2 * NSA Security-Enhanced Linux (SELinux) security module
4 * This file contains the SELinux hook function implementations.
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License version 2,
18 * as published by the Free Software Foundation.
21 #include <linux/config.h>
22 #include <linux/module.h>
23 #include <linux/init.h>
24 #include <linux/kernel.h>
25 #include <linux/ptrace.h>
26 #include <linux/errno.h>
27 #include <linux/sched.h>
28 #include <linux/security.h>
29 #include <linux/xattr.h>
30 #include <linux/capability.h>
31 #include <linux/unistd.h>
33 #include <linux/mman.h>
34 #include <linux/slab.h>
35 #include <linux/pagemap.h>
36 #include <linux/swap.h>
37 #include <linux/smp_lock.h>
38 #include <linux/spinlock.h>
39 #include <linux/syscalls.h>
40 #include <linux/file.h>
41 #include <linux/namei.h>
42 #include <linux/mount.h>
43 #include <linux/ext2_fs.h>
44 #include <linux/proc_fs.h>
46 #include <linux/netfilter_ipv4.h>
47 #include <linux/netfilter_ipv6.h>
48 #include <linux/tty.h>
50 #include <net/ip.h> /* for sysctl_local_port_range[] */
51 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
52 #include <asm/uaccess.h>
53 #include <asm/semaphore.h>
54 #include <asm/ioctls.h>
55 #include <linux/bitops.h>
56 #include <linux/interrupt.h>
57 #include <linux/netdevice.h> /* for network interface checks */
58 #include <linux/netlink.h>
59 #include <linux/tcp.h>
60 #include <linux/udp.h>
61 #include <linux/quota.h>
62 #include <linux/un.h> /* for Unix socket types */
63 #include <net/af_unix.h> /* for Unix socket types */
64 #include <linux/parser.h>
65 #include <linux/nfs_mount.h>
67 #include <linux/hugetlb.h>
68 #include <linux/personality.h>
69 #include <linux/sysctl.h>
70 #include <linux/audit.h>
71 #include <linux/string.h>
78 #define XATTR_SELINUX_SUFFIX "selinux"
79 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
81 extern unsigned int policydb_loaded_version;
82 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
83 extern int selinux_compat_net;
85 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
86 int selinux_enforcing = 0;
88 static int __init enforcing_setup(char *str)
90 selinux_enforcing = simple_strtol(str,NULL,0);
93 __setup("enforcing=", enforcing_setup);
96 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
97 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
99 static int __init selinux_enabled_setup(char *str)
101 selinux_enabled = simple_strtol(str, NULL, 0);
104 __setup("selinux=", selinux_enabled_setup);
106 int selinux_enabled = 1;
109 /* Original (dummy) security module. */
110 static struct security_operations *original_ops = NULL;
112 /* Minimal support for a secondary security module,
113 just to allow the use of the dummy or capability modules.
114 The owlsm module can alternatively be used as a secondary
115 module as long as CONFIG_OWLSM_FD is not enabled. */
116 static struct security_operations *secondary_ops = NULL;
118 /* Lists of inode and superblock security structures initialized
119 before the policy was loaded. */
120 static LIST_HEAD(superblock_security_head);
121 static DEFINE_SPINLOCK(sb_security_lock);
123 static kmem_cache_t *sel_inode_cache;
125 /* Return security context for a given sid or just the context
126 length if the buffer is null or length is 0 */
127 static int selinux_getsecurity(u32 sid, void *buffer, size_t size)
133 rc = security_sid_to_context(sid, &context, &len);
137 if (!buffer || !size)
138 goto getsecurity_exit;
142 goto getsecurity_exit;
144 memcpy(buffer, context, len);
151 /* Allocate and free functions for each kind of security blob. */
153 static int task_alloc_security(struct task_struct *task)
155 struct task_security_struct *tsec;
157 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
162 tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
163 task->security = tsec;
168 static void task_free_security(struct task_struct *task)
170 struct task_security_struct *tsec = task->security;
171 task->security = NULL;
175 static int inode_alloc_security(struct inode *inode)
177 struct task_security_struct *tsec = current->security;
178 struct inode_security_struct *isec;
180 isec = kmem_cache_alloc(sel_inode_cache, SLAB_KERNEL);
184 memset(isec, 0, sizeof(*isec));
185 init_MUTEX(&isec->sem);
186 INIT_LIST_HEAD(&isec->list);
188 isec->sid = SECINITSID_UNLABELED;
189 isec->sclass = SECCLASS_FILE;
190 isec->task_sid = tsec->sid;
191 inode->i_security = isec;
196 static void inode_free_security(struct inode *inode)
198 struct inode_security_struct *isec = inode->i_security;
199 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
201 spin_lock(&sbsec->isec_lock);
202 if (!list_empty(&isec->list))
203 list_del_init(&isec->list);
204 spin_unlock(&sbsec->isec_lock);
206 inode->i_security = NULL;
207 kmem_cache_free(sel_inode_cache, isec);
210 static int file_alloc_security(struct file *file)
212 struct task_security_struct *tsec = current->security;
213 struct file_security_struct *fsec;
215 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
220 fsec->sid = tsec->sid;
221 fsec->fown_sid = tsec->sid;
222 file->f_security = fsec;
227 static void file_free_security(struct file *file)
229 struct file_security_struct *fsec = file->f_security;
230 file->f_security = NULL;
234 static int superblock_alloc_security(struct super_block *sb)
236 struct superblock_security_struct *sbsec;
238 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
242 init_MUTEX(&sbsec->sem);
243 INIT_LIST_HEAD(&sbsec->list);
244 INIT_LIST_HEAD(&sbsec->isec_head);
245 spin_lock_init(&sbsec->isec_lock);
247 sbsec->sid = SECINITSID_UNLABELED;
248 sbsec->def_sid = SECINITSID_FILE;
249 sb->s_security = sbsec;
254 static void superblock_free_security(struct super_block *sb)
256 struct superblock_security_struct *sbsec = sb->s_security;
258 spin_lock(&sb_security_lock);
259 if (!list_empty(&sbsec->list))
260 list_del_init(&sbsec->list);
261 spin_unlock(&sb_security_lock);
263 sb->s_security = NULL;
267 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
269 struct sk_security_struct *ssec;
271 if (family != PF_UNIX)
274 ssec = kzalloc(sizeof(*ssec), priority);
279 ssec->peer_sid = SECINITSID_UNLABELED;
280 sk->sk_security = ssec;
285 static void sk_free_security(struct sock *sk)
287 struct sk_security_struct *ssec = sk->sk_security;
289 if (sk->sk_family != PF_UNIX)
292 sk->sk_security = NULL;
296 /* The security server must be initialized before
297 any labeling or access decisions can be provided. */
298 extern int ss_initialized;
300 /* The file system's label must be initialized prior to use. */
302 static char *labeling_behaviors[6] = {
304 "uses transition SIDs",
306 "uses genfs_contexts",
307 "not configured for labeling",
308 "uses mountpoint labeling",
311 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
313 static inline int inode_doinit(struct inode *inode)
315 return inode_doinit_with_dentry(inode, NULL);
324 static match_table_t tokens = {
325 {Opt_context, "context=%s"},
326 {Opt_fscontext, "fscontext=%s"},
327 {Opt_defcontext, "defcontext=%s"},
330 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
332 static int try_context_mount(struct super_block *sb, void *data)
334 char *context = NULL, *defcontext = NULL;
337 int alloc = 0, rc = 0, seen = 0;
338 struct task_security_struct *tsec = current->security;
339 struct superblock_security_struct *sbsec = sb->s_security;
344 name = sb->s_type->name;
346 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
348 /* NFS we understand. */
349 if (!strcmp(name, "nfs")) {
350 struct nfs_mount_data *d = data;
352 if (d->version < NFS_MOUNT_VERSION)
356 context = d->context;
363 /* Standard string-based options. */
364 char *p, *options = data;
366 while ((p = strsep(&options, ",")) != NULL) {
368 substring_t args[MAX_OPT_ARGS];
373 token = match_token(p, tokens, args);
379 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
382 context = match_strdup(&args[0]);
393 if (seen & (Opt_context|Opt_fscontext)) {
395 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
398 context = match_strdup(&args[0]);
405 seen |= Opt_fscontext;
409 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
411 printk(KERN_WARNING "SELinux: "
412 "defcontext option is invalid "
413 "for this filesystem type\n");
416 if (seen & (Opt_context|Opt_defcontext)) {
418 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
421 defcontext = match_strdup(&args[0]);
428 seen |= Opt_defcontext;
433 printk(KERN_WARNING "SELinux: unknown mount "
445 rc = security_context_to_sid(context, strlen(context), &sid);
447 printk(KERN_WARNING "SELinux: security_context_to_sid"
448 "(%s) failed for (dev %s, type %s) errno=%d\n",
449 context, sb->s_id, name, rc);
453 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
454 FILESYSTEM__RELABELFROM, NULL);
458 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
459 FILESYSTEM__RELABELTO, NULL);
465 if (seen & Opt_context)
466 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
470 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
472 printk(KERN_WARNING "SELinux: security_context_to_sid"
473 "(%s) failed for (dev %s, type %s) errno=%d\n",
474 defcontext, sb->s_id, name, rc);
478 if (sid == sbsec->def_sid)
481 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
482 FILESYSTEM__RELABELFROM, NULL);
486 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
487 FILESYSTEM__ASSOCIATE, NULL);
491 sbsec->def_sid = sid;
503 static int superblock_doinit(struct super_block *sb, void *data)
505 struct superblock_security_struct *sbsec = sb->s_security;
506 struct dentry *root = sb->s_root;
507 struct inode *inode = root->d_inode;
511 if (sbsec->initialized)
514 if (!ss_initialized) {
515 /* Defer initialization until selinux_complete_init,
516 after the initial policy is loaded and the security
517 server is ready to handle calls. */
518 spin_lock(&sb_security_lock);
519 if (list_empty(&sbsec->list))
520 list_add(&sbsec->list, &superblock_security_head);
521 spin_unlock(&sb_security_lock);
525 /* Determine the labeling behavior to use for this filesystem type. */
526 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
528 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
529 __FUNCTION__, sb->s_type->name, rc);
533 rc = try_context_mount(sb, data);
537 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
538 /* Make sure that the xattr handler exists and that no
539 error other than -ENODATA is returned by getxattr on
540 the root directory. -ENODATA is ok, as this may be
541 the first boot of the SELinux kernel before we have
542 assigned xattr values to the filesystem. */
543 if (!inode->i_op->getxattr) {
544 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
545 "xattr support\n", sb->s_id, sb->s_type->name);
549 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
550 if (rc < 0 && rc != -ENODATA) {
551 if (rc == -EOPNOTSUPP)
552 printk(KERN_WARNING "SELinux: (dev %s, type "
553 "%s) has no security xattr handler\n",
554 sb->s_id, sb->s_type->name);
556 printk(KERN_WARNING "SELinux: (dev %s, type "
557 "%s) getxattr errno %d\n", sb->s_id,
558 sb->s_type->name, -rc);
563 if (strcmp(sb->s_type->name, "proc") == 0)
566 sbsec->initialized = 1;
568 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
569 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
570 sb->s_id, sb->s_type->name);
573 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
574 sb->s_id, sb->s_type->name,
575 labeling_behaviors[sbsec->behavior-1]);
578 /* Initialize the root inode. */
579 rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
581 /* Initialize any other inodes associated with the superblock, e.g.
