2 * NSA Security-Enhanced Linux (SELinux) security module
4 * This file contains the SELinux hook function implementations.
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License version 2,
18 * as published by the Free Software Foundation.
21 #include <linux/config.h>
22 #include <linux/module.h>
23 #include <linux/init.h>
24 #include <linux/kernel.h>
25 #include <linux/ptrace.h>
26 #include <linux/errno.h>
27 #include <linux/sched.h>
28 #include <linux/security.h>
29 #include <linux/xattr.h>
30 #include <linux/capability.h>
31 #include <linux/unistd.h>
33 #include <linux/mman.h>
34 #include <linux/slab.h>
35 #include <linux/pagemap.h>
36 #include <linux/swap.h>
37 #include <linux/smp_lock.h>
38 #include <linux/spinlock.h>
39 #include <linux/syscalls.h>
40 #include <linux/file.h>
41 #include <linux/namei.h>
42 #include <linux/mount.h>
43 #include <linux/ext2_fs.h>
44 #include <linux/proc_fs.h>
46 #include <linux/netfilter_ipv4.h>
47 #include <linux/netfilter_ipv6.h>
48 #include <linux/tty.h>
50 #include <net/ip.h> /* for sysctl_local_port_range[] */
51 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
52 #include <asm/uaccess.h>
53 #include <asm/semaphore.h>
54 #include <asm/ioctls.h>
55 #include <linux/bitops.h>
56 #include <linux/interrupt.h>
57 #include <linux/netdevice.h> /* for network interface checks */
58 #include <linux/netlink.h>
59 #include <linux/tcp.h>
60 #include <linux/udp.h>
61 #include <linux/quota.h>
62 #include <linux/un.h> /* for Unix socket types */
63 #include <net/af_unix.h> /* for Unix socket types */
64 #include <linux/parser.h>
65 #include <linux/nfs_mount.h>
67 #include <linux/hugetlb.h>
68 #include <linux/personality.h>
69 #include <linux/sysctl.h>
70 #include <linux/audit.h>
71 #include <linux/string.h>
78 #define XATTR_SELINUX_SUFFIX "selinux"
79 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
81 extern unsigned int policydb_loaded_version;
82 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
84 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
85 int selinux_enforcing = 0;
87 static int __init enforcing_setup(char *str)
89 selinux_enforcing = simple_strtol(str,NULL,0);
92 __setup("enforcing=", enforcing_setup);
95 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
96 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
98 static int __init selinux_enabled_setup(char *str)
100 selinux_enabled = simple_strtol(str, NULL, 0);
103 __setup("selinux=", selinux_enabled_setup);
105 int selinux_enabled = 1;
108 /* Original (dummy) security module. */
109 static struct security_operations *original_ops = NULL;
111 /* Minimal support for a secondary security module,
112 just to allow the use of the dummy or capability modules.
113 The owlsm module can alternatively be used as a secondary
114 module as long as CONFIG_OWLSM_FD is not enabled. */
115 static struct security_operations *secondary_ops = NULL;
117 /* Lists of inode and superblock security structures initialized
118 before the policy was loaded. */
119 static LIST_HEAD(superblock_security_head);
120 static DEFINE_SPINLOCK(sb_security_lock);
122 static kmem_cache_t *sel_inode_cache;
124 /* Return security context for a given sid or just the context
125 length if the buffer is null or length is 0 */
126 static int selinux_getsecurity(u32 sid, void *buffer, size_t size)
132 rc = security_sid_to_context(sid, &context, &len);
136 if (!buffer || !size)
137 goto getsecurity_exit;
141 goto getsecurity_exit;
143 memcpy(buffer, context, len);
150 /* Allocate and free functions for each kind of security blob. */
152 static int task_alloc_security(struct task_struct *task)
154 struct task_security_struct *tsec;
156 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
161 tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
162 task->security = tsec;
167 static void task_free_security(struct task_struct *task)
169 struct task_security_struct *tsec = task->security;
170 task->security = NULL;
174 static int inode_alloc_security(struct inode *inode)
176 struct task_security_struct *tsec = current->security;
177 struct inode_security_struct *isec;
179 isec = kmem_cache_alloc(sel_inode_cache, SLAB_KERNEL);
183 memset(isec, 0, sizeof(*isec));
184 init_MUTEX(&isec->sem);
185 INIT_LIST_HEAD(&isec->list);
187 isec->sid = SECINITSID_UNLABELED;
188 isec->sclass = SECCLASS_FILE;
189 isec->task_sid = tsec->sid;
190 inode->i_security = isec;
195 static void inode_free_security(struct inode *inode)
197 struct inode_security_struct *isec = inode->i_security;
198 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
200 spin_lock(&sbsec->isec_lock);
201 if (!list_empty(&isec->list))
202 list_del_init(&isec->list);
203 spin_unlock(&sbsec->isec_lock);
205 inode->i_security = NULL;
206 kmem_cache_free(sel_inode_cache, isec);
209 static int file_alloc_security(struct file *file)
211 struct task_security_struct *tsec = current->security;
212 struct file_security_struct *fsec;
214 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
219 fsec->sid = tsec->sid;
220 fsec->fown_sid = tsec->sid;
221 file->f_security = fsec;
226 static void file_free_security(struct file *file)
228 struct file_security_struct *fsec = file->f_security;
229 file->f_security = NULL;
233 static int superblock_alloc_security(struct super_block *sb)
235 struct superblock_security_struct *sbsec;
237 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
241 init_MUTEX(&sbsec->sem);
242 INIT_LIST_HEAD(&sbsec->list);
243 INIT_LIST_HEAD(&sbsec->isec_head);
244 spin_lock_init(&sbsec->isec_lock);
246 sbsec->sid = SECINITSID_UNLABELED;
247 sbsec->def_sid = SECINITSID_FILE;
248 sb->s_security = sbsec;
253 static void superblock_free_security(struct super_block *sb)
255 struct superblock_security_struct *sbsec = sb->s_security;
257 spin_lock(&sb_security_lock);
