2 * NSA Security-Enhanced Linux (SELinux) security module
4 * This file contains the SELinux hook function implementations.
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License version 2,
18 * as published by the Free Software Foundation.
21 #include <linux/module.h>
22 #include <linux/init.h>
23 #include <linux/kernel.h>
24 #include <linux/tracehook.h>
25 #include <linux/errno.h>
26 #include <linux/sched.h>
27 #include <linux/security.h>
28 #include <linux/xattr.h>
29 #include <linux/capability.h>
30 #include <linux/unistd.h>
32 #include <linux/mman.h>
33 #include <linux/slab.h>
34 #include <linux/pagemap.h>
35 #include <linux/swap.h>
36 #include <linux/smp_lock.h>
37 #include <linux/spinlock.h>
38 #include <linux/syscalls.h>
39 #include <linux/file.h>
40 #include <linux/namei.h>
41 #include <linux/mount.h>
42 #include <linux/ext2_fs.h>
43 #include <linux/proc_fs.h>
45 #include <linux/netfilter_ipv4.h>
46 #include <linux/netfilter_ipv6.h>
47 #include <linux/tty.h>
49 #include <net/ip.h> /* for sysctl_local_port_range[] */
50 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
51 #include <asm/uaccess.h>
52 #include <asm/semaphore.h>
53 #include <asm/ioctls.h>
54 #include <linux/bitops.h>
55 #include <linux/interrupt.h>
56 #include <linux/netdevice.h> /* for network interface checks */
57 #include <linux/netlink.h>
58 #include <linux/tcp.h>
59 #include <linux/udp.h>
60 #include <linux/quota.h>
61 #include <linux/un.h> /* for Unix socket types */
62 #include <net/af_unix.h> /* for Unix socket types */
63 #include <linux/parser.h>
64 #include <linux/nfs_mount.h>
66 #include <linux/hugetlb.h>
67 #include <linux/personality.h>
68 #include <linux/sysctl.h>
69 #include <linux/audit.h>
70 #include <linux/string.h>
71 #include <linux/selinux.h>
78 #define XATTR_SELINUX_SUFFIX "selinux"
79 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
81 extern unsigned int policydb_loaded_version;
82 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
83 extern int selinux_compat_net;
85 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
86 int selinux_enforcing = 0;
88 static int __init enforcing_setup(char *str)
90 selinux_enforcing = simple_strtol(str,NULL,0);
93 __setup("enforcing=", enforcing_setup);
96 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
97 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
99 static int __init selinux_enabled_setup(char *str)
101 selinux_enabled = simple_strtol(str, NULL, 0);
104 __setup("selinux=", selinux_enabled_setup);
106 int selinux_enabled = 1;
109 /* Original (dummy) security module. */
110 static struct security_operations *original_ops = NULL;
112 /* Minimal support for a secondary security module,
113 just to allow the use of the dummy or capability modules.
114 The owlsm module can alternatively be used as a secondary
115 module as long as CONFIG_OWLSM_FD is not enabled. */
116 static struct security_operations *secondary_ops = NULL;
118 /* Lists of inode and superblock security structures initialized
119 before the policy was loaded. */
120 static LIST_HEAD(superblock_security_head);
121 static DEFINE_SPINLOCK(sb_security_lock);
123 static kmem_cache_t *sel_inode_cache;
125 /* Return security context for a given sid or just the context
126 length if the buffer is null or length is 0 */
127 static int selinux_getsecurity(u32 sid, void *buffer, size_t size)
133 rc = security_sid_to_context(sid, &context, &len);
137 if (!buffer || !size)
138 goto getsecurity_exit;
142 goto getsecurity_exit;
144 memcpy(buffer, context, len);
151 /* Allocate and free functions for each kind of security blob. */
153 static int task_alloc_security(struct task_struct *task)
155 struct task_security_struct *tsec;
157 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
162 tsec->osid = tsec->sid = SECINITSID_UNLABELED;
163 task->security = tsec;
168 static void task_free_security(struct task_struct *task)
170 struct task_security_struct *tsec = task->security;
171 task->security = NULL;
175 static int inode_alloc_security(struct inode *inode)
177 struct task_security_struct *tsec = current->security;
178 struct inode_security_struct *isec;
180 isec = kmem_cache_alloc(sel_inode_cache, SLAB_KERNEL);
184 memset(isec, 0, sizeof(*isec));
185 init_MUTEX(&isec->sem);
186 INIT_LIST_HEAD(&isec->list);
188 isec->sid = SECINITSID_UNLABELED;
189 isec->sclass = SECCLASS_FILE;
190 isec->task_sid = tsec->sid;
191 inode->i_security = isec;
196 static void inode_free_security(struct inode *inode)
198 struct inode_security_struct *isec = inode->i_security;
199 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
201 spin_lock(&sbsec->isec_lock);
202 if (!list_empty(&isec->list))
203 list_del_init(&isec->list);
204 spin_unlock(&sbsec->isec_lock);
206 inode->i_security = NULL;
207 kmem_cache_free(sel_inode_cache, isec);
210 static int file_alloc_security(struct file *file)
212 struct task_security_struct *tsec = current->security;
213 struct file_security_struct *fsec;
215 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
220 fsec->sid = tsec->sid;
221 fsec->fown_sid = tsec->sid;
222 file->f_security = fsec;
227 static void file_free_security(struct file *file)
229 struct file_security_struct *fsec = file->f_security;
230 file->f_security = NULL;
234 static int superblock_alloc_security(struct super_block *sb)
236 struct superblock_security_struct *sbsec;
238 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
242 init_MUTEX(&sbsec->sem);
243 INIT_LIST_HEAD(&sbsec->list);
244 INIT_LIST_HEAD(&sbsec->isec_head);
245 spin_lock_init(&sbsec->isec_lock);
247 sbsec->sid = SECINITSID_UNLABELED;
248 sbsec->def_sid = SECINITSID_FILE;
249 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
250 sb->s_security = sbsec;
255 static void superblock_free_security(struct super_block *sb)
257 struct superblock_security_struct *sbsec = sb->s_security;
259 spin_lock(&sb_security_lock);
260 if (!list_empty(&sbsec->list))
261 list_del_init(&sbsec->list);
262 spin_unlock(&sb_security_lock);
264 sb->s_security = NULL;
268 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
270 struct sk_security_struct *ssec;
272 if (family != PF_UNIX)
275 ssec = kzalloc(sizeof(*ssec), priority);
280 ssec->peer_sid = SECINITSID_UNLABELED;
281 sk->sk_security = ssec;
286 static void sk_free_security(struct sock *sk)
288 struct sk_security_struct *ssec = sk->sk_security;
290 if (sk->sk_family != PF_UNIX)
293 sk->sk_security = NULL;
297 /* The security server must be initialized before
298 any labeling or access decisions can be provided. */
299 extern int ss_initialized;
301 /* The file system's label must be initialized prior to use. */
303 static char *labeling_behaviors[6] = {
305 "uses transition SIDs",
307 "uses genfs_contexts",
308 "not configured for labeling",
309 "uses mountpoint labeling",
312 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
314 static inline int inode_doinit(struct inode *inode)
316 return inode_doinit_with_dentry(inode, NULL);
326 static match_table_t tokens = {
327 {Opt_context, "context=%s"},
328 {Opt_fscontext, "fscontext=%s"},
329 {Opt_defcontext, "defcontext=%s"},
330 {Opt_rootcontext, "rootcontext=%s"},
333 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
335 static int may_context_mount_sb_relabel(u32 sid,
336 struct superblock_security_struct *sbsec,
337 struct task_security_struct *tsec)
341 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
342 FILESYSTEM__RELABELFROM, NULL);
346 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
347 FILESYSTEM__RELABELTO, NULL);
351 static int may_context_mount_inode_relabel(u32 sid,
352 struct superblock_security_struct *sbsec,
353 struct task_security_struct *tsec)
356 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
357 FILESYSTEM__RELABELFROM, NULL);
361 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
362 FILESYSTEM__ASSOCIATE, NULL);
366 static int try_context_mount(struct super_block *sb, void *data)
368 char *context = NULL, *defcontext = NULL;
369 char *fscontext = NULL, *rootcontext = NULL;
372 int alloc = 0, rc = 0, seen = 0;
373 struct task_security_struct *tsec = current->security;
374 struct superblock_security_struct *sbsec = sb->s_security;
379 name = sb->s_type->name;
381 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
383 /* NFS we understand. */
384 if (!strcmp(name, "nfs")) {
385 struct nfs_mount_data *d = data;
387 if (d->version < NFS_MOUNT_VERSION)
391 context = d->context;
398 /* Standard string-based options. */
399 char *p, *options = data;
401 while ((p = strsep(&options, ",")) != NULL) {
403 substring_t args[MAX_OPT_ARGS];
408 token = match_token(p, tokens, args);
412 if (seen & (Opt_context|Opt_defcontext)) {
414 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
417 context = match_strdup(&args[0]);
428 if (seen & Opt_fscontext) {
430 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
433 fscontext = match_strdup(&args[0]);
440 seen |= Opt_fscontext;
443 case Opt_rootcontext:
444 if (seen & Opt_rootcontext) {
446 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
449 rootcontext = match_strdup(&args[0]);
456 seen |= Opt_rootcontext;
460 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
462 printk(KERN_WARNING "SELinux: "
463 "defcontext option is invalid "
464 "for this filesystem type\n");
467 if (seen & (Opt_context|Opt_defcontext)) {
469 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
472 defcontext = match_strdup(&args[0]);
479 seen |= Opt_defcontext;
484 printk(KERN_WARNING "SELinux: unknown mount "
495 /* sets the context of the superblock for the fs being mounted. */
497 rc = security_context_to_sid(fscontext, strlen(fscontext), &sid);
499 printk(KERN_WARNING "SELinux: security_context_to_sid"
500 "(%s) failed for (dev %s, type %s) errno=%d\n",
501 fscontext, sb->s_id, name, rc);
505 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
513 * Switch to using mount point labeling behavior.
514 * sets the label used on all file below the mountpoint, and will set
515 * the superblock context if not already set.
518 rc = security_context_to_sid(context, strlen(context), &sid);
520 printk(KERN_WARNING "SELinux: security_context_to_sid"
521 "(%s) failed for (dev %s, type %s) errno=%d\n",
522 context, sb->s_id, name, rc);
527 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
532 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
536 sbsec->mntpoint_sid = sid;
538 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
542 struct inode *inode = sb->s_root->d_inode;
543 struct inode_security_struct *isec = inode->i_security;
544 rc = security_context_to_sid(rootcontext, strlen(rootcontext), &sid);
546 printk(KERN_WARNING "SELinux: security_context_to_sid"
547 "(%s) failed for (dev %s, type %s) errno=%d\n",
548 rootcontext, sb->s_id, name, rc);
552 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
557 isec->initialized = 1;
561 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
563 printk(KERN_WARNING "SELinux: security_context_to_sid"
564 "(%s) failed for (dev %s, type %s) errno=%d\n",
565 defcontext, sb->s_id, name, rc);
569 if (sid == sbsec->def_sid)
572 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
576 sbsec->def_sid = sid;
590 static int superblock_doinit(struct super_block *sb, void *data)
592 struct superblock_security_struct *sbsec = sb->s_security;
593 struct dentry *root = sb->s_root;
594 struct inode *inode = root->d_inode;
598 if (sbsec->initialized)
601 if (!ss_initialized) {
602 /* Defer initialization until selinux_complete_init,
603 after the initial policy is loaded and the security
604 server is ready to handle calls. */
605 spin_lock(&sb_security_lock);
606 if (list_empty(&sbsec->list))
607 list_add(&sbsec->list, &superblock_security_head);
608 spin_unlock(&sb_security_lock);
612 /* Determine the labeling behavior to use for this filesystem type. */
613 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
615 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
616 __FUNCTION__, sb->s_type->name, rc);
620 rc = try_context_mount(sb, data);
624 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
625 /* Make sure that the xattr handler exists and that no
626 error other than -ENODATA is returned by getxattr on
627 the root directory. -ENODATA is ok, as this may be
628 the first boot of the SELinux kernel before we have
629 assigned xattr values to the filesystem. */
630 if (!inode->i_op->getxattr) {
631 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
632 "xattr support\n", sb->s_id, sb->s_type->name);
636 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
637 if (rc < 0 && rc != -ENODATA) {
638 if (rc == -EOPNOTSUPP)
639 printk(KERN_WARNING "SELinux: (dev %s, type "
640 "%s) has no security xattr handler\n",
641 sb->s_id, sb->s_type->name);
643 printk(KERN_WARNING "SELinux: (dev %s, type "
644 "%s) getxattr errno %d\n", sb->s_id,
645 sb->s_type->name, -rc);
650 if (strcmp(sb->s_type->name, "proc") == 0)
653 sbsec->initialized = 1;
655 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
656 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
657 sb->s_id, sb->s_type->name);
660 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
661 sb->s_id, sb->s_type->name,
662 labeling_behaviors[sbsec->behavior-1]);
665 /* Initialize the root inode. */
666 rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
668 /* Initialize any other inodes associated with the superblock, e.g.