582 inodes created prior to initial policy load or inodes created
583 during get_sb by a pseudo filesystem that directly
585 spin_lock(&sbsec->isec_lock);
587 if (!list_empty(&sbsec->isec_head)) {
588 struct inode_security_struct *isec =
589 list_entry(sbsec->isec_head.next,
590 struct inode_security_struct, list);
591 struct inode *inode = isec->inode;
592 spin_unlock(&sbsec->isec_lock);
593 inode = igrab(inode);
595 if (!IS_PRIVATE (inode))
599 spin_lock(&sbsec->isec_lock);
600 list_del_init(&isec->list);
603 spin_unlock(&sbsec->isec_lock);
609 static inline u16 inode_mode_to_security_class(umode_t mode)
611 switch (mode & S_IFMT) {
613 return SECCLASS_SOCK_FILE;
615 return SECCLASS_LNK_FILE;
617 return SECCLASS_FILE;
619 return SECCLASS_BLK_FILE;
623 return SECCLASS_CHR_FILE;
625 return SECCLASS_FIFO_FILE;
629 return SECCLASS_FILE;
632 static inline int default_protocol_stream(int protocol)
634 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
637 static inline int default_protocol_dgram(int protocol)
639 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
642 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
649 return SECCLASS_UNIX_STREAM_SOCKET;
651 return SECCLASS_UNIX_DGRAM_SOCKET;
658 if (default_protocol_stream(protocol))
659 return SECCLASS_TCP_SOCKET;
661 return SECCLASS_RAWIP_SOCKET;
663 if (default_protocol_dgram(protocol))
664 return SECCLASS_UDP_SOCKET;
666 return SECCLASS_RAWIP_SOCKET;
668 return SECCLASS_RAWIP_SOCKET;
674 return SECCLASS_NETLINK_ROUTE_SOCKET;
675 case NETLINK_FIREWALL:
676 return SECCLASS_NETLINK_FIREWALL_SOCKET;
677 case NETLINK_INET_DIAG:
678 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
680 return SECCLASS_NETLINK_NFLOG_SOCKET;
682 return SECCLASS_NETLINK_XFRM_SOCKET;
683 case NETLINK_SELINUX:
684 return SECCLASS_NETLINK_SELINUX_SOCKET;
686 return SECCLASS_NETLINK_AUDIT_SOCKET;
688 return SECCLASS_NETLINK_IP6FW_SOCKET;
689 case NETLINK_DNRTMSG:
690 return SECCLASS_NETLINK_DNRT_SOCKET;
691 case NETLINK_KOBJECT_UEVENT:
692 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
694 return SECCLASS_NETLINK_SOCKET;
697 return SECCLASS_PACKET_SOCKET;
699 return SECCLASS_KEY_SOCKET;
701 return SECCLASS_APPLETALK_SOCKET;
704 return SECCLASS_SOCKET;
707 #ifdef CONFIG_PROC_FS
708 static int selinux_proc_get_sid(struct proc_dir_entry *de,
713 char *buffer, *path, *end;
715 buffer = (char*)__get_free_page(GFP_KERNEL);
725 while (de && de != de->parent) {
726 buflen -= de->namelen + 1;
730 memcpy(end, de->name, de->namelen);
735 rc = security_genfs_sid("proc", path, tclass, sid);
736 free_page((unsigned long)buffer);
740 static int selinux_proc_get_sid(struct proc_dir_entry *de,
748 /* The inode's security attributes must be initialized before first use. */
749 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
751 struct superblock_security_struct *sbsec = NULL;
752 struct inode_security_struct *isec = inode->i_security;
754 struct dentry *dentry;
755 #define INITCONTEXTLEN 255
756 char *context = NULL;
761 if (isec->initialized)
766 if (isec->initialized)
769 sbsec = inode->i_sb->s_security;
770 if (!sbsec->initialized) {
771 /* Defer initialization until selinux_complete_init,
772 after the initial policy is loaded and the security
773 server is ready to handle calls. */
774 spin_lock(&sbsec->isec_lock);
775 if (list_empty(&isec->list))
776 list_add(&isec->list, &sbsec->isec_head);
777 spin_unlock(&sbsec->isec_lock);
781 switch (sbsec->behavior) {
782 case SECURITY_FS_USE_XATTR:
783 if (!inode->i_op->getxattr) {
784 isec->sid = sbsec->def_sid;
788 /* Need a dentry, since the xattr API requires one.
789 Life would be simpler if we could just pass the inode. */
791 /* Called from d_instantiate or d_splice_alias. */
792 dentry = dget(opt_dentry);
794 /* Called from selinux_complete_init, try to find a dentry. */
795 dentry = d_find_alias(inode);
798 printk(KERN_WARNING "%s: no dentry for dev=%s "
799 "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
804 len = INITCONTEXTLEN;
805 context = kmalloc(len, GFP_KERNEL);
811 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
814 /* Need a larger buffer. Query for the right size. */
815 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
823 context = kmalloc(len, GFP_KERNEL);
829 rc = inode->i_op->getxattr(dentry,
835 if (rc != -ENODATA) {
836 printk(KERN_WARNING "%s: getxattr returned "
837 "%d for dev=%s ino=%ld\n", __FUNCTION__,
838 -rc, inode->i_sb->s_id, inode->i_ino);
842 /* Map ENODATA to the default file SID */
843 sid = sbsec->def_sid;
846 rc = security_context_to_sid_default(context, rc, &sid,
849 printk(KERN_WARNING "%s: context_to_sid(%s) "
850 "returned %d for dev=%s ino=%ld\n",
851 __FUNCTION__, context, -rc,
852 inode->i_sb->s_id, inode->i_ino);
854 /* Leave with the unlabeled SID */
862 case SECURITY_FS_USE_TASK:
863 isec->sid = isec->task_sid;
865 case SECURITY_FS_USE_TRANS:
866 /* Default to the fs SID. */
867 isec->sid = sbsec->sid;
869 /* Try to obtain a transition SID. */
870 isec->sclass = inode_mode_to_security_class(inode->i_mode);
871 rc = security_transition_sid(isec->task_sid,
880 /* Default to the fs SID. */
881 isec->sid = sbsec->sid;
884 struct proc_inode *proci = PROC_I(inode);
886 isec->sclass = inode_mode_to_security_class(inode->i_mode);
887 rc = selinux_proc_get_sid(proci->pde,
898 isec->initialized = 1;
901 if (isec->sclass == SECCLASS_FILE)
902 isec->sclass = inode_mode_to_security_class(inode->i_mode);
909 /* Convert a Linux signal to an access vector. */
910 static inline u32 signal_to_av(int sig)
916 /* Commonly granted from child to parent. */
917 perm = PROCESS__SIGCHLD;
920 /* Cannot be caught or ignored */
921 perm = PROCESS__SIGKILL;
924 /* Cannot be caught or ignored */
925 perm = PROCESS__SIGSTOP;
928 /* All other signals. */
929 perm = PROCESS__SIGNAL;
936 /* Check permission betweeen a pair of tasks, e.g. signal checks,
937 fork check, ptrace check, etc. */
938 static int task_has_perm(struct task_struct *tsk1,
939 struct task_struct *tsk2,
942 struct task_security_struct *tsec1, *tsec2;
944 tsec1 = tsk1->security;
945 tsec2 = tsk2->security;
946 return avc_has_perm(tsec1->sid, tsec2->sid,
947 SECCLASS_PROCESS, perms, NULL);
950 /* Check whether a task is allowed to use a capability. */
951 static int task_has_capability(struct task_struct *tsk,
954 struct task_security_struct *tsec;
955 struct avc_audit_data ad;
957 tsec = tsk->security;
959 AVC_AUDIT_DATA_INIT(&ad,CAP);
963 return avc_has_perm(tsec->sid, tsec->sid,
964 SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
967 /* Check whether a task is allowed to use a system operation. */
968 static int task_has_system(struct task_struct *tsk,
971 struct task_security_struct *tsec;
973 tsec = tsk->security;
975 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
976 SECCLASS_SYSTEM, perms, NULL);
979 /* Check whether a task has a particular permission to an inode.
980 The 'adp' parameter is optional and allows other audit
981 data to be passed (e.g. the dentry). */
982 static int inode_has_perm(struct task_struct *tsk,
985 struct avc_audit_data *adp)
987 struct task_security_struct *tsec;
988 struct inode_security_struct *isec;
989 struct avc_audit_data ad;
991 tsec = tsk->security;
992 isec = inode->i_security;
996 AVC_AUDIT_DATA_INIT(&ad, FS);
997 ad.u.fs.inode = inode;
1000 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1003 /* Same as inode_has_perm, but pass explicit audit data containing
1004 the dentry to help the auditing code to more easily generate the
1005 pathname if needed. */
1006 static inline int dentry_has_perm(struct task_struct *tsk,
1007 struct vfsmount *mnt,
1008 struct dentry *dentry,
1011 struct inode *inode = dentry->d_inode;
1012 struct avc_audit_data ad;
1013 AVC_AUDIT_DATA_INIT(&ad,FS);
1015 ad.u.fs.dentry = dentry;
1016 return inode_has_perm(tsk, inode, av, &ad);
1019 /* Check whether a task can use an open file descriptor to
1020 access an inode in a given way. Check access to the
1021 descriptor itself, and then use dentry_has_perm to
1022 check a particular permission to the file.
1023 Access to the descriptor is implicitly granted if it
1024 has the same SID as the process. If av is zero, then
1025 access to the file is not checked, e.g. for cases
1026 where only the descriptor is affected like seek. */
1027 static int file_has_perm(struct task_struct *tsk,
1031 struct task_security_struct *tsec = tsk->security;
1032 struct file_security_struct *fsec = file->f_security;
1033 struct vfsmount *mnt = file->f_vfsmnt;
1034 struct dentry *dentry = file->f_dentry;
1035 struct inode *inode = dentry->d_inode;
1036 struct avc_audit_data ad;
1039 AVC_AUDIT_DATA_INIT(&ad, FS);
1041 ad.u.fs.dentry = dentry;
1043 if (tsec->sid != fsec->sid) {
1044 rc = avc_has_perm(tsec->sid, fsec->sid,
1052 /* av is zero if only checking access to the descriptor. */
1054 return inode_has_perm(tsk, inode, av, &ad);
1059 /* Check whether a task can create a file. */
1060 static int may_create(struct inode *dir,
1061 struct dentry *dentry,
1064 struct task_security_struct *tsec;
1065 struct inode_security_struct *dsec;
1066 struct superblock_security_struct *sbsec;
1068 struct avc_audit_data ad;
1071 tsec = current->security;
1072 dsec = dir->i_security;
1073 sbsec = dir->i_sb->s_security;
1075 AVC_AUDIT_DATA_INIT(&ad, FS);
1076 ad.u.fs.dentry = dentry;
1078 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1079 DIR__ADD_NAME | DIR__SEARCH,
1084 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1085 newsid = tsec->create_sid;
1087 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1093 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1097 return avc_has_perm(newsid, sbsec->sid,
1098 SECCLASS_FILESYSTEM,
1099 FILESYSTEM__ASSOCIATE, &ad);
1102 /* Check whether a task can create a key. */
1103 static int may_create_key(u32 ksid,
1104 struct task_struct *ctx)
1106 struct task_security_struct *tsec;
1108 tsec = ctx->security;
1110 return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1114 #define MAY_UNLINK 1
1117 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1118 static int may_link(struct inode *dir,
1119 struct dentry *dentry,
1123 struct task_security_struct *tsec;
1124 struct inode_security_struct *dsec, *isec;
1125 struct avc_audit_data ad;
1129 tsec = current->security;
1130 dsec = dir->i_security;
1131 isec = dentry->d_inode->i_security;
1133 AVC_AUDIT_DATA_INIT(&ad, FS);
1134 ad.u.fs.dentry = dentry;
1137 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1138 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1153 printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
1157 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1161 static inline int may_rename(struct inode *old_dir,
1162 struct dentry *old_dentry,
1163 struct inode *new_dir,
1164 struct dentry *new_dentry)
1166 struct task_security_struct *tsec;
1167 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1168 struct avc_audit_data ad;
1170 int old_is_dir, new_is_dir;
1173 tsec = current->security;
1174 old_dsec = old_dir->i_security;
1175 old_isec = old_dentry->d_inode->i_security;
1176 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1177 new_dsec = new_dir->i_security;
1179 AVC_AUDIT_DATA_INIT(&ad, FS);
1181 ad.u.fs.dentry = old_dentry;
1182 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1183 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1186 rc = avc_has_perm(tsec->sid, old_isec->sid,
1187 old_isec->sclass, FILE__RENAME, &ad);
1190 if (old_is_dir && new_dir != old_dir) {
1191 rc = avc_has_perm(tsec->sid, old_isec->sid,
1192 old_isec->sclass, DIR__REPARENT, &ad);
1197 ad.u.fs.dentry = new_dentry;
1198 av = DIR__ADD_NAME | DIR__SEARCH;
1199 if (new_dentry->d_inode)
1200 av |= DIR__REMOVE_NAME;
1201 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1204 if (new_dentry->d_inode) {
1205 new_isec = new_dentry->d_inode->i_security;
1206 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1207 rc = avc_has_perm(tsec->sid, new_isec->sid,
1209 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1217 /* Check whether a task can perform a filesystem operation. */
1218 static int superblock_has_perm(struct task_struct *tsk,
1219 struct super_block *sb,
1221 struct avc_audit_data *ad)
1223 struct task_security_struct *tsec;
1224 struct superblock_security_struct *sbsec;
1226 tsec = tsk->security;
1227 sbsec = sb->s_security;
1228 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1232 /* Convert a Linux mode and permission mask to an access vector. */
1233 static inline u32 file_mask_to_av(int mode, int mask)
1237 if ((mode & S_IFMT) != S_IFDIR) {
1238 if (mask & MAY_EXEC)
1239 av |= FILE__EXECUTE;
1240 if (mask & MAY_READ)
1243 if (mask & MAY_APPEND)
1245 else if (mask & MAY_WRITE)
1249 if (mask & MAY_EXEC)
1251 if (mask & MAY_WRITE)
1253 if (mask & MAY_READ)
1260 /* Convert a Linux file to an access vector. */
1261 static inline u32 file_to_av(struct file *file)
1265 if (file->f_mode & FMODE_READ)
1267 if (file->f_mode & FMODE_WRITE) {
1268 if (file->f_flags & O_APPEND)
1277 /* Set an inode's SID to a specified value. */
1278 static int inode_security_set_sid(struct inode *inode, u32 sid)
1280 struct inode_security_struct *isec = inode->i_security;
1281 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
1283 if (!sbsec->initialized) {
1284 /* Defer initialization to selinux_complete_init. */
1289 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1291 isec->initialized = 1;
1296 /* Hook functions begin here. */
1298 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1300 struct task_security_struct *psec = parent->security;
1301 struct task_security_struct *csec = child->security;
1304 rc = secondary_ops->ptrace(parent,child);
1308 rc = task_has_perm(parent, child, PROCESS__PTRACE);
1309 /* Save the SID of the tracing process for later use in apply_creds. */
1310 if (!(child->ptrace & PT_PTRACED) && !rc)
1311 csec->ptrace_sid = psec->sid;
1315 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1316 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1320 error = task_has_perm(current, target, PROCESS__GETCAP);
1324 return secondary_ops->capget(target, effective, inheritable, permitted);
1327 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1328 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1332 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1336 return task_has_perm(current, target, PROCESS__SETCAP);
1339 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1340 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1342 secondary_ops->capset_set(target, effective, inheritable, permitted);
1345 static int selinux_capable(struct task_struct *tsk, int cap)
1349 rc = secondary_ops->capable(tsk, cap);
1353 return task_has_capability(tsk,cap);
1356 static int selinux_sysctl(ctl_table *table, int op)
1360 struct task_security_struct *tsec;
1364 rc = secondary_ops->sysctl(table, op);
1368 tsec = current->security;
1370 rc = selinux_proc_get_sid(table->de, (op == 001) ?
