audit_data ad;
1099 AVC_AUDIT_DATA_INIT(&ad,FS);
1101 ad.u.fs.dentry = dentry;
1102 return inode_has_perm(tsk, inode, av, &ad);
1105 /* Check whether a task can use an open file descriptor to
1106 access an inode in a given way. Check access to the
1107 descriptor itself, and then use dentry_has_perm to
1108 check a particular permission to the file.
1109 Access to the descriptor is implicitly granted if it
1110 has the same SID as the process. If av is zero, then
1111 access to the file is not checked, e.g. for cases
1112 where only the descriptor is affected like seek. */
1113 static int file_has_perm(struct task_struct *tsk,
1117 struct task_security_struct *tsec = tsk->security;
1118 struct file_security_struct *fsec = file->f_security;
1119 struct vfsmount *mnt = file->f_vfsmnt;
1120 struct dentry *dentry = file->f_dentry;
1121 struct inode *inode = dentry->d_inode;
1122 struct avc_audit_data ad;
1125 AVC_AUDIT_DATA_INIT(&ad, FS);
1127 ad.u.fs.dentry = dentry;
1129 if (tsec->sid != fsec->sid) {
1130 rc = avc_has_perm(tsec->sid, fsec->sid,
1138 /* av is zero if only checking access to the descriptor. */
1140 return inode_has_perm(tsk, inode, av, &ad);
1145 /* Check whether a task can create a file. */
1146 static int may_create(struct inode *dir,
1147 struct dentry *dentry,
1150 struct task_security_struct *tsec;
1151 struct inode_security_struct *dsec;
1152 struct superblock_security_struct *sbsec;
1154 struct avc_audit_data ad;
1157 tsec = current->security;
1158 dsec = dir->i_security;
1159 sbsec = dir->i_sb->s_security;
1161 AVC_AUDIT_DATA_INIT(&ad, FS);
1162 ad.u.fs.dentry = dentry;
1164 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1165 DIR__ADD_NAME | DIR__SEARCH,
1170 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1171 newsid = tsec->create_sid;
1173 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1179 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1183 return avc_has_perm(newsid, sbsec->sid,
1184 SECCLASS_FILESYSTEM,
1185 FILESYSTEM__ASSOCIATE, &ad);
1188 /* Check whether a task can create a key. */
1189 static int may_create_key(u32 ksid,
1190 struct task_struct *ctx)
1192 struct task_security_struct *tsec;
1194 tsec = ctx->security;
1196 return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1200 #define MAY_UNLINK 1
1203 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1204 static int may_link(struct inode *dir,
1205 struct dentry *dentry,
1209 struct task_security_struct *tsec;
1210 struct inode_security_struct *dsec, *isec;
1211 struct avc_audit_data ad;
1215 tsec = current->security;
1216 dsec = dir->i_security;
1217 isec = dentry->d_inode->i_security;
1219 AVC_AUDIT_DATA_INIT(&ad, FS);
1220 ad.u.fs.dentry = dentry;
1223 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1224 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1239 printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
1243 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1247 static inline int may_rename(struct inode *old_dir,
1248 struct dentry *old_dentry,
1249 struct inode *new_dir,
1250 struct dentry *new_dentry)
1252 struct task_security_struct *tsec;
1253 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1254 struct avc_audit_data ad;
1256 int old_is_dir, new_is_dir;
1259 tsec = current->security;
1260 old_dsec = old_dir->i_security;
1261 old_isec = old_dentry->d_inode->i_security;
1262 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1263 new_dsec = new_dir->i_security;
1265 AVC_AUDIT_DATA_INIT(&ad, FS);
1267 ad.u.fs.dentry = old_dentry;
1268 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1269 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1272 rc = avc_has_perm(tsec->sid, old_isec->sid,
1273 old_isec->sclass, FILE__RENAME, &ad);
1276 if (old_is_dir && new_dir != old_dir) {
1277 rc = avc_has_perm(tsec->sid, old_isec->sid,
1278 old_isec->sclass, DIR__REPARENT, &ad);
1283 ad.u.fs.dentry = new_dentry;
1284 av = DIR__ADD_NAME | DIR__SEARCH;
1285 if (new_dentry->d_inode)
1286 av |= DIR__REMOVE_NAME;
1287 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1290 if (new_dentry->d_inode) {
1291 new_isec = new_dentry->d_inode->i_security;
1292 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1293 rc = avc_has_perm(tsec->sid, new_isec->sid,
1295 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1303 /* Check whether a task can perform a filesystem operation. */
1304 static int superblock_has_perm(struct task_struct *tsk,
1305 struct super_block *sb,
1307 struct avc_audit_data *ad)
1309 struct task_security_struct *tsec;
1310 struct superblock_security_struct *sbsec;
1312 tsec = tsk->security;
1313 sbsec = sb->s_security;
1314 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1318 /* Convert a Linux mode and permission mask to an access vector. */
1319 static inline u32 file_mask_to_av(int mode, int mask)
1323 if ((mode & S_IFMT) != S_IFDIR) {
1324 if (mask & MAY_EXEC)
1325 av |= FILE__EXECUTE;
1326 if (mask & MAY_READ)
1329 if (mask & MAY_APPEND)
1331 else if (mask & MAY_WRITE)
1335 if (mask & MAY_EXEC)
1337 if (mask & MAY_WRITE)
1339 if (mask & MAY_READ)
1346 /* Convert a Linux file to an access vector. */
1347 static inline u32 file_to_av(struct file *file)
1351 if (file->f_mode & FMODE_READ)
1353 if (file->f_mode & FMODE_WRITE) {
1354 if (file->f_flags & O_APPEND)
1363 /* Set an inode's SID to a specified value. */
1364 static int inode_security_set_sid(struct inode *inode, u32 sid)
1366 struct inode_security_struct *isec = inode->i_security;
1367 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
1369 if (!sbsec->initialized) {
1370 /* Defer initialization to selinux_complete_init. */
1375 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1377 isec->initialized = 1;
1382 /* Hook functions begin here. */
1384 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1386 struct task_security_struct *psec = parent->security;
1387 struct task_security_struct *csec = child->security;
1390 rc = secondary_ops->ptrace(parent,child);
1394 rc = task_has_perm(parent, child, PROCESS__PTRACE);
1395 /* Save the SID of the tracing process for later use in apply_creds. */
1396 if (!(child->ptrace & PT_PTRACED) && !rc)
1397 csec->ptrace_sid = psec->sid;
1401 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1402 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1406 error = task_has_perm(current, target, PROCESS__GETCAP);
1410 return secondary_ops->capget(target, effective, inheritable, permitted);
1413 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1414 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1418 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1422 return task_has_perm(current, target, PROCESS__SETCAP);
1425 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1426 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1428 secondary_ops->capset_set(target, effective, inheritable, permitted);
1431 static int selinux_capable(struct task_struct *tsk, int cap)
1435 rc = secondary_ops->capable(tsk, cap);
1439 return task_has_capability(tsk,cap);
1442 static int selinux_sysctl(ctl_table *table, int op)
1446 struct task_security_struct *tsec;
1450 rc = secondary_ops->sysctl(table, op);
1454 tsec = current->security;
1456 rc = selinux_proc_get_sid(table->de, (op == 001) ?
1457 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1459 /* Default to the well-defined sysctl SID. */
1460 tsid = SECINITSID_SYSCTL;
1463 /* The op values are "defined" in sysctl.c, thereby creating
1464 * a bad coupling between this module and sysctl.c */
1466 error = avc_has_perm(tsec->sid, tsid,
1467 SECCLASS_DIR, DIR__SEARCH, NULL);
1475 error = avc_has_perm(tsec->sid, tsid,
1476 SECCLASS_FILE, av, NULL);
1482 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1495 rc = superblock_has_perm(current,
1497 FILESYSTEM__QUOTAMOD, NULL);
1502 rc = superblock_has_perm(current,
1504 FILESYSTEM__QUOTAGET, NULL);
1507 rc = 0; /* let the kernel handle invalid cmds */
1513 static int selinux_quota_on(struct dentry *dentry)
1515 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1518 static int selinux_syslog(int type)
1522 rc = secondary_ops->syslog(type);
1527 case 3: /* Read last kernel messages */
1528 case 10: /* Return size of the log buffer */
1529 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1531 case 6: /* Disable logging to console */
1532 case 7: /* Enable logging to console */
1533 case 8: /* Set level of messages printed to console */
1534 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1536 case 0: /* Close log */
1537 case 1: /* Open log */
1538 case 2: /* Read from log */
1539 case 4: /* Read/clear last kernel messages */
1540 case 5: /* Clear ring buffer */
1542 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1549 * Check that a process has enough memory to allocate a new virtual
1550 * mapping. 0 means there is enough memory for the allocation to
1551 * succeed and -ENOMEM implies there is not.
1553 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1554 * if the capability is granted, but __vm_enough_memory requires 1 if
1555 * the capability is granted.
1557 * Do not audit the selinux permission check, as this is applied to all
1558 * processes that allocate mappings.