669 inodes created prior to initial policy load or inodes created
670 during get_sb by a pseudo filesystem that directly
672 spin_lock(&sbsec->isec_lock);
674 if (!list_empty(&sbsec->isec_head)) {
675 struct inode_security_struct *isec =
676 list_entry(sbsec->isec_head.next,
677 struct inode_security_struct, list);
678 struct inode *inode = isec->inode;
679 spin_unlock(&sbsec->isec_lock);
680 inode = igrab(inode);
682 if (!IS_PRIVATE (inode))
686 spin_lock(&sbsec->isec_lock);
687 list_del_init(&isec->list);
690 spin_unlock(&sbsec->isec_lock);
696 static inline u16 inode_mode_to_security_class(umode_t mode)
698 switch (mode & S_IFMT) {
700 return SECCLASS_SOCK_FILE;
702 return SECCLASS_LNK_FILE;
704 return SECCLASS_FILE;
706 return SECCLASS_BLK_FILE;
710 return SECCLASS_CHR_FILE;
712 return SECCLASS_FIFO_FILE;
716 return SECCLASS_FILE;
719 static inline int default_protocol_stream(int protocol)
721 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
724 static inline int default_protocol_dgram(int protocol)
726 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
729 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
736 return SECCLASS_UNIX_STREAM_SOCKET;
738 return SECCLASS_UNIX_DGRAM_SOCKET;
745 if (default_protocol_stream(protocol))
746 return SECCLASS_TCP_SOCKET;
748 return SECCLASS_RAWIP_SOCKET;
750 if (default_protocol_dgram(protocol))
751 return SECCLASS_UDP_SOCKET;
753 return SECCLASS_RAWIP_SOCKET;
755 return SECCLASS_RAWIP_SOCKET;
761 return SECCLASS_NETLINK_ROUTE_SOCKET;
762 case NETLINK_FIREWALL:
763 return SECCLASS_NETLINK_FIREWALL_SOCKET;
764 case NETLINK_INET_DIAG:
765 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
767 return SECCLASS_NETLINK_NFLOG_SOCKET;
769 return SECCLASS_NETLINK_XFRM_SOCKET;
770 case NETLINK_SELINUX:
771 return SECCLASS_NETLINK_SELINUX_SOCKET;
773 return SECCLASS_NETLINK_AUDIT_SOCKET;
775 return SECCLASS_NETLINK_IP6FW_SOCKET;
776 case NETLINK_DNRTMSG:
777 return SECCLASS_NETLINK_DNRT_SOCKET;
778 case NETLINK_KOBJECT_UEVENT:
779 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
781 return SECCLASS_NETLINK_SOCKET;
784 return SECCLASS_PACKET_SOCKET;
786 return SECCLASS_KEY_SOCKET;
788 return SECCLASS_APPLETALK_SOCKET;
791 return SECCLASS_SOCKET;
794 #ifdef CONFIG_PROC_FS
795 static int selinux_proc_get_sid(struct proc_dir_entry *de,
800 char *buffer, *path, *end;
802 buffer = (char*)__get_free_page(GFP_KERNEL);
812 while (de && de != de->parent) {
813 buflen -= de->namelen + 1;
817 memcpy(end, de->name, de->namelen);
822 rc = security_genfs_sid("proc", path, tclass, sid);
823 free_page((unsigned long)buffer);
827 static int selinux_proc_get_sid(struct proc_dir_entry *de,
835 /* The inode's security attributes must be initialized before first use. */
836 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
838 struct superblock_security_struct *sbsec = NULL;
839 struct inode_security_struct *isec = inode->i_security;
841 struct dentry *dentry;
842 #define INITCONTEXTLEN 255
843 char *context = NULL;
848 if (isec->initialized)
853 if (isec->initialized)
856 sbsec = inode->i_sb->s_security;
857 if (!sbsec->initialized) {
858 /* Defer initialization until selinux_complete_init,
859 after the initial policy is loaded and the security
860 server is ready to handle calls. */
861 spin_lock(&sbsec->isec_lock);
862 if (list_empty(&isec->list))
863 list_add(&isec->list, &sbsec->isec_head);
864 spin_unlock(&sbsec->isec_lock);
868 switch (sbsec->behavior) {
869 case SECURITY_FS_USE_XATTR:
870 if (!inode->i_op->getxattr) {
871 isec->sid = sbsec->def_sid;
875 /* Need a dentry, since the xattr API requires one.
876 Life would be simpler if we could just pass the inode. */
878 /* Called from d_instantiate or d_splice_alias. */
879 dentry = dget(opt_dentry);
881 /* Called from selinux_complete_init, try to find a dentry. */
882 dentry = d_find_alias(inode);
885 printk(KERN_WARNING "%s: no dentry for dev=%s "
886 "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
891 len = INITCONTEXTLEN;
892 context = kmalloc(len, GFP_KERNEL);
898 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
901 /* Need a larger buffer. Query for the right size. */
902 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
910 context = kmalloc(len, GFP_KERNEL);
916 rc = inode->i_op->getxattr(dentry,
922 if (rc != -ENODATA) {
923 printk(KERN_WARNING "%s: getxattr returned "
924 "%d for dev=%s ino=%ld\n", __FUNCTION__,
925 -rc, inode->i_sb->s_id, inode->i_ino);
929 /* Map ENODATA to the default file SID */
930 sid = sbsec->def_sid;
933 rc = security_context_to_sid_default(context, rc, &sid,
936 printk(KERN_WARNING "%s: context_to_sid(%s) "
937 "returned %d for dev=%s ino=%ld\n",
938 __FUNCTION__, context, -rc,
939 inode->i_sb->s_id, inode->i_ino);
941 /* Leave with the unlabeled SID */
949 case SECURITY_FS_USE_TASK:
950 isec->sid = isec->task_sid;
952 case SECURITY_FS_USE_TRANS:
953 /* Default to the fs SID. */
954 isec->sid = sbsec->sid;
956 /* Try to obtain a transition SID. */
957 isec->sclass = inode_mode_to_security_class(inode->i_mode);
958 rc = security_transition_sid(isec->task_sid,
966 case SECURITY_FS_USE_MNTPOINT:
967 isec->sid = sbsec->mntpoint_sid;
970 /* Default to the fs superblock SID. */
971 isec->sid = sbsec->sid;
974 struct proc_inode *proci = PROC_I(inode);
976 isec->sclass = inode_mode_to_security_class(inode->i_mode);
977 rc = selinux_proc_get_sid(proci->pde,
988 isec->initialized = 1;
991 if (isec->sclass == SECCLASS_FILE)
992 isec->sclass = inode_mode_to_security_class(inode->i_mode);
999 /* Convert a Linux signal to an access vector. */
1000 static inline u32 signal_to_av(int sig)
1006 /* Commonly granted from child to parent. */
1007 perm = PROCESS__SIGCHLD;
1010 /* Cannot be caught or ignored */
1011 perm = PROCESS__SIGKILL;
1014 /* Cannot be caught or ignored */
1015 perm = PROCESS__SIGSTOP;
1018 /* All other signals. */
1019 perm = PROCESS__SIGNAL;
1026 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1027 fork check, ptrace check, etc. */
1028 static int task_has_perm(struct task_struct *tsk1,
1029 struct task_struct *tsk2,
1032 struct task_security_struct *tsec1, *tsec2;
1034 tsec1 = tsk1->security;
1035 tsec2 = tsk2->security;
1036 return avc_has_perm(tsec1->sid, tsec2->sid,
1037 SECCLASS_PROCESS, perms, NULL);
1040 /* Check whether a task is allowed to use a capability. */
1041 static int task_has_capability(struct task_struct *tsk,
1044 struct task_security_struct *tsec;
1045 struct avc_audit_data ad;
1047 tsec = tsk->security;
1049 AVC_AUDIT_DATA_INIT(&ad,CAP);
1053 return avc_has_perm(tsec->sid, tsec->sid,
1054 SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
1057 /* Check whether a task is allowed to use a system operation. */
1058 static int task_has_system(struct task_struct *tsk,
1061 struct task_security_struct *tsec;
1063 tsec = tsk->security;
1065 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1066 SECCLASS_SYSTEM, perms, NULL);
1069 /* Check whether a task has a particular permission to an inode.
1070 The 'adp' parameter is optional and allows other audit
1071 data to be passed (e.g. the dentry). */
1072 static int inode_has_perm(struct task_struct *tsk,
1073 struct inode *inode,
1075 struct avc_audit_data *adp)
1077 struct task_security_struct *tsec;
1078 struct inode_security_struct *isec;
1079 struct avc_audit_data ad;
1081 tsec = tsk->security;
1082 isec = inode->i_security;
1086 AVC_AUDIT_DATA_INIT(&ad, FS);
1087 ad.u.fs.inode = inode;
1090 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1093 /* Same as inode_has_perm, but pass explicit audit data containing
1094 the dentry to help the auditing code to more easily generate the
1095 pathname if needed. */
1096 static inline int dentry_has_perm(struct task_struct *tsk,
1097 struct vfsmount *mnt,
1098 struct dentry *dentry,
1101 struct inode *inode = dentry->d_inode;
1102 struct avc_audit_data ad;
1103 AVC_AUDIT_DATA_INIT(&ad,FS);
1105 ad.u.fs.dentry = dentry;
1106 return inode_has_perm(tsk, inode, av, &ad);
1109 /* Check whether a task can use an open file descriptor to
1110 access an inode in a given way. Check access to the
1111 descriptor itself, and then use dentry_has_perm to
1112 check a particular permission to the file.
