2 * NSA Security-Enhanced Linux (SELinux) security module
4 * This file contains the SELinux hook function implementations.
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License version 2,
18 * as published by the Free Software Foundation.
21 #include <linux/config.h>
22 #include <linux/module.h>
23 #include <linux/init.h>
24 #include <linux/kernel.h>
25 #include <linux/ptrace.h>
26 #include <linux/errno.h>
27 #include <linux/sched.h>
28 #include <linux/security.h>
29 #include <linux/xattr.h>
30 #include <linux/capability.h>
31 #include <linux/unistd.h>
33 #include <linux/mman.h>
34 #include <linux/slab.h>
35 #include <linux/pagemap.h>
36 #include <linux/swap.h>
37 #include <linux/smp_lock.h>
38 #include <linux/spinlock.h>
39 #include <linux/syscalls.h>
40 #include <linux/file.h>
41 #include <linux/namei.h>
42 #include <linux/mount.h>
43 #include <linux/ext2_fs.h>
44 #include <linux/proc_fs.h>
46 #include <linux/netfilter_ipv4.h>
47 #include <linux/netfilter_ipv6.h>
48 #include <linux/tty.h>
50 #include <net/ip.h> /* for sysctl_local_port_range[] */
51 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
52 #include <asm/uaccess.h>
53 #include <asm/semaphore.h>
54 #include <asm/ioctls.h>
55 #include <linux/bitops.h>
56 #include <linux/interrupt.h>
57 #include <linux/netdevice.h> /* for network interface checks */
58 #include <linux/netlink.h>
59 #include <linux/tcp.h>
60 #include <linux/udp.h>
61 #include <linux/quota.h>
62 #include <linux/un.h> /* for Unix socket types */
63 #include <net/af_unix.h> /* for Unix socket types */
64 #include <linux/parser.h>
65 #include <linux/nfs_mount.h>
67 #include <linux/hugetlb.h>
68 #include <linux/personality.h>
69 #include <linux/sysctl.h>
70 #include <linux/audit.h>
71 #include <linux/string.h>
78 #define XATTR_SELINUX_SUFFIX "selinux"
79 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
81 extern unsigned int policydb_loaded_version;
82 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
84 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
85 int selinux_enforcing = 0;
87 static int __init enforcing_setup(char *str)
89 selinux_enforcing = simple_strtol(str,NULL,0);
92 __setup("enforcing=", enforcing_setup);
95 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
96 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
98 static int __init selinux_enabled_setup(char *str)
100 selinux_enabled = simple_strtol(str, NULL, 0);
103 __setup("selinux=", selinux_enabled_setup);
105 int selinux_enabled = 1;
108 /* Original (dummy) security module. */
109 static struct security_operations *original_ops = NULL;
111 /* Minimal support for a secondary security module,
112 just to allow the use of the dummy or capability modules.
113 The owlsm module can alternatively be used as a secondary
114 module as long as CONFIG_OWLSM_FD is not enabled. */
115 static struct security_operations *secondary_ops = NULL;
117 /* Lists of inode and superblock security structures initialized
118 before the policy was loaded. */
119 static LIST_HEAD(superblock_security_head);
120 static DEFINE_SPINLOCK(sb_security_lock);
122 static kmem_cache_t *sel_inode_cache;
124 /* Return security context for a given sid or just the context
125 length if the buffer is null or length is 0 */
126 static int selinux_getsecurity(u32 sid, void *buffer, size_t size)
132 rc = security_sid_to_context(sid, &context, &len);
136 if (!buffer || !size)
137 goto getsecurity_exit;
141 goto getsecurity_exit;
143 memcpy(buffer, context, len);
150 /* Allocate and free functions for each kind of security blob. */
152 static int task_alloc_security(struct task_struct *task)
154 struct task_security_struct *tsec;
156 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
161 tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
162 task->security = tsec;
167 static void task_free_security(struct task_struct *task)
169 struct task_security_struct *tsec = task->security;
170 task->security = NULL;
174 static int inode_alloc_security(struct inode *inode)
176 struct task_security_struct *tsec = current->security;
177 struct inode_security_struct *isec;
179 isec = kmem_cache_alloc(sel_inode_cache, SLAB_KERNEL);
183 memset(isec, 0, sizeof(*isec));
184 init_MUTEX(&isec->sem);
185 INIT_LIST_HEAD(&isec->list);
187 isec->sid = SECINITSID_UNLABELED;
188 isec->sclass = SECCLASS_FILE;
189 isec->task_sid = tsec->sid;
190 inode->i_security = isec;
195 static void inode_free_security(struct inode *inode)
197 struct inode_security_struct *isec = inode->i_security;
198 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
200 spin_lock(&sbsec->isec_lock);
201 if (!list_empty(&isec->list))
202 list_del_init(&isec->list);
203 spin_unlock(&sbsec->isec_lock);
205 inode->i_security = NULL;
206 kmem_cache_free(sel_inode_cache, isec);
209 static int file_alloc_security(struct file *file)
211 struct task_security_struct *tsec = current->security;
212 struct file_security_struct *fsec;
214 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
219 fsec->sid = tsec->sid;
220 fsec->fown_sid = tsec->sid;
221 file->f_security = fsec;
226 static void file_free_security(struct file *file)
228 struct file_security_struct *fsec = file->f_security;
229 file->f_security = NULL;
233 static int superblock_alloc_security(struct super_block *sb)
235 struct superblock_security_struct *sbsec;
237 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
241 init_MUTEX(&sbsec->sem);
242 INIT_LIST_HEAD(&sbsec->list);
243 INIT_LIST_HEAD(&sbsec->isec_head);
244 spin_lock_init(&sbsec->isec_lock);
246 sbsec->sid = SECINITSID_UNLABELED;
247 sbsec->def_sid = SECINITSID_FILE;
248 sb->s_security = sbsec;
253 static void superblock_free_security(struct super_block *sb)
255 struct superblock_security_struct *sbsec = sb->s_security;
257 spin_lock(&sb_security_lock);
258 if (!list_empty(&sbsec->list))
259 list_del_init(&sbsec->list);
260 spin_unlock(&sb_security_lock);
262 sb->s_security = NULL;
266 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
268 struct sk_security_struct *ssec;
270 if (family != PF_UNIX)
273 ssec = kzalloc(sizeof(*ssec), priority);
278 ssec->peer_sid = SECINITSID_UNLABELED;
279 sk->sk_security = ssec;
284 static void sk_free_security(struct sock *sk)
286 struct sk_security_struct *ssec = sk->sk_security;
288 if (sk->sk_family != PF_UNIX)
291 sk->sk_security = NULL;
295 /* The security server must be initialized before
296 any labeling or access decisions can be provided. */
297 extern int ss_initialized;
299 /* The file system's label must be initialized prior to use. */
301 static char *labeling_behaviors[6] = {
303 "uses transition SIDs",
305 "uses genfs_contexts",
306 "not configured for labeling",
307 "uses mountpoint labeling",
310 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
312 static inline int inode_doinit(struct inode *inode)
314 return inode_doinit_with_dentry(inode, NULL);
323 static match_table_t tokens = {
324 {Opt_context, "context=%s"},
325 {Opt_fscontext, "fscontext=%s"},
326 {Opt_defcontext, "defcontext=%s"},
329 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
331 static int try_context_mount(struct super_block *sb, void *data)
333 char *context = NULL, *defcontext = NULL;
336 int alloc = 0, rc = 0, seen = 0;
337 struct task_security_struct *tsec = current->security;
338 struct superblock_security_struct *sbsec = sb->s_security;
343 name = sb->s_type->name;
345 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
347 /* NFS we understand. */
348 if (!strcmp(name, "nfs")) {
349 struct nfs_mount_data *d = data;
351 if (d->version < NFS_MOUNT_VERSION)
355 context = d->context;
362 /* Standard string-based options. */
363 char *p, *options = data;
365 while ((p = strsep(&options, ",")) != NULL) {
367 substring_t args[MAX_OPT_ARGS];
372 token = match_token(p, tokens, args);
378 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
381 context = match_strdup(&args[0]);
392 if (seen & (Opt_context|Opt_fscontext)) {
394 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
397 context = match_strdup(&args[0]);
404 seen |= Opt_fscontext;
408 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
410 printk(KERN_WARNING "SELinux: "
411 "defcontext option is invalid "
412 "for this filesystem type\n");
415 if (seen & (Opt_context|Opt_defcontext)) {
417 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
420 defcontext = match_strdup(&args[0]);
427 seen |= Opt_defcontext;
432 printk(KERN_WARNING "SELinux: unknown mount "
444 rc = security_context_to_sid(context, strlen(context), &sid);
446 printk(KERN_WARNING "SELinux: security_context_to_sid"
447 "(%s) failed for (dev %s, type %s) errno=%d\n",
448 context, sb->s_id, name, rc);
452 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
453 FILESYSTEM__RELABELFROM, NULL);
457 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
458 FILESYSTEM__RELABELTO, NULL);
464 if (seen & Opt_context)
465 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
469 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
471 printk(KERN_WARNING "SELinux: security_context_to_sid"
472 "(%s) failed for (dev %s, type %s) errno=%d\n",
473 defcontext, sb->s_id, name, rc);
477 if (sid == sbsec->def_sid)
480 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
481 FILESYSTEM__RELABELFROM, NULL);
485 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
486 FILESYSTEM__ASSOCIATE, NULL);
490 sbsec->def_sid = sid;
502 static int superblock_doinit(struct super_block *sb, void *data)
504 struct superblock_security_struct *sbsec = sb->s_security;
505 struct dentry *root = sb->s_root;
506 struct inode *inode = root->d_inode;
510 if (sbsec->initialized)
513 if (!ss_initialized) {
514 /* Defer initialization until selinux_complete_init,
515 after the initial policy is loaded and the security
516 server is ready to handle calls. */
517 spin_lock(&sb_security_lock);
518 if (list_empty(&sbsec->list))
519 list_add(&sbsec->list, &superblock_security_head);
520 spin_unlock(&sb_security_lock);
524 /* Determine the labeling behavior to use for this filesystem type. */
525 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
527 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
528 __FUNCTION__, sb->s_type->name, rc);
532 rc = try_context_mount(sb, data);
536 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
537 /* Make sure that the xattr handler exists and that no
538 error other than -ENODATA is returned by getxattr on
539 the root directory. -ENODATA is ok, as this may be
540 the first boot of the SELinux kernel before we have
541 assigned xattr values to the filesystem. */
542 if (!inode->i_op->getxattr) {
543 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
544 "xattr support\n", sb->s_id, sb->s_type->name);
548 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
549 if (rc < 0 && rc != -ENODATA) {
550 if (rc == -EOPNOTSUPP)
551 printk(KERN_WARNING "SELinux: (dev %s, type "
552 "%s) has no security xattr handler\n",
553 sb->s_id, sb->s_type->name);
555 printk(KERN_WARNING "SELinux: (dev %s, type "
556 "%s) getxattr errno %d\n", sb->s_id,
557 sb->s_type->name, -rc);
562 if (strcmp(sb->s_type->name, "proc") == 0)
565 sbsec->initialized = 1;
567 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
568 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
569 sb->s_id, sb->s_type->name);
572 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
573 sb->s_id, sb->s_type->name,
574 labeling_behaviors[sbsec->behavior-1]);
577 /* Initialize the root inode. */
578 rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
580 /* Initialize any other inodes associated with the superblock, e.g.