1560 static int selinux_vm_enough_memory(long pages)
1562 int rc, cap_sys_admin = 0;
1563 struct task_security_struct *tsec = current->security;
1565 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1567 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1568 SECCLASS_CAPABILITY,
1569 CAP_TO_MASK(CAP_SYS_ADMIN),
1575 return __vm_enough_memory(pages, cap_sys_admin);
1578 /* binprm security operations */
1580 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1582 struct bprm_security_struct *bsec;
1584 bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1589 bsec->sid = SECINITSID_UNLABELED;
1592 bprm->security = bsec;
1596 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1598 struct task_security_struct *tsec;
1599 struct inode *inode = bprm->file->f_dentry->d_inode;
1600 struct inode_security_struct *isec;
1601 struct bprm_security_struct *bsec;
1603 struct avc_audit_data ad;
1606 rc = secondary_ops->bprm_set_security(bprm);
1610 bsec = bprm->security;
1615 tsec = current->security;
1616 isec = inode->i_security;
1618 /* Default to the current task SID. */
1619 bsec->sid = tsec->sid;
1621 /* Reset fs, key, and sock SIDs on execve. */
1622 tsec->create_sid = 0;
1623 tsec->keycreate_sid = 0;
1624 tsec->sockcreate_sid = 0;
1626 if (tsec->exec_sid) {
1627 newsid = tsec->exec_sid;
1628 /* Reset exec SID on execve. */
1631 /* Check for a default transition on this program. */
1632 rc = security_transition_sid(tsec->sid, isec->sid,
1633 SECCLASS_PROCESS, &newsid);
1638 AVC_AUDIT_DATA_INIT(&ad, FS);
1639 ad.u.fs.mnt = bprm->file->f_vfsmnt;
1640 ad.u.fs.dentry = bprm->file->f_dentry;
1642 if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
1645 if (tsec->sid == newsid) {
1646 rc = avc_has_perm(tsec->sid, isec->sid,
1647 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1651 /* Check permissions for the transition. */
1652 rc = avc_has_perm(tsec->sid, newsid,
1653 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1657 rc = avc_has_perm(newsid, isec->sid,
1658 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1662 /* Clear any possibly unsafe personality bits on exec: */
1663 current->personality &= ~PER_CLEAR_ON_SETID;
1665 /* Set the security field to the new SID. */
1673 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1675 return secondary_ops->bprm_check_security(bprm);
1679 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1681 struct task_security_struct *tsec = current->security;
1684 if (tsec->osid != tsec->sid) {
1685 /* Enable secure mode for SIDs transitions unless
1686 the noatsecure permission is granted between
1687 the two SIDs, i.e. ahp returns 0. */
1688 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1690 PROCESS__NOATSECURE, NULL);
1693 return (atsecure || secondary_ops->bprm_secureexec(bprm));
1696 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1698 kfree(bprm->security);
1699 bprm->security = NULL;
1702 extern struct vfsmount *selinuxfs_mount;
1703 extern struct dentry *selinux_null;
1705 /* Derived from fs/exec.c:flush_old_files. */
1706 static inline void flush_unauthorized_files(struct files_struct * files)
1708 struct avc_audit_data ad;
1709 struct file *file, *devnull = NULL;
1710 struct tty_struct *tty = current->signal->tty;
1711 struct fdtable *fdt;
1716 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
1718 /* Revalidate access to controlling tty.
1719 Use inode_has_perm on the tty inode directly rather
1720 than using file_has_perm, as this particular open
1721 file may belong to another process and we are only
1722 interested in the inode-based check here. */
1723 struct inode *inode = file->f_dentry->d_inode;
1724 if (inode_has_perm(current, inode,
1725 FILE__READ | FILE__WRITE, NULL)) {
1726 /* Reset controlling tty. */
1727 current->signal->tty = NULL;
1728 current->signal->tty_old_pgrp = 0;
1734 /* Revalidate access to inherited open files. */
1736 AVC_AUDIT_DATA_INIT(&ad,FS);
1738 spin_lock(&files->file_lock);
1740 unsigned long set, i;
1745 fdt = files_fdtable(files);
1746 if (i >= fdt->max_fds || i >= fdt->max_fdset)
1748 set = fdt->open_fds->fds_bits[j];
1751 spin_unlock(&files->file_lock);
1752 for ( ; set ; i++,set >>= 1) {
1757 if (file_has_perm(current,
1759 file_to_av(file))) {
1761 fd = get_unused_fd();
1771 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1778 fd_install(fd, devnull);
1783 spin_lock(&files->file_lock);
1786 spin_unlock(&files->file_lock);
1789 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1791 struct task_security_struct *tsec;
1792 struct bprm_security_struct *bsec;
1796 secondary_ops->bprm_apply_creds(bprm, unsafe);
1798 tsec = current->security;
1800 bsec = bprm->security;
1803 tsec->osid = tsec->sid;
1805 if (tsec->sid != sid) {
1806 /* Check for shared state. If not ok, leave SID
1807 unchanged and kill. */
1808 if (unsafe & LSM_UNSAFE_SHARE) {
1809 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1810 PROCESS__SHARE, NULL);
1817 /* Check for ptracing, and update the task SID if ok.
1818 Otherwise, leave SID unchanged and kill. */
1819 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1820 rc = avc_has_perm(tsec->ptrace_sid, sid,
1821 SECCLASS_PROCESS, PROCESS__PTRACE,
1833 * called after apply_creds without the task lock held
1835 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1837 struct task_security_struct *tsec;
1838 struct rlimit *rlim, *initrlim;
1839 struct itimerval itimer;
1840 struct bprm_security_struct *bsec;
1843 tsec = current->security;
1844 bsec = bprm->security;
1847 force_sig_specific(SIGKILL, current);
1850 if (tsec->osid == tsec->sid)
1853 /* Close files for which the new task SID is not authorized. */
1854 flush_unauthorized_files(current->files);
1856 /* Check whether the new SID can inherit signal state
1857 from the old SID. If not, clear itimers to avoid
1858 subsequent signal generation and flush and unblock
1859 signals. This must occur _after_ the task SID has
1860 been updated so that any kill done after the flush
1861 will be checked against the new SID. */
1862 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1863 PROCESS__SIGINH, NULL);
1865 memset(&itimer, 0, sizeof itimer);
1866 for (i = 0; i < 3; i++)
1867 do_setitimer(i, &itimer, NULL);
1868 flush_signals(current);
1869 spin_lock_irq(¤t->sighand->siglock);
1870 flush_signal_handlers(current, 1);
1871 sigemptyset(¤t->blocked);
1872 recalc_sigpending();
1873 spin_unlock_irq(¤t->sighand->siglock);
1876 /* Check whether the new SID can inherit resource limits
1877 from the old SID. If not, reset all soft limits to
1878 the lower of the current task's hard limit and the init
1879 task's soft limit. Note that the setting of hard limits
1880 (even to lower them) can be controlled by the setrlimit
1881 check. The inclusion of the init task's soft limit into
1882 the computation is to avoid resetting soft limits higher
1883 than the default soft limit for cases where the default
1884 is lower than the hard limit, e.g. RLIMIT_CORE or
1886 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1887 PROCESS__RLIMITINH, NULL);
1889 for (i = 0; i < RLIM_NLIMITS; i++) {
1890 rlim = current->signal->rlim + i;
1891 initrlim = init_task.signal->rlim+i;
1892 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1894 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1896 * This will cause RLIMIT_CPU calculations
1899 current->it_prof_expires = jiffies_to_cputime(1);
1903 /* Wake up the parent if it is waiting so that it can
1904 recheck wait permission to the new task SID. */
1905 wake_up_interruptible(¤t->parent->signal->wait_chldexit);
1908 /* superblock security operations */
1910 static int selinux_sb_alloc_security(struct super_block *sb)
1912 return superblock_alloc_security(sb);
1915 static void selinux_sb_free_security(struct super_block *sb)
1917 superblock_free_security(sb);
1920 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1925 return !memcmp(prefix, option, plen);
1928 static inline int selinux_option(char *option, int len)
1930 return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1931 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1932 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len) ||
1933 match_prefix("rootcontext=", sizeof("rootcontext=")-1, option, len));
1936 static inline void take_option(char **to, char *from, int *first, int len)
1944 memcpy(*to, from, len);
1948 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
1950 int fnosec, fsec, rc = 0;
1951 char *in_save, *in_curr, *in_end;
1952 char *sec_curr, *nosec_save, *nosec;
1957 /* Binary mount data: just copy */
1958 if (type->fs_flags & FS_BINARY_MOUNTDATA) {
1959 copy_page(sec_curr, in_curr);
1963 nosec = (char *)get_zeroed_page(GFP_KERNEL);
1971 in_save = in_end = orig;
1974 if (*in_end == ',' || *in_end == '\0') {
1975 int len = in_end - in_curr;
1977 if (selinux_option(in_curr, len))
1978 take_option(&sec_curr, in_curr, &fsec, len);
1980 take_option(&nosec, in_curr, &fnosec, len);
1982 in_curr = in_end + 1;
1984 } while (*in_end++);
1986 strcpy(in_save, nosec_save);
1987 free_page((unsigned long)nosec_save);
1992 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
1994 struct avc_audit_data ad;
1997 rc = superblock_doinit(sb, data);
2001 AVC_AUDIT_DATA_INIT(&ad,FS);
2002 ad.u.fs.dentry = sb->s_root;
2003 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2006 static int selinux_sb_statfs(struct dentry *dentry)
2008 struct avc_audit_data ad;
2010 AVC_AUDIT_DATA_INIT(&ad,FS);
2011 ad.u.fs.dentry = dentry->d_sb->s_root;
2012 return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2015 static int selinux_mount(char * dev_name,
2016 struct nameidata *nd,
2018 unsigned long flags,
2023 rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2027 if (flags & MS_REMOUNT)
2028 return superblock_has_perm(current, nd->mnt->mnt_sb,
2029 FILESYSTEM__REMOUNT, NULL);
2031 return dentry_has_perm(current, nd->mnt, nd->dentry,
2035 static int selinux_umount(struct vfsmount *mnt, int flags)
2039 rc = secondary_ops->sb_umount(mnt, flags);
2043 return superblock_has_perm(current,mnt->mnt_sb,
2044 FILESYSTEM__UNMOUNT,NULL);
2047 /* inode security operations */
2049 static int selinux_inode_alloc_security(struct inode *inode)
2051 return inode_alloc_security(inode);
2054 static void selinux_inode_free_security(struct inode *inode)
2056 inode_free_security(inode);
2059 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2060 char **name, void **value,
2063 struct task_security_struct *tsec;
2064 struct inode_security_struct *dsec;
2065 struct superblock_security_struct *sbsec;
2068 char *namep = NULL, *context;
2070 tsec = current->security;
2071 dsec = dir->i_security;
2072 sbsec = dir->i_sb->s_security;
2074 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2075 newsid = tsec->create_sid;
2077 rc = security_transition_sid(tsec->sid, dsec->sid,
2078 inode_mode_to_security_class(inode->i_mode),
2081 printk(KERN_WARNING "%s: "
2082 "security_transition_sid failed, rc=%d (dev=%s "
2085 -rc, inode->i_sb->s_id, inode->i_ino);
2090 inode_security_set_sid(inode, newsid);
2092 if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2096 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
2103 rc = security_sid_to_context(newsid, &context, &clen);
2115 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2117 return may_create(dir, dentry, SECCLASS_FILE);
2120 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2124 rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2127 return may_link(dir, old_dentry, MAY_LINK);
2130 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2134 rc = secondary_ops->inode_unlink(dir, dentry);
2137 return may_link(dir, dentry, MAY_UNLINK);
2140 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2142 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2145 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2147 return may_create(dir, dentry, SECCLASS_DIR);
2150 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2152 return may_link(dir, dentry, MAY_RMDIR);
2155 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2159 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2163 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2166 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2167 struct inode *new_inode, struct dentry *new_dentry)
2169 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2172 static int selinux_inode_readlink(struct dentry *dentry)
2174 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2177 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2181 rc = secondary_ops->inode_follow_link(dentry,nameidata);
2184 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2187 static int selinux_inode_permission(struct inode *inode, int mask,
2188 struct nameidata *nd)
2192 rc = secondary_ops->inode_permission(inode, mask, nd);
2197 /* No permission to check. Existence test. */
2201 return inode_has_perm(current, inode,
2202 file_mask_to_av(inode->i_mode, mask), NULL);
2205 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2209 rc = secondary_ops->inode_setattr(dentry, iattr);
2213 if (iattr->ia_valid & ATTR_FORCE)
2216 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2217 ATTR_ATIME_SET | ATTR_MTIME_SET))
2218 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2220 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2223 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2225 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2228 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2230 struct task_security_struct *tsec = current->security;
2231 struct inode *inode = dentry->d_inode;
2232 struct inode_security_struct *isec = inode->i_security;
2233 struct superblock_security_struct *sbsec;
2234 struct avc_audit_data ad;
2238 if (strcmp(name, XATTR_NAME_SELINUX)) {
2239 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2240 sizeof XATTR_SECURITY_PREFIX - 1) &&
2241 !capable(CAP_SYS_ADMIN)) {
2242 /* A different attribute in the security namespace.