1113 Access to the descriptor is implicitly granted if it
1114 has the same SID as the process. If av is zero, then
1115 access to the file is not checked, e.g. for cases
1116 where only the descriptor is affected like seek. */
1117 static int file_has_perm(struct task_struct *tsk,
1121 struct task_security_struct *tsec = tsk->security;
1122 struct file_security_struct *fsec = file->f_security;
1123 struct vfsmount *mnt = file->f_vfsmnt;
1124 struct dentry *dentry = file->f_dentry;
1125 struct inode *inode = dentry->d_inode;
1126 struct avc_audit_data ad;
1129 AVC_AUDIT_DATA_INIT(&ad, FS);
1131 ad.u.fs.dentry = dentry;
1133 if (tsec->sid != fsec->sid) {
1134 rc = avc_has_perm(tsec->sid, fsec->sid,
1142 /* av is zero if only checking access to the descriptor. */
1144 return inode_has_perm(tsk, inode, av, &ad);
1149 /* Check whether a task can create a file. */
1150 static int may_create(struct inode *dir,
1151 struct dentry *dentry,
1154 struct task_security_struct *tsec;
1155 struct inode_security_struct *dsec;
1156 struct superblock_security_struct *sbsec;
1158 struct avc_audit_data ad;
1161 tsec = current->security;
1162 dsec = dir->i_security;
1163 sbsec = dir->i_sb->s_security;
1165 AVC_AUDIT_DATA_INIT(&ad, FS);
1166 ad.u.fs.dentry = dentry;
1168 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1169 DIR__ADD_NAME | DIR__SEARCH,
1174 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1175 newsid = tsec->create_sid;
1177 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1183 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1187 return avc_has_perm(newsid, sbsec->sid,
1188 SECCLASS_FILESYSTEM,
1189 FILESYSTEM__ASSOCIATE, &ad);
1192 /* Check whether a task can create a key. */
1193 static int may_create_key(u32 ksid,
1194 struct task_struct *ctx)
1196 struct task_security_struct *tsec;
1198 tsec = ctx->security;
1200 return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1204 #define MAY_UNLINK 1
1207 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1208 static int may_link(struct inode *dir,
1209 struct dentry *dentry,
1213 struct task_security_struct *tsec;
1214 struct inode_security_struct *dsec, *isec;
1215 struct avc_audit_data ad;
1219 tsec = current->security;
1220 dsec = dir->i_security;
1221 isec = dentry->d_inode->i_security;
1223 AVC_AUDIT_DATA_INIT(&ad, FS);
1224 ad.u.fs.dentry = dentry;
1227 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1228 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1243 printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
1247 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1251 static inline int may_rename(struct inode *old_dir,
1252 struct dentry *old_dentry,
1253 struct inode *new_dir,
1254 struct dentry *new_dentry)
1256 struct task_security_struct *tsec;
1257 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1258 struct avc_audit_data ad;
1260 int old_is_dir, new_is_dir;
1263 tsec = current->security;
1264 old_dsec = old_dir->i_security;
1265 old_isec = old_dentry->d_inode->i_security;
1266 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1267 new_dsec = new_dir->i_security;
1269 AVC_AUDIT_DATA_INIT(&ad, FS);
1271 ad.u.fs.dentry = old_dentry;
1272 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1273 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1276 rc = avc_has_perm(tsec->sid, old_isec->sid,
1277 old_isec->sclass, FILE__RENAME, &ad);
1280 if (old_is_dir && new_dir != old_dir) {
1281 rc = avc_has_perm(tsec->sid, old_isec->sid,
1282 old_isec->sclass, DIR__REPARENT, &ad);
1287 ad.u.fs.dentry = new_dentry;
1288 av = DIR__ADD_NAME | DIR__SEARCH;
1289 if (new_dentry->d_inode)
1290 av |= DIR__REMOVE_NAME;
1291 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1294 if (new_dentry->d_inode) {
1295 new_isec = new_dentry->d_inode->i_security;
1296 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1297 rc = avc_has_perm(tsec->sid, new_isec->sid,
1299 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1307 /* Check whether a task can perform a filesystem operation. */
1308 static int superblock_has_perm(struct task_struct *tsk,
1309 struct super_block *sb,
1311 struct avc_audit_data *ad)
1313 struct task_security_struct *tsec;
1314 struct superblock_security_struct *sbsec;
1316 tsec = tsk->security;
1317 sbsec = sb->s_security;
1318 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1322 /* Convert a Linux mode and permission mask to an access vector. */
1323 static inline u32 file_mask_to_av(int mode, int mask)
1327 if ((mode & S_IFMT) != S_IFDIR) {
1328 if (mask & MAY_EXEC)
1329 av |= FILE__EXECUTE;
1330 if (mask & MAY_READ)
1333 if (mask & MAY_APPEND)
1335 else if (mask & MAY_WRITE)
1339 if (mask & MAY_EXEC)
1341 if (mask & MAY_WRITE)
1343 if (mask & MAY_READ)
1350 /* Convert a Linux file to an access vector. */
1351 static inline u32 file_to_av(struct file *file)
1355 if (file->f_mode & FMODE_READ)
1357 if (file->f_mode & FMODE_WRITE) {
1358 if (file->f_flags & O_APPEND)
1367 /* Set an inode's SID to a specified value. */
1368 static int inode_security_set_sid(struct inode *inode, u32 sid)
1370 struct inode_security_struct *isec = inode->i_security;
1371 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
1373 if (!sbsec->initialized) {
1374 /* Defer initialization to selinux_complete_init. */
1379 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1381 isec->initialized = 1;
1386 /* Hook functions begin here. */
1388 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1392 rc = secondary_ops->ptrace(parent,child);
1396 return task_has_perm(parent, child, PROCESS__PTRACE);
1399 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1400 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1404 error = task_has_perm(current, target, PROCESS__GETCAP);
1408 return secondary_ops->capget(target, effective, inheritable, permitted);
1411 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1412 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1416 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1420 return task_has_perm(current, target, PROCESS__SETCAP);
1423 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1424 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1426 secondary_ops->capset_set(target, effective, inheritable, permitted);
1429 static int selinux_capable(struct task_struct *tsk, int cap)
1433 rc = secondary_ops->capable(tsk, cap);
1437 return task_has_capability(tsk,cap);
1440 static int selinux_sysctl(ctl_table *table, int op)
1444 struct task_security_struct *tsec;
1448 rc = secondary_ops->sysctl(table, op);
1452 tsec = current->security;
1454 rc = selinux_proc_get_sid(table->de, (op == 001) ?
1455 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1457 /* Default to the well-defined sysctl SID. */
1458 tsid = SECINITSID_SYSCTL;
1461 /* The op values are "defined" in sysctl.c, thereby creating
1462 * a bad coupling between this module and sysctl.c */
1464 error = avc_has_perm(tsec->sid, tsid,
1465 SECCLASS_DIR, DIR__SEARCH, NULL);
1473 error = avc_has_perm(tsec->sid, tsid,
1474 SECCLASS_FILE, av, NULL);
1480 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1493 rc = superblock_has_perm(current,
1495 FILESYSTEM__QUOTAMOD, NULL);
1500 rc = superblock_has_perm(current,
1502 FILESYSTEM__QUOTAGET, NULL);
1505 rc = 0; /* let the kernel handle invalid cmds */
1511 static int selinux_quota_on(struct dentry *dentry)
1513 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1516 static int selinux_syslog(int type)
1520 rc = secondary_ops->syslog(type);
1525 case 3: /* Read last kernel messages */
1526 case 10: /* Return size of the log buffer */
1527 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1529 case 6: /* Disable logging to console */
1530 case 7: /* Enable logging to console */
1531 case 8: /* Set level of messages printed to console */
1532 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1534 case 0: /* Close log */
1535 case 1: /* Open log */
1536 case 2: /* Read from log */
1537 case 4: /* Read/clear last kernel messages */
1538 case 5: /* Clear ring buffer */
1540 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1547 * Check that a process has enough memory to allocate a new virtual
1548 * mapping. 0 means there is enough memory for the allocation to
1549 * succeed and -ENOMEM implies there is not.
1551 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1552 * if the capability is granted, but __vm_enough_memory requires 1 if
1553 * the capability is granted.
1555 * Do not audit the selinux permission check, as this is applied to all
1556 * processes that allocate mappings.
1558 static int selinux_vm_enough_memory(long pages)
1560 int rc, cap_sys_admin = 0;
1561 struct task_security_struct *tsec = current->security;
1563 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1565 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1566 SECCLASS_CAPABILITY,
1567 CAP_TO_MASK(CAP_SYS_ADMIN),
1573 return __vm_enough_memory(pages, cap_sys_admin);
1576 /* binprm security operations */
1578 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1580 struct bprm_security_struct *bsec;
1582 bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1587 bsec->sid = SECINITSID_UNLABELED;
1590 bprm->security = bsec;
1594 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1596 struct task_security_struct *tsec;
1597 struct inode *inode = bprm->file->f_dentry->d_inode;
1598 struct inode_security_struct *isec;
1599 struct bprm_security_struct *bsec;
1601 struct avc_audit_data ad;
1604 rc = secondary_ops->bprm_set_security(bprm);
1608 bsec = bprm->security;
1613 tsec = current->security;
1614 isec = inode->i_security;
1616 /* Default to the current task SID. */
1617 bsec->sid = tsec->sid;
1619 /* Reset fs, key, and sock SIDs on execve. */
1620 tsec->create_sid = 0;
1621 tsec->keycreate_sid = 0;
1622 tsec->sockcreate_sid = 0;
1624 if (tsec->exec_sid) {
1625 newsid = tsec->exec_sid;
1626 /* Reset exec SID on execve. */
1629 /* Check for a default transition on this program. */
1630 rc = security_transition_sid(tsec->sid, isec->sid,
1631 SECCLASS_PROCESS, &newsid);
1636 AVC_AUDIT_DATA_INIT(&ad, FS);
1637 ad.u.fs.mnt = bprm->file->f_vfsmnt;
1638 ad.u.fs.dentry = bprm->file->f_dentry;
1640 if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
1643 if (tsec->sid == newsid) {
1644 rc = avc_has_perm(tsec->sid, isec->sid,
1645 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1649 /* Check permissions for the transition. */
1650 rc = avc_has_perm(tsec->sid, newsid,
1651 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1655 rc = avc_has_perm(newsid, isec->sid,
1656 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1660 /* Clear any possibly unsafe personality bits on exec: */
1661 current->personality &= ~PER_CLEAR_ON_SETID;
1663 /* Set the security field to the new SID. */
1671 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1673 return secondary_ops->bprm_check_security(bprm);
1677 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1679 struct task_security_struct *tsec = current->security;
1682 if (tsec->osid != tsec->sid) {
1683 /* Enable secure mode for SIDs transitions unless
1684 the noatsecure permission is granted between
1685 the two SIDs, i.e. ahp returns 0. */
1686 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1688 PROCESS__NOATSECURE, NULL);
1691 return (atsecure || secondary_ops->bprm_secureexec(bprm));
1694 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1696 kfree(bprm->security);
1697 bprm->security = NULL;
1700 extern struct vfsmount *selinuxfs_mount;
1701 extern struct dentry *selinux_null;
1703 /* Derived from fs/exec.c:flush_old_files. */
1704 static inline void flush_unauthorized_files(struct files_struct * files)
1706 struct avc_audit_data ad;
1707 struct file *file, *devnull = NULL;
1708 struct tty_struct *tty;
1709 struct fdtable *fdt;
1713 mutex_lock(&tty_mutex);
1714 tty = get_current_tty();
1717 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
1719 /* Revalidate access to controlling tty.
1720 Use inode_has_perm on the tty inode directly rather
1721 than using file_has_perm, as this particular open
1722 file may belong to another process and we are only
1723 interested in the inode-based check here. */
1724 struct inode *inode = file->f_dentry->d_inode;
1725 if (inode_has_perm(current, inode,
1726 FILE__READ | FILE__WRITE, NULL)) {
1732 /* Reset controlling tty. */
1734 proc_set_tty(current, NULL);
1736 mutex_unlock(&tty_mutex);
1738 /* Revalidate access to inherited open files. */
1740 AVC_AUDIT_DATA_INIT(&ad,FS);
1742 spin_lock(&files->file_lock);
1744 unsigned long set, i;
1749 fdt = files_fdtable(files);
1750 if (i >= fdt->max_fds || i >= fdt->max_fdset)
1752 set = fdt->open_fds->fds_bits[j];
1755 spin_unlock(&files->file_lock);
1756 for ( ; set ; i++,set >>= 1) {
1761 if (file_has_perm(current,
1763 file_to_av(file))) {
1765 fd = get_unused_fd();
1775 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1782 fd_install(fd, devnull);
1787 spin_lock(&files->file_lock);
1790 spin_unlock(&files->file_lock);
1793 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1795 struct task_security_struct *tsec;
1796 struct bprm_security_struct *bsec;
1800 secondary_ops->bprm_apply_creds(bprm, unsafe);
1802 tsec = current->security;
1804 bsec = bprm->security;
1807 tsec->osid = tsec->sid;
1809 if (tsec->sid != sid) {
1810 /* Check for shared state. If not ok, leave SID
1811 unchanged and kill. */
1812 if (unsafe & LSM_UNSAFE_SHARE) {
1813 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1814 PROCESS__SHARE, NULL);
1821 /* Check for ptracing, and update the task SID if ok.