258 if (!list_empty(&sbsec->list))
259 list_del_init(&sbsec->list);
260 spin_unlock(&sb_security_lock);
262 sb->s_security = NULL;
266 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
268 struct sk_security_struct *ssec;
270 if (family != PF_UNIX)
273 ssec = kzalloc(sizeof(*ssec), priority);
278 ssec->peer_sid = SECINITSID_UNLABELED;
279 sk->sk_security = ssec;
284 static void sk_free_security(struct sock *sk)
286 struct sk_security_struct *ssec = sk->sk_security;
288 if (sk->sk_family != PF_UNIX)
291 sk->sk_security = NULL;
295 /* The security server must be initialized before
296 any labeling or access decisions can be provided. */
297 extern int ss_initialized;
299 /* The file system's label must be initialized prior to use. */
301 static char *labeling_behaviors[6] = {
303 "uses transition SIDs",
305 "uses genfs_contexts",
306 "not configured for labeling",
307 "uses mountpoint labeling",
310 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
312 static inline int inode_doinit(struct inode *inode)
314 return inode_doinit_with_dentry(inode, NULL);
323 static match_table_t tokens = {
324 {Opt_context, "context=%s"},
325 {Opt_fscontext, "fscontext=%s"},
326 {Opt_defcontext, "defcontext=%s"},
329 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
331 static int try_context_mount(struct super_block *sb, void *data)
333 char *context = NULL, *defcontext = NULL;
336 int alloc = 0, rc = 0, seen = 0;
337 struct task_security_struct *tsec = current->security;
338 struct superblock_security_struct *sbsec = sb->s_security;
343 name = sb->s_type->name;
345 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
347 /* NFS we understand. */
348 if (!strcmp(name, "nfs")) {
349 struct nfs_mount_data *d = data;
351 if (d->version < NFS_MOUNT_VERSION)
355 context = d->context;
362 /* Standard string-based options. */
363 char *p, *options = data;
365 while ((p = strsep(&options, ",")) != NULL) {
367 substring_t args[MAX_OPT_ARGS];
372 token = match_token(p, tokens, args);
378 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
381 context = match_strdup(&args[0]);
392 if (seen & (Opt_context|Opt_fscontext)) {
394 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
397 context = match_strdup(&args[0]);
404 seen |= Opt_fscontext;
408 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
410 printk(KERN_WARNING "SELinux: "
411 "defcontext option is invalid "
412 "for this filesystem type\n");
415 if (seen & (Opt_context|Opt_defcontext)) {
417 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
420 defcontext = match_strdup(&args[0]);
427 seen |= Opt_defcontext;
432 printk(KERN_WARNING "SELinux: unknown mount "
444 rc = security_context_to_sid(context, strlen(context), &sid);
446 printk(KERN_WARNING "SELinux: security_context_to_sid"
447 "(%s) failed for (dev %s, type %s) errno=%d\n",
448 context, sb->s_id, name, rc);
452 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
453 FILESYSTEM__RELABELFROM, NULL);
457 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
458 FILESYSTEM__RELABELTO, NULL);
464 if (seen & Opt_context)
465 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
469 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
471 printk(KERN_WARNING "SELinux: security_context_to_sid"
472 "(%s) failed for (dev %s, type %s) errno=%d\n",
473 defcontext, sb->s_id, name, rc);
477 if (sid == sbsec->def_sid)
480 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
481 FILESYSTEM__RELABELFROM, NULL);
485 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
486 FILESYSTEM__ASSOCIATE, NULL);
490 sbsec->def_sid = sid;
502 static int superblock_doinit(struct super_block *sb, void *data)
504 struct superblock_security_struct *sbsec = sb->s_security;
505 struct dentry *root = sb->s_root;
506 struct inode *inode = root->d_inode;
510 if (sbsec->initialized)
513 if (!ss_initialized) {
514 /* Defer initialization until selinux_complete_init,
515 after the initial policy is loaded and the security
516 server is ready to handle calls. */
517 spin_lock(&sb_security_lock);
518 if (list_empty(&sbsec->list))
519 list_add(&sbsec->list, &superblock_security_head);
520 spin_unlock(&sb_security_lock);
524 /* Determine the labeling behavior to use for this filesystem type. */
525 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
527 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
528 __FUNCTION__, sb->s_type->name, rc);
532 rc = try_context_mount(sb, data);
536 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
537 /* Make sure that the xattr handler exists and that no
538 error other than -ENODATA is returned by getxattr on
539 the root directory. -ENODATA is ok, as this may be
540 the first boot of the SELinux kernel before we have
541 assigned xattr values to the filesystem. */
542 if (!inode->i_op->getxattr) {
543 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
544 "xattr support\n", sb->s_id, sb->s_type->name);
548 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
549 if (rc < 0 && rc != -ENODATA) {
550 if (rc == -EOPNOTSUPP)
551 printk(KERN_WARNING "SELinux: (dev %s, type "
552 "%s) has no security xattr handler\n",
553 sb->s_id, sb->s_type->name);
555 printk(KERN_WARNING "SELinux: (dev %s, type "
556 "%s) getxattr errno %d\n", sb->s_id,
557 sb->s_type->name, -rc);
562 if (strcmp(sb->s_type->name, "proc") == 0)
565 sbsec->initialized = 1;
567 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
568 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
569 sb->s_id, sb->s_type->name);
572 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
573 sb->s_id, sb->s_type->name,
574 labeling_behaviors[sbsec->behavior-1]);
577 /* Initialize the root inode. */
578 rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
580 /* Initialize any other inodes associated with the superblock, e.g.