1371 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1373 /* Default to the well-defined sysctl SID. */
1374 tsid = SECINITSID_SYSCTL;
1377 /* The op values are "defined" in sysctl.c, thereby creating
1378 * a bad coupling between this module and sysctl.c */
1380 error = avc_has_perm(tsec->sid, tsid,
1381 SECCLASS_DIR, DIR__SEARCH, NULL);
1389 error = avc_has_perm(tsec->sid, tsid,
1390 SECCLASS_FILE, av, NULL);
1396 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1409 rc = superblock_has_perm(current,
1411 FILESYSTEM__QUOTAMOD, NULL);
1416 rc = superblock_has_perm(current,
1418 FILESYSTEM__QUOTAGET, NULL);
1421 rc = 0; /* let the kernel handle invalid cmds */
1427 static int selinux_quota_on(struct dentry *dentry)
1429 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1432 static int selinux_syslog(int type)
1436 rc = secondary_ops->syslog(type);
1441 case 3: /* Read last kernel messages */
1442 case 10: /* Return size of the log buffer */
1443 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1445 case 6: /* Disable logging to console */
1446 case 7: /* Enable logging to console */
1447 case 8: /* Set level of messages printed to console */
1448 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1450 case 0: /* Close log */
1451 case 1: /* Open log */
1452 case 2: /* Read from log */
1453 case 4: /* Read/clear last kernel messages */
1454 case 5: /* Clear ring buffer */
1456 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1463 * Check that a process has enough memory to allocate a new virtual
1464 * mapping. 0 means there is enough memory for the allocation to
1465 * succeed and -ENOMEM implies there is not.
1467 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1468 * if the capability is granted, but __vm_enough_memory requires 1 if
1469 * the capability is granted.
1471 * Do not audit the selinux permission check, as this is applied to all
1472 * processes that allocate mappings.
1474 static int selinux_vm_enough_memory(long pages)
1476 int rc, cap_sys_admin = 0;
1477 struct task_security_struct *tsec = current->security;
1479 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1481 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1482 SECCLASS_CAPABILITY,
1483 CAP_TO_MASK(CAP_SYS_ADMIN),
1489 return __vm_enough_memory(pages, cap_sys_admin);
1492 /* binprm security operations */
1494 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1496 struct bprm_security_struct *bsec;
1498 bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1503 bsec->sid = SECINITSID_UNLABELED;
1506 bprm->security = bsec;
1510 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1512 struct task_security_struct *tsec;
1513 struct inode *inode = bprm->file->f_dentry->d_inode;
1514 struct inode_security_struct *isec;
1515 struct bprm_security_struct *bsec;
1517 struct avc_audit_data ad;
1520 rc = secondary_ops->bprm_set_security(bprm);
1524 bsec = bprm->security;
1529 tsec = current->security;
1530 isec = inode->i_security;
1532 /* Default to the current task SID. */
1533 bsec->sid = tsec->sid;
1535 /* Reset create and sockcreate SID on execve. */
1536 tsec->create_sid = 0;
1537 tsec->sockcreate_sid = 0;
1539 if (tsec->exec_sid) {
1540 newsid = tsec->exec_sid;
1541 /* Reset exec SID on execve. */
1544 /* Check for a default transition on this program. */
1545 rc = security_transition_sid(tsec->sid, isec->sid,
1546 SECCLASS_PROCESS, &newsid);
1551 AVC_AUDIT_DATA_INIT(&ad, FS);
1552 ad.u.fs.mnt = bprm->file->f_vfsmnt;
1553 ad.u.fs.dentry = bprm->file->f_dentry;
1555 if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
1558 if (tsec->sid == newsid) {
1559 rc = avc_has_perm(tsec->sid, isec->sid,
1560 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1564 /* Check permissions for the transition. */
1565 rc = avc_has_perm(tsec->sid, newsid,
1566 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1570 rc = avc_has_perm(newsid, isec->sid,
1571 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1575 /* Clear any possibly unsafe personality bits on exec: */
1576 current->personality &= ~PER_CLEAR_ON_SETID;
1578 /* Set the security field to the new SID. */
1586 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1588 return secondary_ops->bprm_check_security(bprm);
1592 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1594 struct task_security_struct *tsec = current->security;
1597 if (tsec->osid != tsec->sid) {
1598 /* Enable secure mode for SIDs transitions unless
1599 the noatsecure permission is granted between
1600 the two SIDs, i.e. ahp returns 0. */
1601 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1603 PROCESS__NOATSECURE, NULL);
1606 return (atsecure || secondary_ops->bprm_secureexec(bprm));
1609 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1611 kfree(bprm->security);
1612 bprm->security = NULL;
1615 extern struct vfsmount *selinuxfs_mount;
1616 extern struct dentry *selinux_null;
1618 /* Derived from fs/exec.c:flush_old_files. */
1619 static inline void flush_unauthorized_files(struct files_struct * files)
1621 struct avc_audit_data ad;
1622 struct file *file, *devnull = NULL;
1623 struct tty_struct *tty = current->signal->tty;
1624 struct fdtable *fdt;
1629 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
1631 /* Revalidate access to controlling tty.
1632 Use inode_has_perm on the tty inode directly rather
1633 than using file_has_perm, as this particular open
1634 file may belong to another process and we are only
1635 interested in the inode-based check here. */
1636 struct inode *inode = file->f_dentry->d_inode;
1637 if (inode_has_perm(current, inode,
1638 FILE__READ | FILE__WRITE, NULL)) {
1639 /* Reset controlling tty. */
1640 current->signal->tty = NULL;
1641 current->signal->tty_old_pgrp = 0;
1647 /* Revalidate access to inherited open files. */
1649 AVC_AUDIT_DATA_INIT(&ad,FS);
1651 spin_lock(&files->file_lock);
1653 unsigned long set, i;
1658 fdt = files_fdtable(files);
1659 if (i >= fdt->max_fds || i >= fdt->max_fdset)
1661 set = fdt->open_fds->fds_bits[j];
1664 spin_unlock(&files->file_lock);
1665 for ( ; set ; i++,set >>= 1) {
1670 if (file_has_perm(current,
1672 file_to_av(file))) {
1674 fd = get_unused_fd();
1684 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1691 fd_install(fd, devnull);
1696 spin_lock(&files->file_lock);
1699 spin_unlock(&files->file_lock);
1702 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1704 struct task_security_struct *tsec;
1705 struct bprm_security_struct *bsec;
1709 secondary_ops->bprm_apply_creds(bprm, unsafe);
1711 tsec = current->security;
1713 bsec = bprm->security;
1716 tsec->osid = tsec->sid;
1718 if (tsec->sid != sid) {
1719 /* Check for shared state. If not ok, leave SID
1720 unchanged and kill. */
1721 if (unsafe & LSM_UNSAFE_SHARE) {
1722 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1723 PROCESS__SHARE, NULL);
1730 /* Check for ptracing, and update the task SID if ok.