1822 Otherwise, leave SID unchanged and kill. */
1823 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1824 struct task_struct *t;
1827 t = tracehook_tracer_task(current);
1828 if (unlikely(t == NULL))
1831 struct task_security_struct *sec = t->security;
1832 u32 ptsid = sec->sid;
1835 rc = avc_has_perm(ptsid, sid,
1837 PROCESS__PTRACE, NULL);
1849 * called after apply_creds without the task lock held
1851 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1853 struct task_security_struct *tsec;
1854 struct rlimit *rlim, *initrlim;
1855 struct itimerval itimer;
1856 struct bprm_security_struct *bsec;
1859 tsec = current->security;
1860 bsec = bprm->security;
1863 force_sig_specific(SIGKILL, current);
1866 if (tsec->osid == tsec->sid)
1869 /* Close files for which the new task SID is not authorized. */
1870 flush_unauthorized_files(current->files);
1872 /* Check whether the new SID can inherit signal state
1873 from the old SID. If not, clear itimers to avoid
1874 subsequent signal generation and flush and unblock
1875 signals. This must occur _after_ the task SID has
1876 been updated so that any kill done after the flush
1877 will be checked against the new SID. */
1878 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1879 PROCESS__SIGINH, NULL);
1881 memset(&itimer, 0, sizeof itimer);
1882 for (i = 0; i < 3; i++)
1883 do_setitimer(i, &itimer, NULL);
1884 flush_signals(current);
1885 spin_lock_irq(¤t->sighand->siglock);
1886 flush_signal_handlers(current, 1);
1887 sigemptyset(¤t->blocked);
1888 recalc_sigpending();
1889 spin_unlock_irq(¤t->sighand->siglock);
1892 /* Check whether the new SID can inherit resource limits
1893 from the old SID. If not, reset all soft limits to
1894 the lower of the current task's hard limit and the init
1895 task's soft limit. Note that the setting of hard limits
1896 (even to lower them) can be controlled by the setrlimit
1897 check. The inclusion of the init task's soft limit into
1898 the computation is to avoid resetting soft limits higher
1899 than the default soft limit for cases where the default
1900 is lower than the hard limit, e.g. RLIMIT_CORE or
1902 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1903 PROCESS__RLIMITINH, NULL);
1905 for (i = 0; i < RLIM_NLIMITS; i++) {
1906 rlim = current->signal->rlim + i;
1907 initrlim = init_task.signal->rlim+i;
1908 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1910 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1912 * This will cause RLIMIT_CPU calculations
1915 current->it_prof_expires = jiffies_to_cputime(1);
1919 /* Wake up the parent if it is waiting so that it can
1920 recheck wait permission to the new task SID. */
1921 wake_up_interruptible(¤t->parent->signal->wait_chldexit);
1924 /* superblock security operations */
1926 static int selinux_sb_alloc_security(struct super_block *sb)
1928 return superblock_alloc_security(sb);
1931 static void selinux_sb_free_security(struct super_block *sb)
1933 superblock_free_security(sb);
1936 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1941 return !memcmp(prefix, option, plen);
1944 static inline int selinux_option(char *option, int len)
1946 return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1947 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1948 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len) ||
1949 match_prefix("rootcontext=", sizeof("rootcontext=")-1, option, len));
1952 static inline void take_option(char **to, char *from, int *first, int len)
1960 memcpy(*to, from, len);
1964 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
1966 int fnosec, fsec, rc = 0;
1967 char *in_save, *in_curr, *in_end;
1968 char *sec_curr, *nosec_save, *nosec;
1973 /* Binary mount data: just copy */
1974 if (type->fs_flags & FS_BINARY_MOUNTDATA) {
1975 copy_page(sec_curr, in_curr);
1979 nosec = (char *)get_zeroed_page(GFP_KERNEL);
1987 in_save = in_end = orig;
1990 if (*in_end == ',' || *in_end == '\0') {
1991 int len = in_end - in_curr;
1993 if (selinux_option(in_curr, len))
1994 take_option(&sec_curr, in_curr, &fsec, len);
1996 take_option(&nosec, in_curr, &fnosec, len);
1998 in_curr = in_end + 1;
2000 } while (*in_end++);
2002 strcpy(in_save, nosec_save);
2003 free_page((unsigned long)nosec_save);
2008 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2010 struct avc_audit_data ad;
2013 rc = superblock_doinit(sb, data);
2017 AVC_AUDIT_DATA_INIT(&ad,FS);
2018 ad.u.fs.dentry = sb->s_root;
2019 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2022 static int selinux_sb_statfs(struct dentry *dentry)
2024 struct avc_audit_data ad;
2026 AVC_AUDIT_DATA_INIT(&ad,FS);
2027 ad.u.fs.dentry = dentry->d_sb->s_root;
2028 return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2031 static int selinux_mount(char * dev_name,
2032 struct nameidata *nd,
2034 unsigned long flags,
2039 rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2043 if (flags & MS_REMOUNT)
2044 return superblock_has_perm(current, nd->mnt->mnt_sb,
2045 FILESYSTEM__REMOUNT, NULL);
2047 return dentry_has_perm(current, nd->mnt, nd->dentry,
2051 static int selinux_umount(struct vfsmount *mnt, int flags)
2055 rc = secondary_ops->sb_umount(mnt, flags);
2059 return superblock_has_perm(current,mnt->mnt_sb,
2060 FILESYSTEM__UNMOUNT,NULL);
2063 /* inode security operations */
2065 static int selinux_inode_alloc_security(struct inode *inode)
2067 return inode_alloc_security(inode);
2070 static void selinux_inode_free_security(struct inode *inode)
2072 inode_free_security(inode);
2075 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2076 char **name, void **value,
2079 struct task_security_struct *tsec;
2080 struct inode_security_struct *dsec;
2081 struct superblock_security_struct *sbsec;
2084 char *namep = NULL, *context;
2086 tsec = current->security;
2087 dsec = dir->i_security;
2088 sbsec = dir->i_sb->s_security;
2090 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2091 newsid = tsec->create_sid;
2093 rc = security_transition_sid(tsec->sid, dsec->sid,
2094 inode_mode_to_security_class(inode->i_mode),
2097 printk(KERN_WARNING "%s: "
2098 "security_transition_sid failed, rc=%d (dev=%s "
2101 -rc, inode->i_sb->s_id, inode->i_ino);
2106 inode_security_set_sid(inode, newsid);
2108 if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2112 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
2119 rc = security_sid_to_context(newsid, &context, &clen);
2131 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2133 return may_create(dir, dentry, SECCLASS_FILE);
2136 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2140 rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2143 return may_link(dir, old_dentry, MAY_LINK);
2146 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2150 rc = secondary_ops->inode_unlink(dir, dentry);
2153 return may_link(dir, dentry, MAY_UNLINK);
2156 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2158 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2161 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2163 return may_create(dir, dentry, SECCLASS_DIR);
2166 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2168 return may_link(dir, dentry, MAY_RMDIR);
2171 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2175 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2179 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2182 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2183 struct inode *new_inode, struct dentry *new_dentry)
2185 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2188 static int selinux_inode_readlink(struct dentry *dentry)
2190 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2193 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2197 rc = secondary_ops->inode_follow_link(dentry,nameidata);
2200 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2203 static int selinux_inode_permission(struct inode *inode, int mask,
2204 struct nameidata *nd)
2208 rc = secondary_ops->inode_permission(inode, mask, nd);
2213 /* No permission to check. Existence test. */
2217 return inode_has_perm(current, inode,
2218 file_mask_to_av(inode->i_mode, mask), NULL);
2221 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2225 rc = secondary_ops->inode_setattr(dentry, iattr);
2229 if (iattr->ia_valid & ATTR_FORCE)
2232 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2233 ATTR_ATIME_SET | ATTR_MTIME_SET))
2234 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2236 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2239 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2241 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2244 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2246 struct task_security_struct *tsec = current->security;
2247 struct inode *inode = dentry->d_inode;
2248 struct inode_security_struct *isec = inode->i_security;
2249 struct superblock_security_struct *sbsec;
2250 struct avc_audit_data ad;
2254 if (strcmp(name, XATTR_NAME_SELINUX)) {
2255 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2256 sizeof XATTR_SECURITY_PREFIX - 1) &&
2257 !capable(CAP_SYS_ADMIN)) {
2258 /* A different attribute in the security namespace.
2259 Restrict to administrator. */
2263 /* Not an attribute we recognize, so just check the
2264 ordinary setattr permission. */
2265 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2268 sbsec = inode->i_sb->s_security;
2269 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2272 if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2275 AVC_AUDIT_DATA_INIT(&ad,FS);
2276 ad.u.fs.dentry = dentry;
2278 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2279 FILE__RELABELFROM, &ad);
2283 rc = security_context_to_sid(value, size, &newsid);
2287 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2288 FILE__RELABELTO, &ad);
2292 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2297 return avc_has_perm(newsid,
2299 SECCLASS_FILESYSTEM,
2300 FILESYSTEM__ASSOCIATE,
2304 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2305 void *value, size_t size, int flags)
2307 struct inode *inode = dentry->d_inode;
2308 struct inode_security_struct *isec = inode->i_security;
2312 if (strcmp(name, XATTR_NAME_SELINUX)) {
2313 /* Not an attribute we recognize, so nothing to do. */
2317 rc = security_context_to_sid(value, size, &newsid);
2319 printk(KERN_WARNING "%s: unable to obtain SID for context "
2320 "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2328 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2330 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2333 static int selinux_inode_listxattr (struct dentry *dentry)
2335 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2338 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2340 if (strcmp(name, XATTR_NAME_SELINUX)) {
2341 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2342 sizeof XATTR_SECURITY_PREFIX - 1) &&
2343 !capable(CAP_SYS_ADMIN)) {
2344 /* A different attribute in the security namespace.
2345 Restrict to administrator. */
2349 /* Not an attribute we recognize, so just check the
2350 ordinary setattr permission. Might want a separate
2351 permission for removexattr. */
2352 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2355 /* No one is allowed to remove a SELinux security label.
2356 You can change the label, but all data must be labeled. */
2360 static const char *selinux_inode_xattr_getsuffix(void)
2362 return XATTR_SELINUX_SUFFIX;
2366 * Copy the in-core inode security context value to the user. If the
2367 * getxattr() prior to this succeeded, check to see if we need to
2368 * canonicalize the value to be finally returned to the user.
2370 * Permission check is handled by selinux_inode_getxattr hook.
2372 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void *buffer, size_t size, int err)
2374 struct inode_security_struct *isec = inode->i_security;
2376 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2379 return selinux_getsecurity(isec->sid, buffer, size);
2382 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2383 const void *value, size_t size, int flags)
2385 struct inode_security_struct *isec = inode->i_security;
2389 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2392 if (!value || !size)
2395 rc = security_context_to_sid((void*)value, size, &newsid);
2403 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2405 const int len = sizeof(XATTR_NAME_SELINUX);
2406 if (buffer && len <= buffer_size)
2407 memcpy(buffer, XATTR_NAME_SELINUX, len);
2411 /* file security operations */
2413 static int selinux_file_permission(struct file *file, int mask)
2415 struct inode *inode = file->f_dentry->d_inode;
2418 /* No permission to check. Existence test. */
2422 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2423 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2426 return file_has_perm(current, file,
2427 file_mask_to_av(inode->i_mode, mask));
2430 static int selinux_file_alloc_security(struct file *file)
2432 return file_alloc_security(file);
2435 static void selinux_file_free_security(struct file *file)
2437 file_free_security(file);
2440 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2452 case EXT2_IOC_GETFLAGS:
2454 case EXT2_IOC_GETVERSION:
2455 error = file_has_perm(current, file, FILE__GETATTR);
2458 case EXT2_IOC_SETFLAGS:
2460 case EXT2_IOC_SETVERSION:
2461 error = file_has_perm(current, file, FILE__SETATTR);
2464 /* sys_ioctl() checks */
2468 error = file_has_perm(current, file, 0);
2473 error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2476 /* default case assumes that the command will go
2477 * to the file's ioctl() function.
2480 error = file_has_perm(current, file, FILE__IOCTL);
2486 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2488 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2490 * We are making executable an anonymous mapping or a
2491 * private file mapping that will also be writable.
2492 * This has an additional check.
2494 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2500 /* read access is always possible with a mapping */
2501 u32 av = FILE__READ;
2503 /* write access only matters if the mapping is shared */
2504 if (shared && (prot & PROT_WRITE))
2507 if (prot & PROT_EXEC)
2508 av |= FILE__EXECUTE;
2510 return file_has_perm(current, file, av);
2515 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2516 unsigned long prot, unsigned long flags)
2520 rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2524 if (selinux_checkreqprot)
2527 return file_map_prot_check(file, prot,
2528 (flags & MAP_TYPE) == MAP_SHARED);
2531 static int selinux_file_mprotect(struct vm_area_struct *vma,
2532 unsigned long reqprot,
2537 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2541 if (selinux_checkreqprot)
2544 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2546 if (vma->vm_start >= vma->vm_mm->start_brk &&
2547 vma->vm_end <= vma->vm_mm->brk) {
2548 rc = task_has_perm(current, current,
2550 } else if (!vma->vm_file &&
2551 vma->vm_start <= vma->vm_mm->start_stack &&
2552 vma->vm_end >= vma->vm_mm->start_stack) {
2553 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2554 } else if (vma->vm_file && vma->anon_vma) {
2556 * We are making executable a file mapping that has
2557 * had some COW done. Since pages might have been
2558 * written, check ability to execute the possibly
2559 * modified content. This typically should only
2560 * occur for text relocations.