581 inodes created prior to initial policy load or inodes created
582 during get_sb by a pseudo filesystem that directly
584 spin_lock(&sbsec->isec_lock);
586 if (!list_empty(&sbsec->isec_head)) {
587 struct inode_security_struct *isec =
588 list_entry(sbsec->isec_head.next,
589 struct inode_security_struct, list);
590 struct inode *inode = isec->inode;
591 spin_unlock(&sbsec->isec_lock);
592 inode = igrab(inode);
594 if (!IS_PRIVATE (inode))
598 spin_lock(&sbsec->isec_lock);
599 list_del_init(&isec->list);
602 spin_unlock(&sbsec->isec_lock);
608 static inline u16 inode_mode_to_security_class(umode_t mode)
610 switch (mode & S_IFMT) {
612 return SECCLASS_SOCK_FILE;
614 return SECCLASS_LNK_FILE;
616 return SECCLASS_FILE;
618 return SECCLASS_BLK_FILE;
622 return SECCLASS_CHR_FILE;
624 return SECCLASS_FIFO_FILE;
628 return SECCLASS_FILE;
631 static inline int default_protocol_stream(int protocol)
633 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
636 static inline int default_protocol_dgram(int protocol)
638 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
641 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
648 return SECCLASS_UNIX_STREAM_SOCKET;
650 return SECCLASS_UNIX_DGRAM_SOCKET;
657 if (default_protocol_stream(protocol))
658 return SECCLASS_TCP_SOCKET;
660 return SECCLASS_RAWIP_SOCKET;
662 if (default_protocol_dgram(protocol))
663 return SECCLASS_UDP_SOCKET;
665 return SECCLASS_RAWIP_SOCKET;
667 return SECCLASS_RAWIP_SOCKET;
673 return SECCLASS_NETLINK_ROUTE_SOCKET;
674 case NETLINK_FIREWALL:
675 return SECCLASS_NETLINK_FIREWALL_SOCKET;
676 case NETLINK_INET_DIAG:
677 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
679 return SECCLASS_NETLINK_NFLOG_SOCKET;
681 return SECCLASS_NETLINK_XFRM_SOCKET;
682 case NETLINK_SELINUX:
683 return SECCLASS_NETLINK_SELINUX_SOCKET;
685 return SECCLASS_NETLINK_AUDIT_SOCKET;
687 return SECCLASS_NETLINK_IP6FW_SOCKET;
688 case NETLINK_DNRTMSG:
689 return SECCLASS_NETLINK_DNRT_SOCKET;
690 case NETLINK_KOBJECT_UEVENT:
691 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
693 return SECCLASS_NETLINK_SOCKET;
696 return SECCLASS_PACKET_SOCKET;
698 return SECCLASS_KEY_SOCKET;
701 return SECCLASS_SOCKET;
704 #ifdef CONFIG_PROC_FS
705 static int selinux_proc_get_sid(struct proc_dir_entry *de,
710 char *buffer, *path, *end;
712 buffer = (char*)__get_free_page(GFP_KERNEL);
722 while (de && de != de->parent) {
723 buflen -= de->namelen + 1;
727 memcpy(end, de->name, de->namelen);
732 rc = security_genfs_sid("proc", path, tclass, sid);
733 free_page((unsigned long)buffer);
737 static int selinux_proc_get_sid(struct proc_dir_entry *de,
745 /* The inode's security attributes must be initialized before first use. */
746 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
748 struct superblock_security_struct *sbsec = NULL;
749 struct inode_security_struct *isec = inode->i_security;
751 struct dentry *dentry;
752 #define INITCONTEXTLEN 255
753 char *context = NULL;
758 if (isec->initialized)
763 if (isec->initialized)
766 sbsec = inode->i_sb->s_security;
767 if (!sbsec->initialized) {
768 /* Defer initialization until selinux_complete_init,
769 after the initial policy is loaded and the security
770 server is ready to handle calls. */
771 spin_lock(&sbsec->isec_lock);
772 if (list_empty(&isec->list))
773 list_add(&isec->list, &sbsec->isec_head);
774 spin_unlock(&sbsec->isec_lock);
778 switch (sbsec->behavior) {
779 case SECURITY_FS_USE_XATTR:
780 if (!inode->i_op->getxattr) {
781 isec->sid = sbsec->def_sid;
785 /* Need a dentry, since the xattr API requires one.
786 Life would be simpler if we could just pass the inode. */
788 /* Called from d_instantiate or d_splice_alias. */
789 dentry = dget(opt_dentry);
791 /* Called from selinux_complete_init, try to find a dentry. */
792 dentry = d_find_alias(inode);
795 printk(KERN_WARNING "%s: no dentry for dev=%s "
796 "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
801 len = INITCONTEXTLEN;
802 context = kmalloc(len, GFP_KERNEL);
808 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
811 /* Need a larger buffer. Query for the right size. */
812 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
820 context = kmalloc(len, GFP_KERNEL);
826 rc = inode->i_op->getxattr(dentry,
832 if (rc != -ENODATA) {
833 printk(KERN_WARNING "%s: getxattr returned "
834 "%d for dev=%s ino=%ld\n", __FUNCTION__,
835 -rc, inode->i_sb->s_id, inode->i_ino);
839 /* Map ENODATA to the default file SID */
840 sid = sbsec->def_sid;
843 rc = security_context_to_sid_default(context, rc, &sid,
846 printk(KERN_WARNING "%s: context_to_sid(%s) "
847 "returned %d for dev=%s ino=%ld\n",
848 __FUNCTION__, context, -rc,
849 inode->i_sb->s_id, inode->i_ino);
851 /* Leave with the unlabeled SID */
859 case SECURITY_FS_USE_TASK:
860 isec->sid = isec->task_sid;
862 case SECURITY_FS_USE_TRANS:
863 /* Default to the fs SID. */
864 isec->sid = sbsec->sid;
866 /* Try to obtain a transition SID. */
867 isec->sclass = inode_mode_to_security_class(inode->i_mode);
868 rc = security_transition_sid(isec->task_sid,
877 /* Default to the fs SID. */
878 isec->sid = sbsec->sid;
881 struct proc_inode *proci = PROC_I(inode);
883 isec->sclass = inode_mode_to_security_class(inode->i_mode);
884 rc = selinux_proc_get_sid(proci->pde,
895 isec->initialized = 1;
898 if (isec->sclass == SECCLASS_FILE)
899 isec->sclass = inode_mode_to_security_class(inode->i_mode);
906 /* Convert a Linux signal to an access vector. */
907 static inline u32 signal_to_av(int sig)
913 /* Commonly granted from child to parent. */
914 perm = PROCESS__SIGCHLD;
917 /* Cannot be caught or ignored */
918 perm = PROCESS__SIGKILL;
921 /* Cannot be caught or ignored */
922 perm = PROCESS__SIGSTOP;
925 /* All other signals. */
926 perm = PROCESS__SIGNAL;
933 /* Check permission betweeen a pair of tasks, e.g. signal checks,
934 fork check, ptrace check, etc. */
935 static int task_has_perm(struct task_struct *tsk1,
936 struct task_struct *tsk2,
939 struct task_security_struct *tsec1, *tsec2;
941 tsec1 = tsk1->security;
942 tsec2 = tsk2->security;
943 return avc_has_perm(tsec1->sid, tsec2->sid,
944 SECCLASS_PROCESS, perms, NULL);
947 /* Check whether a task is allowed to use a capability. */
948 static int task_has_capability(struct task_struct *tsk,
951 struct task_security_struct *tsec;
952 struct avc_audit_data ad;
954 tsec = tsk->security;
956 AVC_AUDIT_DATA_INIT(&ad,CAP);
960 return avc_has_perm(tsec->sid, tsec->sid,
961 SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
964 /* Check whether a task is allowed to use a system operation. */
965 static int task_has_system(struct task_struct *tsk,
968 struct task_security_struct *tsec;
970 tsec = tsk->security;
972 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
973 SECCLASS_SYSTEM, perms, NULL);
976 /* Check whether a task has a particular permission to an inode.
977 The 'adp' parameter is optional and allows other audit
978 data to be passed (e.g. the dentry). */
979 static int inode_has_perm(struct task_struct *tsk,
982 struct avc_audit_data *adp)
984 struct task_security_struct *tsec;
985 struct inode_security_struct *isec;
986 struct avc_audit_data ad;
988 tsec = tsk->security;
989 isec = inode->i_security;
993 AVC_AUDIT_DATA_INIT(&ad, FS);
994 ad.u.fs.inode = inode;
997 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1000 /* Same as inode_has_perm, but pass explicit audit data containing
1001 the dentry to help the auditing code to more easily generate the
1002 pathname if needed. */
1003 static inline int dentry_has_perm(struct task_struct *tsk,
1004 struct vfsmount *mnt,
1005 struct dentry *dentry,
1008 struct inode *inode = dentry->d_inode;
1009 struct avc_audit_data ad;
1010 AVC_AUDIT_DATA_INIT(&ad,FS);
1012 ad.u.fs.dentry = dentry;
1013 return inode_has_perm(tsk, inode, av, &ad);
1016 /* Check whether a task can use an open file descriptor to
1017 access an inode in a given way. Check access to the
1018 descriptor itself, and then use dentry_has_perm to
1019 check a particular permission to the file.