581 inodes created prior to initial policy load or inodes created
582 during get_sb by a pseudo filesystem that directly
584 spin_lock(&sbsec->isec_lock);
586 if (!list_empty(&sbsec->isec_head)) {
587 struct inode_security_struct *isec =
588 list_entry(sbsec->isec_head.next,
589 struct inode_security_struct, list);
590 struct inode *inode = isec->inode;
591 spin_unlock(&sbsec->isec_lock);
592 inode = igrab(inode);
594 if (!IS_PRIVATE (inode))
598 spin_lock(&sbsec->isec_lock);
599 list_del_init(&isec->list);
602 spin_unlock(&sbsec->isec_lock);
608 static inline u16 inode_mode_to_security_class(umode_t mode)
610 switch (mode & S_IFMT) {
612 return SECCLASS_SOCK_FILE;
614 return SECCLASS_LNK_FILE;
616 return SECCLASS_FILE;
618 return SECCLASS_BLK_FILE;
622 return SECCLASS_CHR_FILE;
624 return SECCLASS_FIFO_FILE;
628 return SECCLASS_FILE;
631 static inline int default_protocol_stream(int protocol)
633 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
636 static inline int default_protocol_dgram(int protocol)
638 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
641 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
648 return SECCLASS_UNIX_STREAM_SOCKET;
650 return SECCLASS_UNIX_DGRAM_SOCKET;
657 if (default_protocol_stream(protocol))
658 return SECCLASS_TCP_SOCKET;
660 return SECCLASS_RAWIP_SOCKET;
662 if (default_protocol_dgram(protocol))
663 return SECCLASS_UDP_SOCKET;
665 return SECCLASS_RAWIP_SOCKET;
667 return SECCLASS_RAWIP_SOCKET;
673 return SECCLASS_NETLINK_ROUTE_SOCKET;
674 case NETLINK_FIREWALL:
675 return SECCLASS_NETLINK_FIREWALL_SOCKET;
676 case NETLINK_INET_DIAG:
677 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
679 return SECCLASS_NETLINK_NFLOG_SOCKET;
681 return SECCLASS_NETLINK_XFRM_SOCKET;
682 case NETLINK_SELINUX:
683 return SECCLASS_NETLINK_SELINUX_SOCKET;
685 return SECCLASS_NETLINK_AUDIT_SOCKET;
687 return SECCLASS_NETLINK_IP6FW_SOCKET;
688 case NETLINK_DNRTMSG:
689 return SECCLASS_NETLINK_DNRT_SOCKET;
690 case NETLINK_KOBJECT_UEVENT:
691 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
693 return SECCLASS_NETLINK_SOCKET;
696 return SECCLASS_PACKET_SOCKET;
698 return SECCLASS_KEY_SOCKET;
700 return SECCLASS_APPLETALK_SOCKET;
703 return SECCLASS_SOCKET;
706 #ifdef CONFIG_PROC_FS
707 static int selinux_proc_get_sid(struct proc_dir_entry *de,
712 char *buffer, *path, *end;
714 buffer = (char*)__get_free_page(GFP_KERNEL);
724 while (de && de != de->parent) {
725 buflen -= de->namelen + 1;
729 memcpy(end, de->name, de->namelen);
734 rc = security_genfs_sid("proc", path, tclass, sid);
735 free_page((unsigned long)buffer);
739 static int selinux_proc_get_sid(struct proc_dir_entry *de,
747 /* The inode's security attributes must be initialized before first use. */
748 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
750 struct superblock_security_struct *sbsec = NULL;
751 struct inode_security_struct *isec = inode->i_security;
753 struct dentry *dentry;
754 #define INITCONTEXTLEN 255
755 char *context = NULL;
760 if (isec->initialized)
765 if (isec->initialized)
768 sbsec = inode->i_sb->s_security;
769 if (!sbsec->initialized) {
770 /* Defer initialization until selinux_complete_init,
771 after the initial policy is loaded and the security
772 server is ready to handle calls. */
773 spin_lock(&sbsec->isec_lock);
774 if (list_empty(&isec->list))
775 list_add(&isec->list, &sbsec->isec_head);
776 spin_unlock(&sbsec->isec_lock);
780 switch (sbsec->behavior) {
781 case SECURITY_FS_USE_XATTR:
782 if (!inode->i_op->getxattr) {
783 isec->sid = sbsec->def_sid;
787 /* Need a dentry, since the xattr API requires one.