2562 rc = file_has_perm(current, vma->vm_file,
2569 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2572 static int selinux_file_lock(struct file *file, unsigned int cmd)
2574 return file_has_perm(current, file, FILE__LOCK);
2577 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2584 if (!file->f_dentry || !file->f_dentry->d_inode) {
2589 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2590 err = file_has_perm(current, file,FILE__WRITE);
2599 /* Just check FD__USE permission */
2600 err = file_has_perm(current, file, 0);
2605 #if BITS_PER_LONG == 32
2610 if (!file->f_dentry || !file->f_dentry->d_inode) {
2614 err = file_has_perm(current, file, FILE__LOCK);
2621 static int selinux_file_set_fowner(struct file *file)
2623 struct task_security_struct *tsec;
2624 struct file_security_struct *fsec;
2626 tsec = current->security;
2627 fsec = file->f_security;
2628 fsec->fown_sid = tsec->sid;
2633 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2634 struct fown_struct *fown, int signum)
2638 struct task_security_struct *tsec;
2639 struct file_security_struct *fsec;
2641 /* struct fown_struct is never outside the context of a struct file */
2642 file = (struct file *)((long)fown - offsetof(struct file,f_owner));
2644 tsec = tsk->security;
2645 fsec = file->f_security;
2648 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2650 perm = signal_to_av(signum);
2652 return avc_has_perm(fsec->fown_sid, tsec->sid,
2653 SECCLASS_PROCESS, perm, NULL);
2656 static int selinux_file_receive(struct file *file)
2658 return file_has_perm(current, file, file_to_av(file));
2661 /* task security operations */
2663 static int selinux_task_create(unsigned long clone_flags)
2667 rc = secondary_ops->task_create(clone_flags);
2671 return task_has_perm(current, current, PROCESS__FORK);
2674 static int selinux_task_alloc_security(struct task_struct *tsk)
2676 struct task_security_struct *tsec1, *tsec2;
2679 tsec1 = current->security;
2681 rc = task_alloc_security(tsk);
2684 tsec2 = tsk->security;
2686 tsec2->osid = tsec1->osid;
2687 tsec2->sid = tsec1->sid;
2689 /* Retain the exec, fs, key, and sock SIDs across fork */
2690 tsec2->exec_sid = tsec1->exec_sid;
2691 tsec2->create_sid = tsec1->create_sid;
2692 tsec2->keycreate_sid = tsec1->keycreate_sid;
2693 tsec2->sockcreate_sid = tsec1->sockcreate_sid;
2698 static void selinux_task_free_security(struct task_struct *tsk)
2700 task_free_security(tsk);
2703 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2705 /* Since setuid only affects the current process, and
2706 since the SELinux controls are not based on the Linux
2707 identity attributes, SELinux does not need to control
2708 this operation. However, SELinux does control the use
2709 of the CAP_SETUID and CAP_SETGID capabilities using the
2714 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2716 return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2719 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2721 /* See the comment for setuid above. */
2725 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2727 return task_has_perm(current, p, PROCESS__SETPGID);
2730 static int selinux_task_getpgid(struct task_struct *p)
2732 return task_has_perm(current, p, PROCESS__GETPGID);
2735 static int selinux_task_getsid(struct task_struct *p)
2737 return task_has_perm(current, p, PROCESS__GETSESSION);
2740 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
2742 selinux_get_task_sid(p, secid);
2745 static int selinux_task_setgroups(struct group_info *group_info)
2747 /* See the comment for setuid above. */
2751 static int selinux_task_setnice(struct task_struct *p, int nice)
2755 rc = secondary_ops->task_setnice(p, nice);
2759 return task_has_perm(current,p, PROCESS__SETSCHED);
2762 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
2764 return task_has_perm(current, p, PROCESS__SETSCHED);
2767 static int selinux_task_getioprio(struct task_struct *p)
2769 return task_has_perm(current, p, PROCESS__GETSCHED);
2772 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2774 struct rlimit *old_rlim = current->signal->rlim + resource;
2777 rc = secondary_ops->task_setrlimit(resource, new_rlim);
2781 /* Control the ability to change the hard limit (whether
2782 lowering or raising it), so that the hard limit can
2783 later be used as a safe reset point for the soft limit
2784 upon context transitions. See selinux_bprm_apply_creds. */
2785 if (old_rlim->rlim_max != new_rlim->rlim_max)
2786 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2791 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2793 return task_has_perm(current, p, PROCESS__SETSCHED);
2796 static int selinux_task_getscheduler(struct task_struct *p)
2798 return task_has_perm(current, p, PROCESS__GETSCHED);
2801 static int selinux_task_movememory(struct task_struct *p)
2803 return task_has_perm(current, p, PROCESS__SETSCHED);
2806 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
2811 struct task_security_struct *tsec;
2813 rc = secondary_ops->task_kill(p, info, sig, secid);
2817 if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
2821 perm = PROCESS__SIGNULL; /* null signal; existence test */
2823 perm = signal_to_av(sig);
2826 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
2828 rc = task_has_perm(current, p, perm);
2832 static int selinux_task_prctl(int option,
2838 /* The current prctl operations do not appear to require
2839 any SELinux controls since they merely observe or modify
2840 the state of the current process. */
2844 static int selinux_task_wait(struct task_struct *p)
2848 perm = signal_to_av(p->exit_signal);
2850 return task_has_perm(p, current, perm);
2853 static void selinux_task_reparent_to_init(struct task_struct *p)
2855 struct task_security_struct *tsec;
2857 secondary_ops->task_reparent_to_init(p);
2860 tsec->osid = tsec->sid;
2861 tsec->sid = SECINITSID_KERNEL;
2865 static void selinux_task_to_inode(struct task_struct *p,
2866 struct inode *inode)
2868 struct task_security_struct *tsec = p->security;
2869 struct inode_security_struct *isec = inode->i_security;
2871 isec->sid = tsec->sid;
2872 isec->initialized = 1;
2876 /* Returns error only if unable to parse addresses */
2877 static int selinux_parse_skb_ipv4(struct sk_buff *skb, struct avc_audit_data *ad)
2879 int offset, ihlen, ret = -EINVAL;
2880 struct iphdr _iph, *ih;
2882 offset = skb->nh.raw - skb->data;
2883 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2887 ihlen = ih->ihl * 4;
2888 if (ihlen < sizeof(_iph))
2891 ad->u.net.v4info.saddr = ih->saddr;
2892 ad->u.net.v4info.daddr = ih->daddr;
2895 switch (ih->protocol) {
2897 struct tcphdr _tcph, *th;
2899 if (ntohs(ih->frag_off) & IP_OFFSET)
2903 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2907 ad->u.net.sport = th->source;
2908 ad->u.net.dport = th->dest;
2913 struct udphdr _udph, *uh;
2915 if (ntohs(ih->frag_off) & IP_OFFSET)
2919 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2923 ad->u.net.sport = uh->source;
2924 ad->u.net.dport = uh->dest;
2935 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2937 /* Returns error only if unable to parse addresses */
2938 static int selinux_parse_skb_ipv6(struct sk_buff *skb, struct avc_audit_data *ad)
2941 int ret = -EINVAL, offset;
2942 struct ipv6hdr _ipv6h, *ip6;
2944 offset = skb->nh.raw - skb->data;
2945 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
2949 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
2950 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
2953 nexthdr = ip6->nexthdr;
2954 offset += sizeof(_ipv6h);
2955 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
2961 struct tcphdr _tcph, *th;
2963 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2967 ad->u.net.sport = th->source;
2968 ad->u.net.dport = th->dest;
2973 struct udphdr _udph, *uh;
2975 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2979 ad->u.net.sport = uh->source;
2980 ad->u.net.dport = uh->dest;
2984 /* includes fragments */
2994 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
2995 char **addrp, int *len, int src)
2999 switch (ad->u.net.family) {
3001 ret = selinux_parse_skb_ipv4(skb, ad);
3005 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3006 &ad->u.net.v4info.daddr);
3009 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3011 ret = selinux_parse_skb_ipv6(skb, ad);
3015 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3016 &ad->u.net.v6info.daddr);
3026 /* socket security operations */
3027 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3030 struct inode_security_struct *isec;
3031 struct task_security_struct *tsec;
3032 struct avc_audit_data ad;
3035 tsec = task->security;
3036 isec = SOCK_INODE(sock)->i_security;
3038 if (isec->sid == SECINITSID_KERNEL)
3041 AVC_AUDIT_DATA_INIT(&ad,NET);
3042 ad.u.net.sk = sock->sk;
3043 err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3049 static int selinux_socket_create(int family, int type,
3050 int protocol, int kern)
3053 struct task_security_struct *tsec;
3059 tsec = current->security;
3060 newsid = tsec->sockcreate_sid ? : tsec->sid;
3061 err = avc_has_perm(tsec->sid, newsid,
3062 socket_type_to_security_class(family, type,
3063 protocol), SOCKET__CREATE, NULL);
3069 static void selinux_socket_post_create(struct socket *sock, int family,
3070 int type, int protocol, int kern)
3072 struct inode_security_struct *isec;
3073 struct task_security_struct *tsec;
3076 isec = SOCK_INODE(sock)->i_security;
3078 tsec = current->security;
3079 newsid = tsec->sockcreate_sid ? : tsec->sid;
3080 isec->sclass = socket_type_to_security_class(family, type, protocol);
3081 isec->sid = kern ? SECINITSID_KERNEL : newsid;
3082 isec->initialized = 1;
3087 /* Range of port numbers used to automatically bind.
3088 Need to determine whether we should perform a name_bind
3089 permission check between the socket and the port number. */
3090 #define ip_local_port_range_0 sysctl_local_port_range[0]
3091 #define ip_local_port_range_1 sysctl_local_port_range[1]
3093 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3098 err = socket_has_perm(current, sock, SOCKET__BIND);
3103 * If PF_INET or PF_INET6, check name_bind permission for the port.
3104 * Multiple address binding for SCTP is not supported yet: we just
3105 * check the first address now.
3107 family = sock->sk->sk_family;
3108 if (family == PF_INET || family == PF_INET6) {
3110 struct inode_security_struct *isec;
3111 struct task_security_struct *tsec;
3112 struct avc_audit_data ad;
3113 struct sockaddr_in *addr4 = NULL;
3114 struct sockaddr_in6 *addr6 = NULL;
3115 unsigned short snum;
3116 struct sock *sk = sock->sk;
3117 u32 sid, node_perm, addrlen;
3119 tsec = current->security;
3120 isec = SOCK_INODE(sock)->i_security;
3122 if (family == PF_INET) {
3123 addr4 = (struct sockaddr_in *)address;
3124 snum = ntohs(addr4->sin_port);
3125 addrlen = sizeof(addr4->sin_addr.s_addr);
3126 addrp = (char *)&addr4->sin_addr.s_addr;
3128 addr6 = (struct sockaddr_in6 *)address;
3129 snum = ntohs(addr6->sin6_port);
3130 addrlen = sizeof(addr6->sin6_addr.s6_addr);
3131 addrp = (char *)&addr6->sin6_addr.s6_addr;
3134 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3135 snum > ip_local_port_range_1)) {
3136 err = security_port_sid(sk->sk_family, sk->sk_type,
3137 sk->sk_protocol, snum, &sid);
3140 AVC_AUDIT_DATA_INIT(&ad,NET);
3141 ad.u.net.sport = htons(snum);
3142 ad.u.net.family = family;
3143 err = avc_has_perm(isec->sid, sid,
3145 SOCKET__NAME_BIND, &ad);
3150 switch(isec->sclass) {
3151 case SECCLASS_TCP_SOCKET:
3152 node_perm = TCP_SOCKET__NODE_BIND;
3155 case SECCLASS_UDP_SOCKET:
3156 node_perm = UDP_SOCKET__NODE_BIND;
3160 node_perm = RAWIP_SOCKET__NODE_BIND;
3164 err = security_node_sid(family, addrp, addrlen, &sid);
3168 AVC_AUDIT_DATA_INIT(&ad,NET);
3169 ad.u.net.sport = htons(snum);
3170 ad.u.net.family = family;
3172 if (family == PF_INET)
3173 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3175 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3177 err = avc_has_perm(isec->sid, sid,
3178 isec->sclass, node_perm, &ad);
3186 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3188 struct inode_security_struct *isec;
3191 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3196 * If a TCP socket, check name_connect permission for the port.