1731 Otherwise, leave SID unchanged and kill. */
1732 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1733 rc = avc_has_perm(tsec->ptrace_sid, sid,
1734 SECCLASS_PROCESS, PROCESS__PTRACE,
1746 * called after apply_creds without the task lock held
1748 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1750 struct task_security_struct *tsec;
1751 struct rlimit *rlim, *initrlim;
1752 struct itimerval itimer;
1753 struct bprm_security_struct *bsec;
1756 tsec = current->security;
1757 bsec = bprm->security;
1760 force_sig_specific(SIGKILL, current);
1763 if (tsec->osid == tsec->sid)
1766 /* Close files for which the new task SID is not authorized. */
1767 flush_unauthorized_files(current->files);
1769 /* Check whether the new SID can inherit signal state
1770 from the old SID. If not, clear itimers to avoid
1771 subsequent signal generation and flush and unblock
1772 signals. This must occur _after_ the task SID has
1773 been updated so that any kill done after the flush
1774 will be checked against the new SID. */
1775 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1776 PROCESS__SIGINH, NULL);
1778 memset(&itimer, 0, sizeof itimer);
1779 for (i = 0; i < 3; i++)
1780 do_setitimer(i, &itimer, NULL);
1781 flush_signals(current);
1782 spin_lock_irq(¤t->sighand->siglock);
1783 flush_signal_handlers(current, 1);
1784 sigemptyset(¤t->blocked);
1785 recalc_sigpending();
1786 spin_unlock_irq(¤t->sighand->siglock);
1789 /* Check whether the new SID can inherit resource limits
1790 from the old SID. If not, reset all soft limits to
1791 the lower of the current task's hard limit and the init
1792 task's soft limit. Note that the setting of hard limits
1793 (even to lower them) can be controlled by the setrlimit
1794 check. The inclusion of the init task's soft limit into
1795 the computation is to avoid resetting soft limits higher
1796 than the default soft limit for cases where the default
1797 is lower than the hard limit, e.g. RLIMIT_CORE or
1799 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1800 PROCESS__RLIMITINH, NULL);
1802 for (i = 0; i < RLIM_NLIMITS; i++) {
1803 rlim = current->signal->rlim + i;
1804 initrlim = init_task.signal->rlim+i;
1805 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1807 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1809 * This will cause RLIMIT_CPU calculations
1812 current->it_prof_expires = jiffies_to_cputime(1);
1816 /* Wake up the parent if it is waiting so that it can
1817 recheck wait permission to the new task SID. */
1818 wake_up_interruptible(¤t->parent->signal->wait_chldexit);
1821 /* superblock security operations */
1823 static int selinux_sb_alloc_security(struct super_block *sb)
1825 return superblock_alloc_security(sb);
1828 static void selinux_sb_free_security(struct super_block *sb)
1830 superblock_free_security(sb);
1833 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1838 return !memcmp(prefix, option, plen);
1841 static inline int selinux_option(char *option, int len)
1843 return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1844 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1845 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len));
1848 static inline void take_option(char **to, char *from, int *first, int len)
1856 memcpy(*to, from, len);
1860 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
1862 int fnosec, fsec, rc = 0;
1863 char *in_save, *in_curr, *in_end;
1864 char *sec_curr, *nosec_save, *nosec;
1869 /* Binary mount data: just copy */
1870 if (type->fs_flags & FS_BINARY_MOUNTDATA) {
1871 copy_page(sec_curr, in_curr);
1875 nosec = (char *)get_zeroed_page(GFP_KERNEL);
1883 in_save = in_end = orig;
1886 if (*in_end == ',' || *in_end == '\0') {
1887 int len = in_end - in_curr;
1889 if (selinux_option(in_curr, len))
1890 take_option(&sec_curr, in_curr, &fsec, len);
1892 take_option(&nosec, in_curr, &fnosec, len);
1894 in_curr = in_end + 1;
1896 } while (*in_end++);
1898 strcpy(in_save, nosec_save);
1899 free_page((unsigned long)nosec_save);
1904 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
1906 struct avc_audit_data ad;
1909 rc = superblock_doinit(sb, data);
1913 AVC_AUDIT_DATA_INIT(&ad,FS);
1914 ad.u.fs.dentry = sb->s_root;
1915 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
1918 static int selinux_sb_statfs(struct dentry *dentry)
1920 struct avc_audit_data ad;
1922 AVC_AUDIT_DATA_INIT(&ad,FS);
1923 ad.u.fs.dentry = dentry->d_sb->s_root;
1924 return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
1927 static int selinux_mount(char * dev_name,
1928 struct nameidata *nd,
1930 unsigned long flags,
1935 rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
1939 if (flags & MS_REMOUNT)
1940 return superblock_has_perm(current, nd->mnt->mnt_sb,
1941 FILESYSTEM__REMOUNT, NULL);
1943 return dentry_has_perm(current, nd->mnt, nd->dentry,
1947 static int selinux_umount(struct vfsmount *mnt, int flags)
1951 rc = secondary_ops->sb_umount(mnt, flags);
1955 return superblock_has_perm(current,mnt->mnt_sb,
1956 FILESYSTEM__UNMOUNT,NULL);
1959 /* inode security operations */
1961 static int selinux_inode_alloc_security(struct inode *inode)
1963 return inode_alloc_security(inode);
1966 static void selinux_inode_free_security(struct inode *inode)
1968 inode_free_security(inode);
1971 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
1972 char **name, void **value,
1975 struct task_security_struct *tsec;
1976 struct inode_security_struct *dsec;
1977 struct superblock_security_struct *sbsec;
1980 char *namep = NULL, *context;
1982 tsec = current->security;
1983 dsec = dir->i_security;
1984 sbsec = dir->i_sb->s_security;
1986 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1987 newsid = tsec->create_sid;
1989 rc = security_transition_sid(tsec->sid, dsec->sid,
1990 inode_mode_to_security_class(inode->i_mode),
1993 printk(KERN_WARNING "%s: "
1994 "security_transition_sid failed, rc=%d (dev=%s "
1997 -rc, inode->i_sb->s_id, inode->i_ino);
2002 inode_security_set_sid(inode, newsid);
2004 if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2008 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
2015 rc = security_sid_to_context(newsid, &context, &clen);
2027 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2029 return may_create(dir, dentry, SECCLASS_FILE);
2032 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2036 rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2039 return may_link(dir, old_dentry, MAY_LINK);
2042 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2046 rc = secondary_ops->inode_unlink(dir, dentry);
2049 return may_link(dir, dentry, MAY_UNLINK);
2052 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2054 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2057 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2059 return may_create(dir, dentry, SECCLASS_DIR);
2062 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2064 return may_link(dir, dentry, MAY_RMDIR);
2067 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2071 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2075 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2078 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2079 struct inode *new_inode, struct dentry *new_dentry)
2081 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2084 static int selinux_inode_readlink(struct dentry *dentry)
2086 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2089 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2093 rc = secondary_ops->inode_follow_link(dentry,nameidata);
2096 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2099 static int selinux_inode_permission(struct inode *inode, int mask,
2100 struct nameidata *nd)
2104 rc = secondary_ops->inode_permission(inode, mask, nd);
2109 /* No permission to check. Existence test. */
2113 return inode_has_perm(current, inode,
2114 file_mask_to_av(inode->i_mode, mask), NULL);
2117 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2121 rc = secondary_ops->inode_setattr(dentry, iattr);
2125 if (iattr->ia_valid & ATTR_FORCE)
2128 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2129 ATTR_ATIME_SET | ATTR_MTIME_SET))
2130 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2132 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2135 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2137 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2140 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2142 struct task_security_struct *tsec = current->security;
2143 struct inode *inode = dentry->d_inode;
2144 struct inode_security_struct *isec = inode->i_security;
2145 struct superblock_security_struct *sbsec;
2146 struct avc_audit_data ad;
2150 if (strcmp(name, XATTR_NAME_SELINUX)) {
2151 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2152 sizeof XATTR_SECURITY_PREFIX - 1) &&
2153 !capable(CAP_SYS_ADMIN)) {
2154 /* A different attribute in the security namespace.
2155 Restrict to administrator. */
2159 /* Not an attribute we recognize, so just check the
2160 ordinary setattr permission. */
2161 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2164 sbsec = inode->i_sb->s_security;
2165 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2168 if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2171 AVC_AUDIT_DATA_INIT(&ad,FS);
2172 ad.u.fs.dentry = dentry;
2174 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2175 FILE__RELABELFROM, &ad);
2179 rc = security_context_to_sid(value, size, &newsid);
2183 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2184 FILE__RELABELTO, &ad);
2188 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2193 return avc_has_perm(newsid,
2195 SECCLASS_FILESYSTEM,
2196 FILESYSTEM__ASSOCIATE,
2200 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2201 void *value, size_t size, int flags)
2203 struct inode *inode = dentry->d_inode;
2204 struct inode_security_struct *isec = inode->i_security;
2208 if (strcmp(name, XATTR_NAME_SELINUX)) {
2209 /* Not an attribute we recognize, so nothing to do. */
2213 rc = security_context_to_sid(value, size, &newsid);
2215 printk(KERN_WARNING "%s: unable to obtain SID for context "
2216 "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2224 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2226 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2229 static int selinux_inode_listxattr (struct dentry *dentry)
2231 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2234 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2236 if (strcmp(name, XATTR_NAME_SELINUX)) {
2237 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2238 sizeof XATTR_SECURITY_PREFIX - 1) &&
2239 !capable(CAP_SYS_ADMIN)) {
2240 /* A different attribute in the security namespace.
2241 Restrict to administrator. */
2245 /* Not an attribute we recognize, so just check the
2246 ordinary setattr permission. Might want a separate
2247 permission for removexattr. */
2248 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2251 /* No one is allowed to remove a SELinux security label.
2252 You can change the label, but all data must be labeled. */
2256 static const char *selinux_inode_xattr_getsuffix(void)
2258 return XATTR_SELINUX_SUFFIX;
2262 * Copy the in-core inode security context value to the user. If the
2263 * getxattr() prior to this succeeded, check to see if we need to
2264 * canonicalize the value to be finally returned to the user.
2266 * Permission check is handled by selinux_inode_getxattr hook.
2268 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void *buffer, size_t size, int err)
2270 struct inode_security_struct *isec = inode->i_security;
2272 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2275 return selinux_getsecurity(isec->sid, buffer, size);
2278 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2279 const void *value, size_t size, int flags)
2281 struct inode_security_struct *isec = inode->i_security;
2285 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2288 if (!value || !size)
2291 rc = security_context_to_sid((void*)value, size, &newsid);
2299 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2301 const int len = sizeof(XATTR_NAME_SELINUX);
2302 if (buffer && len <= buffer_size)
2303 memcpy(buffer, XATTR_NAME_SELINUX, len);
2307 /* file security operations */
2309 static int selinux_file_permission(struct file *file, int mask)
2311 struct inode *inode = file->f_dentry->d_inode;
2314 /* No permission to check. Existence test. */
2318 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2319 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2322 return file_has_perm(current, file,
2323 file_mask_to_av(inode->i_mode, mask));
2326 static int selinux_file_alloc_security(struct file *file)
2328 return file_alloc_security(file);
2331 static void selinux_file_free_security(struct file *file)
2333 file_free_security(file);
2336 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2348 case EXT2_IOC_GETFLAGS:
2350 case EXT2_IOC_GETVERSION:
2351 error = file_has_perm(current, file, FILE__GETATTR);
2354 case EXT2_IOC_SETFLAGS:
2356 case EXT2_IOC_SETVERSION:
2357 error = file_has_perm(current, file, FILE__SETATTR);
2360 /* sys_ioctl() checks */
2364 error = file_has_perm(current, file, 0);
2369 error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2372 /* default case assumes that the command will go
2373 * to the file's ioctl() function.
2376 error = file_has_perm(current, file, FILE__IOCTL);
2382 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2384 #ifndef CONFIG_PPC32
2385 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2387 * We are making executable an anonymous mapping or a
2388 * private file mapping that will also be writable.
2389 * This has an additional check.
2391 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2398 /* read access is always possible with a mapping */
2399 u32 av = FILE__READ;
2401 /* write access only matters if the mapping is shared */
2402 if (shared && (prot & PROT_WRITE))
2405 if (prot & PROT_EXEC)
2406 av |= FILE__EXECUTE;
2408 return file_has_perm(current, file, av);
2413 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2414 unsigned long prot, unsigned long flags)
2418 rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2422 if (selinux_checkreqprot)
2425 return file_map_prot_check(file, prot,
2426 (flags & MAP_TYPE) == MAP_SHARED);
2429 static int selinux_file_mprotect(struct vm_area_struct *vma,
2430 unsigned long reqprot,
2435 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2439 if (selinux_checkreqprot)
2442 #ifndef CONFIG_PPC32
2443 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2445 if (vma->vm_start >= vma->vm_mm->start_brk &&
2446 vma->vm_end <= vma->vm_mm->brk) {
2447 rc = task_has_perm(current, current,
2449 } else if (!vma->vm_file &&
2450 vma->vm_start <= vma->vm_mm->start_stack &&
2451 vma->vm_end >= vma->vm_mm->start_stack) {
2452 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2453 } else if (vma->vm_file && vma->anon_vma) {
2455 * We are making executable a file mapping that has
2456 * had some COW done. Since pages might have been
2457 * written, check ability to execute the possibly
2458 * modified content. This typically should only
2459 * occur for text relocations.