788 Life would be simpler if we could just pass the inode. */
790 /* Called from d_instantiate or d_splice_alias. */
791 dentry = dget(opt_dentry);
793 /* Called from selinux_complete_init, try to find a dentry. */
794 dentry = d_find_alias(inode);
797 printk(KERN_WARNING "%s: no dentry for dev=%s "
798 "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
803 len = INITCONTEXTLEN;
804 context = kmalloc(len, GFP_KERNEL);
810 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
813 /* Need a larger buffer. Query for the right size. */
814 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
822 context = kmalloc(len, GFP_KERNEL);
828 rc = inode->i_op->getxattr(dentry,
834 if (rc != -ENODATA) {
835 printk(KERN_WARNING "%s: getxattr returned "
836 "%d for dev=%s ino=%ld\n", __FUNCTION__,
837 -rc, inode->i_sb->s_id, inode->i_ino);
841 /* Map ENODATA to the default file SID */
842 sid = sbsec->def_sid;
845 rc = security_context_to_sid_default(context, rc, &sid,
848 printk(KERN_WARNING "%s: context_to_sid(%s) "
849 "returned %d for dev=%s ino=%ld\n",
850 __FUNCTION__, context, -rc,
851 inode->i_sb->s_id, inode->i_ino);
853 /* Leave with the unlabeled SID */
861 case SECURITY_FS_USE_TASK:
862 isec->sid = isec->task_sid;
864 case SECURITY_FS_USE_TRANS:
865 /* Default to the fs SID. */
866 isec->sid = sbsec->sid;
868 /* Try to obtain a transition SID. */
869 isec->sclass = inode_mode_to_security_class(inode->i_mode);
870 rc = security_transition_sid(isec->task_sid,
879 /* Default to the fs SID. */
880 isec->sid = sbsec->sid;
883 struct proc_inode *proci = PROC_I(inode);
885 isec->sclass = inode_mode_to_security_class(inode->i_mode);
886 rc = selinux_proc_get_sid(proci->pde,
897 isec->initialized = 1;
900 if (isec->sclass == SECCLASS_FILE)
901 isec->sclass = inode_mode_to_security_class(inode->i_mode);
908 /* Convert a Linux signal to an access vector. */
909 static inline u32 signal_to_av(int sig)
915 /* Commonly granted from child to parent. */
916 perm = PROCESS__SIGCHLD;
919 /* Cannot be caught or ignored */
920 perm = PROCESS__SIGKILL;
923 /* Cannot be caught or ignored */
924 perm = PROCESS__SIGSTOP;
927 /* All other signals. */
928 perm = PROCESS__SIGNAL;
935 /* Check permission betweeen a pair of tasks, e.g. signal checks,
936 fork check, ptrace check, etc. */
937 static int task_has_perm(struct task_struct *tsk1,
938 struct task_struct *tsk2,
941 struct task_security_struct *tsec1, *tsec2;
943 tsec1 = tsk1->security;
944 tsec2 = tsk2->security;
945 return avc_has_perm(tsec1->sid, tsec2->sid,
946 SECCLASS_PROCESS, perms, NULL);
949 /* Check whether a task is allowed to use a capability. */
950 static int task_has_capability(struct task_struct *tsk,
953 struct task_security_struct *tsec;
954 struct avc_audit_data ad;
956 tsec = tsk->security;
958 AVC_AUDIT_DATA_INIT(&ad,CAP);
962 return avc_has_perm(tsec->sid, tsec->sid,
963 SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
966 /* Check whether a task is allowed to use a system operation. */
967 static int task_has_system(struct task_struct *tsk,
970 struct task_security_struct *tsec;
972 tsec = tsk->security;
974 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
975 SECCLASS_SYSTEM, perms, NULL);
978 /* Check whether a task has a particular permission to an inode.
979 The 'adp' parameter is optional and allows other audit
980 data to be passed (e.g. the dentry). */
981 static int inode_has_perm(struct task_struct *tsk,
984 struct avc_audit_data *adp)
986 struct task_security_struct *tsec;
987 struct inode_security_struct *isec;
988 struct avc_audit_data ad;
990 tsec = tsk->security;
991 isec = inode->i_security;
995 AVC_AUDIT_DATA_INIT(&ad, FS);
996 ad.u.fs.inode = inode;
999 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1002 /* Same as inode_has_perm, but pass explicit audit data containing
1003 the dentry to help the auditing code to more easily generate the
1004 pathname if needed. */
1005 static inline int dentry_has_perm(struct task_struct *tsk,
1006 struct vfsmount *mnt,
1007 struct dentry *dentry,
1010 struct inode *inode = dentry->d_inode;
1011 struct avc_audit_data ad;
1012 AVC_AUDIT_DATA_INIT(&ad,FS);
1014 ad.u.fs.dentry = dentry;
1015 return inode_has_perm(tsk, inode, av, &ad);
1018 /* Check whether a task can use an open file descriptor to
1019 access an inode in a given way. Check access to the
1020 descriptor itself, and then use dentry_has_perm to
1021 check a particular permission to the file.
1022 Access to the descriptor is implicitly granted if it
1023 has the same SID as the process. If av is zero, then
1024 access to the file is not checked, e.g. for cases
1025 where only the descriptor is affected like seek. */
1026 static int file_has_perm(struct task_struct *tsk,
1030 struct task_security_struct *tsec = tsk->security;
1031 struct file_security_struct *fsec = file->f_security;
1032 struct vfsmount *mnt = file->f_vfsmnt;
1033 struct dentry *dentry = file->f_dentry;
1034 struct inode *inode = dentry->d_inode;
1035 struct avc_audit_data ad;
1038 AVC_AUDIT_DATA_INIT(&ad, FS);
1040 ad.u.fs.dentry = dentry;
1042 if (tsec->sid != fsec->sid) {
1043 rc = avc_has_perm(tsec->sid, fsec->sid,
1051 /* av is zero if only checking access to the descriptor. */
1053 return inode_has_perm(tsk, inode, av, &ad);
1058 /* Check whether a task can create a file. */
1059 static int may_create(struct inode *dir,
1060 struct dentry *dentry,
1063 struct task_security_struct *tsec;
1064 struct inode_security_struct *dsec;
1065 struct superblock_security_struct *sbsec;
1067 struct avc_audit_data ad;
1070 tsec = current->security;
1071 dsec = dir->i_security;
1072 sbsec = dir->i_sb->s_security;
1074 AVC_AUDIT_DATA_INIT(&ad, FS);
1075 ad.u.fs.dentry = dentry;
1077 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1078 DIR__ADD_NAME | DIR__SEARCH,
1083 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1084 newsid = tsec->create_sid;
1086 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1092 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1096 return avc_has_perm(newsid, sbsec->sid,
1097 SECCLASS_FILESYSTEM,
1098 FILESYSTEM__ASSOCIATE, &ad);
1102 #define MAY_UNLINK 1
1105 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1106 static int may_link(struct inode *dir,
1107 struct dentry *dentry,
1111 struct task_security_struct *tsec;
1112 struct inode_security_struct *dsec, *isec;
1113 struct avc_audit_data ad;