3198 isec = SOCK_INODE(sock)->i_security;
3199 if (isec->sclass == SECCLASS_TCP_SOCKET) {
3200 struct sock *sk = sock->sk;
3201 struct avc_audit_data ad;
3202 struct sockaddr_in *addr4 = NULL;
3203 struct sockaddr_in6 *addr6 = NULL;
3204 unsigned short snum;
3207 if (sk->sk_family == PF_INET) {
3208 addr4 = (struct sockaddr_in *)address;
3209 if (addrlen < sizeof(struct sockaddr_in))
3211 snum = ntohs(addr4->sin_port);
3213 addr6 = (struct sockaddr_in6 *)address;
3214 if (addrlen < SIN6_LEN_RFC2133)
3216 snum = ntohs(addr6->sin6_port);
3219 err = security_port_sid(sk->sk_family, sk->sk_type,
3220 sk->sk_protocol, snum, &sid);
3224 AVC_AUDIT_DATA_INIT(&ad,NET);
3225 ad.u.net.dport = htons(snum);
3226 ad.u.net.family = sk->sk_family;
3227 err = avc_has_perm(isec->sid, sid, isec->sclass,
3228 TCP_SOCKET__NAME_CONNECT, &ad);
3237 static int selinux_socket_listen(struct socket *sock, int backlog)
3239 return socket_has_perm(current, sock, SOCKET__LISTEN);
3242 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3245 struct inode_security_struct *isec;
3246 struct inode_security_struct *newisec;
3248 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3252 newisec = SOCK_INODE(newsock)->i_security;
3254 isec = SOCK_INODE(sock)->i_security;
3255 newisec->sclass = isec->sclass;
3256 newisec->sid = isec->sid;
3257 newisec->initialized = 1;
3262 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3265 return socket_has_perm(current, sock, SOCKET__WRITE);
3268 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3269 int size, int flags)
3271 return socket_has_perm(current, sock, SOCKET__READ);
3274 static int selinux_socket_getsockname(struct socket *sock)
3276 return socket_has_perm(current, sock, SOCKET__GETATTR);
3279 static int selinux_socket_getpeername(struct socket *sock)
3281 return socket_has_perm(current, sock, SOCKET__GETATTR);
3284 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3286 return socket_has_perm(current, sock, SOCKET__SETOPT);
3289 static int selinux_socket_getsockopt(struct socket *sock, int level,
3292 return socket_has_perm(current, sock, SOCKET__GETOPT);
3295 static int selinux_socket_shutdown(struct socket *sock, int how)
3297 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3300 static int selinux_socket_unix_stream_connect(struct socket *sock,
3301 struct socket *other,
3304 struct sk_security_struct *ssec;
3305 struct inode_security_struct *isec;
3306 struct inode_security_struct *other_isec;
3307 struct avc_audit_data ad;
3310 err = secondary_ops->unix_stream_connect(sock, other, newsk);
3314 isec = SOCK_INODE(sock)->i_security;
3315 other_isec = SOCK_INODE(other)->i_security;
3317 AVC_AUDIT_DATA_INIT(&ad,NET);
3318 ad.u.net.sk = other->sk;
3320 err = avc_has_perm(isec->sid, other_isec->sid,
3322 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3326 /* connecting socket */
3327 ssec = sock->sk->sk_security;
3328 ssec->peer_sid = other_isec->sid;
3330 /* server child socket */
3331 ssec = newsk->sk_security;
3332 ssec->peer_sid = isec->sid;
3337 static int selinux_socket_unix_may_send(struct socket *sock,
3338 struct socket *other)
3340 struct inode_security_struct *isec;
3341 struct inode_security_struct *other_isec;
3342 struct avc_audit_data ad;
3345 isec = SOCK_INODE(sock)->i_security;
3346 other_isec = SOCK_INODE(other)->i_security;
3348 AVC_AUDIT_DATA_INIT(&ad,NET);
3349 ad.u.net.sk = other->sk;
3351 err = avc_has_perm(isec->sid, other_isec->sid,
3352 isec->sclass, SOCKET__SENDTO, &ad);
3359 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
3360 struct avc_audit_data *ad, u32 sock_sid, u16 sock_class,
3361 u16 family, char *addrp, int len)
3364 u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3369 err = sel_netif_sids(skb->dev, &if_sid, NULL);
3373 switch (sock_class) {
3374 case SECCLASS_UDP_SOCKET:
3375 netif_perm = NETIF__UDP_RECV;
3376 node_perm = NODE__UDP_RECV;
3377 recv_perm = UDP_SOCKET__RECV_MSG;
3380 case SECCLASS_TCP_SOCKET:
3381 netif_perm = NETIF__TCP_RECV;
3382 node_perm = NODE__TCP_RECV;
3383 recv_perm = TCP_SOCKET__RECV_MSG;
3387 netif_perm = NETIF__RAWIP_RECV;
3388 node_perm = NODE__RAWIP_RECV;
3392 err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3396 err = security_node_sid(family, addrp, len, &node_sid);
3400 err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, ad);
3407 err = security_port_sid(sk->sk_family, sk->sk_type,
3408 sk->sk_protocol, ntohs(ad->u.net.sport),
3413 err = avc_has_perm(sock_sid, port_sid,
3414 sock_class, recv_perm, ad);
3421 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3428 struct socket *sock;
3429 struct avc_audit_data ad;
3431 family = sk->sk_family;
3432 if (family != PF_INET && family != PF_INET6)
3435 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3436 if (family == PF_INET6 && skb->protocol == ntohs(ETH_P_IP))
3439 read_lock_bh(&sk->sk_callback_lock);
3440 sock = sk->sk_socket;
3442 struct inode *inode;
3443 inode = SOCK_INODE(sock);
3445 struct inode_security_struct *isec;
3446 isec = inode->i_security;
3447 sock_sid = isec->sid;
3448 sock_class = isec->sclass;
3451 read_unlock_bh(&sk->sk_callback_lock);
3455 AVC_AUDIT_DATA_INIT(&ad, NET);
3456 ad.u.net.netif = skb->dev ? skb->dev->name : "[unknown]";
3457 ad.u.net.family = family;
3459 err = selinux_parse_skb(skb, &ad, &addrp, &len, 1);
3463 if (selinux_compat_net)
3464 err = selinux_sock_rcv_skb_compat(sk, skb, &ad, sock_sid,
3468 err = avc_has_perm(sock_sid, skb->secmark, SECCLASS_PACKET,
3473 err = selinux_xfrm_sock_rcv_skb(sock_sid, skb);
3478 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
3479 int __user *optlen, unsigned len)
3484 struct sk_security_struct *ssec;
3485 struct inode_security_struct *isec;
3488 isec = SOCK_INODE(sock)->i_security;
3490 /* if UNIX_STREAM check peer_sid, if TCP check dst for labelled sa */
3491 if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET) {
3492 ssec = sock->sk->sk_security;
3493 peer_sid = ssec->peer_sid;
3495 else if (isec->sclass == SECCLASS_TCP_SOCKET) {
3496 peer_sid = selinux_socket_getpeer_stream(sock->sk);
3498 if (peer_sid == SECSID_NULL) {
3508 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
3513 if (scontext_len > len) {
3518 if (copy_to_user(optval, scontext, scontext_len))
3522 if (put_user(scontext_len, optlen))
3530 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
3532 u32 peer_secid = SECSID_NULL;
3535 if (sock && (sock->sk->sk_family == PF_UNIX))
3536 selinux_get_inode_sid(SOCK_INODE(sock), &peer_secid);
3538 peer_secid = selinux_socket_getpeer_dgram(skb);
3540 if (peer_secid == SECSID_NULL)
3542 *secid = peer_secid;
3547 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
3549 return sk_alloc_security(sk, family, priority);
3552 static void selinux_sk_free_security(struct sock *sk)
3554 sk_free_security(sk);
3557 static unsigned int selinux_sk_getsid_security(struct sock *sk, struct flowi *fl, u8 dir)
3559 struct inode_security_struct *isec;
3560 u32 sock_sid = SECINITSID_ANY_SOCKET;
3563 return selinux_no_sk_sid(fl);
3565 read_lock_bh(&sk->sk_callback_lock);
3566 isec = get_sock_isec(sk);
3569 sock_sid = isec->sid;
3571 read_unlock_bh(&sk->sk_callback_lock);
3575 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3579 struct nlmsghdr *nlh;
3580 struct socket *sock = sk->sk_socket;
3581 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3583 if (skb->len < NLMSG_SPACE(0)) {
3587 nlh = (struct nlmsghdr *)skb->data;
3589 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3591 if (err == -EINVAL) {
3592 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
3593 "SELinux: unrecognized netlink message"
3594 " type=%hu for sclass=%hu\n",
3595 nlh->nlmsg_type, isec->sclass);
3596 if (!selinux_enforcing)
3606 err = socket_has_perm(current, sock, perm);
3611 #ifdef CONFIG_NETFILTER
3613 static int selinux_ip_postroute_last_compat(struct sock *sk, struct net_device *dev,
3614 struct inode_security_struct *isec,
3615 struct avc_audit_data *ad,
3616 u16 family, char *addrp, int len)
3619 u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
3621 err = sel_netif_sids(dev, &if_sid, NULL);
3625 switch (isec->sclass) {
3626 case SECCLASS_UDP_SOCKET:
3627 netif_perm = NETIF__UDP_SEND;
3628 node_perm = NODE__UDP_SEND;
3629 send_perm = UDP_SOCKET__SEND_MSG;
3632 case SECCLASS_TCP_SOCKET:
3633 netif_perm = NETIF__TCP_SEND;
3634 node_perm = NODE__TCP_SEND;
3635 send_perm = TCP_SOCKET__SEND_MSG;
3639 netif_perm = NETIF__RAWIP_SEND;
3640 node_perm = NODE__RAWIP_SEND;
3644 err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3648 err = security_node_sid(family, addrp, len, &node_sid);
3652 err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE, node_perm, ad);
3659 err = security_port_sid(sk->sk_family,
3662 ntohs(ad->u.net.dport),
3667 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3674 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3675 struct sk_buff **pskb,
3676 const struct net_device *in,
3677 const struct net_device *out,
3678 int (*okfn)(struct sk_buff *),
3684 struct socket *sock;
3685 struct inode *inode;
3686 struct sk_buff *skb = *pskb;
3687 struct inode_security_struct *isec;
3688 struct avc_audit_data ad;
3689 struct net_device *dev = (struct net_device *)out;
3695 sock = sk->sk_socket;
3699 inode = SOCK_INODE(sock);
3703 isec = inode->i_security;
3705 AVC_AUDIT_DATA_INIT(&ad, NET);
3706 ad.u.net.netif = dev->name;
3707 ad.u.net.family = family;
3709 err = selinux_parse_skb(skb, &ad, &addrp, &len, 0);
3713 if (selinux_compat_net)
3714 err = selinux_ip_postroute_last_compat(sk, dev, isec, &ad,
3715 family, addrp, len);
3717 err = avc_has_perm(isec->sid, skb->secmark, SECCLASS_PACKET,
3723 err = selinux_xfrm_postroute_last(isec->sid, skb);
3725 return err ? NF_DROP : NF_ACCEPT;
3728 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3729 struct sk_buff **pskb,
3730 const struct net_device *in,
3731 const struct net_device *out,
3732 int (*okfn)(struct sk_buff *))
3734 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3737 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3739 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3740 struct sk_buff **pskb,
3741 const struct net_device *in,
3742 const struct net_device *out,
3743 int (*okfn)(struct sk_buff *))
3745 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3750 #endif /* CONFIG_NETFILTER */
3752 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3756 err = secondary_ops->netlink_send(sk, skb);
3760 if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
3761 err = selinux_nlmsg_perm(sk, skb);
3766 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
3769 struct avc_audit_data ad;
3771 err = secondary_ops->netlink_recv(skb, capability);
3775 AVC_AUDIT_DATA_INIT(&ad, CAP);
3776 ad.u.cap = capability;
3778 return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
3779 SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
3782 static int ipc_alloc_security(struct task_struct *task,
3783 struct kern_ipc_perm *perm,
3786 struct task_security_struct *tsec = task->security;
3787 struct ipc_security_struct *isec;
3789 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
3793 isec->sclass = sclass;
3794 isec->ipc_perm = perm;
3795 isec->sid = tsec->sid;
3796 perm->security = isec;