1020 Access to the descriptor is implicitly granted if it
1021 has the same SID as the process. If av is zero, then
1022 access to the file is not checked, e.g. for cases
1023 where only the descriptor is affected like seek. */
1024 static int file_has_perm(struct task_struct *tsk,
1028 struct task_security_struct *tsec = tsk->security;
1029 struct file_security_struct *fsec = file->f_security;
1030 struct vfsmount *mnt = file->f_vfsmnt;
1031 struct dentry *dentry = file->f_dentry;
1032 struct inode *inode = dentry->d_inode;
1033 struct avc_audit_data ad;
1036 AVC_AUDIT_DATA_INIT(&ad, FS);
1038 ad.u.fs.dentry = dentry;
1040 if (tsec->sid != fsec->sid) {
1041 rc = avc_has_perm(tsec->sid, fsec->sid,
1049 /* av is zero if only checking access to the descriptor. */
1051 return inode_has_perm(tsk, inode, av, &ad);
1056 /* Check whether a task can create a file. */
1057 static int may_create(struct inode *dir,
1058 struct dentry *dentry,
1061 struct task_security_struct *tsec;
1062 struct inode_security_struct *dsec;
1063 struct superblock_security_struct *sbsec;
1065 struct avc_audit_data ad;
1068 tsec = current->security;
1069 dsec = dir->i_security;
1070 sbsec = dir->i_sb->s_security;
1072 AVC_AUDIT_DATA_INIT(&ad, FS);
1073 ad.u.fs.dentry = dentry;
1075 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1076 DIR__ADD_NAME | DIR__SEARCH,
1081 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1082 newsid = tsec->create_sid;
1084 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1090 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1094 return avc_has_perm(newsid, sbsec->sid,
1095 SECCLASS_FILESYSTEM,
1096 FILESYSTEM__ASSOCIATE, &ad);
1100 #define MAY_UNLINK 1
1103 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1104 static int may_link(struct inode *dir,
1105 struct dentry *dentry,
1109 struct task_security_struct *tsec;
1110 struct inode_security_struct *dsec, *isec;
1111 struct avc_audit_data ad;
1115 tsec = current->security;
1116 dsec = dir->i_security;
1117 isec = dentry->d_inode->i_security;
1119 AVC_AUDIT_DATA_INIT(&ad, FS);
1120 ad.u.fs.dentry = dentry;
1123 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1124 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1139 printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
1143 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1147 static inline int may_rename(struct inode *old_dir,
1148 struct dentry *old_dentry,
1149 struct inode *new_dir,
1150 struct dentry *new_dentry)
1152 struct task_security_struct *tsec;
1153 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1154 struct avc_audit_data ad;
1156 int old_is_dir, new_is_dir;
1159 tsec = current->security;
1160 old_dsec = old_dir->i_security;
1161 old_isec = old_dentry->d_inode->i_security;
1162 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1163 new_dsec = new_dir->i_security;
1165 AVC_AUDIT_DATA_INIT(&ad, FS);
1167 ad.u.fs.dentry = old_dentry;
1168 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1169 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1172 rc = avc_has_perm(tsec->sid, old_isec->sid,
1173 old_isec->sclass, FILE__RENAME, &ad);
1176 if (old_is_dir && new_dir != old_dir) {
1177 rc = avc_has_perm(tsec->sid, old_isec->sid,
1178 old_isec->sclass, DIR__REPARENT, &ad);
1183 ad.u.fs.dentry = new_dentry;
1184 av = DIR__ADD_NAME | DIR__SEARCH;
1185 if (new_dentry->d_inode)
1186 av |= DIR__REMOVE_NAME;
1187 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1190 if (new_dentry->d_inode) {
1191 new_isec = new_dentry->d_inode->i_security;
1192 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1193 rc = avc_has_perm(tsec->sid, new_isec->sid,
1195 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1203 /* Check whether a task can perform a filesystem operation. */
1204 static int superblock_has_perm(struct task_struct *tsk,
1205 struct super_block *sb,
1207 struct avc_audit_data *ad)
1209 struct task_security_struct *tsec;
1210 struct superblock_security_struct *sbsec;
1212 tsec = tsk->security;
1213 sbsec = sb->s_security;
1214 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1218 /* Convert a Linux mode and permission mask to an access vector. */
1219 static inline u32 file_mask_to_av(int mode, int mask)
1223 if ((mode & S_IFMT) != S_IFDIR) {
1224 if (mask & MAY_EXEC)
1225 av |= FILE__EXECUTE;
1226 if (mask & MAY_READ)
1229 if (mask & MAY_APPEND)
1231 else if (mask & MAY_WRITE)
1235 if (mask & MAY_EXEC)
1237 if (mask & MAY_WRITE)
1239 if (mask & MAY_READ)
1246 /* Convert a Linux file to an access vector. */
1247 static inline u32 file_to_av(struct file *file)
1251 if (file->f_mode & FMODE_READ)
1253 if (file->f_mode & FMODE_WRITE) {
1254 if (file->f_flags & O_APPEND)
1263 /* Set an inode's SID to a specified value. */
1264 static int inode_security_set_sid(struct inode *inode, u32 sid)
1266 struct inode_security_struct *isec = inode->i_security;
1267 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
1269 if (!sbsec->initialized) {
1270 /* Defer initialization to selinux_complete_init. */
1275 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1277 isec->initialized = 1;
1282 /* Hook functions begin here. */
1284 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1286 struct task_security_struct *psec = parent->security;
1287 struct task_security_struct *csec = child->security;
1290 rc = secondary_ops->ptrace(parent,child);
1294 rc = task_has_perm(parent, child, PROCESS__PTRACE);
1295 /* Save the SID of the tracing process for later use in apply_creds. */
1296 if (!(child->ptrace & PT_PTRACED) && !rc)
1297 csec->ptrace_sid = psec->sid;
1301 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1302 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1306 error = task_has_perm(current, target, PROCESS__GETCAP);
1310 return secondary_ops->capget(target, effective, inheritable, permitted);
1313 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1314 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1318 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1322 return task_has_perm(current, target, PROCESS__SETCAP);
1325 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1326 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1328 secondary_ops->capset_set(target, effective, inheritable, permitted);
1331 static int selinux_capable(struct task_struct *tsk, int cap)
1335 rc = secondary_ops->capable(tsk, cap);
1339 return task_has_capability(tsk,cap);
1342 static int selinux_sysctl(ctl_table *table, int op)
1346 struct task_security_struct *tsec;
1350 rc = secondary_ops->sysctl(table, op);
1354 tsec = current->security;
1356 rc = selinux_proc_get_sid(table->de, (op == 001) ?
1357 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1359 /* Default to the well-defined sysctl SID. */
1360 tsid = SECINITSID_SYSCTL;
1363 /* The op values are "defined" in sysctl.c, thereby creating
1364 * a bad coupling between this module and sysctl.c */
1366 error = avc_has_perm(tsec->sid, tsid,
1367 SECCLASS_DIR, DIR__SEARCH, NULL);
1375 error = avc_has_perm(tsec->sid, tsid,
1376 SECCLASS_FILE, av, NULL);
1382 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1395 rc = superblock_has_perm(current,
1397 FILESYSTEM__QUOTAMOD, NULL);
1402 rc = superblock_has_perm(current,
1404 FILESYSTEM__QUOTAGET, NULL);
1407 rc = 0; /* let the kernel handle invalid cmds */
1413 static int selinux_quota_on(struct dentry *dentry)
1415 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1418 static int selinux_syslog(int type)
1422 rc = secondary_ops->syslog(type);
1427 case 3: /* Read last kernel messages */
1428 case 10: /* Return size of the log buffer */
1429 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1431 case 6: /* Disable logging to console */
1432 case 7: /* Enable logging to console */
1433 case 8: /* Set level of messages printed to console */
1434 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1436 case 0: /* Close log */
1437 case 1: /* Open log */
1438 case 2: /* Read from log */
1439 case 4: /* Read/clear last kernel messages */
1440 case 5: /* Clear ring buffer */
1442 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1449 * Check that a process has enough memory to allocate a new virtual
1450 * mapping. 0 means there is enough memory for the allocation to
1451 * succeed and -ENOMEM implies there is not.
1453 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1454 * if the capability is granted, but __vm_enough_memory requires 1 if
1455 * the capability is granted.
1457 * Do not audit the selinux permission check, as this is applied to all
1458 * processes that allocate mappings.
1460 static int selinux_vm_enough_memory(long pages)
1462 int rc, cap_sys_admin = 0;
1463 struct task_security_struct *tsec = current->security;
1465 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1467 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1468 SECCLASS_CAPABILITY,
1469 CAP_TO_MASK(CAP_SYS_ADMIN),
1475 return __vm_enough_memory(pages, cap_sys_admin);
1478 /* binprm security operations */
1480 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1482 struct bprm_security_struct *bsec;
1484 bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1489 bsec->sid = SECINITSID_UNLABELED;
1492 bprm->security = bsec;
1496 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1498 struct task_security_struct *tsec;
1499 struct inode *inode = bprm->file->f_dentry->d_inode;
1500 struct inode_security_struct *isec;
1501 struct bprm_security_struct *bsec;
1503 struct avc_audit_data ad;
1506 rc = secondary_ops->bprm_set_security(bprm);
1510 bsec = bprm->security;
1515 tsec = current->security;
1516 isec = inode->i_security;
1518 /* Default to the current task SID. */
1519 bsec->sid = tsec->sid;
1521 /* Reset create SID on execve. */
1522 tsec->create_sid = 0;
1524 if (tsec->exec_sid) {
1525 newsid = tsec->exec_sid;
1526 /* Reset exec SID on execve. */
1529 /* Check for a default transition on this program. */
1530 rc = security_transition_sid(tsec->sid, isec->sid,
1531 SECCLASS_PROCESS, &newsid);
1536 AVC_AUDIT_DATA_INIT(&ad, FS);
1537 ad.u.fs.mnt = bprm->file->f_vfsmnt;
1538 ad.u.fs.dentry = bprm->file->f_dentry;
1540 if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
1543 if (tsec->sid == newsid) {
1544 rc = avc_has_perm(tsec->sid, isec->sid,
1545 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1549 /* Check permissions for the transition. */
1550 rc = avc_has_perm(tsec->sid, newsid,
1551 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1555 rc = avc_has_perm(newsid, isec->sid,
1556 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1560 /* Clear any possibly unsafe personality bits on exec: */
1561 current->personality &= ~PER_CLEAR_ON_SETID;
1563 /* Set the security field to the new SID. */
1571 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1573 return secondary_ops->bprm_check_security(bprm);
1577 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1579 struct task_security_struct *tsec = current->security;
1582 if (tsec->osid != tsec->sid) {
1583 /* Enable secure mode for SIDs transitions unless
1584 the noatsecure permission is granted between
1585 the two SIDs, i.e. ahp returns 0. */
1586 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1588 PROCESS__NOATSECURE, NULL);
1591 return (atsecure || secondary_ops->bprm_secureexec(bprm));
1594 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1596 kfree(bprm->security);
1597 bprm->security = NULL;
1600 extern struct vfsmount *selinuxfs_mount;
1601 extern struct dentry *selinux_null;
1603 /* Derived from fs/exec.c:flush_old_files. */
1604 static inline void flush_unauthorized_files(struct files_struct * files)
1606 struct avc_audit_data ad;
1607 struct file *file, *devnull = NULL;
1608 struct tty_struct *tty = current->signal->tty;
1609 struct fdtable *fdt;
1614 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
1616 /* Revalidate access to controlling tty.
1617 Use inode_has_perm on the tty inode directly rather
1618 than using file_has_perm, as this particular open
1619 file may belong to another process and we are only
1620 interested in the inode-based check here. */
1621 struct inode *inode = file->f_dentry->d_inode;
1622 if (inode_has_perm(current, inode,
1623 FILE__READ | FILE__WRITE, NULL)) {
1624 /* Reset controlling tty. */
1625 current->signal->tty = NULL;
1626 current->signal->tty_old_pgrp = 0;
1632 /* Revalidate access to inherited open files. */
1634 AVC_AUDIT_DATA_INIT(&ad,FS);
1636 spin_lock(&files->file_lock);
1638 unsigned long set, i;
1643 fdt = files_fdtable(files);
1644 if (i >= fdt->max_fds || i >= fdt->max_fdset)
1646 set = fdt->open_fds->fds_bits[j];
1649 spin_unlock(&files->file_lock);
1650 for ( ; set ; i++,set >>= 1) {
1655 if (file_has_perm(current,
1657 file_to_av(file))) {
1659 fd = get_unused_fd();
1669 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1676 fd_install(fd, devnull);
1681 spin_lock(&files->file_lock);
1684 spin_unlock(&files->file_lock);
1687 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1689 struct task_security_struct *tsec;
1690 struct bprm_security_struct *bsec;
1694 secondary_ops->bprm_apply_creds(bprm, unsafe);
1696 tsec = current->security;
1698 bsec = bprm->security;
1701 tsec->osid = tsec->sid;
1703 if (tsec->sid != sid) {
1704 /* Check for shared state. If not ok, leave SID
1705 unchanged and kill. */
1706 if (unsafe & LSM_UNSAFE_SHARE) {
1707 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1708 PROCESS__SHARE, NULL);
1715 /* Check for ptracing, and update the task SID if ok.