1117 tsec = current->security;
1118 dsec = dir->i_security;
1119 isec = dentry->d_inode->i_security;
1121 AVC_AUDIT_DATA_INIT(&ad, FS);
1122 ad.u.fs.dentry = dentry;
1125 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1126 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1141 printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
1145 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1149 static inline int may_rename(struct inode *old_dir,
1150 struct dentry *old_dentry,
1151 struct inode *new_dir,
1152 struct dentry *new_dentry)
1154 struct task_security_struct *tsec;
1155 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1156 struct avc_audit_data ad;
1158 int old_is_dir, new_is_dir;
1161 tsec = current->security;
1162 old_dsec = old_dir->i_security;
1163 old_isec = old_dentry->d_inode->i_security;
1164 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1165 new_dsec = new_dir->i_security;
1167 AVC_AUDIT_DATA_INIT(&ad, FS);
1169 ad.u.fs.dentry = old_dentry;
1170 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1171 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1174 rc = avc_has_perm(tsec->sid, old_isec->sid,
1175 old_isec->sclass, FILE__RENAME, &ad);
1178 if (old_is_dir && new_dir != old_dir) {
1179 rc = avc_has_perm(tsec->sid, old_isec->sid,
1180 old_isec->sclass, DIR__REPARENT, &ad);
1185 ad.u.fs.dentry = new_dentry;
1186 av = DIR__ADD_NAME | DIR__SEARCH;
1187 if (new_dentry->d_inode)
1188 av |= DIR__REMOVE_NAME;
1189 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1192 if (new_dentry->d_inode) {
1193 new_isec = new_dentry->d_inode->i_security;
1194 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1195 rc = avc_has_perm(tsec->sid, new_isec->sid,
1197 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1205 /* Check whether a task can perform a filesystem operation. */
1206 static int superblock_has_perm(struct task_struct *tsk,
1207 struct super_block *sb,
1209 struct avc_audit_data *ad)
1211 struct task_security_struct *tsec;
1212 struct superblock_security_struct *sbsec;
1214 tsec = tsk->security;
1215 sbsec = sb->s_security;
1216 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1220 /* Convert a Linux mode and permission mask to an access vector. */
1221 static inline u32 file_mask_to_av(int mode, int mask)
1225 if ((mode & S_IFMT) != S_IFDIR) {
1226 if (mask & MAY_EXEC)
1227 av |= FILE__EXECUTE;
1228 if (mask & MAY_READ)
1231 if (mask & MAY_APPEND)
1233 else if (mask & MAY_WRITE)
1237 if (mask & MAY_EXEC)
1239 if (mask & MAY_WRITE)
1241 if (mask & MAY_READ)
1248 /* Convert a Linux file to an access vector. */
1249 static inline u32 file_to_av(struct file *file)
1253 if (file->f_mode & FMODE_READ)
1255 if (file->f_mode & FMODE_WRITE) {
1256 if (file->f_flags & O_APPEND)
1265 /* Set an inode's SID to a specified value. */
1266 static int inode_security_set_sid(struct inode *inode, u32 sid)
1268 struct inode_security_struct *isec = inode->i_security;
1269 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
1271 if (!sbsec->initialized) {
1272 /* Defer initialization to selinux_complete_init. */
1277 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1279 isec->initialized = 1;
1284 /* Hook functions begin here. */
1286 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1288 struct task_security_struct *psec = parent->security;
1289 struct task_security_struct *csec = child->security;
1292 rc = secondary_ops->ptrace(parent,child);
1296 rc = task_has_perm(parent, child, PROCESS__PTRACE);
1297 /* Save the SID of the tracing process for later use in apply_creds. */
1298 if (!(child->ptrace & PT_PTRACED) && !rc)
1299 csec->ptrace_sid = psec->sid;
1303 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1304 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1308 error = task_has_perm(current, target, PROCESS__GETCAP);
1312 return secondary_ops->capget(target, effective, inheritable, permitted);
1315 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1316 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1320 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1324 return task_has_perm(current, target, PROCESS__SETCAP);
1327 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1328 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1330 secondary_ops->capset_set(target, effective, inheritable, permitted);
1333 static int selinux_capable(struct task_struct *tsk, int cap)
1337 rc = secondary_ops->capable(tsk, cap);
1341 return task_has_capability(tsk,cap);
1344 static int selinux_sysctl(ctl_table *table, int op)
1348 struct task_security_struct *tsec;
1352 rc = secondary_ops->sysctl(table, op);
1356 tsec = current->security;
1358 rc = selinux_proc_get_sid(table->de, (op == 001) ?
1359 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1361 /* Default to the well-defined sysctl SID. */
1362 tsid = SECINITSID_SYSCTL;
1365 /* The op values are "defined" in sysctl.c, thereby creating
1366 * a bad coupling between this module and sysctl.c */
1368 error = avc_has_perm(tsec->sid, tsid,
1369 SECCLASS_DIR, DIR__SEARCH, NULL);
1377 error = avc_has_perm(tsec->sid, tsid,
1378 SECCLASS_FILE, av, NULL);
1384 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1397 rc = superblock_has_perm(current,
1399 FILESYSTEM__QUOTAMOD, NULL);
1404 rc = superblock_has_perm(current,
1406 FILESYSTEM__QUOTAGET, NULL);
1409 rc = 0; /* let the kernel handle invalid cmds */
1415 static int selinux_quota_on(struct dentry *dentry)
1417 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1420 static int selinux_syslog(int type)
1424 rc = secondary_ops->syslog(type);
1429 case 3: /* Read last kernel messages */
1430 case 10: /* Return size of the log buffer */
1431 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1433 case 6: /* Disable logging to console */
1434 case 7: /* Enable logging to console */
1435 case 8: /* Set level of messages printed to console */
1436 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1438 case 0: /* Close log */
1439 case 1: /* Open log */
1440 case 2: /* Read from log */
1441 case 4: /* Read/clear last kernel messages */
1442 case 5: /* Clear ring buffer */
1444 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1451 * Check that a process has enough memory to allocate a new virtual
1452 * mapping. 0 means there is enough memory for the allocation to
1453 * succeed and -ENOMEM implies there is not.