2243 Restrict to administrator. */
2247 /* Not an attribute we recognize, so just check the
2248 ordinary setattr permission. */
2249 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2252 sbsec = inode->i_sb->s_security;
2253 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2256 if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2259 AVC_AUDIT_DATA_INIT(&ad,FS);
2260 ad.u.fs.dentry = dentry;
2262 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2263 FILE__RELABELFROM, &ad);
2267 rc = security_context_to_sid(value, size, &newsid);
2271 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2272 FILE__RELABELTO, &ad);
2276 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2281 return avc_has_perm(newsid,
2283 SECCLASS_FILESYSTEM,
2284 FILESYSTEM__ASSOCIATE,
2288 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2289 void *value, size_t size, int flags)
2291 struct inode *inode = dentry->d_inode;
2292 struct inode_security_struct *isec = inode->i_security;
2296 if (strcmp(name, XATTR_NAME_SELINUX)) {
2297 /* Not an attribute we recognize, so nothing to do. */
2301 rc = security_context_to_sid(value, size, &newsid);
2303 printk(KERN_WARNING "%s: unable to obtain SID for context "
2304 "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2312 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2314 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2317 static int selinux_inode_listxattr (struct dentry *dentry)
2319 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2322 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2324 if (strcmp(name, XATTR_NAME_SELINUX)) {
2325 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2326 sizeof XATTR_SECURITY_PREFIX - 1) &&
2327 !capable(CAP_SYS_ADMIN)) {
2328 /* A different attribute in the security namespace.
2329 Restrict to administrator. */
2333 /* Not an attribute we recognize, so just check the
2334 ordinary setattr permission. Might want a separate
2335 permission for removexattr. */
2336 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2339 /* No one is allowed to remove a SELinux security label.
2340 You can change the label, but all data must be labeled. */
2344 static const char *selinux_inode_xattr_getsuffix(void)
2346 return XATTR_SELINUX_SUFFIX;
2350 * Copy the in-core inode security context value to the user. If the
2351 * getxattr() prior to this succeeded, check to see if we need to
2352 * canonicalize the value to be finally returned to the user.
2354 * Permission check is handled by selinux_inode_getxattr hook.
2356 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void *buffer, size_t size, int err)
2358 struct inode_security_struct *isec = inode->i_security;
2360 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2363 return selinux_getsecurity(isec->sid, buffer, size);
2366 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2367 const void *value, size_t size, int flags)
2369 struct inode_security_struct *isec = inode->i_security;
2373 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2376 if (!value || !size)
2379 rc = security_context_to_sid((void*)value, size, &newsid);
2387 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2389 const int len = sizeof(XATTR_NAME_SELINUX);
2390 if (buffer && len <= buffer_size)
2391 memcpy(buffer, XATTR_NAME_SELINUX, len);
2395 /* file security operations */
2397 static int selinux_file_permission(struct file *file, int mask)
2399 struct inode *inode = file->f_dentry->d_inode;
2402 /* No permission to check. Existence test. */
2406 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2407 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2410 return file_has_perm(current, file,
2411 file_mask_to_av(inode->i_mode, mask));
2414 static int selinux_file_alloc_security(struct file *file)
2416 return file_alloc_security(file);
2419 static void selinux_file_free_security(struct file *file)
2421 file_free_security(file);
2424 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2436 case EXT2_IOC_GETFLAGS:
2438 case EXT2_IOC_GETVERSION:
2439 error = file_has_perm(current, file, FILE__GETATTR);
2442 case EXT2_IOC_SETFLAGS:
2444 case EXT2_IOC_SETVERSION:
2445 error = file_has_perm(current, file, FILE__SETATTR);
2448 /* sys_ioctl() checks */
2452 error = file_has_perm(current, file, 0);
2457 error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2460 /* default case assumes that the command will go
2461 * to the file's ioctl() function.
2464 error = file_has_perm(current, file, FILE__IOCTL);
2470 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2472 #ifndef CONFIG_PPC32
2473 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2475 * We are making executable an anonymous mapping or a
2476 * private file mapping that will also be writable.
2477 * This has an additional check.
2479 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2486 /* read access is always possible with a mapping */
2487 u32 av = FILE__READ;
2489 /* write access only matters if the mapping is shared */
2490 if (shared && (prot & PROT_WRITE))
2493 if (prot & PROT_EXEC)
2494 av |= FILE__EXECUTE;
2496 return file_has_perm(current, file, av);
2501 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2502 unsigned long prot, unsigned long flags)
2506 rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2510 if (selinux_checkreqprot)
2513 return file_map_prot_check(file, prot,
2514 (flags & MAP_TYPE) == MAP_SHARED);
2517 static int selinux_file_mprotect(struct vm_area_struct *vma,
2518 unsigned long reqprot,
2523 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2527 if (selinux_checkreqprot)
2530 #ifndef CONFIG_PPC32
2531 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2533 if (vma->vm_start >= vma->vm_mm->start_brk &&
2534 vma->vm_end <= vma->vm_mm->brk) {
2535 rc = task_has_perm(current, current,
2537 } else if (!vma->vm_file &&
2538 vma->vm_start <= vma->vm_mm->start_stack &&
2539 vma->vm_end >= vma->vm_mm->start_stack) {
2540 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2541 } else if (vma->vm_file && vma->anon_vma) {
2543 * We are making executable a file mapping that has
2544 * had some COW done. Since pages might have been
2545 * written, check ability to execute the possibly
2546 * modified content. This typically should only
2547 * occur for text relocations.
2549 rc = file_has_perm(current, vma->vm_file,
2557 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2560 static int selinux_file_lock(struct file *file, unsigned int cmd)
2562 return file_has_perm(current, file, FILE__LOCK);
2565 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2572 if (!file->f_dentry || !file->f_dentry->d_inode) {
2577 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2578 err = file_has_perm(current, file,FILE__WRITE);
2587 /* Just check FD__USE permission */
2588 err = file_has_perm(current, file, 0);
2593 #if BITS_PER_LONG == 32
2598 if (!file->f_dentry || !file->f_dentry->d_inode) {
2602 err = file_has_perm(current, file, FILE__LOCK);
2609 static int selinux_file_set_fowner(struct file *file)
2611 struct task_security_struct *tsec;
2612 struct file_security_struct *fsec;
2614 tsec = current->security;
2615 fsec = file->f_security;
2616 fsec->fown_sid = tsec->sid;
2621 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2622 struct fown_struct *fown, int signum)
2626 struct task_security_struct *tsec;
2627 struct file_security_struct *fsec;
2629 /* struct fown_struct is never outside the context of a struct file */
2630 file = (struct file *)((long)fown - offsetof(struct file,f_owner));
2632 tsec = tsk->security;
2633 fsec = file->f_security;
2636 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2638 perm = signal_to_av(signum);
2640 return avc_has_perm(fsec->fown_sid, tsec->sid,
2641 SECCLASS_PROCESS, perm, NULL);
2644 static int selinux_file_receive(struct file *file)
2646 return file_has_perm(current, file, file_to_av(file));
2649 /* task security operations */
2651 static int selinux_task_create(unsigned long clone_flags)
2655 rc = secondary_ops->task_create(clone_flags);
2659 return task_has_perm(current, current, PROCESS__FORK);
2662 static int selinux_task_alloc_security(struct task_struct *tsk)
2664 struct task_security_struct *tsec1, *tsec2;
2667 tsec1 = current->security;
2669 rc = task_alloc_security(tsk);
2672 tsec2 = tsk->security;
2674 tsec2->osid = tsec1->osid;
2675 tsec2->sid = tsec1->sid;
2677 /* Retain the exec, fs, key, and sock SIDs across fork */
2678 tsec2->exec_sid = tsec1->exec_sid;
2679 tsec2->create_sid = tsec1->create_sid;
2680 tsec2->keycreate_sid = tsec1->keycreate_sid;
2681 tsec2->sockcreate_sid = tsec1->sockcreate_sid;
2683 /* Retain ptracer SID across fork, if any.