2461 rc = file_has_perm(current, vma->vm_file,
2469 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2472 static int selinux_file_lock(struct file *file, unsigned int cmd)
2474 return file_has_perm(current, file, FILE__LOCK);
2477 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2484 if (!file->f_dentry || !file->f_dentry->d_inode) {
2489 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2490 err = file_has_perm(current, file,FILE__WRITE);
2499 /* Just check FD__USE permission */
2500 err = file_has_perm(current, file, 0);
2505 #if BITS_PER_LONG == 32
2510 if (!file->f_dentry || !file->f_dentry->d_inode) {
2514 err = file_has_perm(current, file, FILE__LOCK);
2521 static int selinux_file_set_fowner(struct file *file)
2523 struct task_security_struct *tsec;
2524 struct file_security_struct *fsec;
2526 tsec = current->security;
2527 fsec = file->f_security;
2528 fsec->fown_sid = tsec->sid;
2533 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2534 struct fown_struct *fown, int signum)
2538 struct task_security_struct *tsec;
2539 struct file_security_struct *fsec;
2541 /* struct fown_struct is never outside the context of a struct file */
2542 file = (struct file *)((long)fown - offsetof(struct file,f_owner));
2544 tsec = tsk->security;
2545 fsec = file->f_security;
2548 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2550 perm = signal_to_av(signum);
2552 return avc_has_perm(fsec->fown_sid, tsec->sid,
2553 SECCLASS_PROCESS, perm, NULL);
2556 static int selinux_file_receive(struct file *file)
2558 return file_has_perm(current, file, file_to_av(file));
2561 /* task security operations */
2563 static int selinux_task_create(unsigned long clone_flags)
2567 rc = secondary_ops->task_create(clone_flags);
2571 return task_has_perm(current, current, PROCESS__FORK);
2574 static int selinux_task_alloc_security(struct task_struct *tsk)
2576 struct task_security_struct *tsec1, *tsec2;
2579 tsec1 = current->security;
2581 rc = task_alloc_security(tsk);
2584 tsec2 = tsk->security;
2586 tsec2->osid = tsec1->osid;
2587 tsec2->sid = tsec1->sid;
2589 /* Retain the exec, create, and sock SIDs across fork */
2590 tsec2->exec_sid = tsec1->exec_sid;
2591 tsec2->create_sid = tsec1->create_sid;
2592 tsec2->sockcreate_sid = tsec1->sockcreate_sid;
2594 /* Retain ptracer SID across fork, if any.
2595 This will be reset by the ptrace hook upon any
2596 subsequent ptrace_attach operations. */
2597 tsec2->ptrace_sid = tsec1->ptrace_sid;
2602 static void selinux_task_free_security(struct task_struct *tsk)
2604 task_free_security(tsk);
2607 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2609 /* Since setuid only affects the current process, and
2610 since the SELinux controls are not based on the Linux
2611 identity attributes, SELinux does not need to control
2612 this operation. However, SELinux does control the use
2613 of the CAP_SETUID and CAP_SETGID capabilities using the
2618 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2620 return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2623 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2625 /* See the comment for setuid above. */
2629 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2631 return task_has_perm(current, p, PROCESS__SETPGID);
2634 static int selinux_task_getpgid(struct task_struct *p)
2636 return task_has_perm(current, p, PROCESS__GETPGID);
2639 static int selinux_task_getsid(struct task_struct *p)
2641 return task_has_perm(current, p, PROCESS__GETSESSION);
2644 static int selinux_task_setgroups(struct group_info *group_info)
2646 /* See the comment for setuid above. */
2650 static int selinux_task_setnice(struct task_struct *p, int nice)
2654 rc = secondary_ops->task_setnice(p, nice);
2658 return task_has_perm(current,p, PROCESS__SETSCHED);
2661 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
2663 return task_has_perm(current, p, PROCESS__SETSCHED);
2666 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2668 struct rlimit *old_rlim = current->signal->rlim + resource;
2671 rc = secondary_ops->task_setrlimit(resource, new_rlim);
2675 /* Control the ability to change the hard limit (whether
2676 lowering or raising it), so that the hard limit can
2677 later be used as a safe reset point for the soft limit
2678 upon context transitions. See selinux_bprm_apply_creds. */
2679 if (old_rlim->rlim_max != new_rlim->rlim_max)
2680 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2685 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2687 return task_has_perm(current, p, PROCESS__SETSCHED);
2690 static int selinux_task_getscheduler(struct task_struct *p)
2692 return task_has_perm(current, p, PROCESS__GETSCHED);
2695 static int selinux_task_movememory(struct task_struct *p)
2697 return task_has_perm(current, p, PROCESS__SETSCHED);
2700 static int selinux_task_kill(struct task_struct *p, struct siginfo *info, int sig)
2705 rc = secondary_ops->task_kill(p, info, sig);
2709 if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
2713 perm = PROCESS__SIGNULL; /* null signal; existence test */
2715 perm = signal_to_av(sig);
2717 return task_has_perm(current, p, perm);
2720 static int selinux_task_prctl(int option,
2726 /* The current prctl operations do not appear to require
2727 any SELinux controls since they merely observe or modify
2728 the state of the current process. */
2732 static int selinux_task_wait(struct task_struct *p)
2736 perm = signal_to_av(p->exit_signal);
2738 return task_has_perm(p, current, perm);
2741 static void selinux_task_reparent_to_init(struct task_struct *p)
2743 struct task_security_struct *tsec;
2745 secondary_ops->task_reparent_to_init(p);
2748 tsec->osid = tsec->sid;
2749 tsec->sid = SECINITSID_KERNEL;
2753 static void selinux_task_to_inode(struct task_struct *p,
2754 struct inode *inode)
2756 struct task_security_struct *tsec = p->security;
2757 struct inode_security_struct *isec = inode->i_security;
2759 isec->sid = tsec->sid;
2760 isec->initialized = 1;
2764 /* Returns error only if unable to parse addresses */
2765 static int selinux_parse_skb_ipv4(struct sk_buff *skb, struct avc_audit_data *ad)
2767 int offset, ihlen, ret = -EINVAL;
2768 struct iphdr _iph, *ih;
2770 offset = skb->nh.raw - skb->data;
2771 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2775 ihlen = ih->ihl * 4;
2776 if (ihlen < sizeof(_iph))
2779 ad->u.net.v4info.saddr = ih->saddr;
2780 ad->u.net.v4info.daddr = ih->daddr;
2783 switch (ih->protocol) {
2785 struct tcphdr _tcph, *th;
2787 if (ntohs(ih->frag_off) & IP_OFFSET)
2791 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2795 ad->u.net.sport = th->source;
2796 ad->u.net.dport = th->dest;
2801 struct udphdr _udph, *uh;
2803 if (ntohs(ih->frag_off) & IP_OFFSET)
2807 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2811 ad->u.net.sport = uh->source;
2812 ad->u.net.dport = uh->dest;
2823 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2825 /* Returns error only if unable to parse addresses */
2826 static int selinux_parse_skb_ipv6(struct sk_buff *skb, struct avc_audit_data *ad)
2829 int ret = -EINVAL, offset;
2830 struct ipv6hdr _ipv6h, *ip6;
2832 offset = skb->nh.raw - skb->data;
2833 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
2837 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
2838 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
2841 nexthdr = ip6->nexthdr;
2842 offset += sizeof(_ipv6h);
2843 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
2849 struct tcphdr _tcph, *th;
2851 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2855 ad->u.net.sport = th->source;
2856 ad->u.net.dport = th->dest;
2861 struct udphdr _udph, *uh;
2863 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2867 ad->u.net.sport = uh->source;
2868 ad->u.net.dport = uh->dest;
2872 /* includes fragments */
2882 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
2883 char **addrp, int *len, int src)
2887 switch (ad->u.net.family) {
2889 ret = selinux_parse_skb_ipv4(skb, ad);
2893 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
2894 &ad->u.net.v4info.daddr);
2897 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2899 ret = selinux_parse_skb_ipv6(skb, ad);
2903 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
2904 &ad->u.net.v6info.daddr);
2914 /* socket security operations */
2915 static int socket_has_perm(struct task_struct *task, struct socket *sock,
2918 struct inode_security_struct *isec;
2919 struct task_security_struct *tsec;
2920 struct avc_audit_data ad;
2923 tsec = task->security;
2924 isec = SOCK_INODE(sock)->i_security;
2926 if (isec->sid == SECINITSID_KERNEL)
2929 AVC_AUDIT_DATA_INIT(&ad,NET);
2930 ad.u.net.sk = sock->sk;
2931 err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
2937 static int selinux_socket_create(int family, int type,
2938 int protocol, int kern)
2941 struct task_security_struct *tsec;
2947 tsec = current->security;
2948 newsid = tsec->sockcreate_sid ? : tsec->sid;
2949 err = avc_has_perm(tsec->sid, newsid,
2950 socket_type_to_security_class(family, type,
2951 protocol), SOCKET__CREATE, NULL);
2957 static void selinux_socket_post_create(struct socket *sock, int family,
2958 int type, int protocol, int kern)
2960 struct inode_security_struct *isec;
2961 struct task_security_struct *tsec;
2964 isec = SOCK_INODE(sock)->i_security;
2966 tsec = current->security;
2967 newsid = tsec->sockcreate_sid ? : tsec->sid;
2968 isec->sclass = socket_type_to_security_class(family, type, protocol);
2969 isec->sid = kern ? SECINITSID_KERNEL : newsid;
2970 isec->initialized = 1;
2975 /* Range of port numbers used to automatically bind.
2976 Need to determine whether we should perform a name_bind
2977 permission check between the socket and the port number. */
2978 #define ip_local_port_range_0 sysctl_local_port_range[0]
2979 #define ip_local_port_range_1 sysctl_local_port_range[1]
2981 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
2986 err = socket_has_perm(current, sock, SOCKET__BIND);
2991 * If PF_INET or PF_INET6, check name_bind permission for the port.
2992 * Multiple address binding for SCTP is not supported yet: we just
2993 * check the first address now.
2995 family = sock->sk->sk_family;
2996 if (family == PF_INET || family == PF_INET6) {
2998 struct inode_security_struct *isec;
2999 struct task_security_struct *tsec;
3000 struct avc_audit_data ad;
3001 struct sockaddr_in *addr4 = NULL;
3002 struct sockaddr_in6 *addr6 = NULL;
3003 unsigned short snum;
3004 struct sock *sk = sock->sk;
3005 u32 sid, node_perm, addrlen;
3007 tsec = current->security;
3008 isec = SOCK_INODE(sock)->i_security;
3010 if (family == PF_INET) {
3011 addr4 = (struct sockaddr_in *)address;
3012 snum = ntohs(addr4->sin_port);
3013 addrlen = sizeof(addr4->sin_addr.s_addr);
3014 addrp = (char *)&addr4->sin_addr.s_addr;
3016 addr6 = (struct sockaddr_in6 *)address;
3017 snum = ntohs(addr6->sin6_port);
3018 addrlen = sizeof(addr6->sin6_addr.s6_addr);
3019 addrp = (char *)&addr6->sin6_addr.s6_addr;
3022 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3023 snum > ip_local_port_range_1)) {
3024 err = security_port_sid(sk->sk_family, sk->sk_type,
3025 sk->sk_protocol, snum, &sid);
3028 AVC_AUDIT_DATA_INIT(&ad,NET);
3029 ad.u.net.sport = htons(snum);
3030 ad.u.net.family = family;
3031 err = avc_has_perm(isec->sid, sid,
3033 SOCKET__NAME_BIND, &ad);
3038 switch(isec->sclass) {
3039 case SECCLASS_TCP_SOCKET:
3040 node_perm = TCP_SOCKET__NODE_BIND;
3043 case SECCLASS_UDP_SOCKET:
3044 node_perm = UDP_SOCKET__NODE_BIND;
3048 node_perm = RAWIP_SOCKET__NODE_BIND;
3052 err = security_node_sid(family, addrp, addrlen, &sid);
3056 AVC_AUDIT_DATA_INIT(&ad,NET);
3057 ad.u.net.sport = htons(snum);
3058 ad.u.net.family = family;
3060 if (family == PF_INET)
3061 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3063 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3065 err = avc_has_perm(isec->sid, sid,
3066 isec->sclass, node_perm, &ad);
3074 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3076 struct inode_security_struct *isec;
3079 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3084 * If a TCP socket, check name_connect permission for the port.