1716 Otherwise, leave SID unchanged and kill. */
1717 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1718 rc = avc_has_perm(tsec->ptrace_sid, sid,
1719 SECCLASS_PROCESS, PROCESS__PTRACE,
1731 * called after apply_creds without the task lock held
1733 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1735 struct task_security_struct *tsec;
1736 struct rlimit *rlim, *initrlim;
1737 struct itimerval itimer;
1738 struct bprm_security_struct *bsec;
1741 tsec = current->security;
1742 bsec = bprm->security;
1745 force_sig_specific(SIGKILL, current);
1748 if (tsec->osid == tsec->sid)
1751 /* Close files for which the new task SID is not authorized. */
1752 flush_unauthorized_files(current->files);
1754 /* Check whether the new SID can inherit signal state
1755 from the old SID. If not, clear itimers to avoid
1756 subsequent signal generation and flush and unblock
1757 signals. This must occur _after_ the task SID has
1758 been updated so that any kill done after the flush
1759 will be checked against the new SID. */
1760 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1761 PROCESS__SIGINH, NULL);
1763 memset(&itimer, 0, sizeof itimer);
1764 for (i = 0; i < 3; i++)
1765 do_setitimer(i, &itimer, NULL);
1766 flush_signals(current);
1767 spin_lock_irq(¤t->sighand->siglock);
1768 flush_signal_handlers(current, 1);
1769 sigemptyset(¤t->blocked);
1770 recalc_sigpending();
1771 spin_unlock_irq(¤t->sighand->siglock);
1774 /* Check whether the new SID can inherit resource limits
1775 from the old SID. If not, reset all soft limits to
1776 the lower of the current task's hard limit and the init
1777 task's soft limit. Note that the setting of hard limits
1778 (even to lower them) can be controlled by the setrlimit
1779 check. The inclusion of the init task's soft limit into
1780 the computation is to avoid resetting soft limits higher
1781 than the default soft limit for cases where the default
1782 is lower than the hard limit, e.g. RLIMIT_CORE or
1784 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1785 PROCESS__RLIMITINH, NULL);
1787 for (i = 0; i < RLIM_NLIMITS; i++) {
1788 rlim = current->signal->rlim + i;
1789 initrlim = init_task.signal->rlim+i;
1790 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1792 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1794 * This will cause RLIMIT_CPU calculations
1797 current->it_prof_expires = jiffies_to_cputime(1);
1801 /* Wake up the parent if it is waiting so that it can
1802 recheck wait permission to the new task SID. */
1803 wake_up_interruptible(¤t->parent->signal->wait_chldexit);
1806 /* superblock security operations */
1808 static int selinux_sb_alloc_security(struct super_block *sb)
1810 return superblock_alloc_security(sb);
1813 static void selinux_sb_free_security(struct super_block *sb)
1815 superblock_free_security(sb);
1818 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1823 return !memcmp(prefix, option, plen);
1826 static inline int selinux_option(char *option, int len)
1828 return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1829 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1830 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len));
1833 static inline void take_option(char **to, char *from, int *first, int len)
1841 memcpy(*to, from, len);
1845 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
1847 int fnosec, fsec, rc = 0;
1848 char *in_save, *in_curr, *in_end;
1849 char *sec_curr, *nosec_save, *nosec;
1854 /* Binary mount data: just copy */
1855 if (type->fs_flags & FS_BINARY_MOUNTDATA) {
1856 copy_page(sec_curr, in_curr);
1860 nosec = (char *)get_zeroed_page(GFP_KERNEL);
1868 in_save = in_end = orig;
1871 if (*in_end == ',' || *in_end == '\0') {
1872 int len = in_end - in_curr;
1874 if (selinux_option(in_curr, len))
1875 take_option(&sec_curr, in_curr, &fsec, len);
1877 take_option(&nosec, in_curr, &fnosec, len);
1879 in_curr = in_end + 1;
1881 } while (*in_end++);
1883 strcpy(in_save, nosec_save);
1884 free_page((unsigned long)nosec_save);
1889 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
1891 struct avc_audit_data ad;
1894 rc = superblock_doinit(sb, data);
1898 AVC_AUDIT_DATA_INIT(&ad,FS);
1899 ad.u.fs.dentry = sb->s_root;
1900 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
1903 static int selinux_sb_statfs(struct super_block *sb)
1905 struct avc_audit_data ad;
1907 AVC_AUDIT_DATA_INIT(&ad,FS);
1908 ad.u.fs.dentry = sb->s_root;
1909 return superblock_has_perm(current, sb, FILESYSTEM__GETATTR, &ad);
1912 static int selinux_mount(char * dev_name,
1913 struct nameidata *nd,
1915 unsigned long flags,
1920 rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
1924 if (flags & MS_REMOUNT)
1925 return superblock_has_perm(current, nd->mnt->mnt_sb,
1926 FILESYSTEM__REMOUNT, NULL);
1928 return dentry_has_perm(current, nd->mnt, nd->dentry,
1932 static int selinux_umount(struct vfsmount *mnt, int flags)
1936 rc = secondary_ops->sb_umount(mnt, flags);
1940 return superblock_has_perm(current,mnt->mnt_sb,
1941 FILESYSTEM__UNMOUNT,NULL);
1944 /* inode security operations */
1946 static int selinux_inode_alloc_security(struct inode *inode)
1948 return inode_alloc_security(inode);
1951 static void selinux_inode_free_security(struct inode *inode)
1953 inode_free_security(inode);
1956 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
1957 char **name, void **value,
1960 struct task_security_struct *tsec;
1961 struct inode_security_struct *dsec;
1962 struct superblock_security_struct *sbsec;
1965 char *namep = NULL, *context;
1967 tsec = current->security;
1968 dsec = dir->i_security;
1969 sbsec = dir->i_sb->s_security;
1971 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1972 newsid = tsec->create_sid;
1974 rc = security_transition_sid(tsec->sid, dsec->sid,
1975 inode_mode_to_security_class(inode->i_mode),
1978 printk(KERN_WARNING "%s: "
1979 "security_transition_sid failed, rc=%d (dev=%s "
1982 -rc, inode->i_sb->s_id, inode->i_ino);
1987 inode_security_set_sid(inode, newsid);
1989 if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
1993 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
2000 rc = security_sid_to_context(newsid, &context, &clen);
2012 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2014 return may_create(dir, dentry, SECCLASS_FILE);
2017 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2021 rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2024 return may_link(dir, old_dentry, MAY_LINK);
2027 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2031 rc = secondary_ops->inode_unlink(dir, dentry);
2034 return may_link(dir, dentry, MAY_UNLINK);
2037 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2039 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2042 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2044 return may_create(dir, dentry, SECCLASS_DIR);
2047 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2049 return may_link(dir, dentry, MAY_RMDIR);
2052 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2056 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2060 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2063 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2064 struct inode *new_inode, struct dentry *new_dentry)
2066 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2069 static int selinux_inode_readlink(struct dentry *dentry)
2071 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2074 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2078 rc = secondary_ops->inode_follow_link(dentry,nameidata);
2081 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2084 static int selinux_inode_permission(struct inode *inode, int mask,
2085 struct nameidata *nd)
2089 rc = secondary_ops->inode_permission(inode, mask, nd);
2094 /* No permission to check. Existence test. */
2098 return inode_has_perm(current, inode,
2099 file_mask_to_av(inode->i_mode, mask), NULL);
2102 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2106 rc = secondary_ops->inode_setattr(dentry, iattr);
2110 if (iattr->ia_valid & ATTR_FORCE)
2113 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2114 ATTR_ATIME_SET | ATTR_MTIME_SET))
2115 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2117 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2120 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2122 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2125 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2127 struct task_security_struct *tsec = current->security;
2128 struct inode *inode = dentry->d_inode;
2129 struct inode_security_struct *isec = inode->i_security;
2130 struct superblock_security_struct *sbsec;
2131 struct avc_audit_data ad;
2135 if (strcmp(name, XATTR_NAME_SELINUX)) {
2136 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2137 sizeof XATTR_SECURITY_PREFIX - 1) &&
2138 !capable(CAP_SYS_ADMIN)) {
2139 /* A different attribute in the security namespace.
2140 Restrict to administrator. */
2144 /* Not an attribute we recognize, so just check the
2145 ordinary setattr permission. */
2146 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2149 sbsec = inode->i_sb->s_security;
2150 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2153 if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2156 AVC_AUDIT_DATA_INIT(&ad,FS);
2157 ad.u.fs.dentry = dentry;
2159 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2160 FILE__RELABELFROM, &ad);
2164 rc = security_context_to_sid(value, size, &newsid);
2168 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2169 FILE__RELABELTO, &ad);
2173 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2178 return avc_has_perm(newsid,
2180 SECCLASS_FILESYSTEM,
2181 FILESYSTEM__ASSOCIATE,
2185 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2186 void *value, size_t size, int flags)
2188 struct inode *inode = dentry->d_inode;
2189 struct inode_security_struct *isec = inode->i_security;
2193 if (strcmp(name, XATTR_NAME_SELINUX)) {
2194 /* Not an attribute we recognize, so nothing to do. */
2198 rc = security_context_to_sid(value, size, &newsid);
2200 printk(KERN_WARNING "%s: unable to obtain SID for context "
2201 "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2209 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2211 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2214 static int selinux_inode_listxattr (struct dentry *dentry)
2216 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2219 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2221 if (strcmp(name, XATTR_NAME_SELINUX)) {
2222 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2223 sizeof XATTR_SECURITY_PREFIX - 1) &&
2224 !capable(CAP_SYS_ADMIN)) {
2225 /* A different attribute in the security namespace.
2226 Restrict to administrator. */
2230 /* Not an attribute we recognize, so just check the
2231 ordinary setattr permission. Might want a separate
2232 permission for removexattr. */
2233 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2236 /* No one is allowed to remove a SELinux security label.
2237 You can change the label, but all data must be labeled. */
2241 static const char *selinux_inode_xattr_getsuffix(void)
2243 return XATTR_SELINUX_SUFFIX;
2247 * Copy the in-core inode security context value to the user. If the
2248 * getxattr() prior to this succeeded, check to see if we need to
2249 * canonicalize the value to be finally returned to the user.
2251 * Permission check is handled by selinux_inode_getxattr hook.
2253 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void *buffer, size_t size, int err)
2255 struct inode_security_struct *isec = inode->i_security;
2257 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2260 return selinux_getsecurity(isec->sid, buffer, size);
2263 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2264 const void *value, size_t size, int flags)
2266 struct inode_security_struct *isec = inode->i_security;
2270 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2273 if (!value || !size)
2276 rc = security_context_to_sid((void*)value, size, &newsid);
2284 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2286 const int len = sizeof(XATTR_NAME_SELINUX);
2287 if (buffer && len <= buffer_size)
2288 memcpy(buffer, XATTR_NAME_SELINUX, len);
2292 /* file security operations */
2294 static int selinux_file_permission(struct file *file, int mask)
2296 struct inode *inode = file->f_dentry->d_inode;
2299 /* No permission to check. Existence test. */
2303 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2304 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2307 return file_has_perm(current, file,
2308 file_mask_to_av(inode->i_mode, mask));
2311 static int selinux_file_alloc_security(struct file *file)
2313 return file_alloc_security(file);
2316 static void selinux_file_free_security(struct file *file)
2318 file_free_security(file);
2321 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2333 case EXT2_IOC_GETFLAGS:
2335 case EXT2_IOC_GETVERSION:
2336 error = file_has_perm(current, file, FILE__GETATTR);
2339 case EXT2_IOC_SETFLAGS:
2341 case EXT2_IOC_SETVERSION:
2342 error = file_has_perm(current, file, FILE__SETATTR);
2345 /* sys_ioctl() checks */
2349 error = file_has_perm(current, file, 0);
2354 error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2357 /* default case assumes that the command will go
2358 * to the file's ioctl() function.
2361 error = file_has_perm(current, file, FILE__IOCTL);
2367 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2369 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2371 * We are making executable an anonymous mapping or a
2372 * private file mapping that will also be writable.
2373 * This has an additional check.
2375 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2381 /* read access is always possible with a mapping */
2382 u32 av = FILE__READ;
2384 /* write access only matters if the mapping is shared */
2385 if (shared && (prot & PROT_WRITE))
2388 if (prot & PROT_EXEC)
2389 av |= FILE__EXECUTE;
2391 return file_has_perm(current, file, av);
2396 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2397 unsigned long prot, unsigned long flags)
2401 rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2405 if (selinux_checkreqprot)
2408 return file_map_prot_check(file, prot,
2409 (flags & MAP_TYPE) == MAP_SHARED);
2412 static int selinux_file_mprotect(struct vm_area_struct *vma,
2413 unsigned long reqprot,
2418 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2422 if (selinux_checkreqprot)
2425 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2427 if (vma->vm_start >= vma->vm_mm->start_brk &&
2428 vma->vm_end <= vma->vm_mm->brk) {
2429 rc = task_has_perm(current, current,
2431 } else if (!vma->vm_file &&
2432 vma->vm_start <= vma->vm_mm->start_stack &&
2433 vma->vm_end >= vma->vm_mm->start_stack) {
2434 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2435 } else if (vma->vm_file && vma->anon_vma) {
2437 * We are making executable a file mapping that has
2438 * had some COW done. Since pages might have been
2439 * written, check ability to execute the possibly
2440 * modified content. This typically should only
2441 * occur for text relocations.