3801 static void ipc_free_security(struct kern_ipc_perm *perm)
3803 struct ipc_security_struct *isec = perm->security;
3804 perm->security = NULL;
3808 static int msg_msg_alloc_security(struct msg_msg *msg)
3810 struct msg_security_struct *msec;
3812 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
3817 msec->sid = SECINITSID_UNLABELED;
3818 msg->security = msec;
3823 static void msg_msg_free_security(struct msg_msg *msg)
3825 struct msg_security_struct *msec = msg->security;
3827 msg->security = NULL;
3831 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
3834 struct task_security_struct *tsec;
3835 struct ipc_security_struct *isec;
3836 struct avc_audit_data ad;
3838 tsec = current->security;
3839 isec = ipc_perms->security;
3841 AVC_AUDIT_DATA_INIT(&ad, IPC);
3842 ad.u.ipc_id = ipc_perms->key;
3844 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3847 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
3849 return msg_msg_alloc_security(msg);
3852 static void selinux_msg_msg_free_security(struct msg_msg *msg)
3854 msg_msg_free_security(msg);
3857 /* message queue security operations */
3858 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
3860 struct task_security_struct *tsec;
3861 struct ipc_security_struct *isec;
3862 struct avc_audit_data ad;
3865 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
3869 tsec = current->security;
3870 isec = msq->q_perm.security;
3872 AVC_AUDIT_DATA_INIT(&ad, IPC);
3873 ad.u.ipc_id = msq->q_perm.key;
3875 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3878 ipc_free_security(&msq->q_perm);
3884 static void selinux_msg_queue_free_security(struct msg_queue *msq)
3886 ipc_free_security(&msq->q_perm);
3889 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
3891 struct task_security_struct *tsec;
3892 struct ipc_security_struct *isec;
3893 struct avc_audit_data ad;
3895 tsec = current->security;
3896 isec = msq->q_perm.security;
3898 AVC_AUDIT_DATA_INIT(&ad, IPC);
3899 ad.u.ipc_id = msq->q_perm.key;
3901 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3902 MSGQ__ASSOCIATE, &ad);
3905 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
3913 /* No specific object, just general system-wide information. */
3914 return task_has_system(current, SYSTEM__IPC_INFO);
3917 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
3920 perms = MSGQ__SETATTR;
3923 perms = MSGQ__DESTROY;
3929 err = ipc_has_perm(&msq->q_perm, perms);
3933 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
3935 struct task_security_struct *tsec;
3936 struct ipc_security_struct *isec;
3937 struct msg_security_struct *msec;
3938 struct avc_audit_data ad;
3941 tsec = current->security;
3942 isec = msq->q_perm.security;
3943 msec = msg->security;
3946 * First time through, need to assign label to the message
3948 if (msec->sid == SECINITSID_UNLABELED) {
3950 * Compute new sid based on current process and
3951 * message queue this message will be stored in
3953 rc = security_transition_sid(tsec->sid,
3961 AVC_AUDIT_DATA_INIT(&ad, IPC);
3962 ad.u.ipc_id = msq->q_perm.key;
3964 /* Can this process write to the queue? */
3965 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3968 /* Can this process send the message */
3969 rc = avc_has_perm(tsec->sid, msec->sid,
3970 SECCLASS_MSG, MSG__SEND, &ad);
3972 /* Can the message be put in the queue? */
3973 rc = avc_has_perm(msec->sid, isec->sid,
3974 SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
3979 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
3980 struct task_struct *target,
3981 long type, int mode)
3983 struct task_security_struct *tsec;
3984 struct ipc_security_struct *isec;
3985 struct msg_security_struct *msec;
3986 struct avc_audit_data ad;
3989 tsec = target->security;
3990 isec = msq->q_perm.security;
3991 msec = msg->security;
3993 AVC_AUDIT_DATA_INIT(&ad, IPC);
3994 ad.u.ipc_id = msq->q_perm.key;
3996 rc = avc_has_perm(tsec->sid, isec->sid,
3997 SECCLASS_MSGQ, MSGQ__READ, &ad);
3999 rc = avc_has_perm(tsec->sid, msec->sid,
4000 SECCLASS_MSG, MSG__RECEIVE, &ad);
4004 /* Shared Memory security operations */
4005 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4007 struct task_security_struct *tsec;
4008 struct ipc_security_struct *isec;
4009 struct avc_audit_data ad;
4012 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4016 tsec = current->security;
4017 isec = shp->shm_perm.security;
4019 AVC_AUDIT_DATA_INIT(&ad, IPC);
4020 ad.u.ipc_id = shp->shm_perm.key;
4022 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4025 ipc_free_security(&shp->shm_perm);
4031 static void selinux_shm_free_security(struct shmid_kernel *shp)
4033 ipc_free_security(&shp->shm_perm);
4036 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4038 struct task_security_struct *tsec;
4039 struct ipc_security_struct *isec;
4040 struct avc_audit_data ad;
4042 tsec = current->security;
4043 isec = shp->shm_perm.security;
4045 AVC_AUDIT_DATA_INIT(&ad, IPC);
4046 ad.u.ipc_id = shp->shm_perm.key;
4048 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4049 SHM__ASSOCIATE, &ad);
4052 /* Note, at this point, shp is locked down */
4053 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4061 /* No specific object, just general system-wide information. */
4062 return task_has_system(current, SYSTEM__IPC_INFO);
4065 perms = SHM__GETATTR | SHM__ASSOCIATE;
4068 perms = SHM__SETATTR;
4075 perms = SHM__DESTROY;
4081 err = ipc_has_perm(&shp->shm_perm, perms);
4085 static int selinux_shm_shmat(struct shmid_kernel *shp,
4086 char __user *shmaddr, int shmflg)
4091 rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4095 if (shmflg & SHM_RDONLY)
4098 perms = SHM__READ | SHM__WRITE;
4100 return ipc_has_perm(&shp->shm_perm, perms);
4103 /* Semaphore security operations */
4104 static int selinux_sem_alloc_security(struct sem_array *sma)
4106 struct task_security_struct *tsec;
4107 struct ipc_security_struct *isec;
4108 struct avc_audit_data ad;
4111 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4115 tsec = current->security;
4116 isec = sma->sem_perm.security;
4118 AVC_AUDIT_DATA_INIT(&ad, IPC);
4119 ad.u.ipc_id = sma->sem_perm.key;
4121 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4124 ipc_free_security(&sma->sem_perm);
4130 static void selinux_sem_free_security(struct sem_array *sma)
4132 ipc_free_security(&sma->sem_perm);
4135 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4137 struct task_security_struct *tsec;
4138 struct ipc_security_struct *isec;
4139 struct avc_audit_data ad;
4141 tsec = current->security;
4142 isec = sma->sem_perm.security;
4144 AVC_AUDIT_DATA_INIT(&ad, IPC);
4145 ad.u.ipc_id = sma->sem_perm.key;
4147 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4148 SEM__ASSOCIATE, &ad);
4151 /* Note, at this point, sma is locked down */
4152 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4160 /* No specific object, just general system-wide information. */
4161 return task_has_system(current, SYSTEM__IPC_INFO);
4165 perms = SEM__GETATTR;
4176 perms = SEM__DESTROY;
4179 perms = SEM__SETATTR;
4183 perms = SEM__GETATTR | SEM__ASSOCIATE;
4189 err = ipc_has_perm(&sma->sem_perm, perms);
4193 static int selinux_sem_semop(struct sem_array *sma,
4194 struct sembuf *sops, unsigned nsops, int alter)
4199 perms = SEM__READ | SEM__WRITE;
4203 return ipc_has_perm(&sma->sem_perm, perms);
4206 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4212 av |= IPC__UNIX_READ;
4214 av |= IPC__UNIX_WRITE;
4219 return ipc_has_perm(ipcp, av);
4222 /* module stacking operations */
4223 static int selinux_register_security (const char *name, struct security_operations *ops)
4225 if (secondary_ops != original_ops) {
4226 printk(KERN_INFO "%s: There is already a secondary security "
4227 "module registered.\n", __FUNCTION__);
4231 secondary_ops = ops;
4233 printk(KERN_INFO "%s: Registering secondary module %s\n",
4240 static int selinux_unregister_security (const char *name, struct security_operations *ops)
4242 if (ops != secondary_ops) {
4243 printk (KERN_INFO "%s: trying to unregister a security module "
4244 "that is not registered.\n", __FUNCTION__);
4248 secondary_ops = original_ops;
4253 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4256 inode_doinit_with_dentry(inode, dentry);
4259 static int selinux_getprocattr(struct task_struct *p,
4260 char *name, void *value, size_t size)
4262 struct task_security_struct *tsec;
4267 error = task_has_perm(current, p, PROCESS__GETATTR);
4274 if (!strcmp(name, "current"))
4276 else if (!strcmp(name, "prev"))
4278 else if (!strcmp(name, "exec"))
4279 sid = tsec->exec_sid;
4280 else if (!strcmp(name, "fscreate"))
4281 sid = tsec->create_sid;
4282 else if (!strcmp(name, "keycreate"))
4283 sid = tsec->keycreate_sid;
4284 else if (!strcmp(name, "sockcreate"))
4285 sid = tsec->sockcreate_sid;
4292 return selinux_getsecurity(sid, value, size);
4295 static int selinux_setprocattr(struct task_struct *p,
4296 char *name, void *value, size_t size)
4298 struct task_security_struct *tsec;
4299 struct task_struct *tracer;
4305 /* SELinux only allows a process to change its own
4306 security attributes. */
4311 * Basic control over ability to set these attributes at all.
4312 * current == p, but we'll pass them separately in case the
4313 * above restriction is ever removed.
4315 if (!strcmp(name, "exec"))
4316 error = task_has_perm(current, p, PROCESS__SETEXEC);
4317 else if (!strcmp(name, "fscreate"))
4318 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4319 else if (!strcmp(name, "keycreate"))
4320 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
4321 else if (!strcmp(name, "sockcreate"))
4322 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
4323 else if (!strcmp(name, "current"))
4324 error = task_has_perm(current, p, PROCESS__SETCURRENT);
4330 /* Obtain a SID for the context, if one was specified. */
4331 if (size && str[1] && str[1] != '\n') {
4332 if (str[size-1] == '\n') {
4336 error = security_context_to_sid(value, size, &sid);
4341 /* Permission checking based on the specified context is
4342 performed during the actual operation (execve,
4343 open/mkdir/...), when we know the full context of the
4344 operation. See selinux_bprm_set_security for the execve
4345 checks and may_create for the file creation checks. The
4346 operation will then fail if the context is not permitted. */
4348 if (!strcmp(name, "exec"))
4349 tsec->exec_sid = sid;
4350 else if (!strcmp(name, "fscreate"))
4351 tsec->create_sid = sid;
4352 else if (!strcmp(name, "keycreate")) {
4353 error = may_create_key(sid, p);
4356 tsec->keycreate_sid = sid;
4357 } else if (!strcmp(name, "sockcreate"))
4358 tsec->sockcreate_sid = sid;
4359 else if (!strcmp(name, "current")) {
4360 struct av_decision avd;
4365 /* Only allow single threaded processes to change context */
4366 if (atomic_read(&p->mm->mm_users) != 1) {
4367 struct task_struct *g, *t;
4368 struct mm_struct *mm = p->mm;
4369 read_lock(&tasklist_lock);
4370 do_each_thread(g, t)
4371 if (t->mm == mm && t != p) {
4372 read_unlock(&tasklist_lock);
4375 while_each_thread(g, t);
4376 read_unlock(&tasklist_lock);
4379 /* Check permissions for the transition. */
4380 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
4381 PROCESS__DYNTRANSITION, NULL);
4385 /* Check for ptracing, and update the task SID if ok.