2684 This will be reset by the ptrace hook upon any
2685 subsequent ptrace_attach operations. */
2686 tsec2->ptrace_sid = tsec1->ptrace_sid;
2691 static void selinux_task_free_security(struct task_struct *tsk)
2693 task_free_security(tsk);
2696 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2698 /* Since setuid only affects the current process, and
2699 since the SELinux controls are not based on the Linux
2700 identity attributes, SELinux does not need to control
2701 this operation. However, SELinux does control the use
2702 of the CAP_SETUID and CAP_SETGID capabilities using the
2707 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2709 return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2712 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2714 /* See the comment for setuid above. */
2718 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2720 return task_has_perm(current, p, PROCESS__SETPGID);
2723 static int selinux_task_getpgid(struct task_struct *p)
2725 return task_has_perm(current, p, PROCESS__GETPGID);
2728 static int selinux_task_getsid(struct task_struct *p)
2730 return task_has_perm(current, p, PROCESS__GETSESSION);
2733 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
2735 selinux_get_task_sid(p, secid);
2738 static int selinux_task_setgroups(struct group_info *group_info)
2740 /* See the comment for setuid above. */
2744 static int selinux_task_setnice(struct task_struct *p, int nice)
2748 rc = secondary_ops->task_setnice(p, nice);
2752 return task_has_perm(current,p, PROCESS__SETSCHED);
2755 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
2757 return task_has_perm(current, p, PROCESS__SETSCHED);
2760 static int selinux_task_getioprio(struct task_struct *p)
2762 return task_has_perm(current, p, PROCESS__GETSCHED);
2765 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2767 struct rlimit *old_rlim = current->signal->rlim + resource;
2770 rc = secondary_ops->task_setrlimit(resource, new_rlim);
2774 /* Control the ability to change the hard limit (whether
2775 lowering or raising it), so that the hard limit can
2776 later be used as a safe reset point for the soft limit
2777 upon context transitions. See selinux_bprm_apply_creds. */
2778 if (old_rlim->rlim_max != new_rlim->rlim_max)
2779 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2784 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2786 return task_has_perm(current, p, PROCESS__SETSCHED);
2789 static int selinux_task_getscheduler(struct task_struct *p)
2791 return task_has_perm(current, p, PROCESS__GETSCHED);
2794 static int selinux_task_movememory(struct task_struct *p)
2796 return task_has_perm(current, p, PROCESS__SETSCHED);
2799 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
2804 struct task_security_struct *tsec;
2806 rc = secondary_ops->task_kill(p, info, sig, secid);
2810 if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
2814 perm = PROCESS__SIGNULL; /* null signal; existence test */
2816 perm = signal_to_av(sig);
2819 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
2821 rc = task_has_perm(current, p, perm);
2825 static int selinux_task_prctl(int option,
2831 /* The current prctl operations do not appear to require
2832 any SELinux controls since they merely observe or modify
2833 the state of the current process. */
2837 static int selinux_task_wait(struct task_struct *p)
2841 perm = signal_to_av(p->exit_signal);
2843 return task_has_perm(p, current, perm);
2846 static void selinux_task_reparent_to_init(struct task_struct *p)
2848 struct task_security_struct *tsec;
2850 secondary_ops->task_reparent_to_init(p);
2853 tsec->osid = tsec->sid;
2854 tsec->sid = SECINITSID_KERNEL;
2858 static void selinux_task_to_inode(struct task_struct *p,
2859 struct inode *inode)
2861 struct task_security_struct *tsec = p->security;
2862 struct inode_security_struct *isec = inode->i_security;
2864 isec->sid = tsec->sid;
2865 isec->initialized = 1;
2869 /* Returns error only if unable to parse addresses */
2870 static int selinux_parse_skb_ipv4(struct sk_buff *skb, struct avc_audit_data *ad)
2872 int offset, ihlen, ret = -EINVAL;
2873 struct iphdr _iph, *ih;
2875 offset = skb->nh.raw - skb->data;
2876 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2880 ihlen = ih->ihl * 4;
2881 if (ihlen < sizeof(_iph))
2884 ad->u.net.v4info.saddr = ih->saddr;
2885 ad->u.net.v4info.daddr = ih->daddr;
2888 switch (ih->protocol) {
2890 struct tcphdr _tcph, *th;
2892 if (ntohs(ih->frag_off) & IP_OFFSET)
2896 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2900 ad->u.net.sport = th->source;
2901 ad->u.net.dport = th->dest;
2906 struct udphdr _udph, *uh;
2908 if (ntohs(ih->frag_off) & IP_OFFSET)
2912 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2916 ad->u.net.sport = uh->source;
2917 ad->u.net.dport = uh->dest;
2928 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2930 /* Returns error only if unable to parse addresses */
2931 static int selinux_parse_skb_ipv6(struct sk_buff *skb, struct avc_audit_data *ad)
2934 int ret = -EINVAL, offset;
2935 struct ipv6hdr _ipv6h, *ip6;
2937 offset = skb->nh.raw - skb->data;
2938 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
2942 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
2943 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
2946 nexthdr = ip6->nexthdr;
2947 offset += sizeof(_ipv6h);
2948 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
2954 struct tcphdr _tcph, *th;
2956 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2960 ad->u.net.sport = th->source;
2961 ad->u.net.dport = th->dest;
2966 struct udphdr _udph, *uh;
2968 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2972 ad->u.net.sport = uh->source;
2973 ad->u.net.dport = uh->dest;
2977 /* includes fragments */
2987 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
2988 char **addrp, int *len, int src)
2992 switch (ad->u.net.family) {
2994 ret = selinux_parse_skb_ipv4(skb, ad);
2998 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
2999 &ad->u.net.v4info.daddr);
3002 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3004 ret = selinux_parse_skb_ipv6(skb, ad);
3008 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3009 &ad->u.net.v6info.daddr);
3019 /* socket security operations */
3020 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3023 struct inode_security_struct *isec;
3024 struct task_security_struct *tsec;
3025 struct avc_audit_data ad;
3028 tsec = task->security;
3029 isec = SOCK_INODE(sock)->i_security;
3031 if (isec->sid == SECINITSID_KERNEL)
3034 AVC_AUDIT_DATA_INIT(&ad,NET);
3035 ad.u.net.sk = sock->sk;
3036 err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3042 static int selinux_socket_create(int family, int type,
3043 int protocol, int kern)
3046 struct task_security_struct *tsec;
3052 tsec = current->security;
3053 newsid = tsec->sockcreate_sid ? : tsec->sid;
3054 err = avc_has_perm(tsec->sid, newsid,
3055 socket_type_to_security_class(family, type,
3056 protocol), SOCKET__CREATE, NULL);
3062 static void selinux_socket_post_create(struct socket *sock, int family,
3063 int type, int protocol, int kern)
3065 struct inode_security_struct *isec;
3066 struct task_security_struct *tsec;
3069 isec = SOCK_INODE(sock)->i_security;
3071 tsec = current->security;
3072 newsid = tsec->sockcreate_sid ? : tsec->sid;
3073 isec->sclass = socket_type_to_security_class(family, type, protocol);
3074 isec->sid = kern ? SECINITSID_KERNEL : newsid;
3075 isec->initialized = 1;
3080 /* Range of port numbers used to automatically bind.
3081 Need to determine whether we should perform a name_bind
3082 permission check between the socket and the port number. */
3083 #define ip_local_port_range_0 sysctl_local_port_range[0]
3084 #define ip_local_port_range_1 sysctl_local_port_range[1]
3086 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3091 err = socket_has_perm(current, sock, SOCKET__BIND);
3096 * If PF_INET or PF_INET6, check name_bind permission for the port.
3097 * Multiple address binding for SCTP is not supported yet: we just
3098 * check the first address now.