2443 rc = file_has_perm(current, vma->vm_file,
2450 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2453 static int selinux_file_lock(struct file *file, unsigned int cmd)
2455 return file_has_perm(current, file, FILE__LOCK);
2458 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2465 if (!file->f_dentry || !file->f_dentry->d_inode) {
2470 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2471 err = file_has_perm(current, file,FILE__WRITE);
2480 /* Just check FD__USE permission */
2481 err = file_has_perm(current, file, 0);
2486 #if BITS_PER_LONG == 32
2491 if (!file->f_dentry || !file->f_dentry->d_inode) {
2495 err = file_has_perm(current, file, FILE__LOCK);
2502 static int selinux_file_set_fowner(struct file *file)
2504 struct task_security_struct *tsec;
2505 struct file_security_struct *fsec;
2507 tsec = current->security;
2508 fsec = file->f_security;
2509 fsec->fown_sid = tsec->sid;
2514 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2515 struct fown_struct *fown, int signum)
2519 struct task_security_struct *tsec;
2520 struct file_security_struct *fsec;
2522 /* struct fown_struct is never outside the context of a struct file */
2523 file = (struct file *)((long)fown - offsetof(struct file,f_owner));
2525 tsec = tsk->security;
2526 fsec = file->f_security;
2529 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2531 perm = signal_to_av(signum);
2533 return avc_has_perm(fsec->fown_sid, tsec->sid,
2534 SECCLASS_PROCESS, perm, NULL);
2537 static int selinux_file_receive(struct file *file)
2539 return file_has_perm(current, file, file_to_av(file));
2542 /* task security operations */
2544 static int selinux_task_create(unsigned long clone_flags)
2548 rc = secondary_ops->task_create(clone_flags);
2552 return task_has_perm(current, current, PROCESS__FORK);
2555 static int selinux_task_alloc_security(struct task_struct *tsk)
2557 struct task_security_struct *tsec1, *tsec2;
2560 tsec1 = current->security;
2562 rc = task_alloc_security(tsk);
2565 tsec2 = tsk->security;
2567 tsec2->osid = tsec1->osid;
2568 tsec2->sid = tsec1->sid;
2570 /* Retain the exec and create SIDs across fork */
2571 tsec2->exec_sid = tsec1->exec_sid;
2572 tsec2->create_sid = tsec1->create_sid;
2574 /* Retain ptracer SID across fork, if any.
2575 This will be reset by the ptrace hook upon any
2576 subsequent ptrace_attach operations. */
2577 tsec2->ptrace_sid = tsec1->ptrace_sid;
2582 static void selinux_task_free_security(struct task_struct *tsk)
2584 task_free_security(tsk);
2587 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2589 /* Since setuid only affects the current process, and
2590 since the SELinux controls are not based on the Linux
2591 identity attributes, SELinux does not need to control
2592 this operation. However, SELinux does control the use
2593 of the CAP_SETUID and CAP_SETGID capabilities using the
2598 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2600 return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2603 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2605 /* See the comment for setuid above. */
2609 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2611 return task_has_perm(current, p, PROCESS__SETPGID);
2614 static int selinux_task_getpgid(struct task_struct *p)
2616 return task_has_perm(current, p, PROCESS__GETPGID);
2619 static int selinux_task_getsid(struct task_struct *p)
2621 return task_has_perm(current, p, PROCESS__GETSESSION);
2624 static int selinux_task_setgroups(struct group_info *group_info)
2626 /* See the comment for setuid above. */
2630 static int selinux_task_setnice(struct task_struct *p, int nice)
2634 rc = secondary_ops->task_setnice(p, nice);
2638 return task_has_perm(current,p, PROCESS__SETSCHED);
2641 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2643 struct rlimit *old_rlim = current->signal->rlim + resource;
2646 rc = secondary_ops->task_setrlimit(resource, new_rlim);
2650 /* Control the ability to change the hard limit (whether
2651 lowering or raising it), so that the hard limit can
2652 later be used as a safe reset point for the soft limit
2653 upon context transitions. See selinux_bprm_apply_creds. */
2654 if (old_rlim->rlim_max != new_rlim->rlim_max)
2655 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2660 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2662 return task_has_perm(current, p, PROCESS__SETSCHED);
2665 static int selinux_task_getscheduler(struct task_struct *p)
2667 return task_has_perm(current, p, PROCESS__GETSCHED);
2670 static int selinux_task_kill(struct task_struct *p, struct siginfo *info, int sig)
2675 rc = secondary_ops->task_kill(p, info, sig);
2679 if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
2683 perm = PROCESS__SIGNULL; /* null signal; existence test */
2685 perm = signal_to_av(sig);
2687 return task_has_perm(current, p, perm);
2690 static int selinux_task_prctl(int option,
2696 /* The current prctl operations do not appear to require
2697 any SELinux controls since they merely observe or modify
2698 the state of the current process. */
2702 static int selinux_task_wait(struct task_struct *p)
2706 perm = signal_to_av(p->exit_signal);
2708 return task_has_perm(p, current, perm);
2711 static void selinux_task_reparent_to_init(struct task_struct *p)
2713 struct task_security_struct *tsec;
2715 secondary_ops->task_reparent_to_init(p);
2718 tsec->osid = tsec->sid;
2719 tsec->sid = SECINITSID_KERNEL;
2723 static void selinux_task_to_inode(struct task_struct *p,
2724 struct inode *inode)
2726 struct task_security_struct *tsec = p->security;
2727 struct inode_security_struct *isec = inode->i_security;
2729 isec->sid = tsec->sid;
2730 isec->initialized = 1;
2734 /* Returns error only if unable to parse addresses */
2735 static int selinux_parse_skb_ipv4(struct sk_buff *skb, struct avc_audit_data *ad)
2737 int offset, ihlen, ret = -EINVAL;
2738 struct iphdr _iph, *ih;
2740 offset = skb->nh.raw - skb->data;
2741 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2745 ihlen = ih->ihl * 4;
2746 if (ihlen < sizeof(_iph))
2749 ad->u.net.v4info.saddr = ih->saddr;
2750 ad->u.net.v4info.daddr = ih->daddr;
2753 switch (ih->protocol) {
2755 struct tcphdr _tcph, *th;
2757 if (ntohs(ih->frag_off) & IP_OFFSET)
2761 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2765 ad->u.net.sport = th->source;
2766 ad->u.net.dport = th->dest;
2771 struct udphdr _udph, *uh;
2773 if (ntohs(ih->frag_off) & IP_OFFSET)
2777 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2781 ad->u.net.sport = uh->source;
2782 ad->u.net.dport = uh->dest;
2793 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2795 /* Returns error only if unable to parse addresses */
2796 static int selinux_parse_skb_ipv6(struct sk_buff *skb, struct avc_audit_data *ad)
2799 int ret = -EINVAL, offset;
2800 struct ipv6hdr _ipv6h, *ip6;
2802 offset = skb->nh.raw - skb->data;
2803 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
2807 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
2808 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
2811 nexthdr = ip6->nexthdr;
2812 offset += sizeof(_ipv6h);
2813 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
2819 struct tcphdr _tcph, *th;
2821 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2825 ad->u.net.sport = th->source;
2826 ad->u.net.dport = th->dest;
2831 struct udphdr _udph, *uh;
2833 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2837 ad->u.net.sport = uh->source;
2838 ad->u.net.dport = uh->dest;
2842 /* includes fragments */
2852 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
2853 char **addrp, int *len, int src)
2857 switch (ad->u.net.family) {
2859 ret = selinux_parse_skb_ipv4(skb, ad);
2863 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
2864 &ad->u.net.v4info.daddr);
2867 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2869 ret = selinux_parse_skb_ipv6(skb, ad);
2873 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
2874 &ad->u.net.v6info.daddr);
2884 /* socket security operations */
2885 static int socket_has_perm(struct task_struct *task, struct socket *sock,
2888 struct inode_security_struct *isec;
2889 struct task_security_struct *tsec;
2890 struct avc_audit_data ad;
2893 tsec = task->security;
2894 isec = SOCK_INODE(sock)->i_security;
2896 if (isec->sid == SECINITSID_KERNEL)
2899 AVC_AUDIT_DATA_INIT(&ad,NET);
2900 ad.u.net.sk = sock->sk;
2901 err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
2907 static int selinux_socket_create(int family, int type,
2908 int protocol, int kern)
2911 struct task_security_struct *tsec;
2916 tsec = current->security;
2917 err = avc_has_perm(tsec->sid, tsec->sid,
2918 socket_type_to_security_class(family, type,
2919 protocol), SOCKET__CREATE, NULL);
2925 static void selinux_socket_post_create(struct socket *sock, int family,
2926 int type, int protocol, int kern)
2928 struct inode_security_struct *isec;
2929 struct task_security_struct *tsec;
2931 isec = SOCK_INODE(sock)->i_security;
2933 tsec = current->security;
2934 isec->sclass = socket_type_to_security_class(family, type, protocol);
2935 isec->sid = kern ? SECINITSID_KERNEL : tsec->sid;
2936 isec->initialized = 1;
2941 /* Range of port numbers used to automatically bind.
2942 Need to determine whether we should perform a name_bind
2943 permission check between the socket and the port number. */
2944 #define ip_local_port_range_0 sysctl_local_port_range[0]
2945 #define ip_local_port_range_1 sysctl_local_port_range[1]
2947 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
2952 err = socket_has_perm(current, sock, SOCKET__BIND);
2957 * If PF_INET or PF_INET6, check name_bind permission for the port.
2958 * Multiple address binding for SCTP is not supported yet: we just
2959 * check the first address now.
2961 family = sock->sk->sk_family;
2962 if (family == PF_INET || family == PF_INET6) {
2964 struct inode_security_struct *isec;
2965 struct task_security_struct *tsec;
2966 struct avc_audit_data ad;
2967 struct sockaddr_in *addr4 = NULL;
2968 struct sockaddr_in6 *addr6 = NULL;
2969 unsigned short snum;
2970 struct sock *sk = sock->sk;
2971 u32 sid, node_perm, addrlen;
2973 tsec = current->security;
2974 isec = SOCK_INODE(sock)->i_security;
2976 if (family == PF_INET) {
2977 addr4 = (struct sockaddr_in *)address;
2978 snum = ntohs(addr4->sin_port);
2979 addrlen = sizeof(addr4->sin_addr.s_addr);
2980 addrp = (char *)&addr4->sin_addr.s_addr;
2982 addr6 = (struct sockaddr_in6 *)address;
2983 snum = ntohs(addr6->sin6_port);
2984 addrlen = sizeof(addr6->sin6_addr.s6_addr);
2985 addrp = (char *)&addr6->sin6_addr.s6_addr;
2988 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
2989 snum > ip_local_port_range_1)) {
2990 err = security_port_sid(sk->sk_family, sk->sk_type,
2991 sk->sk_protocol, snum, &sid);
2994 AVC_AUDIT_DATA_INIT(&ad,NET);
2995 ad.u.net.sport = htons(snum);
2996 ad.u.net.family = family;
2997 err = avc_has_perm(isec->sid, sid,
2999 SOCKET__NAME_BIND, &ad);
3004 switch(isec->sclass) {
3005 case SECCLASS_TCP_SOCKET:
3006 node_perm = TCP_SOCKET__NODE_BIND;
3009 case SECCLASS_UDP_SOCKET:
3010 node_perm = UDP_SOCKET__NODE_BIND;
3014 node_perm = RAWIP_SOCKET__NODE_BIND;
3018 err = security_node_sid(family, addrp, addrlen, &sid);
3022 AVC_AUDIT_DATA_INIT(&ad,NET);
3023 ad.u.net.sport = htons(snum);
3024 ad.u.net.family = family;
3026 if (family == PF_INET)
3027 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3029 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3031 err = avc_has_perm(isec->sid, sid,
3032 isec->sclass, node_perm, &ad);
3040 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3042 struct inode_security_struct *isec;
3045 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3050 * If a TCP socket, check name_connect permission for the port.