4386 Otherwise, leave SID unchanged and fail. */
4389 tracer = tracehook_tracer_task(p);
4390 if (tracer != NULL) {
4391 struct task_security_struct *ptsec = tracer->security;
4392 u32 ptsid = ptsec->sid;
4394 error = avc_has_perm_noaudit(ptsid, sid,
4396 PROCESS__PTRACE, &avd);
4400 avc_audit(ptsid, sid, SECCLASS_PROCESS,
4401 PROCESS__PTRACE, &avd, error, NULL);
4416 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
4418 return security_sid_to_context(secid, secdata, seclen);
4421 static void selinux_release_secctx(char *secdata, u32 seclen)
4429 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
4430 unsigned long flags)
4432 struct task_security_struct *tsec = tsk->security;
4433 struct key_security_struct *ksec;
4435 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
4440 if (tsec->keycreate_sid)
4441 ksec->sid = tsec->keycreate_sid;
4443 ksec->sid = tsec->sid;
4449 static void selinux_key_free(struct key *k)
4451 struct key_security_struct *ksec = k->security;
4457 static int selinux_key_permission(key_ref_t key_ref,
4458 struct task_struct *ctx,
4462 struct task_security_struct *tsec;
4463 struct key_security_struct *ksec;
4465 key = key_ref_to_ptr(key_ref);
4467 tsec = ctx->security;
4468 ksec = key->security;
4470 /* if no specific permissions are requested, we skip the
4471 permission check. No serious, additional covert channels
4472 appear to be created. */
4476 return avc_has_perm(tsec->sid, ksec->sid,
4477 SECCLASS_KEY, perm, NULL);
4482 static struct security_operations selinux_ops = {
4483 .ptrace = selinux_ptrace,
4484 .capget = selinux_capget,
4485 .capset_check = selinux_capset_check,
4486 .capset_set = selinux_capset_set,
4487 .sysctl = selinux_sysctl,
4488 .capable = selinux_capable,
4489 .quotactl = selinux_quotactl,
4490 .quota_on = selinux_quota_on,
4491 .syslog = selinux_syslog,
4492 .vm_enough_memory = selinux_vm_enough_memory,
4494 .netlink_send = selinux_netlink_send,
4495 .netlink_recv = selinux_netlink_recv,
4497 .bprm_alloc_security = selinux_bprm_alloc_security,
4498 .bprm_free_security = selinux_bprm_free_security,
4499 .bprm_apply_creds = selinux_bprm_apply_creds,
4500 .bprm_post_apply_creds = selinux_bprm_post_apply_creds,
4501 .bprm_set_security = selinux_bprm_set_security,
4502 .bprm_check_security = selinux_bprm_check_security,
4503 .bprm_secureexec = selinux_bprm_secureexec,
4505 .sb_alloc_security = selinux_sb_alloc_security,
4506 .sb_free_security = selinux_sb_free_security,
4507 .sb_copy_data = selinux_sb_copy_data,
4508 .sb_kern_mount = selinux_sb_kern_mount,
4509 .sb_statfs = selinux_sb_statfs,
4510 .sb_mount = selinux_mount,
4511 .sb_umount = selinux_umount,
4513 .inode_alloc_security = selinux_inode_alloc_security,
4514 .inode_free_security = selinux_inode_free_security,
4515 .inode_init_security = selinux_inode_init_security,
4516 .inode_create = selinux_inode_create,
4517 .inode_link = selinux_inode_link,
4518 .inode_unlink = selinux_inode_unlink,
4519 .inode_symlink = selinux_inode_symlink,
4520 .inode_mkdir = selinux_inode_mkdir,
4521 .inode_rmdir = selinux_inode_rmdir,
4522 .inode_mknod = selinux_inode_mknod,
4523 .inode_rename = selinux_inode_rename,
4524 .inode_readlink = selinux_inode_readlink,
4525 .inode_follow_link = selinux_inode_follow_link,
4526 .inode_permission = selinux_inode_permission,
4527 .inode_setattr = selinux_inode_setattr,
4528 .inode_getattr = selinux_inode_getattr,
4529 .inode_setxattr = selinux_inode_setxattr,
4530 .inode_post_setxattr = selinux_inode_post_setxattr,
4531 .inode_getxattr = selinux_inode_getxattr,
4532 .inode_listxattr = selinux_inode_listxattr,
4533 .inode_removexattr = selinux_inode_removexattr,
4534 .inode_xattr_getsuffix = selinux_inode_xattr_getsuffix,
4535 .inode_getsecurity = selinux_inode_getsecurity,
4536 .inode_setsecurity = selinux_inode_setsecurity,
4537 .inode_listsecurity = selinux_inode_listsecurity,
4539 .file_permission = selinux_file_permission,
4540 .file_alloc_security = selinux_file_alloc_security,
4541 .file_free_security = selinux_file_free_security,
4542 .file_ioctl = selinux_file_ioctl,
4543 .file_mmap = selinux_file_mmap,
4544 .file_mprotect = selinux_file_mprotect,
4545 .file_lock = selinux_file_lock,
4546 .file_fcntl = selinux_file_fcntl,
4547 .file_set_fowner = selinux_file_set_fowner,
4548 .file_send_sigiotask = selinux_file_send_sigiotask,
4549 .file_receive = selinux_file_receive,
4551 .task_create = selinux_task_create,
4552 .task_alloc_security = selinux_task_alloc_security,
4553 .task_free_security = selinux_task_free_security,
4554 .task_setuid = selinux_task_setuid,
4555 .task_post_setuid = selinux_task_post_setuid,
4556 .task_setgid = selinux_task_setgid,
4557 .task_setpgid = selinux_task_setpgid,
4558 .task_getpgid = selinux_task_getpgid,
4559 .task_getsid = selinux_task_getsid,
4560 .task_getsecid = selinux_task_getsecid,
4561 .task_setgroups = selinux_task_setgroups,
4562 .task_setnice = selinux_task_setnice,
4563 .task_setioprio = selinux_task_setioprio,
4564 .task_getioprio = selinux_task_getioprio,
4565 .task_setrlimit = selinux_task_setrlimit,
4566 .task_setscheduler = selinux_task_setscheduler,
4567 .task_getscheduler = selinux_task_getscheduler,
4568 .task_movememory = selinux_task_movememory,
4569 .task_kill = selinux_task_kill,
4570 .task_wait = selinux_task_wait,
4571 .task_prctl = selinux_task_prctl,
4572 .task_reparent_to_init = selinux_task_reparent_to_init,
4573 .task_to_inode = selinux_task_to_inode,
4575 .ipc_permission = selinux_ipc_permission,
4577 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
4578 .msg_msg_free_security = selinux_msg_msg_free_security,
4580 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
4581 .msg_queue_free_security = selinux_msg_queue_free_security,
4582 .msg_queue_associate = selinux_msg_queue_associate,
4583 .msg_queue_msgctl = selinux_msg_queue_msgctl,
4584 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
4585 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
4587 .shm_alloc_security = selinux_shm_alloc_security,
4588 .shm_free_security = selinux_shm_free_security,
4589 .shm_associate = selinux_shm_associate,
4590 .shm_shmctl = selinux_shm_shmctl,
4591 .shm_shmat = selinux_shm_shmat,
4593 .sem_alloc_security = selinux_sem_alloc_security,
4594 .sem_free_security = selinux_sem_free_security,
4595 .sem_associate = selinux_sem_associate,
4596 .sem_semctl = selinux_sem_semctl,
4597 .sem_semop = selinux_sem_semop,
4599 .register_security = selinux_register_security,
4600 .unregister_security = selinux_unregister_security,
4602 .d_instantiate = selinux_d_instantiate,
4604 .getprocattr = selinux_getprocattr,
4605 .setprocattr = selinux_setprocattr,
4607 .secid_to_secctx = selinux_secid_to_secctx,
4608 .release_secctx = selinux_release_secctx,
4610 .unix_stream_connect = selinux_socket_unix_stream_connect,
4611 .unix_may_send = selinux_socket_unix_may_send,
4613 .socket_create = selinux_socket_create,
4614 .socket_post_create = selinux_socket_post_create,
4615 .socket_bind = selinux_socket_bind,
4616 .socket_connect = selinux_socket_connect,
4617 .socket_listen = selinux_socket_listen,
4618 .socket_accept = selinux_socket_accept,
4619 .socket_sendmsg = selinux_socket_sendmsg,
4620 .socket_recvmsg = selinux_socket_recvmsg,
4621 .socket_getsockname = selinux_socket_getsockname,
4622 .socket_getpeername = selinux_socket_getpeername,
4623 .socket_getsockopt = selinux_socket_getsockopt,
4624 .socket_setsockopt = selinux_socket_setsockopt,
4625 .socket_shutdown = selinux_socket_shutdown,
4626 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
4627 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
4628 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
4629 .sk_alloc_security = selinux_sk_alloc_security,
4630 .sk_free_security = selinux_sk_free_security,
4631 .sk_getsid = selinux_sk_getsid_security,
4633 #ifdef CONFIG_SECURITY_NETWORK_XFRM
4634 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
4635 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
4636 .xfrm_policy_free_security = selinux_xfrm_policy_free,
4637 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
4638 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
4639 .xfrm_state_free_security = selinux_xfrm_state_free,
4640 .xfrm_state_delete_security = selinux_xfrm_state_delete,
4641 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
4645 .key_alloc = selinux_key_alloc,
4646 .key_free = selinux_key_free,
4647 .key_permission = selinux_key_permission,
4651 static __init int selinux_init(void)
4653 struct task_security_struct *tsec;
4655 if (!selinux_enabled) {
4656 printk(KERN_INFO "SELinux: Disabled at boot.\n");
4660 printk(KERN_INFO "SELinux: Initializing.\n");
4662 /* Set the security state for the initial task. */
4663 if (task_alloc_security(current))
4664 panic("SELinux: Failed to initialize initial task.\n");
4665 tsec = current->security;
4666 tsec->osid = tsec->sid = SECINITSID_KERNEL;
4668 sel_inode_cache = kmem_cache_create("selinux_inode_security",
4669 sizeof(struct inode_security_struct),
4670 0, SLAB_PANIC, NULL, NULL);
4673 original_ops = secondary_ops = security_ops;
4675 panic ("SELinux: No initial security operations\n");
4676 if (register_security (&selinux_ops))
4677 panic("SELinux: Unable to register with kernel.\n");
4679 if (selinux_enforcing) {
4680 printk(KERN_INFO "SELinux: Starting in enforcing mode\n");
4682 printk(KERN_INFO "SELinux: Starting in permissive mode\n");
4686 /* Add security information to initial keyrings */
4687 selinux_key_alloc(&root_user_keyring, current,
4688 KEY_ALLOC_NOT_IN_QUOTA);
4689 selinux_key_alloc(&root_session_keyring, current,
4690 KEY_ALLOC_NOT_IN_QUOTA);
4696 void selinux_complete_init(void)
4698 printk(KERN_INFO "SELinux: Completing initialization.\n");
4700 /* Set up any superblocks initialized prior to the policy load. */
4701 printk(KERN_INFO "SELinux: Setting up existing superblocks.\n");
4702 spin_lock(&sb_lock);
4703 spin_lock(&sb_security_lock);
4705 if (!list_empty(&superblock_security_head)) {
4706 struct superblock_security_struct *sbsec =
4707 list_entry(superblock_security_head.next,
4708 struct superblock_security_struct,
4710 struct super_block *sb = sbsec->sb;
4712 spin_unlock(&sb_security_lock);
4713 spin_unlock(&sb_lock);
4714 down_read(&sb->s_umount);
4716 superblock_doinit(sb, NULL);
4718 spin_lock(&sb_lock);
4719 spin_lock(&sb_security_lock);
4720 list_del_init(&sbsec->list);
4723 spin_unlock(&sb_security_lock);
4724 spin_unlock(&sb_lock);
4727 /* SELinux requires early initialization in order to label
4728 all processes and objects when they are created. */
4729 security_initcall(selinux_init);
4731 #if defined(CONFIG_NETFILTER)
4733 static struct nf_hook_ops selinux_ipv4_op = {
4734 .hook = selinux_ipv4_postroute_last,
4735 .owner = THIS_MODULE,
4737 .hooknum = NF_IP_POST_ROUTING,
4738 .priority = NF_IP_PRI_SELINUX_LAST,
4741 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4743 static struct nf_hook_ops selinux_ipv6_op = {
4744 .hook = selinux_ipv6_postroute_last,
4745 .owner = THIS_MODULE,
4747 .hooknum = NF_IP6_POST_ROUTING,
4748 .priority = NF_IP6_PRI_SELINUX_LAST,
4753 static int __init selinux_nf_ip_init(void)
4757 if (!selinux_enabled)
4760 printk(KERN_INFO "SELinux: Registering netfilter hooks\n");
4762 err = nf_register_hook(&selinux_ipv4_op);
4764 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
4766 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4768 err = nf_register_hook(&selinux_ipv6_op);
4770 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
4778 __initcall(selinux_nf_ip_init);
4780 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4781 static void selinux_nf_ip_exit(void)
4783 printk(KERN_INFO "SELinux: Unregistering netfilter hooks\n");
4785 nf_unregister_hook(&selinux_ipv4_op);
4786 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4787 nf_unregister_hook(&selinux_ipv6_op);
4792 #else /* CONFIG_NETFILTER */
4794 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4795 #define selinux_nf_ip_exit()
4798 #endif /* CONFIG_NETFILTER */
4800 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4801 int selinux_disable(void)
4803 extern void exit_sel_fs(void);
4804 static int selinux_disabled = 0;
4806 if (ss_initialized) {
4807 /* Not permitted after initial policy load. */
4811 if (selinux_disabled) {
4812 /* Only do this once. */
4816 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
4818 selinux_disabled = 1;
4819 selinux_enabled = 0;
4821 /* Reset security_ops to the secondary module, dummy or capability. */
4822 security_ops = secondary_ops;
4824 /* Unregister netfilter hooks. */
4825 selinux_nf_ip_exit();
4827 /* Unregister selinuxfs. */