3100 family = sock->sk->sk_family;
3101 if (family == PF_INET || family == PF_INET6) {
3103 struct inode_security_struct *isec;
3104 struct task_security_struct *tsec;
3105 struct avc_audit_data ad;
3106 struct sockaddr_in *addr4 = NULL;
3107 struct sockaddr_in6 *addr6 = NULL;
3108 unsigned short snum;
3109 struct sock *sk = sock->sk;
3110 u32 sid, node_perm, addrlen;
3112 tsec = current->security;
3113 isec = SOCK_INODE(sock)->i_security;
3115 if (family == PF_INET) {
3116 addr4 = (struct sockaddr_in *)address;
3117 snum = ntohs(addr4->sin_port);
3118 addrlen = sizeof(addr4->sin_addr.s_addr);
3119 addrp = (char *)&addr4->sin_addr.s_addr;
3121 addr6 = (struct sockaddr_in6 *)address;
3122 snum = ntohs(addr6->sin6_port);
3123 addrlen = sizeof(addr6->sin6_addr.s6_addr);
3124 addrp = (char *)&addr6->sin6_addr.s6_addr;
3127 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3128 snum > ip_local_port_range_1)) {
3129 err = security_port_sid(sk->sk_family, sk->sk_type,
3130 sk->sk_protocol, snum, &sid);
3133 AVC_AUDIT_DATA_INIT(&ad,NET);
3134 ad.u.net.sport = htons(snum);
3135 ad.u.net.family = family;
3136 err = avc_has_perm(isec->sid, sid,
3138 SOCKET__NAME_BIND, &ad);
3143 switch(isec->sclass) {
3144 case SECCLASS_TCP_SOCKET:
3145 node_perm = TCP_SOCKET__NODE_BIND;
3148 case SECCLASS_UDP_SOCKET:
3149 node_perm = UDP_SOCKET__NODE_BIND;
3153 node_perm = RAWIP_SOCKET__NODE_BIND;
3157 err = security_node_sid(family, addrp, addrlen, &sid);
3161 AVC_AUDIT_DATA_INIT(&ad,NET);
3162 ad.u.net.sport = htons(snum);
3163 ad.u.net.family = family;
3165 if (family == PF_INET)
3166 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3168 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3170 err = avc_has_perm(isec->sid, sid,
3171 isec->sclass, node_perm, &ad);
3179 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3181 struct inode_security_struct *isec;
3184 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3189 * If a TCP socket, check name_connect permission for the port.
3191 isec = SOCK_INODE(sock)->i_security;
3192 if (isec->sclass == SECCLASS_TCP_SOCKET) {
3193 struct sock *sk = sock->sk;
3194 struct avc_audit_data ad;
3195 struct sockaddr_in *addr4 = NULL;
3196 struct sockaddr_in6 *addr6 = NULL;
3197 unsigned short snum;
3200 if (sk->sk_family == PF_INET) {
3201 addr4 = (struct sockaddr_in *)address;
3202 if (addrlen < sizeof(struct sockaddr_in))
3204 snum = ntohs(addr4->sin_port);
3206 addr6 = (struct sockaddr_in6 *)address;
3207 if (addrlen < SIN6_LEN_RFC2133)
3209 snum = ntohs(addr6->sin6_port);
3212 err = security_port_sid(sk->sk_family, sk->sk_type,
3213 sk->sk_protocol, snum, &sid);
3217 AVC_AUDIT_DATA_INIT(&ad,NET);
3218 ad.u.net.dport = htons(snum);
3219 ad.u.net.family = sk->sk_family;
3220 err = avc_has_perm(isec->sid, sid, isec->sclass,
3221 TCP_SOCKET__NAME_CONNECT, &ad);
3230 static int selinux_socket_listen(struct socket *sock, int backlog)
3232 return socket_has_perm(current, sock, SOCKET__LISTEN);
3235 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3238 struct inode_security_struct *isec;
3239 struct inode_security_struct *newisec;
3241 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3245 newisec = SOCK_INODE(newsock)->i_security;
3247 isec = SOCK_INODE(sock)->i_security;
3248 newisec->sclass = isec->sclass;
3249 newisec->sid = isec->sid;
3250 newisec->initialized = 1;
3255 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3258 return socket_has_perm(current, sock, SOCKET__WRITE);
3261 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3262 int size, int flags)
3264 return socket_has_perm(current, sock, SOCKET__READ);
3267 static int selinux_socket_getsockname(struct socket *sock)
3269 return socket_has_perm(current, sock, SOCKET__GETATTR);
3272 static int selinux_socket_getpeername(struct socket *sock)
3274 return socket_has_perm(current, sock, SOCKET__GETATTR);
3277 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3279 return socket_has_perm(current, sock, SOCKET__SETOPT);
3282 static int selinux_socket_getsockopt(struct socket *sock, int level,
3285 return socket_has_perm(current, sock, SOCKET__GETOPT);
3288 static int selinux_socket_shutdown(struct socket *sock, int how)
3290 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3293 static int selinux_socket_unix_stream_connect(struct socket *sock,
3294 struct socket *other,
3297 struct sk_security_struct *ssec;
3298 struct inode_security_struct *isec;
3299 struct inode_security_struct *other_isec;
3300 struct avc_audit_data ad;
3303 err = secondary_ops->unix_stream_connect(sock, other, newsk);
3307 isec = SOCK_INODE(sock)->i_security;
3308 other_isec = SOCK_INODE(other)->i_security;
3310 AVC_AUDIT_DATA_INIT(&ad,NET);
3311 ad.u.net.sk = other->sk;
3313 err = avc_has_perm(isec->sid, other_isec->sid,
3315 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3319 /* connecting socket */
3320 ssec = sock->sk->sk_security;
3321 ssec->peer_sid = other_isec->sid;
3323 /* server child socket */
3324 ssec = newsk->sk_security;
3325 ssec->peer_sid = isec->sid;
3330 static int selinux_socket_unix_may_send(struct socket *sock,
3331 struct socket *other)
3333 struct inode_security_struct *isec;
3334 struct inode_security_struct *other_isec;
3335 struct avc_audit_data ad;
3338 isec = SOCK_INODE(sock)->i_security;
3339 other_isec = SOCK_INODE(other)->i_security;
3341 AVC_AUDIT_DATA_INIT(&ad,NET);
3342 ad.u.net.sk = other->sk;
3344 err = avc_has_perm(isec->sid, other_isec->sid,
3345 isec->sclass, SOCKET__SENDTO, &ad);
3352 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
3353 struct avc_audit_data *ad, u32 sock_sid, u16 sock_class,
3354 u16 family, char *addrp, int len)
3357 u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3362 err = sel_netif_sids(skb->dev, &if_sid, NULL);
3366 switch (sock_class) {
3367 case SECCLASS_UDP_SOCKET:
3368 netif_perm = NETIF__UDP_RECV;
3369 node_perm = NODE__UDP_RECV;
3370 recv_perm = UDP_SOCKET__RECV_MSG;
3373 case SECCLASS_TCP_SOCKET:
3374 netif_perm = NETIF__TCP_RECV;
3375 node_perm = NODE__TCP_RECV;
3376 recv_perm = TCP_SOCKET__RECV_MSG;
3380 netif_perm = NETIF__RAWIP_RECV;
3381 node_perm = NODE__RAWIP_RECV;
3385 err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3389 err = security_node_sid(family, addrp, len, &node_sid);
3393 err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, ad);
3400 err = security_port_sid(sk->sk_family, sk->sk_type,
3401 sk->sk_protocol, ntohs(ad->u.net.sport),
3406 err = avc_has_perm(sock_sid, port_sid,
3407 sock_class, recv_perm, ad);
3414 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3421 struct socket *sock;
3422 struct avc_audit_data ad;
3424 family = sk->sk_family;
3425 if (family != PF_INET && family != PF_INET6)
3428 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3429 if (family == PF_INET6 && skb->protocol == ntohs(ETH_P_IP))
3432 read_lock_bh(&sk->sk_callback_lock);
3433 sock = sk->sk_socket;
3435 struct inode *inode;
3436 inode = SOCK_INODE(sock);
3438 struct inode_security_struct *isec;
3439 isec = inode->i_security;
3440 sock_sid = isec->sid;
3441 sock_class = isec->sclass;
3444 read_unlock_bh(&sk->sk_callback_lock);
3448 AVC_AUDIT_DATA_INIT(&ad, NET);
3449 ad.u.net.netif = skb->dev ? skb->dev->name : "[unknown]";
3450 ad.u.net.family = family;
3452 err = selinux_parse_skb(skb, &ad, &addrp, &len, 1);
3456 if (selinux_compat_net)
3457 err = selinux_sock_rcv_skb_compat(sk, skb, &ad, sock_sid,
3461 err = avc_has_perm(sock_sid, skb->secmark, SECCLASS_PACKET,
3466 err = selinux_xfrm_sock_rcv_skb(sock_sid, skb);
3471 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
3472 int __user *optlen, unsigned len)
3477 struct sk_security_struct *ssec;
3478 struct inode_security_struct *isec;
3481 isec = SOCK_INODE(sock)->i_security;
3483 /* if UNIX_STREAM check peer_sid, if TCP check dst for labelled sa */
3484 if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET) {
3485 ssec = sock->sk->sk_security;
3486 peer_sid = ssec->peer_sid;
3488 else if (isec->sclass == SECCLASS_TCP_SOCKET) {
3489 peer_sid = selinux_socket_getpeer_stream(sock->sk);
3491 if (peer_sid == SECSID_NULL) {
3501 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
3506 if (scontext_len > len) {
3511 if (copy_to_user(optval, scontext, scontext_len))
3515 if (put_user(scontext_len, optlen))
3523 static int selinux_socket_getpeersec_dgram(struct sk_buff *skb, char **secdata, u32 *seclen)
3528 if (skb->sk->sk_family == PF_UNIX)
3529 selinux_get_inode_sid(SOCK_INODE(skb->sk->sk_socket),
3532 peer_sid = selinux_socket_getpeer_dgram(skb);
3534 if (peer_sid == SECSID_NULL)
3537 err = security_sid_to_context(peer_sid, secdata, seclen);
3544 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
3546 return sk_alloc_security(sk, family, priority);
3549 static void selinux_sk_free_security(struct sock *sk)
3551 sk_free_security(sk);
3554 static unsigned int selinux_sk_getsid_security(struct sock *sk, struct flowi *fl, u8 dir)
3556 struct inode_security_struct *isec;
3557 u32 sock_sid = SECINITSID_ANY_SOCKET;
3560 return selinux_no_sk_sid(fl);
3562 read_lock_bh(&sk->sk_callback_lock);
3563 isec = get_sock_isec(sk);
3566 sock_sid = isec->sid;
3568 read_unlock_bh(&sk->sk_callback_lock);