3052 isec = SOCK_INODE(sock)->i_security;
3053 if (isec->sclass == SECCLASS_TCP_SOCKET) {
3054 struct sock *sk = sock->sk;
3055 struct avc_audit_data ad;
3056 struct sockaddr_in *addr4 = NULL;
3057 struct sockaddr_in6 *addr6 = NULL;
3058 unsigned short snum;
3061 if (sk->sk_family == PF_INET) {
3062 addr4 = (struct sockaddr_in *)address;
3063 if (addrlen < sizeof(struct sockaddr_in))
3065 snum = ntohs(addr4->sin_port);
3067 addr6 = (struct sockaddr_in6 *)address;
3068 if (addrlen < SIN6_LEN_RFC2133)
3070 snum = ntohs(addr6->sin6_port);
3073 err = security_port_sid(sk->sk_family, sk->sk_type,
3074 sk->sk_protocol, snum, &sid);
3078 AVC_AUDIT_DATA_INIT(&ad,NET);
3079 ad.u.net.dport = htons(snum);
3080 ad.u.net.family = sk->sk_family;
3081 err = avc_has_perm(isec->sid, sid, isec->sclass,
3082 TCP_SOCKET__NAME_CONNECT, &ad);
3091 static int selinux_socket_listen(struct socket *sock, int backlog)
3093 return socket_has_perm(current, sock, SOCKET__LISTEN);
3096 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3099 struct inode_security_struct *isec;
3100 struct inode_security_struct *newisec;
3102 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3106 newisec = SOCK_INODE(newsock)->i_security;
3108 isec = SOCK_INODE(sock)->i_security;
3109 newisec->sclass = isec->sclass;
3110 newisec->sid = isec->sid;
3111 newisec->initialized = 1;
3116 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3119 return socket_has_perm(current, sock, SOCKET__WRITE);
3122 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3123 int size, int flags)
3125 return socket_has_perm(current, sock, SOCKET__READ);
3128 static int selinux_socket_getsockname(struct socket *sock)
3130 return socket_has_perm(current, sock, SOCKET__GETATTR);
3133 static int selinux_socket_getpeername(struct socket *sock)
3135 return socket_has_perm(current, sock, SOCKET__GETATTR);
3138 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3140 return socket_has_perm(current, sock, SOCKET__SETOPT);
3143 static int selinux_socket_getsockopt(struct socket *sock, int level,
3146 return socket_has_perm(current, sock, SOCKET__GETOPT);
3149 static int selinux_socket_shutdown(struct socket *sock, int how)
3151 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3154 static int selinux_socket_unix_stream_connect(struct socket *sock,
3155 struct socket *other,
3158 struct sk_security_struct *ssec;
3159 struct inode_security_struct *isec;
3160 struct inode_security_struct *other_isec;
3161 struct avc_audit_data ad;
3164 err = secondary_ops->unix_stream_connect(sock, other, newsk);
3168 isec = SOCK_INODE(sock)->i_security;
3169 other_isec = SOCK_INODE(other)->i_security;
3171 AVC_AUDIT_DATA_INIT(&ad,NET);
3172 ad.u.net.sk = other->sk;
3174 err = avc_has_perm(isec->sid, other_isec->sid,
3176 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3180 /* connecting socket */
3181 ssec = sock->sk->sk_security;
3182 ssec->peer_sid = other_isec->sid;
3184 /* server child socket */
3185 ssec = newsk->sk_security;
3186 ssec->peer_sid = isec->sid;
3191 static int selinux_socket_unix_may_send(struct socket *sock,
3192 struct socket *other)
3194 struct inode_security_struct *isec;
3195 struct inode_security_struct *other_isec;
3196 struct avc_audit_data ad;
3199 isec = SOCK_INODE(sock)->i_security;
3200 other_isec = SOCK_INODE(other)->i_security;
3202 AVC_AUDIT_DATA_INIT(&ad,NET);
3203 ad.u.net.sk = other->sk;
3205 err = avc_has_perm(isec->sid, other_isec->sid,
3206 isec->sclass, SOCKET__SENDTO, &ad);
3213 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3218 u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3221 struct socket *sock;
3222 struct net_device *dev;
3223 struct avc_audit_data ad;
3225 family = sk->sk_family;
3226 if (family != PF_INET && family != PF_INET6)
3229 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3230 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
3233 read_lock_bh(&sk->sk_callback_lock);
3234 sock = sk->sk_socket;
3236 struct inode *inode;
3237 inode = SOCK_INODE(sock);
3239 struct inode_security_struct *isec;
3240 isec = inode->i_security;
3241 sock_sid = isec->sid;
3242 sock_class = isec->sclass;
3245 read_unlock_bh(&sk->sk_callback_lock);
3253 err = sel_netif_sids(dev, &if_sid, NULL);
3257 switch (sock_class) {
3258 case SECCLASS_UDP_SOCKET:
3259 netif_perm = NETIF__UDP_RECV;
3260 node_perm = NODE__UDP_RECV;
3261 recv_perm = UDP_SOCKET__RECV_MSG;
3264 case SECCLASS_TCP_SOCKET:
3265 netif_perm = NETIF__TCP_RECV;
3266 node_perm = NODE__TCP_RECV;
3267 recv_perm = TCP_SOCKET__RECV_MSG;
3271 netif_perm = NETIF__RAWIP_RECV;
3272 node_perm = NODE__RAWIP_RECV;
3276 AVC_AUDIT_DATA_INIT(&ad, NET);
3277 ad.u.net.netif = dev->name;
3278 ad.u.net.family = family;
3280 err = selinux_parse_skb(skb, &ad, &addrp, &len, 1);
3284 err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, &ad);
3288 /* Fixme: this lookup is inefficient */
3289 err = security_node_sid(family, addrp, len, &node_sid);
3293 err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, &ad);
3300 /* Fixme: make this more efficient */
3301 err = security_port_sid(sk->sk_family, sk->sk_type,
3302 sk->sk_protocol, ntohs(ad.u.net.sport),
3307 err = avc_has_perm(sock_sid, port_sid,
3308 sock_class, recv_perm, &ad);
3312 err = selinux_xfrm_sock_rcv_skb(sock_sid, skb);
3318 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
3319 int __user *optlen, unsigned len)
3324 struct sk_security_struct *ssec;
3325 struct inode_security_struct *isec;
3328 isec = SOCK_INODE(sock)->i_security;
3330 /* if UNIX_STREAM check peer_sid, if TCP check dst for labelled sa */
3331 if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET) {
3332 ssec = sock->sk->sk_security;
3333 peer_sid = ssec->peer_sid;
3335 else if (isec->sclass == SECCLASS_TCP_SOCKET) {
3336 peer_sid = selinux_socket_getpeer_stream(sock->sk);
3338 if (peer_sid == SECSID_NULL) {
3348 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
3353 if (scontext_len > len) {
3358 if (copy_to_user(optval, scontext, scontext_len))
3362 if (put_user(scontext_len, optlen))
3370 static int selinux_socket_getpeersec_dgram(struct sk_buff *skb, char **secdata, u32 *seclen)
3373 u32 peer_sid = selinux_socket_getpeer_dgram(skb);
3375 if (peer_sid == SECSID_NULL)
3378 err = security_sid_to_context(peer_sid, secdata, seclen);
3387 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
3389 return sk_alloc_security(sk, family, priority);
3392 static void selinux_sk_free_security(struct sock *sk)
3394 sk_free_security(sk);
3397 static unsigned int selinux_sk_getsid_security(struct sock *sk, struct flowi *fl, u8 dir)
3399 struct inode_security_struct *isec;
3400 u32 sock_sid = SECINITSID_ANY_SOCKET;
3403 return selinux_no_sk_sid(fl);
3405 read_lock_bh(&sk->sk_callback_lock);
3406 isec = get_sock_isec(sk);
3409 sock_sid = isec->sid;
3411 read_unlock_bh(&sk->sk_callback_lock);
3415 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3419 struct nlmsghdr *nlh;
3420 struct socket *sock = sk->sk_socket;
3421 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3423 if (skb->len < NLMSG_SPACE(0)) {
3427 nlh = (struct nlmsghdr *)skb->data;
3429 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3431 if (err == -EINVAL) {
3432 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
3433 "SELinux: unrecognized netlink message"
3434 " type=%hu for sclass=%hu\n",
3435 nlh->nlmsg_type, isec->sclass);
3436 if (!selinux_enforcing)
3446 err = socket_has_perm(current, sock, perm);
3451 #ifdef CONFIG_NETFILTER
3453 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3454 struct sk_buff **pskb,
3455 const struct net_device *in,
3456 const struct net_device *out,
3457 int (*okfn)(struct sk_buff *),
3461 int len, err = NF_ACCEPT;
3462 u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
3464 struct socket *sock;
3465 struct inode *inode;
3466 struct sk_buff *skb = *pskb;
3467 struct inode_security_struct *isec;
3468 struct avc_audit_data ad;
3469 struct net_device *dev = (struct net_device *)out;
3475 sock = sk->sk_socket;
3479 inode = SOCK_INODE(sock);
3483 err = sel_netif_sids(dev, &if_sid, NULL);
3487 isec = inode->i_security;
3489 switch (isec->sclass) {
3490 case SECCLASS_UDP_SOCKET:
3491 netif_perm = NETIF__UDP_SEND;
3492 node_perm = NODE__UDP_SEND;
3493 send_perm = UDP_SOCKET__SEND_MSG;
3496 case SECCLASS_TCP_SOCKET:
3497 netif_perm = NETIF__TCP_SEND;
3498 node_perm = NODE__TCP_SEND;
3499 send_perm = TCP_SOCKET__SEND_MSG;
3503 netif_perm = NETIF__RAWIP_SEND;
3504 node_perm = NODE__RAWIP_SEND;
3509 AVC_AUDIT_DATA_INIT(&ad, NET);
3510 ad.u.net.netif = dev->name;
3511 ad.u.net.family = family;
3513 err = selinux_parse_skb(skb, &ad, &addrp,
3514 &len, 0) ? NF_DROP : NF_ACCEPT;
3515 if (err != NF_ACCEPT)
3518 err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF,
3519 netif_perm, &ad) ? NF_DROP : NF_ACCEPT;
3520 if (err != NF_ACCEPT)
3523 /* Fixme: this lookup is inefficient */
3524 err = security_node_sid(family, addrp, len,
3525 &node_sid) ? NF_DROP : NF_ACCEPT;
3526 if (err != NF_ACCEPT)
3529 err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE,
3530 node_perm, &ad) ? NF_DROP : NF_ACCEPT;
3531 if (err != NF_ACCEPT)
3537 /* Fixme: make this more efficient */
3538 err = security_port_sid(sk->sk_family,
3541 ntohs(ad.u.net.dport),
3542 &port_sid) ? NF_DROP : NF_ACCEPT;
3543 if (err != NF_ACCEPT)
3546 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3547 send_perm, &ad) ? NF_DROP : NF_ACCEPT;
3550 if (err != NF_ACCEPT)
3553 err = selinux_xfrm_postroute_last(isec->sid, skb);
3559 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3560 struct sk_buff **pskb,
3561 const struct net_device *in,
3562 const struct net_device *out,
3563 int (*okfn)(struct sk_buff *))
3565 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3568 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3570 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3571 struct sk_buff **pskb,
3572 const struct net_device *in,
3573 const struct net_device *out,
3574 int (*okfn)(struct sk_buff *))
3576 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3581 #endif /* CONFIG_NETFILTER */
3583 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3585 struct task_security_struct *tsec;
3586 struct av_decision avd;
3589 err = secondary_ops->netlink_send(sk, skb);
3593 tsec = current->security;
3596 avc_has_perm_noaudit(tsec->sid, tsec->sid,
3597 SECCLASS_CAPABILITY, ~0, &avd);
3598 cap_mask(NETLINK_CB(skb).eff_cap, avd.allowed);
3600 if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
3601 err = selinux_nlmsg_perm(sk, skb);
3606 static int selinux_netlink_recv(struct sk_buff *skb)
3608 if (!cap_raised(NETLINK_CB(skb).eff_cap, CAP_NET_ADMIN))
3613 static int ipc_alloc_security(struct task_struct *task,
3614 struct kern_ipc_perm *perm,
3617 struct task_security_struct *tsec = task->security;
3618 struct ipc_security_struct *isec;