1455 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1456 * if the capability is granted, but __vm_enough_memory requires 1 if
1457 * the capability is granted.
1459 * Do not audit the selinux permission check, as this is applied to all
1460 * processes that allocate mappings.
1462 static int selinux_vm_enough_memory(long pages)
1464 int rc, cap_sys_admin = 0;
1465 struct task_security_struct *tsec = current->security;
1467 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1469 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1470 SECCLASS_CAPABILITY,
1471 CAP_TO_MASK(CAP_SYS_ADMIN),
1477 return __vm_enough_memory(pages, cap_sys_admin);
1480 /* binprm security operations */
1482 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1484 struct bprm_security_struct *bsec;
1486 bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1491 bsec->sid = SECINITSID_UNLABELED;
1494 bprm->security = bsec;
1498 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1500 struct task_security_struct *tsec;
1501 struct inode *inode = bprm->file->f_dentry->d_inode;
1502 struct inode_security_struct *isec;
1503 struct bprm_security_struct *bsec;
1505 struct avc_audit_data ad;
1508 rc = secondary_ops->bprm_set_security(bprm);
1512 bsec = bprm->security;
1517 tsec = current->security;
1518 isec = inode->i_security;
1520 /* Default to the current task SID. */
1521 bsec->sid = tsec->sid;
1523 /* Reset create SID on execve. */
1524 tsec->create_sid = 0;
1526 if (tsec->exec_sid) {
1527 newsid = tsec->exec_sid;
1528 /* Reset exec SID on execve. */
1531 /* Check for a default transition on this program. */
1532 rc = security_transition_sid(tsec->sid, isec->sid,
1533 SECCLASS_PROCESS, &newsid);
1538 AVC_AUDIT_DATA_INIT(&ad, FS);
1539 ad.u.fs.mnt = bprm->file->f_vfsmnt;
1540 ad.u.fs.dentry = bprm->file->f_dentry;
1542 if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
1545 if (tsec->sid == newsid) {
1546 rc = avc_has_perm(tsec->sid, isec->sid,
1547 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1551 /* Check permissions for the transition. */
1552 rc = avc_has_perm(tsec->sid, newsid,
1553 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1557 rc = avc_has_perm(newsid, isec->sid,
1558 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1562 /* Clear any possibly unsafe personality bits on exec: */
1563 current->personality &= ~PER_CLEAR_ON_SETID;
1565 /* Set the security field to the new SID. */
1573 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1575 return secondary_ops->bprm_check_security(bprm);
1579 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1581 struct task_security_struct *tsec = current->security;
1584 if (tsec->osid != tsec->sid) {
1585 /* Enable secure mode for SIDs transitions unless
1586 the noatsecure permission is granted between
1587 the two SIDs, i.e. ahp returns 0. */
1588 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1590 PROCESS__NOATSECURE, NULL);
1593 return (atsecure || secondary_ops->bprm_secureexec(bprm));
1596 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1598 kfree(bprm->security);
1599 bprm->security = NULL;
1602 extern struct vfsmount *selinuxfs_mount;
1603 extern struct dentry *selinux_null;
1605 /* Derived from fs/exec.c:flush_old_files. */
1606 static inline void flush_unauthorized_files(struct files_struct * files)
1608 struct avc_audit_data ad;
1609 struct file *file, *devnull = NULL;
1610 struct tty_struct *tty = current->signal->tty;
1611 struct fdtable *fdt;
1616 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
1618 /* Revalidate access to controlling tty.
1619 Use inode_has_perm on the tty inode directly rather
1620 than using file_has_perm, as this particular open
1621 file may belong to another process and we are only
1622 interested in the inode-based check here. */
1623 struct inode *inode = file->f_dentry->d_inode;
1624 if (inode_has_perm(current, inode,
1625 FILE__READ | FILE__WRITE, NULL)) {
1626 /* Reset controlling tty. */
1627 current->signal->tty = NULL;
1628 current->signal->tty_old_pgrp = 0;
1634 /* Revalidate access to inherited open files. */
1636 AVC_AUDIT_DATA_INIT(&ad,FS);
1638 spin_lock(&files->file_lock);
1640 unsigned long set, i;
1645 fdt = files_fdtable(files);
1646 if (i >= fdt->max_fds || i >= fdt->max_fdset)
1648 set = fdt->open_fds->fds_bits[j];
1651 spin_unlock(&files->file_lock);
1652 for ( ; set ; i++,set >>= 1) {
1657 if (file_has_perm(current,
1659 file_to_av(file))) {
1661 fd = get_unused_fd();
1671 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1678 fd_install(fd, devnull);
1683 spin_lock(&files->file_lock);
1686 spin_unlock(&files->file_lock);
1689 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1691 struct task_security_struct *tsec;
1692 struct bprm_security_struct *bsec;
1696 secondary_ops->bprm_apply_creds(bprm, unsafe);
1698 tsec = current->security;
1700 bsec = bprm->security;
1703 tsec->osid = tsec->sid;
1705 if (tsec->sid != sid) {
1706 /* Check for shared state. If not ok, leave SID
1707 unchanged and kill. */
1708 if (unsafe & LSM_UNSAFE_SHARE) {
1709 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1710 PROCESS__SHARE, NULL);
1717 /* Check for ptracing, and update the task SID if ok.