3086 isec = SOCK_INODE(sock)->i_security;
3087 if (isec->sclass == SECCLASS_TCP_SOCKET) {
3088 struct sock *sk = sock->sk;
3089 struct avc_audit_data ad;
3090 struct sockaddr_in *addr4 = NULL;
3091 struct sockaddr_in6 *addr6 = NULL;
3092 unsigned short snum;
3095 if (sk->sk_family == PF_INET) {
3096 addr4 = (struct sockaddr_in *)address;
3097 if (addrlen < sizeof(struct sockaddr_in))
3099 snum = ntohs(addr4->sin_port);
3101 addr6 = (struct sockaddr_in6 *)address;
3102 if (addrlen < SIN6_LEN_RFC2133)
3104 snum = ntohs(addr6->sin6_port);
3107 err = security_port_sid(sk->sk_family, sk->sk_type,
3108 sk->sk_protocol, snum, &sid);
3112 AVC_AUDIT_DATA_INIT(&ad,NET);
3113 ad.u.net.dport = htons(snum);
3114 ad.u.net.family = sk->sk_family;
3115 err = avc_has_perm(isec->sid, sid, isec->sclass,
3116 TCP_SOCKET__NAME_CONNECT, &ad);
3125 static int selinux_socket_listen(struct socket *sock, int backlog)
3127 return socket_has_perm(current, sock, SOCKET__LISTEN);
3130 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3133 struct inode_security_struct *isec;
3134 struct inode_security_struct *newisec;
3136 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3140 newisec = SOCK_INODE(newsock)->i_security;
3142 isec = SOCK_INODE(sock)->i_security;
3143 newisec->sclass = isec->sclass;
3144 newisec->sid = isec->sid;
3145 newisec->initialized = 1;
3150 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3153 return socket_has_perm(current, sock, SOCKET__WRITE);
3156 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3157 int size, int flags)
3159 return socket_has_perm(current, sock, SOCKET__READ);
3162 static int selinux_socket_getsockname(struct socket *sock)
3164 return socket_has_perm(current, sock, SOCKET__GETATTR);
3167 static int selinux_socket_getpeername(struct socket *sock)
3169 return socket_has_perm(current, sock, SOCKET__GETATTR);
3172 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3174 return socket_has_perm(current, sock, SOCKET__SETOPT);
3177 static int selinux_socket_getsockopt(struct socket *sock, int level,
3180 return socket_has_perm(current, sock, SOCKET__GETOPT);
3183 static int selinux_socket_shutdown(struct socket *sock, int how)
3185 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3188 static int selinux_socket_unix_stream_connect(struct socket *sock,
3189 struct socket *other,
3192 struct sk_security_struct *ssec;
3193 struct inode_security_struct *isec;
3194 struct inode_security_struct *other_isec;
3195 struct avc_audit_data ad;
3198 err = secondary_ops->unix_stream_connect(sock, other, newsk);
3202 isec = SOCK_INODE(sock)->i_security;
3203 other_isec = SOCK_INODE(other)->i_security;
3205 AVC_AUDIT_DATA_INIT(&ad,NET);
3206 ad.u.net.sk = other->sk;
3208 err = avc_has_perm(isec->sid, other_isec->sid,
3210 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3214 /* connecting socket */
3215 ssec = sock->sk->sk_security;
3216 ssec->peer_sid = other_isec->sid;
3218 /* server child socket */
3219 ssec = newsk->sk_security;
3220 ssec->peer_sid = isec->sid;
3225 static int selinux_socket_unix_may_send(struct socket *sock,
3226 struct socket *other)
3228 struct inode_security_struct *isec;
3229 struct inode_security_struct *other_isec;
3230 struct avc_audit_data ad;
3233 isec = SOCK_INODE(sock)->i_security;
3234 other_isec = SOCK_INODE(other)->i_security;
3236 AVC_AUDIT_DATA_INIT(&ad,NET);
3237 ad.u.net.sk = other->sk;
3239 err = avc_has_perm(isec->sid, other_isec->sid,
3240 isec->sclass, SOCKET__SENDTO, &ad);
3247 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
3248 struct avc_audit_data *ad, u32 sock_sid, u16 sock_class,
3249 u16 family, char *addrp, int len)
3252 u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3257 err = sel_netif_sids(skb->dev, &if_sid, NULL);
3261 switch (sock_class) {
3262 case SECCLASS_UDP_SOCKET:
3263 netif_perm = NETIF__UDP_RECV;
3264 node_perm = NODE__UDP_RECV;
3265 recv_perm = UDP_SOCKET__RECV_MSG;
3268 case SECCLASS_TCP_SOCKET:
3269 netif_perm = NETIF__TCP_RECV;
3270 node_perm = NODE__TCP_RECV;
3271 recv_perm = TCP_SOCKET__RECV_MSG;
3275 netif_perm = NETIF__RAWIP_RECV;
3276 node_perm = NODE__RAWIP_RECV;
3280 err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3284 err = security_node_sid(family, addrp, len, &node_sid);
3288 err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, ad);
3295 err = security_port_sid(sk->sk_family, sk->sk_type,
3296 sk->sk_protocol, ntohs(ad->u.net.sport),
3301 err = avc_has_perm(sock_sid, port_sid,
3302 sock_class, recv_perm, ad);
3309 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3316 struct socket *sock;
3317 struct avc_audit_data ad;
3319 family = sk->sk_family;
3320 if (family != PF_INET && family != PF_INET6)
3323 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3324 if (family == PF_INET6 && skb->protocol == ntohs(ETH_P_IP))
3327 read_lock_bh(&sk->sk_callback_lock);
3328 sock = sk->sk_socket;
3330 struct inode *inode;
3331 inode = SOCK_INODE(sock);
3333 struct inode_security_struct *isec;
3334 isec = inode->i_security;
3335 sock_sid = isec->sid;
3336 sock_class = isec->sclass;
3339 read_unlock_bh(&sk->sk_callback_lock);
3343 AVC_AUDIT_DATA_INIT(&ad, NET);
3344 ad.u.net.netif = skb->dev ? skb->dev->name : "[unknown]";
3345 ad.u.net.family = family;
3347 err = selinux_parse_skb(skb, &ad, &addrp, &len, 1);
3351 if (selinux_compat_net)
3352 err = selinux_sock_rcv_skb_compat(sk, skb, &ad, sock_sid,
3356 err = avc_has_perm(sock_sid, skb->secmark, SECCLASS_PACKET,
3361 err = selinux_xfrm_sock_rcv_skb(sock_sid, skb);
3366 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
3367 int __user *optlen, unsigned len)
3372 struct sk_security_struct *ssec;
3373 struct inode_security_struct *isec;
3376 isec = SOCK_INODE(sock)->i_security;
3378 /* if UNIX_STREAM check peer_sid, if TCP check dst for labelled sa */
3379 if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET) {
3380 ssec = sock->sk->sk_security;
3381 peer_sid = ssec->peer_sid;
3383 else if (isec->sclass == SECCLASS_TCP_SOCKET) {
3384 peer_sid = selinux_socket_getpeer_stream(sock->sk);
3386 if (peer_sid == SECSID_NULL) {
3396 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
3401 if (scontext_len > len) {
3406 if (copy_to_user(optval, scontext, scontext_len))
3410 if (put_user(scontext_len, optlen))
3418 static int selinux_socket_getpeersec_dgram(struct sk_buff *skb, char **secdata, u32 *seclen)
3421 u32 peer_sid = selinux_socket_getpeer_dgram(skb);
3423 if (peer_sid == SECSID_NULL)
3426 err = security_sid_to_context(peer_sid, secdata, seclen);
3435 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
3437 return sk_alloc_security(sk, family, priority);
3440 static void selinux_sk_free_security(struct sock *sk)
3442 sk_free_security(sk);
3445 static unsigned int selinux_sk_getsid_security(struct sock *sk, struct flowi *fl, u8 dir)
3447 struct inode_security_struct *isec;
3448 u32 sock_sid = SECINITSID_ANY_SOCKET;
3451 return selinux_no_sk_sid(fl);
3453 read_lock_bh(&sk->sk_callback_lock);
3454 isec = get_sock_isec(sk);
3457 sock_sid = isec->sid;
3459 read_unlock_bh(&sk->sk_callback_lock);
3463 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3467 struct nlmsghdr *nlh;
3468 struct socket *sock = sk->sk_socket;
3469 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3471 if (skb->len < NLMSG_SPACE(0)) {
3475 nlh = (struct nlmsghdr *)skb->data;
3477 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3479 if (err == -EINVAL) {
3480 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
3481 "SELinux: unrecognized netlink message"
3482 " type=%hu for sclass=%hu\n",
3483 nlh->nlmsg_type, isec->sclass);
3484 if (!selinux_enforcing)
3494 err = socket_has_perm(current, sock, perm);
3499 #ifdef CONFIG_NETFILTER
3501 static int selinux_ip_postroute_last_compat(struct sock *sk, struct net_device *dev,
3502 struct inode_security_struct *isec,
3503 struct avc_audit_data *ad,
3504 u16 family, char *addrp, int len)
3507 u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
3509 err = sel_netif_sids(dev, &if_sid, NULL);
3513 switch (isec->sclass) {
3514 case SECCLASS_UDP_SOCKET:
3515 netif_perm = NETIF__UDP_SEND;
3516 node_perm = NODE__UDP_SEND;
3517 send_perm = UDP_SOCKET__SEND_MSG;
3520 case SECCLASS_TCP_SOCKET:
3521 netif_perm = NETIF__TCP_SEND;
3522 node_perm = NODE__TCP_SEND;
3523 send_perm = TCP_SOCKET__SEND_MSG;
3527 netif_perm = NETIF__RAWIP_SEND;
3528 node_perm = NODE__RAWIP_SEND;
3532 err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3536 err = security_node_sid(family, addrp, len, &node_sid);
3540 err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE, node_perm, ad);
3547 err = security_port_sid(sk->sk_family,
3550 ntohs(ad->u.net.dport),
3555 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3562 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3563 struct sk_buff **pskb,
3564 const struct net_device *in,
3565 const struct net_device *out,
3566 int (*okfn)(struct sk_buff *),
3572 struct socket *sock;
3573 struct inode *inode;
3574 struct sk_buff *skb = *pskb;
3575 struct inode_security_struct *isec;
3576 struct avc_audit_data ad;
3577 struct net_device *dev = (struct net_device *)out;
3583 sock = sk->sk_socket;
3587 inode = SOCK_INODE(sock);
3591 isec = inode->i_security;
3593 AVC_AUDIT_DATA_INIT(&ad, NET);
3594 ad.u.net.netif = dev->name;
3595 ad.u.net.family = family;
3597 err = selinux_parse_skb(skb, &ad, &addrp, &len, 0);
3601 if (selinux_compat_net)
3602 err = selinux_ip_postroute_last_compat(sk, dev, isec, &ad,
3603 family, addrp, len);
3605 err = avc_has_perm(isec->sid, skb->secmark, SECCLASS_PACKET,
3611 err = selinux_xfrm_postroute_last(isec->sid, skb);
3613 return err ? NF_DROP : NF_ACCEPT;
3616 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3617 struct sk_buff **pskb,
3618 const struct net_device *in,
3619 const struct net_device *out,
3620 int (*okfn)(struct sk_buff *))
3622 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3625 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3627 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3628 struct sk_buff **pskb,
3629 const struct net_device *in,
3630 const struct net_device *out,
3631 int (*okfn)(struct sk_buff *))
3633 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3638 #endif /* CONFIG_NETFILTER */
3640 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3642 struct task_security_struct *tsec;
3643 struct av_decision avd;
3646 err = secondary_ops->netlink_send(sk, skb);
3650 tsec = current->security;
3653 avc_has_perm_noaudit(tsec->sid, tsec->sid,
3654 SECCLASS_CAPABILITY, ~0, &avd);
3655 cap_mask(NETLINK_CB(skb).eff_cap, avd.allowed);
3657 if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
3658 err = selinux_nlmsg_perm(sk, skb);
3663 static int selinux_netlink_recv(struct sk_buff *skb)
3665 if (!cap_raised(NETLINK_CB(skb).eff_cap, CAP_NET_ADMIN))
3670 static int ipc_alloc_security(struct task_struct *task,
3671 struct kern_ipc_perm *perm,
3674 struct task_security_struct *tsec = task->security;
3675 struct ipc_security_struct *isec;
3677 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
3681 isec->sclass = sclass;
3682 isec->ipc_perm = perm;
3683 isec->sid = tsec->sid;
3684 perm->security = isec;
3689 static void ipc_free_security(struct kern_ipc_perm *perm)