3620 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
3624 isec->sclass = sclass;
3625 isec->ipc_perm = perm;
3626 isec->sid = tsec->sid;
3627 perm->security = isec;
3632 static void ipc_free_security(struct kern_ipc_perm *perm)
3634 struct ipc_security_struct *isec = perm->security;
3635 perm->security = NULL;
3639 static int msg_msg_alloc_security(struct msg_msg *msg)
3641 struct msg_security_struct *msec;
3643 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
3648 msec->sid = SECINITSID_UNLABELED;
3649 msg->security = msec;
3654 static void msg_msg_free_security(struct msg_msg *msg)
3656 struct msg_security_struct *msec = msg->security;
3658 msg->security = NULL;
3662 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
3665 struct task_security_struct *tsec;
3666 struct ipc_security_struct *isec;
3667 struct avc_audit_data ad;
3669 tsec = current->security;
3670 isec = ipc_perms->security;
3672 AVC_AUDIT_DATA_INIT(&ad, IPC);
3673 ad.u.ipc_id = ipc_perms->key;
3675 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3678 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
3680 return msg_msg_alloc_security(msg);
3683 static void selinux_msg_msg_free_security(struct msg_msg *msg)
3685 msg_msg_free_security(msg);
3688 /* message queue security operations */
3689 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
3691 struct task_security_struct *tsec;
3692 struct ipc_security_struct *isec;
3693 struct avc_audit_data ad;
3696 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
3700 tsec = current->security;
3701 isec = msq->q_perm.security;
3703 AVC_AUDIT_DATA_INIT(&ad, IPC);
3704 ad.u.ipc_id = msq->q_perm.key;
3706 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3709 ipc_free_security(&msq->q_perm);
3715 static void selinux_msg_queue_free_security(struct msg_queue *msq)
3717 ipc_free_security(&msq->q_perm);
3720 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
3722 struct task_security_struct *tsec;
3723 struct ipc_security_struct *isec;
3724 struct avc_audit_data ad;
3726 tsec = current->security;
3727 isec = msq->q_perm.security;
3729 AVC_AUDIT_DATA_INIT(&ad, IPC);
3730 ad.u.ipc_id = msq->q_perm.key;
3732 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3733 MSGQ__ASSOCIATE, &ad);
3736 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
3744 /* No specific object, just general system-wide information. */
3745 return task_has_system(current, SYSTEM__IPC_INFO);
3748 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
3751 perms = MSGQ__SETATTR;
3754 perms = MSGQ__DESTROY;
3760 err = ipc_has_perm(&msq->q_perm, perms);
3764 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
3766 struct task_security_struct *tsec;
3767 struct ipc_security_struct *isec;
3768 struct msg_security_struct *msec;
3769 struct avc_audit_data ad;
3772 tsec = current->security;
3773 isec = msq->q_perm.security;
3774 msec = msg->security;
3777 * First time through, need to assign label to the message
3779 if (msec->sid == SECINITSID_UNLABELED) {
3781 * Compute new sid based on current process and
3782 * message queue this message will be stored in
3784 rc = security_transition_sid(tsec->sid,
3792 AVC_AUDIT_DATA_INIT(&ad, IPC);
3793 ad.u.ipc_id = msq->q_perm.key;
3795 /* Can this process write to the queue? */
3796 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3799 /* Can this process send the message */
3800 rc = avc_has_perm(tsec->sid, msec->sid,
3801 SECCLASS_MSG, MSG__SEND, &ad);
3803 /* Can the message be put in the queue? */
3804 rc = avc_has_perm(msec->sid, isec->sid,
3805 SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
3810 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
3811 struct task_struct *target,
3812 long type, int mode)
3814 struct task_security_struct *tsec;
3815 struct ipc_security_struct *isec;
3816 struct msg_security_struct *msec;
3817 struct avc_audit_data ad;
3820 tsec = target->security;
3821 isec = msq->q_perm.security;
3822 msec = msg->security;
3824 AVC_AUDIT_DATA_INIT(&ad, IPC);
3825 ad.u.ipc_id = msq->q_perm.key;
3827 rc = avc_has_perm(tsec->sid, isec->sid,
3828 SECCLASS_MSGQ, MSGQ__READ, &ad);
3830 rc = avc_has_perm(tsec->sid, msec->sid,
3831 SECCLASS_MSG, MSG__RECEIVE, &ad);
3835 /* Shared Memory security operations */
3836 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
3838 struct task_security_struct *tsec;
3839 struct ipc_security_struct *isec;
3840 struct avc_audit_data ad;
3843 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
3847 tsec = current->security;
3848 isec = shp->shm_perm.security;
3850 AVC_AUDIT_DATA_INIT(&ad, IPC);
3851 ad.u.ipc_id = shp->shm_perm.key;
3853 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3856 ipc_free_security(&shp->shm_perm);
3862 static void selinux_shm_free_security(struct shmid_kernel *shp)
3864 ipc_free_security(&shp->shm_perm);
3867 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
3869 struct task_security_struct *tsec;
3870 struct ipc_security_struct *isec;
3871 struct avc_audit_data ad;
3873 tsec = current->security;
3874 isec = shp->shm_perm.security;
3876 AVC_AUDIT_DATA_INIT(&ad, IPC);
3877 ad.u.ipc_id = shp->shm_perm.key;
3879 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3880 SHM__ASSOCIATE, &ad);
3883 /* Note, at this point, shp is locked down */
3884 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
3892 /* No specific object, just general system-wide information. */
3893 return task_has_system(current, SYSTEM__IPC_INFO);
3896 perms = SHM__GETATTR | SHM__ASSOCIATE;
3899 perms = SHM__SETATTR;
3906 perms = SHM__DESTROY;
3912 err = ipc_has_perm(&shp->shm_perm, perms);
3916 static int selinux_shm_shmat(struct shmid_kernel *shp,
3917 char __user *shmaddr, int shmflg)
3922 rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
3926 if (shmflg & SHM_RDONLY)
3929 perms = SHM__READ | SHM__WRITE;
3931 return ipc_has_perm(&shp->shm_perm, perms);
3934 /* Semaphore security operations */
3935 static int selinux_sem_alloc_security(struct sem_array *sma)
3937 struct task_security_struct *tsec;
3938 struct ipc_security_struct *isec;
3939 struct avc_audit_data ad;
3942 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
3946 tsec = current->security;
3947 isec = sma->sem_perm.security;
3949 AVC_AUDIT_DATA_INIT(&ad, IPC);
3950 ad.u.ipc_id = sma->sem_perm.key;
3952 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
3955 ipc_free_security(&sma->sem_perm);
3961 static void selinux_sem_free_security(struct sem_array *sma)
3963 ipc_free_security(&sma->sem_perm);
3966 static int selinux_sem_associate(struct sem_array *sma, int semflg)
3968 struct task_security_struct *tsec;
3969 struct ipc_security_struct *isec;
3970 struct avc_audit_data ad;
3972 tsec = current->security;
3973 isec = sma->sem_perm.security;
3975 AVC_AUDIT_DATA_INIT(&ad, IPC);
3976 ad.u.ipc_id = sma->sem_perm.key;
3978 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
3979 SEM__ASSOCIATE, &ad);
3982 /* Note, at this point, sma is locked down */
3983 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
3991 /* No specific object, just general system-wide information. */
3992 return task_has_system(current, SYSTEM__IPC_INFO);
3996 perms = SEM__GETATTR;
4007 perms = SEM__DESTROY;
4010 perms = SEM__SETATTR;
4014 perms = SEM__GETATTR | SEM__ASSOCIATE;
4020 err = ipc_has_perm(&sma->sem_perm, perms);
4024 static int selinux_sem_semop(struct sem_array *sma,
4025 struct sembuf *sops, unsigned nsops, int alter)
4030 perms = SEM__READ | SEM__WRITE;
4034 return ipc_has_perm(&sma->sem_perm, perms);
4037 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4043 av |= IPC__UNIX_READ;
4045 av |= IPC__UNIX_WRITE;
4050 return ipc_has_perm(ipcp, av);
4053 /* module stacking operations */
4054 static int selinux_register_security (const char *name, struct security_operations *ops)
4056 if (secondary_ops != original_ops) {
4057 printk(KERN_INFO "%s: There is already a secondary security "
4058 "module registered.\n", __FUNCTION__);
4062 secondary_ops = ops;
4064 printk(KERN_INFO "%s: Registering secondary module %s\n",
4071 static int selinux_unregister_security (const char *name, struct security_operations *ops)
4073 if (ops != secondary_ops) {
4074 printk (KERN_INFO "%s: trying to unregister a security module "
4075 "that is not registered.\n", __FUNCTION__);
4079 secondary_ops = original_ops;
4084 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4087 inode_doinit_with_dentry(inode, dentry);
4090 static int selinux_getprocattr(struct task_struct *p,
4091 char *name, void *value, size_t size)
4093 struct task_security_struct *tsec;
4098 error = task_has_perm(current, p, PROCESS__GETATTR);
4105 if (!strcmp(name, "current"))
4107 else if (!strcmp(name, "prev"))
4109 else if (!strcmp(name, "exec"))
4110 sid = tsec->exec_sid;
4111 else if (!strcmp(name, "fscreate"))
4112 sid = tsec->create_sid;
4119 return selinux_getsecurity(sid, value, size);
4122 static int selinux_setprocattr(struct task_struct *p,
4123 char *name, void *value, size_t size)
4125 struct task_security_struct *tsec;
4131 /* SELinux only allows a process to change its own
4132 security attributes. */
4137 * Basic control over ability to set these attributes at all.
4138 * current == p, but we'll pass them separately in case the
4139 * above restriction is ever removed.
4141 if (!strcmp(name, "exec"))
4142 error = task_has_perm(current, p, PROCESS__SETEXEC);
4143 else if (!strcmp(name, "fscreate"))
4144 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4145 else if (!strcmp(name, "current"))
4146 error = task_has_perm(current, p, PROCESS__SETCURRENT);
4152 /* Obtain a SID for the context, if one was specified. */
4153 if (size && str[1] && str[1] != '\n') {
4154 if (str[size-1] == '\n') {
4158 error = security_context_to_sid(value, size, &sid);
4163 /* Permission checking based on the specified context is
4164 performed during the actual operation (execve,
4165 open/mkdir/...), when we know the full context of the
4166 operation. See selinux_bprm_set_security for the execve
4167 checks and may_create for the file creation checks. The
4168 operation will then fail if the context is not permitted. */
4170 if (!strcmp(name, "exec"))
4171 tsec->exec_sid = sid;
4172 else if (!strcmp(name, "fscreate"))
4173 tsec->create_sid = sid;
4174 else if (!strcmp(name, "current")) {
4175 struct av_decision avd;
4180 /* Only allow single threaded processes to change context */
4181 if (atomic_read(&p->mm->mm_users) != 1) {
4182 struct task_struct *g, *t;
4183 struct mm_struct *mm = p->mm;
4184 read_lock(&tasklist_lock);
4185 do_each_thread(g, t)
4186 if (t->mm == mm && t != p) {
4187 read_unlock(&tasklist_lock);
4190 while_each_thread(g, t);
4191 read_unlock(&tasklist_lock);
4194 /* Check permissions for the transition. */
4195 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
4196 PROCESS__DYNTRANSITION, NULL);
4200 /* Check for ptracing, and update the task SID if ok.