3572 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3576 struct nlmsghdr *nlh;
3577 struct socket *sock = sk->sk_socket;
3578 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3580 if (skb->len < NLMSG_SPACE(0)) {
3584 nlh = (struct nlmsghdr *)skb->data;
3586 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3588 if (err == -EINVAL) {
3589 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
3590 "SELinux: unrecognized netlink message"
3591 " type=%hu for sclass=%hu\n",
3592 nlh->nlmsg_type, isec->sclass);
3593 if (!selinux_enforcing)
3603 err = socket_has_perm(current, sock, perm);
3608 #ifdef CONFIG_NETFILTER
3610 static int selinux_ip_postroute_last_compat(struct sock *sk, struct net_device *dev,
3611 struct inode_security_struct *isec,
3612 struct avc_audit_data *ad,
3613 u16 family, char *addrp, int len)
3616 u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
3618 err = sel_netif_sids(dev, &if_sid, NULL);
3622 switch (isec->sclass) {
3623 case SECCLASS_UDP_SOCKET:
3624 netif_perm = NETIF__UDP_SEND;
3625 node_perm = NODE__UDP_SEND;
3626 send_perm = UDP_SOCKET__SEND_MSG;
3629 case SECCLASS_TCP_SOCKET:
3630 netif_perm = NETIF__TCP_SEND;
3631 node_perm = NODE__TCP_SEND;
3632 send_perm = TCP_SOCKET__SEND_MSG;
3636 netif_perm = NETIF__RAWIP_SEND;
3637 node_perm = NODE__RAWIP_SEND;
3641 err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3645 err = security_node_sid(family, addrp, len, &node_sid);
3649 err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE, node_perm, ad);
3656 err = security_port_sid(sk->sk_family,
3659 ntohs(ad->u.net.dport),
3664 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3671 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3672 struct sk_buff **pskb,
3673 const struct net_device *in,
3674 const struct net_device *out,
3675 int (*okfn)(struct sk_buff *),
3681 struct socket *sock;
3682 struct inode *inode;
3683 struct sk_buff *skb = *pskb;
3684 struct inode_security_struct *isec;
3685 struct avc_audit_data ad;
3686 struct net_device *dev = (struct net_device *)out;
3692 sock = sk->sk_socket;
3696 inode = SOCK_INODE(sock);
3700 isec = inode->i_security;
3702 AVC_AUDIT_DATA_INIT(&ad, NET);
3703 ad.u.net.netif = dev->name;
3704 ad.u.net.family = family;
3706 err = selinux_parse_skb(skb, &ad, &addrp, &len, 0);
3710 if (selinux_compat_net)
3711 err = selinux_ip_postroute_last_compat(sk, dev, isec, &ad,
3712 family, addrp, len);
3714 err = avc_has_perm(isec->sid, skb->secmark, SECCLASS_PACKET,
3720 err = selinux_xfrm_postroute_last(isec->sid, skb);
3722 return err ? NF_DROP : NF_ACCEPT;
3725 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3726 struct sk_buff **pskb,
3727 const struct net_device *in,
3728 const struct net_device *out,
3729 int (*okfn)(struct sk_buff *))
3731 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3734 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3736 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3737 struct sk_buff **pskb,
3738 const struct net_device *in,
3739 const struct net_device *out,
3740 int (*okfn)(struct sk_buff *))
3742 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3747 #endif /* CONFIG_NETFILTER */
3749 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3753 err = secondary_ops->netlink_send(sk, skb);
3757 if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
3758 err = selinux_nlmsg_perm(sk, skb);
3763 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
3766 struct avc_audit_data ad;
3768 err = secondary_ops->netlink_recv(skb, capability);
3772 AVC_AUDIT_DATA_INIT(&ad, CAP);
3773 ad.u.cap = capability;
3775 return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
3776 SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
3779 static int ipc_alloc_security(struct task_struct *task,
3780 struct kern_ipc_perm *perm,
3783 struct task_security_struct *tsec = task->security;
3784 struct ipc_security_struct *isec;
3786 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
3790 isec->sclass = sclass;
3791 isec->ipc_perm = perm;
3792 isec->sid = tsec->sid;
3793 perm->security = isec;
3798 static void ipc_free_security(struct kern_ipc_perm *perm)
3800 struct ipc_security_struct *isec = perm->security;
3801 perm->security = NULL;
3805 static int msg_msg_alloc_security(struct msg_msg *msg)
3807 struct msg_security_struct *msec;
3809 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
3814 msec->sid = SECINITSID_UNLABELED;
3815 msg->security = msec;
3820 static void msg_msg_free_security(struct msg_msg *msg)
3822 struct msg_security_struct *msec = msg->security;
3824 msg->security = NULL;
3828 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
3831 struct task_security_struct *tsec;
3832 struct ipc_security_struct *isec;
3833 struct avc_audit_data ad;
3835 tsec = current->security;
3836 isec = ipc_perms->security;
3838 AVC_AUDIT_DATA_INIT(&ad, IPC);
3839 ad.u.ipc_id = ipc_perms->key;
3841 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3844 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
3846 return msg_msg_alloc_security(msg);
3849 static void selinux_msg_msg_free_security(struct msg_msg *msg)
3851 msg_msg_free_security(msg);
3854 /* message queue security operations */
3855 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
3857 struct task_security_struct *tsec;
3858 struct ipc_security_struct *isec;
3859 struct avc_audit_data ad;
3862 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
3866 tsec = current->security;
3867 isec = msq->q_perm.security;
3869 AVC_AUDIT_DATA_INIT(&ad, IPC);
3870 ad.u.ipc_id = msq->q_perm.key;
3872 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3875 ipc_free_security(&msq->q_perm);
3881 static void selinux_msg_queue_free_security(struct msg_queue *msq)
3883 ipc_free_security(&msq->q_perm);
3886 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
3888 struct task_security_struct *tsec;
3889 struct ipc_security_struct *isec;
3890 struct avc_audit_data ad;
3892 tsec = current->security;
3893 isec = msq->q_perm.security;
3895 AVC_AUDIT_DATA_INIT(&ad, IPC);
3896 ad.u.ipc_id = msq->q_perm.key;
3898 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3899 MSGQ__ASSOCIATE, &ad);
3902 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
3910 /* No specific object, just general system-wide information. */
3911 return task_has_system(current, SYSTEM__IPC_INFO);
3914 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
3917 perms = MSGQ__SETATTR;
3920 perms = MSGQ__DESTROY;
3926 err = ipc_has_perm(&msq->q_perm, perms);
3930 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
3932 struct task_security_struct *tsec;
3933 struct ipc_security_struct *isec;
3934 struct msg_security_struct *msec;
3935 struct avc_audit_data ad;
3938 tsec = current->security;
3939 isec = msq->q_perm.security;
3940 msec = msg->security;
3943 * First time through, need to assign label to the message
3945 if (msec->sid == SECINITSID_UNLABELED) {
3947 * Compute new sid based on current process and
3948 * message queue this message will be stored in
3950 rc = security_transition_sid(tsec->sid,
3958 AVC_AUDIT_DATA_INIT(&ad, IPC);
3959 ad.u.ipc_id = msq->q_perm.key;
3961 /* Can this process write to the queue? */
3962 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3965 /* Can this process send the message */
3966 rc = avc_has_perm(tsec->sid, msec->sid,
3967 SECCLASS_MSG, MSG__SEND, &ad);
3969 /* Can the message be put in the queue? */
3970 rc = avc_has_perm(msec->sid, isec->sid,
3971 SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
3976 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
3977 struct task_struct *target,
3978 long type, int mode)
3980 struct task_security_struct *tsec;
3981 struct ipc_security_struct *isec;
3982 struct msg_security_struct *msec;
3983 struct avc_audit_data ad;
3986 tsec = target->security;
3987 isec = msq->q_perm.security;
3988 msec = msg->security;
3990 AVC_AUDIT_DATA_INIT(&ad, IPC);
3991 ad.u.ipc_id = msq->q_perm.key;
3993 rc = avc_has_perm(tsec->sid, isec->sid,
3994 SECCLASS_MSGQ, MSGQ__READ, &ad);
3996 rc = avc_has_perm(tsec->sid, msec->sid,
3997 SECCLASS_MSG, MSG__RECEIVE, &ad);
4001 /* Shared Memory security operations */
4002 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4004 struct task_security_struct *tsec;
4005 struct ipc_security_struct *isec;
4006 struct avc_audit_data ad;
4009 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4013 tsec = current->security;
4014 isec = shp->shm_perm.security;
4016 AVC_AUDIT_DATA_INIT(&ad, IPC);
4017 ad.u.ipc_id = shp->shm_perm.key;
4019 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4022 ipc_free_security(&shp->shm_perm);
4028 static void selinux_shm_free_security(struct shmid_kernel *shp)
4030 ipc_free_security(&shp->shm_perm);
4033 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4035 struct task_security_struct *tsec;
4036 struct ipc_security_struct *isec;
4037 struct avc_audit_data ad;
4039 tsec = current->security;
4040 isec = shp->shm_perm.security;
4042 AVC_AUDIT_DATA_INIT(&ad, IPC);
4043 ad.u.ipc_id = shp->shm_perm.key;
4045 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4046 SHM__ASSOCIATE, &ad);
4049 /* Note, at this point, shp is locked down */