3691 struct ipc_security_struct *isec = perm->security;
3692 perm->security = NULL;
3696 static int msg_msg_alloc_security(struct msg_msg *msg)
3698 struct msg_security_struct *msec;
3700 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
3705 msec->sid = SECINITSID_UNLABELED;
3706 msg->security = msec;
3711 static void msg_msg_free_security(struct msg_msg *msg)
3713 struct msg_security_struct *msec = msg->security;
3715 msg->security = NULL;
3719 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
3722 struct task_security_struct *tsec;
3723 struct ipc_security_struct *isec;
3724 struct avc_audit_data ad;
3726 tsec = current->security;
3727 isec = ipc_perms->security;
3729 AVC_AUDIT_DATA_INIT(&ad, IPC);
3730 ad.u.ipc_id = ipc_perms->key;
3732 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3735 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
3737 return msg_msg_alloc_security(msg);
3740 static void selinux_msg_msg_free_security(struct msg_msg *msg)
3742 msg_msg_free_security(msg);
3745 /* message queue security operations */
3746 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
3748 struct task_security_struct *tsec;
3749 struct ipc_security_struct *isec;
3750 struct avc_audit_data ad;
3753 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
3757 tsec = current->security;
3758 isec = msq->q_perm.security;
3760 AVC_AUDIT_DATA_INIT(&ad, IPC);
3761 ad.u.ipc_id = msq->q_perm.key;
3763 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3766 ipc_free_security(&msq->q_perm);
3772 static void selinux_msg_queue_free_security(struct msg_queue *msq)
3774 ipc_free_security(&msq->q_perm);
3777 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
3779 struct task_security_struct *tsec;
3780 struct ipc_security_struct *isec;
3781 struct avc_audit_data ad;
3783 tsec = current->security;
3784 isec = msq->q_perm.security;
3786 AVC_AUDIT_DATA_INIT(&ad, IPC);
3787 ad.u.ipc_id = msq->q_perm.key;
3789 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3790 MSGQ__ASSOCIATE, &ad);
3793 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
3801 /* No specific object, just general system-wide information. */
3802 return task_has_system(current, SYSTEM__IPC_INFO);
3805 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
3808 perms = MSGQ__SETATTR;
3811 perms = MSGQ__DESTROY;
3817 err = ipc_has_perm(&msq->q_perm, perms);
3821 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
3823 struct task_security_struct *tsec;
3824 struct ipc_security_struct *isec;
3825 struct msg_security_struct *msec;
3826 struct avc_audit_data ad;
3829 tsec = current->security;
3830 isec = msq->q_perm.security;
3831 msec = msg->security;
3834 * First time through, need to assign label to the message
3836 if (msec->sid == SECINITSID_UNLABELED) {
3838 * Compute new sid based on current process and
3839 * message queue this message will be stored in
3841 rc = security_transition_sid(tsec->sid,
3849 AVC_AUDIT_DATA_INIT(&ad, IPC);
3850 ad.u.ipc_id = msq->q_perm.key;
3852 /* Can this process write to the queue? */
3853 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3856 /* Can this process send the message */
3857 rc = avc_has_perm(tsec->sid, msec->sid,
3858 SECCLASS_MSG, MSG__SEND, &ad);
3860 /* Can the message be put in the queue? */
3861 rc = avc_has_perm(msec->sid, isec->sid,
3862 SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
3867 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
3868 struct task_struct *target,
3869 long type, int mode)
3871 struct task_security_struct *tsec;
3872 struct ipc_security_struct *isec;
3873 struct msg_security_struct *msec;
3874 struct avc_audit_data ad;
3877 tsec = target->security;
3878 isec = msq->q_perm.security;
3879 msec = msg->security;
3881 AVC_AUDIT_DATA_INIT(&ad, IPC);
3882 ad.u.ipc_id = msq->q_perm.key;
3884 rc = avc_has_perm(tsec->sid, isec->sid,
3885 SECCLASS_MSGQ, MSGQ__READ, &ad);
3887 rc = avc_has_perm(tsec->sid, msec->sid,
3888 SECCLASS_MSG, MSG__RECEIVE, &ad);
3892 /* Shared Memory security operations */
3893 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
3895 struct task_security_struct *tsec;
3896 struct ipc_security_struct *isec;
3897 struct avc_audit_data ad;
3900 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
3904 tsec = current->security;
3905 isec = shp->shm_perm.security;
3907 AVC_AUDIT_DATA_INIT(&ad, IPC);
3908 ad.u.ipc_id = shp->shm_perm.key;
3910 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3913 ipc_free_security(&shp->shm_perm);
3919 static void selinux_shm_free_security(struct shmid_kernel *shp)
3921 ipc_free_security(&shp->shm_perm);
3924 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
3926 struct task_security_struct *tsec;
3927 struct ipc_security_struct *isec;
3928 struct avc_audit_data ad;
3930 tsec = current->security;
3931 isec = shp->shm_perm.security;
3933 AVC_AUDIT_DATA_INIT(&ad, IPC);
3934 ad.u.ipc_id = shp->shm_perm.key;
3936 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3937 SHM__ASSOCIATE, &ad);
3940 /* Note, at this point, shp is locked down */
3941 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
3949 /* No specific object, just general system-wide information. */
3950 return task_has_system(current, SYSTEM__IPC_INFO);
3953 perms = SHM__GETATTR | SHM__ASSOCIATE;
3956 perms = SHM__SETATTR;
3963 perms = SHM__DESTROY;
3969 err = ipc_has_perm(&shp->shm_perm, perms);
3973 static int selinux_shm_shmat(struct shmid_kernel *shp,
3974 char __user *shmaddr, int shmflg)
3979 rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
3983 if (shmflg & SHM_RDONLY)
3986 perms = SHM__READ | SHM__WRITE;
3988 return ipc_has_perm(&shp->shm_perm, perms);
3991 /* Semaphore security operations */
3992 static int selinux_sem_alloc_security(struct sem_array *sma)
3994 struct task_security_struct *tsec;
3995 struct ipc_security_struct *isec;
3996 struct avc_audit_data ad;
3999 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4003 tsec = current->security;
4004 isec = sma->sem_perm.security;
4006 AVC_AUDIT_DATA_INIT(&ad, IPC);
4007 ad.u.ipc_id = sma->sem_perm.key;
4009 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4012 ipc_free_security(&sma->sem_perm);
4018 static void selinux_sem_free_security(struct sem_array *sma)
4020 ipc_free_security(&sma->sem_perm);
4023 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4025 struct task_security_struct *tsec;
4026 struct ipc_security_struct *isec;
4027 struct avc_audit_data ad;
4029 tsec = current->security;
4030 isec = sma->sem_perm.security;
4032 AVC_AUDIT_DATA_INIT(&ad, IPC);
4033 ad.u.ipc_id = sma->sem_perm.key;
4035 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4036 SEM__ASSOCIATE, &ad);
4039 /* Note, at this point, sma is locked down */
4040 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4048 /* No specific object, just general system-wide information. */
4049 return task_has_system(current, SYSTEM__IPC_INFO);
4053 perms = SEM__GETATTR;
4064 perms = SEM__DESTROY;
4067 perms = SEM__SETATTR;
4071 perms = SEM__GETATTR | SEM__ASSOCIATE;
4077 err = ipc_has_perm(&sma->sem_perm, perms);
4081 static int selinux_sem_semop(struct sem_array *sma,
4082 struct sembuf *sops, unsigned nsops, int alter)
4087 perms = SEM__READ | SEM__WRITE;
4091 return ipc_has_perm(&sma->sem_perm, perms);
4094 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4100 av |= IPC__UNIX_READ;
4102 av |= IPC__UNIX_WRITE;
4107 return ipc_has_perm(ipcp, av);
4110 /* module stacking operations */
4111 static int selinux_register_security (const char *name, struct security_operations *ops)
4113 if (secondary_ops != original_ops) {
4114 printk(KERN_INFO "%s: There is already a secondary security "
4115 "module registered.\n", __FUNCTION__);
4119 secondary_ops = ops;
4121 printk(KERN_INFO "%s: Registering secondary module %s\n",
4128 static int selinux_unregister_security (const char *name, struct security_operations *ops)
4130 if (ops != secondary_ops) {
4131 printk (KERN_INFO "%s: trying to unregister a security module "
4132 "that is not registered.\n", __FUNCTION__);
4136 secondary_ops = original_ops;
4141 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4144 inode_doinit_with_dentry(inode, dentry);
4147 static int selinux_getprocattr(struct task_struct *p,
4148 char *name, void *value, size_t size)
4150 struct task_security_struct *tsec;
4155 error = task_has_perm(current, p, PROCESS__GETATTR);
4162 if (!strcmp(name, "current"))
4164 else if (!strcmp(name, "prev"))
4166 else if (!strcmp(name, "exec"))
4167 sid = tsec->exec_sid;
4168 else if (!strcmp(name, "fscreate"))
4169 sid = tsec->create_sid;
4170 else if (!strcmp(name, "keycreate"))
4171 sid = tsec->keycreate_sid;
4172 else if (!strcmp(name, "sockcreate"))
4173 sid = tsec->sockcreate_sid;
4180 return selinux_getsecurity(sid, value, size);
4183 static int selinux_setprocattr(struct task_struct *p,
4184 char *name, void *value, size_t size)
4186 struct task_security_struct *tsec;
4192 /* SELinux only allows a process to change its own
4193 security attributes. */
4198 * Basic control over ability to set these attributes at all.
4199 * current == p, but we'll pass them separately in case the
4200 * above restriction is ever removed.
4202 if (!strcmp(name, "exec"))
4203 error = task_has_perm(current, p, PROCESS__SETEXEC);
4204 else if (!strcmp(name, "fscreate"))
4205 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4206 else if (!strcmp(name, "keycreate"))
4207 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
4208 else if (!strcmp(name, "sockcreate"))
4209 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
4210 else if (!strcmp(name, "current"))
4211 error = task_has_perm(current, p, PROCESS__SETCURRENT);
4217 /* Obtain a SID for the context, if one was specified. */
4218 if (size && str[1] && str[1] != '\n') {
4219 if (str[size-1] == '\n') {
4223 error = security_context_to_sid(value, size, &sid);
4228 /* Permission checking based on the specified context is
4229 performed during the actual operation (execve,
4230 open/mkdir/...), when we know the full context of the
4231 operation. See selinux_bprm_set_security for the execve
4232 checks and may_create for the file creation checks. The
4233 operation will then fail if the context is not permitted. */
4235 if (!strcmp(name, "exec"))
4236 tsec->exec_sid = sid;
4237 else if (!strcmp(name, "fscreate"))
4238 tsec->create_sid = sid;
4239 else if (!strcmp(name, "keycreate")) {
4240 error = may_create_key(sid, p);
4243 tsec->keycreate_sid = sid;
4244 } else if (!strcmp(name, "sockcreate"))
4245 tsec->sockcreate_sid = sid;
4246 else if (!strcmp(name, "current")) {
4247 struct av_decision avd;
4252 /* Only allow single threaded processes to change context */
4253 if (atomic_read(&p->mm->mm_users) != 1) {
4254 struct task_struct *g, *t;
4255 struct mm_struct *mm = p->mm;
4256 read_lock(&tasklist_lock);
4257 do_each_thread(g, t)
4258 if (t->mm == mm && t != p) {
4259 read_unlock(&tasklist_lock);
4262 while_each_thread(g, t);
4263 read_unlock(&tasklist_lock);
4266 /* Check permissions for the transition. */
4267 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
4268 PROCESS__DYNTRANSITION, NULL);
4272 /* Check for ptracing, and update the task SID if ok.