4201 Otherwise, leave SID unchanged and fail. */
4203 if (p->ptrace & PT_PTRACED) {
4204 error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
4206 PROCESS__PTRACE, &avd);
4210 avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
4211 PROCESS__PTRACE, &avd, error, NULL);
4225 static struct security_operations selinux_ops = {
4226 .ptrace = selinux_ptrace,
4227 .capget = selinux_capget,
4228 .capset_check = selinux_capset_check,
4229 .capset_set = selinux_capset_set,
4230 .sysctl = selinux_sysctl,
4231 .capable = selinux_capable,
4232 .quotactl = selinux_quotactl,
4233 .quota_on = selinux_quota_on,
4234 .syslog = selinux_syslog,
4235 .vm_enough_memory = selinux_vm_enough_memory,
4237 .netlink_send = selinux_netlink_send,
4238 .netlink_recv = selinux_netlink_recv,
4240 .bprm_alloc_security = selinux_bprm_alloc_security,
4241 .bprm_free_security = selinux_bprm_free_security,
4242 .bprm_apply_creds = selinux_bprm_apply_creds,
4243 .bprm_post_apply_creds = selinux_bprm_post_apply_creds,
4244 .bprm_set_security = selinux_bprm_set_security,
4245 .bprm_check_security = selinux_bprm_check_security,
4246 .bprm_secureexec = selinux_bprm_secureexec,
4248 .sb_alloc_security = selinux_sb_alloc_security,
4249 .sb_free_security = selinux_sb_free_security,
4250 .sb_copy_data = selinux_sb_copy_data,
4251 .sb_kern_mount = selinux_sb_kern_mount,
4252 .sb_statfs = selinux_sb_statfs,
4253 .sb_mount = selinux_mount,
4254 .sb_umount = selinux_umount,
4256 .inode_alloc_security = selinux_inode_alloc_security,
4257 .inode_free_security = selinux_inode_free_security,
4258 .inode_init_security = selinux_inode_init_security,
4259 .inode_create = selinux_inode_create,
4260 .inode_link = selinux_inode_link,
4261 .inode_unlink = selinux_inode_unlink,
4262 .inode_symlink = selinux_inode_symlink,
4263 .inode_mkdir = selinux_inode_mkdir,
4264 .inode_rmdir = selinux_inode_rmdir,
4265 .inode_mknod = selinux_inode_mknod,
4266 .inode_rename = selinux_inode_rename,
4267 .inode_readlink = selinux_inode_readlink,
4268 .inode_follow_link = selinux_inode_follow_link,
4269 .inode_permission = selinux_inode_permission,
4270 .inode_setattr = selinux_inode_setattr,
4271 .inode_getattr = selinux_inode_getattr,
4272 .inode_setxattr = selinux_inode_setxattr,
4273 .inode_post_setxattr = selinux_inode_post_setxattr,
4274 .inode_getxattr = selinux_inode_getxattr,
4275 .inode_listxattr = selinux_inode_listxattr,
4276 .inode_removexattr = selinux_inode_removexattr,
4277 .inode_xattr_getsuffix = selinux_inode_xattr_getsuffix,
4278 .inode_getsecurity = selinux_inode_getsecurity,
4279 .inode_setsecurity = selinux_inode_setsecurity,
4280 .inode_listsecurity = selinux_inode_listsecurity,
4282 .file_permission = selinux_file_permission,
4283 .file_alloc_security = selinux_file_alloc_security,
4284 .file_free_security = selinux_file_free_security,
4285 .file_ioctl = selinux_file_ioctl,
4286 .file_mmap = selinux_file_mmap,
4287 .file_mprotect = selinux_file_mprotect,
4288 .file_lock = selinux_file_lock,
4289 .file_fcntl = selinux_file_fcntl,
4290 .file_set_fowner = selinux_file_set_fowner,
4291 .file_send_sigiotask = selinux_file_send_sigiotask,
4292 .file_receive = selinux_file_receive,
4294 .task_create = selinux_task_create,
4295 .task_alloc_security = selinux_task_alloc_security,
4296 .task_free_security = selinux_task_free_security,
4297 .task_setuid = selinux_task_setuid,
4298 .task_post_setuid = selinux_task_post_setuid,
4299 .task_setgid = selinux_task_setgid,
4300 .task_setpgid = selinux_task_setpgid,
4301 .task_getpgid = selinux_task_getpgid,
4302 .task_getsid = selinux_task_getsid,
4303 .task_setgroups = selinux_task_setgroups,
4304 .task_setnice = selinux_task_setnice,
4305 .task_setrlimit = selinux_task_setrlimit,
4306 .task_setscheduler = selinux_task_setscheduler,
4307 .task_getscheduler = selinux_task_getscheduler,
4308 .task_kill = selinux_task_kill,
4309 .task_wait = selinux_task_wait,
4310 .task_prctl = selinux_task_prctl,
4311 .task_reparent_to_init = selinux_task_reparent_to_init,
4312 .task_to_inode = selinux_task_to_inode,
4314 .ipc_permission = selinux_ipc_permission,
4316 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
4317 .msg_msg_free_security = selinux_msg_msg_free_security,
4319 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
4320 .msg_queue_free_security = selinux_msg_queue_free_security,
4321 .msg_queue_associate = selinux_msg_queue_associate,
4322 .msg_queue_msgctl = selinux_msg_queue_msgctl,
4323 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
4324 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
4326 .shm_alloc_security = selinux_shm_alloc_security,
4327 .shm_free_security = selinux_shm_free_security,
4328 .shm_associate = selinux_shm_associate,
4329 .shm_shmctl = selinux_shm_shmctl,
4330 .shm_shmat = selinux_shm_shmat,
4332 .sem_alloc_security = selinux_sem_alloc_security,
4333 .sem_free_security = selinux_sem_free_security,
4334 .sem_associate = selinux_sem_associate,
4335 .sem_semctl = selinux_sem_semctl,
4336 .sem_semop = selinux_sem_semop,
4338 .register_security = selinux_register_security,
4339 .unregister_security = selinux_unregister_security,
4341 .d_instantiate = selinux_d_instantiate,
4343 .getprocattr = selinux_getprocattr,
4344 .setprocattr = selinux_setprocattr,
4346 .unix_stream_connect = selinux_socket_unix_stream_connect,
4347 .unix_may_send = selinux_socket_unix_may_send,
4349 .socket_create = selinux_socket_create,
4350 .socket_post_create = selinux_socket_post_create,
4351 .socket_bind = selinux_socket_bind,
4352 .socket_connect = selinux_socket_connect,
4353 .socket_listen = selinux_socket_listen,
4354 .socket_accept = selinux_socket_accept,
4355 .socket_sendmsg = selinux_socket_sendmsg,
4356 .socket_recvmsg = selinux_socket_recvmsg,
4357 .socket_getsockname = selinux_socket_getsockname,
4358 .socket_getpeername = selinux_socket_getpeername,
4359 .socket_getsockopt = selinux_socket_getsockopt,
4360 .socket_setsockopt = selinux_socket_setsockopt,
4361 .socket_shutdown = selinux_socket_shutdown,
4362 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
4363 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
4364 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
4365 .sk_alloc_security = selinux_sk_alloc_security,
4366 .sk_free_security = selinux_sk_free_security,
4367 .sk_getsid = selinux_sk_getsid_security,
4369 #ifdef CONFIG_SECURITY_NETWORK_XFRM
4370 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
4371 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
4372 .xfrm_policy_free_security = selinux_xfrm_policy_free,
4373 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
4374 .xfrm_state_free_security = selinux_xfrm_state_free,
4375 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
4379 static __init int selinux_init(void)
4381 struct task_security_struct *tsec;
4383 if (!selinux_enabled) {
4384 printk(KERN_INFO "SELinux: Disabled at boot.\n");
4388 printk(KERN_INFO "SELinux: Initializing.\n");
4390 /* Set the security state for the initial task. */
4391 if (task_alloc_security(current))
4392 panic("SELinux: Failed to initialize initial task.\n");
4393 tsec = current->security;
4394 tsec->osid = tsec->sid = SECINITSID_KERNEL;
4396 sel_inode_cache = kmem_cache_create("selinux_inode_security",
4397 sizeof(struct inode_security_struct),
4398 0, SLAB_PANIC, NULL, NULL);
4401 original_ops = secondary_ops = security_ops;
4403 panic ("SELinux: No initial security operations\n");
4404 if (register_security (&selinux_ops))
4405 panic("SELinux: Unable to register with kernel.\n");
4407 if (selinux_enforcing) {
4408 printk(KERN_INFO "SELinux: Starting in enforcing mode\n");
4410 printk(KERN_INFO "SELinux: Starting in permissive mode\n");
4415 void selinux_complete_init(void)
4417 printk(KERN_INFO "SELinux: Completing initialization.\n");
4419 /* Set up any superblocks initialized prior to the policy load. */
4420 printk(KERN_INFO "SELinux: Setting up existing superblocks.\n");
4421 spin_lock(&sb_lock);
4422 spin_lock(&sb_security_lock);
4424 if (!list_empty(&superblock_security_head)) {
4425 struct superblock_security_struct *sbsec =
4426 list_entry(superblock_security_head.next,
4427 struct superblock_security_struct,
4429 struct super_block *sb = sbsec->sb;
4431 spin_unlock(&sb_security_lock);
4432 spin_unlock(&sb_lock);
4433 down_read(&sb->s_umount);
4435 superblock_doinit(sb, NULL);
4437 spin_lock(&sb_lock);
4438 spin_lock(&sb_security_lock);
4439 list_del_init(&sbsec->list);
4442 spin_unlock(&sb_security_lock);
4443 spin_unlock(&sb_lock);
4446 /* SELinux requires early initialization in order to label
4447 all processes and objects when they are created. */
4448 security_initcall(selinux_init);
4450 #if defined(CONFIG_NETFILTER)
4452 static struct nf_hook_ops selinux_ipv4_op = {
4453 .hook = selinux_ipv4_postroute_last,
4454 .owner = THIS_MODULE,
4456 .hooknum = NF_IP_POST_ROUTING,
4457 .priority = NF_IP_PRI_SELINUX_LAST,
4460 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4462 static struct nf_hook_ops selinux_ipv6_op = {
4463 .hook = selinux_ipv6_postroute_last,
4464 .owner = THIS_MODULE,
4466 .hooknum = NF_IP6_POST_ROUTING,
4467 .priority = NF_IP6_PRI_SELINUX_LAST,
4472 static int __init selinux_nf_ip_init(void)
4476 if (!selinux_enabled)
4479 printk(KERN_INFO "SELinux: Registering netfilter hooks\n");
4481 err = nf_register_hook(&selinux_ipv4_op);
4483 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
4485 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4487 err = nf_register_hook(&selinux_ipv6_op);
4489 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
4497 __initcall(selinux_nf_ip_init);
4499 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4500 static void selinux_nf_ip_exit(void)
4502 printk(KERN_INFO "SELinux: Unregistering netfilter hooks\n");
4504 nf_unregister_hook(&selinux_ipv4_op);
4505 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4506 nf_unregister_hook(&selinux_ipv6_op);
4511 #else /* CONFIG_NETFILTER */
4513 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4514 #define selinux_nf_ip_exit()
4517 #endif /* CONFIG_NETFILTER */
4519 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4520 int selinux_disable(void)
4522 extern void exit_sel_fs(void);
4523 static int selinux_disabled = 0;
4525 if (ss_initialized) {
4526 /* Not permitted after initial policy load. */
4530 if (selinux_disabled) {
4531 /* Only do this once. */
4535 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
4537 selinux_disabled = 1;
4538 selinux_enabled = 0;
4540 /* Reset security_ops to the secondary module, dummy or capability. */
4541 security_ops = secondary_ops;
4543 /* Unregister netfilter hooks. */
4544 selinux_nf_ip_exit();
4546 /* Unregister selinuxfs. */