1718 Otherwise, leave SID unchanged and kill. */
1719 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1720 rc = avc_has_perm(tsec->ptrace_sid, sid,
1721 SECCLASS_PROCESS, PROCESS__PTRACE,
1733 * called after apply_creds without the task lock held
1735 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1737 struct task_security_struct *tsec;
1738 struct rlimit *rlim, *initrlim;
1739 struct itimerval itimer;
1740 struct bprm_security_struct *bsec;
1743 tsec = current->security;
1744 bsec = bprm->security;
1747 force_sig_specific(SIGKILL, current);
1750 if (tsec->osid == tsec->sid)
1753 /* Close files for which the new task SID is not authorized. */
1754 flush_unauthorized_files(current->files);
1756 /* Check whether the new SID can inherit signal state
1757 from the old SID. If not, clear itimers to avoid
1758 subsequent signal generation and flush and unblock
1759 signals. This must occur _after_ the task SID has
1760 been updated so that any kill done after the flush
1761 will be checked against the new SID. */
1762 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1763 PROCESS__SIGINH, NULL);
1765 memset(&itimer, 0, sizeof itimer);
1766 for (i = 0; i < 3; i++)
1767 do_setitimer(i, &itimer, NULL);
1768 flush_signals(current);
1769 spin_lock_irq(¤t->sighand->siglock);
1770 flush_signal_handlers(current, 1);
1771 sigemptyset(¤t->blocked);
1772 recalc_sigpending();
1773 spin_unlock_irq(¤t->sighand->siglock);
1776 /* Check whether the new SID can inherit resource limits
1777 from the old SID. If not, reset all soft limits to
1778 the lower of the current task's hard limit and the init
1779 task's soft limit. Note that the setting of hard limits
1780 (even to lower them) can be controlled by the setrlimit
1781 check. The inclusion of the init task's soft limit into
1782 the computation is to avoid resetting soft limits higher
1783 than the default soft limit for cases where the default
1784 is lower than the hard limit, e.g. RLIMIT_CORE or
1786 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1787 PROCESS__RLIMITINH, NULL);
1789 for (i = 0; i < RLIM_NLIMITS; i++) {
1790 rlim = current->signal->rlim + i;
1791 initrlim = init_task.signal->rlim+i;
1792 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1794 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1796 * This will cause RLIMIT_CPU calculations
1799 current->it_prof_expires = jiffies_to_cputime(1);
1803 /* Wake up the parent if it is waiting so that it can
1804 recheck wait permission to the new task SID. */
1805 wake_up_interruptible(¤t->parent->signal->wait_chldexit);
1808 /* superblock security operations */
1810 static int selinux_sb_alloc_security(struct super_block *sb)
1812 return superblock_alloc_security(sb);
1815 static void selinux_sb_free_security(struct super_block *sb)
1817 superblock_free_security(sb);
1820 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1825 return !memcmp(prefix, option, plen);
1828 static inline int selinux_option(char *option, int len)
1830 return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1831 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1832 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len));
1835 static inline void take_option(char **to, char *from, int *first, int len)
1843 memcpy(*to, from, len);
1847 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
1849 int fnosec, fsec, rc = 0;
1850 char *in_save, *in_curr, *in_end;
1851 char *sec_curr, *nosec_save, *nosec;
1856 /* Binary mount data: just copy */
1857 if (type->fs_flags & FS_BINARY_MOUNTDATA) {
1858 copy_page(sec_curr, in_curr);
1862 nosec = (char *)get_zeroed_page(GFP_KERNEL);
1870 in_save = in_end = orig;
1873 if (*in_end == ',' || *in_end == '\0') {
1874 int len = in_end - in_curr;
1876 if (selinux_option(in_curr, len))
1877 take_option(&sec_curr, in_curr, &fsec, len);
1879 take_option(&nosec, in_curr, &fnosec, len);
1881 in_curr = in_end + 1;
1883 } while (*in_end++);
1885 strcpy(in_save, nosec_save);
1886 free_page((unsigned long)nosec_save);
1891 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
1893 struct avc_audit_data ad;
1896 rc = superblock_doinit(sb, data);
1900 AVC_AUDIT_DATA_INIT(&ad,FS);
1901 ad.u.fs.dentry = sb->s_root;
1902 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
1905 static int selinux_sb_statfs(struct super_block *sb)
1907 struct avc_audit_data ad;
1909 AVC_AUDIT_DATA_INIT(&ad,FS);
1910 ad.u.fs.dentry = sb->s_root;
1911 return superblock_has_perm(current, sb, FILESYSTEM__GETATTR, &ad);
1914 static int selinux_mount(char * dev_name,
1915 struct nameidata *nd,
1917 unsigned long flags,
1922 rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
1926 if (flags & MS_REMOUNT)
1927 return superblock_has_perm(current, nd->mnt->mnt_sb,
1928 FILESYSTEM__REMOUNT, NULL);
1930 return dentry_has_perm(current, nd->mnt, nd->dentry,
1934 static int selinux_umount(struct vfsmount *mnt, int flags)
1938 rc = secondary_ops->sb_umount(mnt, flags);
1942 return superblock_has_perm(current,mnt->mnt_sb,
1943 FILESYSTEM__UNMOUNT,NULL);
1946 /* inode security operations */
1948 static int selinux_inode_alloc_security(struct inode *inode)
1950 return inode_alloc_security(inode);
1953 static void selinux_inode_free_security(struct inode *inode)
1955 inode_free_security(inode);
1958 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
1959 char **name, void **value,
1962 struct task_security_struct *tsec;
1963 struct inode_security_struct *dsec;
1964 struct superblock_security_struct *sbsec;
1967 char *namep = NULL, *context;
1969 tsec = current->security;
1970 dsec = dir->i_security;
1971 sbsec = dir->i_sb->s_security;
1973 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1974 newsid = tsec->create_sid;
1976 rc = security_transition_sid(tsec->sid, dsec->sid,
1977 inode_mode_to_security_class(inode->i_mode),
1980 printk(KERN_WARNING "%s: "
1981 "security_transition_sid failed, rc=%d (dev=%s "
1984 -rc, inode->i_sb->s_id, inode->i_ino);
1989 inode_security_set_sid(inode, newsid);
1991 if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
1995 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
2002 rc = security_sid_to_context(newsid, &context, &clen);
2014 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2016 return may_create(dir, dentry, SECCLASS_FILE);
2019 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2023 rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2026 return may_link(dir, old_dentry, MAY_LINK);