4050 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4058 /* No specific object, just general system-wide information. */
4059 return task_has_system(current, SYSTEM__IPC_INFO);
4062 perms = SHM__GETATTR | SHM__ASSOCIATE;
4065 perms = SHM__SETATTR;
4072 perms = SHM__DESTROY;
4078 err = ipc_has_perm(&shp->shm_perm, perms);
4082 static int selinux_shm_shmat(struct shmid_kernel *shp,
4083 char __user *shmaddr, int shmflg)
4088 rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4092 if (shmflg & SHM_RDONLY)
4095 perms = SHM__READ | SHM__WRITE;
4097 return ipc_has_perm(&shp->shm_perm, perms);
4100 /* Semaphore security operations */
4101 static int selinux_sem_alloc_security(struct sem_array *sma)
4103 struct task_security_struct *tsec;
4104 struct ipc_security_struct *isec;
4105 struct avc_audit_data ad;
4108 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4112 tsec = current->security;
4113 isec = sma->sem_perm.security;
4115 AVC_AUDIT_DATA_INIT(&ad, IPC);
4116 ad.u.ipc_id = sma->sem_perm.key;
4118 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4121 ipc_free_security(&sma->sem_perm);
4127 static void selinux_sem_free_security(struct sem_array *sma)
4129 ipc_free_security(&sma->sem_perm);
4132 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4134 struct task_security_struct *tsec;
4135 struct ipc_security_struct *isec;
4136 struct avc_audit_data ad;
4138 tsec = current->security;
4139 isec = sma->sem_perm.security;
4141 AVC_AUDIT_DATA_INIT(&ad, IPC);
4142 ad.u.ipc_id = sma->sem_perm.key;
4144 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4145 SEM__ASSOCIATE, &ad);
4148 /* Note, at this point, sma is locked down */
4149 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4157 /* No specific object, just general system-wide information. */
4158 return task_has_system(current, SYSTEM__IPC_INFO);
4162 perms = SEM__GETATTR;
4173 perms = SEM__DESTROY;
4176 perms = SEM__SETATTR;
4180 perms = SEM__GETATTR | SEM__ASSOCIATE;
4186 err = ipc_has_perm(&sma->sem_perm, perms);
4190 static int selinux_sem_semop(struct sem_array *sma,
4191 struct sembuf *sops, unsigned nsops, int alter)
4196 perms = SEM__READ | SEM__WRITE;
4200 return ipc_has_perm(&sma->sem_perm, perms);
4203 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4209 av |= IPC__UNIX_READ;
4211 av |= IPC__UNIX_WRITE;
4216 return ipc_has_perm(ipcp, av);
4219 /* module stacking operations */
4220 static int selinux_register_security (const char *name, struct security_operations *ops)
4222 if (secondary_ops != original_ops) {
4223 printk(KERN_INFO "%s: There is already a secondary security "
4224 "module registered.\n", __FUNCTION__);
4228 secondary_ops = ops;
4230 printk(KERN_INFO "%s: Registering secondary module %s\n",
4237 static int selinux_unregister_security (const char *name, struct security_operations *ops)
4239 if (ops != secondary_ops) {
4240 printk (KERN_INFO "%s: trying to unregister a security module "
4241 "that is not registered.\n", __FUNCTION__);
4245 secondary_ops = original_ops;
4250 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4253 inode_doinit_with_dentry(inode, dentry);
4256 static int selinux_getprocattr(struct task_struct *p,
4257 char *name, void *value, size_t size)
4259 struct task_security_struct *tsec;
4264 error = task_has_perm(current, p, PROCESS__GETATTR);
4271 if (!strcmp(name, "current"))
4273 else if (!strcmp(name, "prev"))
4275 else if (!strcmp(name, "exec"))
4276 sid = tsec->exec_sid;
4277 else if (!strcmp(name, "fscreate"))
4278 sid = tsec->create_sid;
4279 else if (!strcmp(name, "keycreate"))
4280 sid = tsec->keycreate_sid;
4281 else if (!strcmp(name, "sockcreate"))
4282 sid = tsec->sockcreate_sid;
4289 return selinux_getsecurity(sid, value, size);
4292 static int selinux_setprocattr(struct task_struct *p,
4293 char *name, void *value, size_t size)
4295 struct task_security_struct *tsec;
4301 /* SELinux only allows a process to change its own
4302 security attributes. */
4307 * Basic control over ability to set these attributes at all.
4308 * current == p, but we'll pass them separately in case the
4309 * above restriction is ever removed.
4311 if (!strcmp(name, "exec"))
4312 error = task_has_perm(current, p, PROCESS__SETEXEC);
4313 else if (!strcmp(name, "fscreate"))
4314 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4315 else if (!strcmp(name, "keycreate"))
4316 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
4317 else if (!strcmp(name, "sockcreate"))
4318 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
4319 else if (!strcmp(name, "current"))
4320 error = task_has_perm(current, p, PROCESS__SETCURRENT);
4326 /* Obtain a SID for the context, if one was specified. */
4327 if (size && str[1] && str[1] != '\n') {
4328 if (str[size-1] == '\n') {
4332 error = security_context_to_sid(value, size, &sid);
4337 /* Permission checking based on the specified context is
4338 performed during the actual operation (execve,
4339 open/mkdir/...), when we know the full context of the
4340 operation. See selinux_bprm_set_security for the execve
4341 checks and may_create for the file creation checks. The
4342 operation will then fail if the context is not permitted. */
4344 if (!strcmp(name, "exec"))
4345 tsec->exec_sid = sid;
4346 else if (!strcmp(name, "fscreate"))
4347 tsec->create_sid = sid;
4348 else if (!strcmp(name, "keycreate")) {
4349 error = may_create_key(sid, p);
4352 tsec->keycreate_sid = sid;
4353 } else if (!strcmp(name, "sockcreate"))
4354 tsec->sockcreate_sid = sid;
4355 else if (!strcmp(name, "current")) {
4356 struct av_decision avd;
4361 /* Only allow single threaded processes to change context */
4362 if (atomic_read(&p->mm->mm_users) != 1) {
4363 struct task_struct *g, *t;
4364 struct mm_struct *mm = p->mm;
4365 read_lock(&tasklist_lock);
4366 do_each_thread(g, t)
4367 if (t->mm == mm && t != p) {
4368 read_unlock(&tasklist_lock);
4371 while_each_thread(g, t);
4372 read_unlock(&tasklist_lock);
4375 /* Check permissions for the transition. */
4376 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
4377 PROCESS__DYNTRANSITION, NULL);
4381 /* Check for ptracing, and update the task SID if ok.
4382 Otherwise, leave SID unchanged and fail. */
4384 if (p->ptrace & PT_PTRACED) {
4385 error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
4387 PROCESS__PTRACE, &avd);
4391 avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
4392 PROCESS__PTRACE, &avd, error, NULL);
4408 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
4409 unsigned long flags)
4411 struct task_security_struct *tsec = tsk->security;
4412 struct key_security_struct *ksec;
4414 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
4419 if (tsec->keycreate_sid)
4420 ksec->sid = tsec->keycreate_sid;
4422 ksec->sid = tsec->sid;
4428 static void selinux_key_free(struct key *k)
4430 struct key_security_struct *ksec = k->security;
4436 static int selinux_key_permission(key_ref_t key_ref,
4437 struct task_struct *ctx,
4441 struct task_security_struct *tsec;
4442 struct key_security_struct *ksec;
4444 key = key_ref_to_ptr(key_ref);
4446 tsec = ctx->security;
4447 ksec = key->security;
4449 /* if no specific permissions are requested, we skip the
4450 permission check. No serious, additional covert channels
4451 appear to be created. */
4455 return avc_has_perm(tsec->sid, ksec->sid,
4456 SECCLASS_KEY, perm, NULL);
4461 static struct security_operations selinux_ops = {
4462 .ptrace = selinux_ptrace,
4463 .capget = selinux_capget,
4464 .capset_check = selinux_capset_check,
4465 .capset_set = selinux_capset_set,
4466 .sysctl = selinux_sysctl,
4467 .capable = selinux_capable,
4468 .quotactl = selinux_quotactl,
4469 .quota_on = selinux_quota_on,
4470 .syslog = selinux_syslog,
4471 .vm_enough_memory = selinux_vm_enough_memory,
4473 .netlink_send = selinux_netlink_send,
4474 .netlink_recv = selinux_netlink_recv,
4476 .bprm_alloc_security = selinux_bprm_alloc_security,
4477 .bprm_free_security = selinux_bprm_free_security,
4478 .bprm_apply_creds = selinux_bprm_apply_creds,
4479 .bprm_post_apply_creds = selinux_bprm_post_apply_creds,
4480 .bprm_set_security = selinux_bprm_set_security,
4481 .bprm_check_security = selinux_bprm_check_security,
4482 .bprm_secureexec = selinux_bprm_secureexec,
4484 .sb_alloc_security = selinux_sb_alloc_security,
4485 .sb_free_security = selinux_sb_free_security,
4486 .sb_copy_data = selinux_sb_copy_data,
4487 .sb_kern_mount = selinux_sb_kern_mount,
4488 .sb_statfs = selinux_sb_statfs,
4489 .sb_mount = selinux_mount,
4490 .sb_umount = selinux_umount,
4492 .inode_alloc_security = selinux_inode_alloc_security,
4493 .inode_free_security = selinux_inode_free_security,
4494 .inode_init_security = selinux_inode_init_security,
4495 .inode_create = selinux_inode_create,
4496 .inode_link = selinux_inode_link,
4497 .inode_unlink = selinux_inode_unlink,
4498 .inode_symlink = selinux_inode_symlink,
4499 .inode_mkdir = selinux_inode_mkdir,
4500 .inode_rmdir = selinux_inode_rmdir,
4501 .inode_mknod = selinux_inode_mknod,
4502 .inode_rename = selinux_inode_rename,
4503 .inode_readlink = selinux_inode_readlink,
4504 .inode_follow_link = selinux_inode_follow_link,
4505 .inode_permission = selinux_inode_permission,
4506 .inode_setattr = selinux_inode_setattr,