4273 Otherwise, leave SID unchanged and fail. */
4275 if (p->ptrace & PT_PTRACED) {
4276 error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
4278 PROCESS__PTRACE, &avd);
4282 avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
4283 PROCESS__PTRACE, &avd, error, NULL);
4299 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
4300 unsigned long flags)
4302 struct task_security_struct *tsec = tsk->security;
4303 struct key_security_struct *ksec;
4305 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
4310 if (tsec->keycreate_sid)
4311 ksec->sid = tsec->keycreate_sid;
4313 ksec->sid = tsec->sid;
4319 static void selinux_key_free(struct key *k)
4321 struct key_security_struct *ksec = k->security;
4327 static int selinux_key_permission(key_ref_t key_ref,
4328 struct task_struct *ctx,
4332 struct task_security_struct *tsec;
4333 struct key_security_struct *ksec;
4335 key = key_ref_to_ptr(key_ref);
4337 tsec = ctx->security;
4338 ksec = key->security;
4340 /* if no specific permissions are requested, we skip the
4341 permission check. No serious, additional covert channels
4342 appear to be created. */
4346 return avc_has_perm(tsec->sid, ksec->sid,
4347 SECCLASS_KEY, perm, NULL);
4352 static struct security_operations selinux_ops = {
4353 .ptrace = selinux_ptrace,
4354 .capget = selinux_capget,
4355 .capset_check = selinux_capset_check,
4356 .capset_set = selinux_capset_set,
4357 .sysctl = selinux_sysctl,
4358 .capable = selinux_capable,
4359 .quotactl = selinux_quotactl,
4360 .quota_on = selinux_quota_on,
4361 .syslog = selinux_syslog,
4362 .vm_enough_memory = selinux_vm_enough_memory,
4364 .netlink_send = selinux_netlink_send,
4365 .netlink_recv = selinux_netlink_recv,
4367 .bprm_alloc_security = selinux_bprm_alloc_security,
4368 .bprm_free_security = selinux_bprm_free_security,
4369 .bprm_apply_creds = selinux_bprm_apply_creds,
4370 .bprm_post_apply_creds = selinux_bprm_post_apply_creds,
4371 .bprm_set_security = selinux_bprm_set_security,
4372 .bprm_check_security = selinux_bprm_check_security,
4373 .bprm_secureexec = selinux_bprm_secureexec,
4375 .sb_alloc_security = selinux_sb_alloc_security,
4376 .sb_free_security = selinux_sb_free_security,
4377 .sb_copy_data = selinux_sb_copy_data,
4378 .sb_kern_mount = selinux_sb_kern_mount,
4379 .sb_statfs = selinux_sb_statfs,
4380 .sb_mount = selinux_mount,
4381 .sb_umount = selinux_umount,
4383 .inode_alloc_security = selinux_inode_alloc_security,
4384 .inode_free_security = selinux_inode_free_security,
4385 .inode_init_security = selinux_inode_init_security,
4386 .inode_create = selinux_inode_create,
4387 .inode_link = selinux_inode_link,
4388 .inode_unlink = selinux_inode_unlink,
4389 .inode_symlink = selinux_inode_symlink,
4390 .inode_mkdir = selinux_inode_mkdir,
4391 .inode_rmdir = selinux_inode_rmdir,
4392 .inode_mknod = selinux_inode_mknod,
4393 .inode_rename = selinux_inode_rename,
4394 .inode_readlink = selinux_inode_readlink,
4395 .inode_follow_link = selinux_inode_follow_link,
4396 .inode_permission = selinux_inode_permission,
4397 .inode_setattr = selinux_inode_setattr,
4398 .inode_getattr = selinux_inode_getattr,
4399 .inode_setxattr = selinux_inode_setxattr,
4400 .inode_post_setxattr = selinux_inode_post_setxattr,
4401 .inode_getxattr = selinux_inode_getxattr,
4402 .inode_listxattr = selinux_inode_listxattr,
4403 .inode_removexattr = selinux_inode_removexattr,
4404 .inode_xattr_getsuffix = selinux_inode_xattr_getsuffix,
4405 .inode_getsecurity = selinux_inode_getsecurity,
4406 .inode_setsecurity = selinux_inode_setsecurity,
4407 .inode_listsecurity = selinux_inode_listsecurity,
4409 .file_permission = selinux_file_permission,
4410 .file_alloc_security = selinux_file_alloc_security,
4411 .file_free_security = selinux_file_free_security,
4412 .file_ioctl = selinux_file_ioctl,
4413 .file_mmap = selinux_file_mmap,
4414 .file_mprotect = selinux_file_mprotect,
4415 .file_lock = selinux_file_lock,
4416 .file_fcntl = selinux_file_fcntl,
4417 .file_set_fowner = selinux_file_set_fowner,
4418 .file_send_sigiotask = selinux_file_send_sigiotask,
4419 .file_receive = selinux_file_receive,
4421 .task_create = selinux_task_create,
4422 .task_alloc_security = selinux_task_alloc_security,
4423 .task_free_security = selinux_task_free_security,
4424 .task_setuid = selinux_task_setuid,
4425 .task_post_setuid = selinux_task_post_setuid,
4426 .task_setgid = selinux_task_setgid,
4427 .task_setpgid = selinux_task_setpgid,
4428 .task_getpgid = selinux_task_getpgid,
4429 .task_getsid = selinux_task_getsid,
4430 .task_setgroups = selinux_task_setgroups,
4431 .task_setnice = selinux_task_setnice,
4432 .task_setioprio = selinux_task_setioprio,
4433 .task_setrlimit = selinux_task_setrlimit,
4434 .task_setscheduler = selinux_task_setscheduler,
4435 .task_getscheduler = selinux_task_getscheduler,
4436 .task_movememory = selinux_task_movememory,
4437 .task_kill = selinux_task_kill,
4438 .task_wait = selinux_task_wait,
4439 .task_prctl = selinux_task_prctl,
4440 .task_reparent_to_init = selinux_task_reparent_to_init,
4441 .task_to_inode = selinux_task_to_inode,
4443 .ipc_permission = selinux_ipc_permission,
4445 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
4446 .msg_msg_free_security = selinux_msg_msg_free_security,
4448 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
4449 .msg_queue_free_security = selinux_msg_queue_free_security,
4450 .msg_queue_associate = selinux_msg_queue_associate,
4451 .msg_queue_msgctl = selinux_msg_queue_msgctl,
4452 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
4453 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
4455 .shm_alloc_security = selinux_shm_alloc_security,
4456 .shm_free_security = selinux_shm_free_security,
4457 .shm_associate = selinux_shm_associate,
4458 .shm_shmctl = selinux_shm_shmctl,
4459 .shm_shmat = selinux_shm_shmat,
4461 .sem_alloc_security = selinux_sem_alloc_security,
4462 .sem_free_security = selinux_sem_free_security,
4463 .sem_associate = selinux_sem_associate,
4464 .sem_semctl = selinux_sem_semctl,
4465 .sem_semop = selinux_sem_semop,
4467 .register_security = selinux_register_security,
4468 .unregister_security = selinux_unregister_security,
4470 .d_instantiate = selinux_d_instantiate,
4472 .getprocattr = selinux_getprocattr,
4473 .setprocattr = selinux_setprocattr,
4475 .unix_stream_connect = selinux_socket_unix_stream_connect,
4476 .unix_may_send = selinux_socket_unix_may_send,
4478 .socket_create = selinux_socket_create,
4479 .socket_post_create = selinux_socket_post_create,
4480 .socket_bind = selinux_socket_bind,
4481 .socket_connect = selinux_socket_connect,
4482 .socket_listen = selinux_socket_listen,
4483 .socket_accept = selinux_socket_accept,
4484 .socket_sendmsg = selinux_socket_sendmsg,
4485 .socket_recvmsg = selinux_socket_recvmsg,
4486 .socket_getsockname = selinux_socket_getsockname,
4487 .socket_getpeername = selinux_socket_getpeername,
4488 .socket_getsockopt = selinux_socket_getsockopt,
4489 .socket_setsockopt = selinux_socket_setsockopt,
4490 .socket_shutdown = selinux_socket_shutdown,
4491 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
4492 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
4493 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
4494 .sk_alloc_security = selinux_sk_alloc_security,
4495 .sk_free_security = selinux_sk_free_security,
4496 .sk_getsid = selinux_sk_getsid_security,
4498 #ifdef CONFIG_SECURITY_NETWORK_XFRM
4499 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
4500 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
4501 .xfrm_policy_free_security = selinux_xfrm_policy_free,
4502 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
4503 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
4504 .xfrm_state_free_security = selinux_xfrm_state_free,
4505 .xfrm_state_delete_security = selinux_xfrm_state_delete,
4506 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
4510 .key_alloc = selinux_key_alloc,
4511 .key_free = selinux_key_free,
4512 .key_permission = selinux_key_permission,
4516 static __init int selinux_init(void)
4518 struct task_security_struct *tsec;
4520 if (!selinux_enabled) {
4521 printk(KERN_INFO "SELinux: Disabled at boot.\n");
4525 printk(KERN_INFO "SELinux: Initializing.\n");
4527 /* Set the security state for the initial task. */
4528 if (task_alloc_security(current))
4529 panic("SELinux: Failed to initialize initial task.\n");
4530 tsec = current->security;
4531 tsec->osid = tsec->sid = SECINITSID_KERNEL;
4533 sel_inode_cache = kmem_cache_create("selinux_inode_security",
4534 sizeof(struct inode_security_struct),
4535 0, SLAB_PANIC, NULL, NULL);
4538 original_ops = secondary_ops = security_ops;
4540 panic ("SELinux: No initial security operations\n");
4541 if (register_security (&selinux_ops))
4542 panic("SELinux: Unable to register with kernel.\n");
4544 if (selinux_enforcing) {
4545 printk(KERN_INFO "SELinux: Starting in enforcing mode\n");
4547 printk(KERN_INFO "SELinux: Starting in permissive mode\n");
4551 /* Add security information to initial keyrings */
4552 selinux_key_alloc(&root_user_keyring, current,
4553 KEY_ALLOC_NOT_IN_QUOTA);
4554 selinux_key_alloc(&root_session_keyring, current,
4555 KEY_ALLOC_NOT_IN_QUOTA);
4561 void selinux_complete_init(void)
4563 printk(KERN_INFO "SELinux: Completing initialization.\n");
4565 /* Set up any superblocks initialized prior to the policy load. */
4566 printk(KERN_INFO "SELinux: Setting up existing superblocks.\n");
4567 spin_lock(&sb_lock);
4568 spin_lock(&sb_security_lock);
4570 if (!list_empty(&superblock_security_head)) {
4571 struct superblock_security_struct *sbsec =
4572 list_entry(superblock_security_head.next,
4573 struct superblock_security_struct,
4575 struct super_block *sb = sbsec->sb;
4577 spin_unlock(&sb_security_lock);
4578 spin_unlock(&sb_lock);
4579 down_read(&sb->s_umount);
4581 superblock_doinit(sb, NULL);
4583 spin_lock(&sb_lock);
4584 spin_lock(&sb_security_lock);
4585 list_del_init(&sbsec->list);
4588 spin_unlock(&sb_security_lock);
4589 spin_unlock(&sb_lock);
4592 /* SELinux requires early initialization in order to label
4593 all processes and objects when they are created. */
4594 security_initcall(selinux_init);
4596 #if defined(CONFIG_NETFILTER)
4598 static struct nf_hook_ops selinux_ipv4_op = {
4599 .hook = selinux_ipv4_postroute_last,
4600 .owner = THIS_MODULE,
4602 .hooknum = NF_IP_POST_ROUTING,
4603 .priority = NF_IP_PRI_SELINUX_LAST,
4606 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4608 static struct nf_hook_ops selinux_ipv6_op = {
4609 .hook = selinux_ipv6_postroute_last,
4610 .owner = THIS_MODULE,
4612 .hooknum = NF_IP6_POST_ROUTING,
4613 .priority = NF_IP6_PRI_SELINUX_LAST,
4618 static int __init selinux_nf_ip_init(void)
4622 if (!selinux_enabled)
4625 printk(KERN_INFO "SELinux: Registering netfilter hooks\n");
4627 err = nf_register_hook(&selinux_ipv4_op);
4629 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
4631 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4633 err = nf_register_hook(&selinux_ipv6_op);
4635 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
4643 __initcall(selinux_nf_ip_init);
4645 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4646 static void selinux_nf_ip_exit(void)
4648 printk(KERN_INFO "SELinux: Unregistering netfilter hooks\n");
4650 nf_unregister_hook(&selinux_ipv4_op);
4651 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4652 nf_unregister_hook(&selinux_ipv6_op);
4657 #else /* CONFIG_NETFILTER */
4659 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4660 #define selinux_nf_ip_exit()
4663 #endif /* CONFIG_NETFILTER */
4665 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4666 int selinux_disable(void)
4668 extern void exit_sel_fs(void);
4669 static int selinux_disabled = 0;
4671 if (ss_initialized) {
4672 /* Not permitted after initial policy load. */
4676 if (selinux_disabled) {
4677 /* Only do this once. */
4681 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
4683 selinux_disabled = 1;
4684 selinux_enabled = 0;
4686 /* Reset security_ops to the secondary module, dummy or capability. */
4687 security_ops = secondary_ops;
4689 /* Unregister netfilter hooks. */
4690 selinux_nf_ip_exit();
4692 /* Unregister selinuxfs. */