4507 .inode_getattr = selinux_inode_getattr,
4508 .inode_setxattr = selinux_inode_setxattr,
4509 .inode_post_setxattr = selinux_inode_post_setxattr,
4510 .inode_getxattr = selinux_inode_getxattr,
4511 .inode_listxattr = selinux_inode_listxattr,
4512 .inode_removexattr = selinux_inode_removexattr,
4513 .inode_xattr_getsuffix = selinux_inode_xattr_getsuffix,
4514 .inode_getsecurity = selinux_inode_getsecurity,
4515 .inode_setsecurity = selinux_inode_setsecurity,
4516 .inode_listsecurity = selinux_inode_listsecurity,
4518 .file_permission = selinux_file_permission,
4519 .file_alloc_security = selinux_file_alloc_security,
4520 .file_free_security = selinux_file_free_security,
4521 .file_ioctl = selinux_file_ioctl,
4522 .file_mmap = selinux_file_mmap,
4523 .file_mprotect = selinux_file_mprotect,
4524 .file_lock = selinux_file_lock,
4525 .file_fcntl = selinux_file_fcntl,
4526 .file_set_fowner = selinux_file_set_fowner,
4527 .file_send_sigiotask = selinux_file_send_sigiotask,
4528 .file_receive = selinux_file_receive,
4530 .task_create = selinux_task_create,
4531 .task_alloc_security = selinux_task_alloc_security,
4532 .task_free_security = selinux_task_free_security,
4533 .task_setuid = selinux_task_setuid,
4534 .task_post_setuid = selinux_task_post_setuid,
4535 .task_setgid = selinux_task_setgid,
4536 .task_setpgid = selinux_task_setpgid,
4537 .task_getpgid = selinux_task_getpgid,
4538 .task_getsid = selinux_task_getsid,
4539 .task_getsecid = selinux_task_getsecid,
4540 .task_setgroups = selinux_task_setgroups,
4541 .task_setnice = selinux_task_setnice,
4542 .task_setioprio = selinux_task_setioprio,
4543 .task_getioprio = selinux_task_getioprio,
4544 .task_setrlimit = selinux_task_setrlimit,
4545 .task_setscheduler = selinux_task_setscheduler,
4546 .task_getscheduler = selinux_task_getscheduler,
4547 .task_movememory = selinux_task_movememory,
4548 .task_kill = selinux_task_kill,
4549 .task_wait = selinux_task_wait,
4550 .task_prctl = selinux_task_prctl,
4551 .task_reparent_to_init = selinux_task_reparent_to_init,
4552 .task_to_inode = selinux_task_to_inode,
4554 .ipc_permission = selinux_ipc_permission,
4556 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
4557 .msg_msg_free_security = selinux_msg_msg_free_security,
4559 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
4560 .msg_queue_free_security = selinux_msg_queue_free_security,
4561 .msg_queue_associate = selinux_msg_queue_associate,
4562 .msg_queue_msgctl = selinux_msg_queue_msgctl,
4563 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
4564 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
4566 .shm_alloc_security = selinux_shm_alloc_security,
4567 .shm_free_security = selinux_shm_free_security,
4568 .shm_associate = selinux_shm_associate,
4569 .shm_shmctl = selinux_shm_shmctl,
4570 .shm_shmat = selinux_shm_shmat,
4572 .sem_alloc_security = selinux_sem_alloc_security,
4573 .sem_free_security = selinux_sem_free_security,
4574 .sem_associate = selinux_sem_associate,
4575 .sem_semctl = selinux_sem_semctl,
4576 .sem_semop = selinux_sem_semop,
4578 .register_security = selinux_register_security,
4579 .unregister_security = selinux_unregister_security,
4581 .d_instantiate = selinux_d_instantiate,
4583 .getprocattr = selinux_getprocattr,
4584 .setprocattr = selinux_setprocattr,
4586 .unix_stream_connect = selinux_socket_unix_stream_connect,
4587 .unix_may_send = selinux_socket_unix_may_send,
4589 .socket_create = selinux_socket_create,
4590 .socket_post_create = selinux_socket_post_create,
4591 .socket_bind = selinux_socket_bind,
4592 .socket_connect = selinux_socket_connect,
4593 .socket_listen = selinux_socket_listen,
4594 .socket_accept = selinux_socket_accept,
4595 .socket_sendmsg = selinux_socket_sendmsg,
4596 .socket_recvmsg = selinux_socket_recvmsg,
4597 .socket_getsockname = selinux_socket_getsockname,
4598 .socket_getpeername = selinux_socket_getpeername,
4599 .socket_getsockopt = selinux_socket_getsockopt,
4600 .socket_setsockopt = selinux_socket_setsockopt,
4601 .socket_shutdown = selinux_socket_shutdown,
4602 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
4603 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
4604 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
4605 .sk_alloc_security = selinux_sk_alloc_security,
4606 .sk_free_security = selinux_sk_free_security,
4607 .sk_getsid = selinux_sk_getsid_security,
4609 #ifdef CONFIG_SECURITY_NETWORK_XFRM
4610 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
4611 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
4612 .xfrm_policy_free_security = selinux_xfrm_policy_free,
4613 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
4614 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
4615 .xfrm_state_free_security = selinux_xfrm_state_free,
4616 .xfrm_state_delete_security = selinux_xfrm_state_delete,
4617 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
4621 .key_alloc = selinux_key_alloc,
4622 .key_free = selinux_key_free,
4623 .key_permission = selinux_key_permission,
4627 static __init int selinux_init(void)
4629 struct task_security_struct *tsec;
4631 if (!selinux_enabled) {
4632 printk(KERN_INFO "SELinux: Disabled at boot.\n");
4636 printk(KERN_INFO "SELinux: Initializing.\n");
4638 /* Set the security state for the initial task. */
4639 if (task_alloc_security(current))
4640 panic("SELinux: Failed to initialize initial task.\n");
4641 tsec = current->security;
4642 tsec->osid = tsec->sid = SECINITSID_KERNEL;
4644 sel_inode_cache = kmem_cache_create("selinux_inode_security",
4645 sizeof(struct inode_security_struct),
4646 0, SLAB_PANIC, NULL, NULL);
4649 original_ops = secondary_ops = security_ops;
4651 panic ("SELinux: No initial security operations\n");
4652 if (register_security (&selinux_ops))
4653 panic("SELinux: Unable to register with kernel.\n");
4655 if (selinux_enforcing) {
4656 printk(KERN_INFO "SELinux: Starting in enforcing mode\n");
4658 printk(KERN_INFO "SELinux: Starting in permissive mode\n");
4662 /* Add security information to initial keyrings */
4663 selinux_key_alloc(&root_user_keyring, current,
4664 KEY_ALLOC_NOT_IN_QUOTA);
4665 selinux_key_alloc(&root_session_keyring, current,
4666 KEY_ALLOC_NOT_IN_QUOTA);
4672 void selinux_complete_init(void)
4674 printk(KERN_INFO "SELinux: Completing initialization.\n");
4676 /* Set up any superblocks initialized prior to the policy load. */
4677 printk(KERN_INFO "SELinux: Setting up existing superblocks.\n");
4678 spin_lock(&sb_lock);
4679 spin_lock(&sb_security_lock);
4681 if (!list_empty(&superblock_security_head)) {
4682 struct superblock_security_struct *sbsec =
4683 list_entry(superblock_security_head.next,
4684 struct superblock_security_struct,
4686 struct super_block *sb = sbsec->sb;
4688 spin_unlock(&sb_security_lock);
4689 spin_unlock(&sb_lock);
4690 down_read(&sb->s_umount);
4692 superblock_doinit(sb, NULL);
4694 spin_lock(&sb_lock);
4695 spin_lock(&sb_security_lock);
4696 list_del_init(&sbsec->list);
4699 spin_unlock(&sb_security_lock);
4700 spin_unlock(&sb_lock);
4703 /* SELinux requires early initialization in order to label
4704 all processes and objects when they are created. */
4705 security_initcall(selinux_init);
4707 #if defined(CONFIG_NETFILTER)
4709 static struct nf_hook_ops selinux_ipv4_op = {
4710 .hook = selinux_ipv4_postroute_last,
4711 .owner = THIS_MODULE,
4713 .hooknum = NF_IP_POST_ROUTING,
4714 .priority = NF_IP_PRI_SELINUX_LAST,
4717 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4719 static struct nf_hook_ops selinux_ipv6_op = {
4720 .hook = selinux_ipv6_postroute_last,
4721 .owner = THIS_MODULE,
4723 .hooknum = NF_IP6_POST_ROUTING,
4724 .priority = NF_IP6_PRI_SELINUX_LAST,
4729 static int __init selinux_nf_ip_init(void)
4733 if (!selinux_enabled)
4736 printk(KERN_INFO "SELinux: Registering netfilter hooks\n");
4738 err = nf_register_hook(&selinux_ipv4_op);
4740 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
4742 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4744 err = nf_register_hook(&selinux_ipv6_op);
4746 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
4754 __initcall(selinux_nf_ip_init);
4756 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4757 static void selinux_nf_ip_exit(void)
4759 printk(KERN_INFO "SELinux: Unregistering netfilter hooks\n");
4761 nf_unregister_hook(&selinux_ipv4_op);
4762 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4763 nf_unregister_hook(&selinux_ipv6_op);
4768 #else /* CONFIG_NETFILTER */
4770 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4771 #define selinux_nf_ip_exit()
4774 #endif /* CONFIG_NETFILTER */
4776 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4777 int selinux_disable(void)
4779 extern void exit_sel_fs(void);
4780 static int selinux_disabled = 0;
4782 if (ss_initialized) {
4783 /* Not permitted after initial policy load. */
4787 if (selinux_disabled) {
4788 /* Only do this once. */
4792 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
4794 selinux_disabled = 1;
4795 selinux_enabled = 0;
4797 /* Reset security_ops to the secondary module, dummy or capability. */
4798 security_ops = secondary_ops;
4800 /* Unregister netfilter hooks. */
4801 selinux_nf_ip_exit();
4803 /* Unregister selinuxfs. */