2029 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2033 rc = secondary_ops->inode_unlink(dir, dentry);
2036 return may_link(dir, dentry, MAY_UNLINK);
2039 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2041 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2044 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2046 return may_create(dir, dentry, SECCLASS_DIR);
2049 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2051 return may_link(dir, dentry, MAY_RMDIR);
2054 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2058 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2062 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2065 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2066 struct inode *new_inode, struct dentry *new_dentry)
2068 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2071 static int selinux_inode_readlink(struct dentry *dentry)
2073 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2076 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2080 rc = secondary_ops->inode_follow_link(dentry,nameidata);
2083 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2086 static int selinux_inode_permission(struct inode *inode, int mask,
2087 struct nameidata *nd)
2091 rc = secondary_ops->inode_permission(inode, mask, nd);
2096 /* No permission to check. Existence test. */
2100 return inode_has_perm(current, inode,
2101 file_mask_to_av(inode->i_mode, mask), NULL);
2104 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2108 rc = secondary_ops->inode_setattr(dentry, iattr);
2112 if (iattr->ia_valid & ATTR_FORCE)
2115 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2116 ATTR_ATIME_SET | ATTR_MTIME_SET))
2117 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2119 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2122 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2124 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2127 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2129 struct task_security_struct *tsec = current->security;
2130 struct inode *inode = dentry->d_inode;
2131 struct inode_security_struct *isec = inode->i_security;
2132 struct superblock_security_struct *sbsec;
2133 struct avc_audit_data ad;
2137 if (strcmp(name, XATTR_NAME_SELINUX)) {
2138 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2139 sizeof XATTR_SECURITY_PREFIX - 1) &&
2140 !capable(CAP_SYS_ADMIN)) {
2141 /* A different attribute in the security namespace.
2142 Restrict to administrator. */
2146 /* Not an attribute we recognize, so just check the
2147 ordinary setattr permission. */
2148 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2151 sbsec = inode->i_sb->s_security;
2152 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2155 if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2158 AVC_AUDIT_DATA_INIT(&ad,FS);
2159 ad.u.fs.dentry = dentry;
2161 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2162 FILE__RELABELFROM, &ad);
2166 rc = security_context_to_sid(value, size, &newsid);
2170 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2171 FILE__RELABELTO, &ad);
2175 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2180 return avc_has_perm(newsid,
2182 SECCLASS_FILESYSTEM,
2183 FILESYSTEM__ASSOCIATE,
2187 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2188 void *value, size_t size, int flags)
2190 struct inode *inode = dentry->d_inode;
2191 struct inode_security_struct *isec = inode->i_security;
2195 if (strcmp(name, XATTR_NAME_SELINUX)) {
2196 /* Not an attribute we recognize, so nothing to do. */
2200 rc = security_context_to_sid(value, size, &newsid);
2202 printk(KERN_WARNING "%s: unable to obtain SID for context "
2203 "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2211 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2213 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2216 static int selinux_inode_listxattr (struct dentry *dentry)
2218 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2221 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2223 if (strcmp(name, XATTR_NAME_SELINUX)) {
2224 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2225 sizeof XATTR_SECURITY_PREFIX - 1) &&
2226 !capable(CAP_SYS_ADMIN)) {
2227 /* A different attribute in the security namespace.
2228 Restrict to administrator. */
2232 /* Not an attribute we recognize, so just check the
2233 ordinary setattr permission. Might want a separate
2234 permission for removexattr. */
2235 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2238 /* No one is allowed to remove a SELinux security label.
2239 You can change the label, but all data must be labeled. */
2243 static const char *selinux_inode_xattr_getsuffix(void)
2245 return XATTR_SELINUX_SUFFIX;
2249 * Copy the in-core inode security context value to the user. If the
2250 * getxattr() prior to this succeeded, check to see if we need to
2251 * canonicalize the value to be finally returned to the user.
2253 * Permission check is handled by selinux_inode_getxattr hook.
2255 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void *buffer, size_t size, int err)
2257 struct inode_security_struct *isec = inode->i_security;
2259 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2262 return selinux_getsecurity(isec->sid, buffer, size);
2265 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2266 const void *value, size_t size, int flags)
2268 struct inode_security_struct *isec = inode->i_security;
2272 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2275 if (!value || !size)
2278 rc = security_context_to_sid((void*)value, size, &newsid);
2286 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2288 const int len = sizeof(XATTR_NAME_SELINUX);
2289 if (buffer && len <= buffer_size)
2290 memcpy(buffer, XATTR_NAME_SELINUX, len);
2294 /* file security operations */
2296 static int selinux_file_permission(struct file *file, int mask)
2298 struct inode *inode = file->f_dentry->d_inode;
2301 /* No permission to check. Existence test. */
2305 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2306 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2309 return file_has_perm(current, file,
2310 file_mask_to_av(inode->i_mode, mask));
2313 static int selinux_file_alloc_security(struct file *file)
2315 return file_alloc_security(file);
2318 static void selinux_file_free_security(struct file *file)
2320 file_free_security(file);
2323 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2335 case EXT2_IOC_GETFLAGS:
2337 case EXT2_IOC_GETVERSION:
2338 error = file_has_perm(current, file, FILE__GETATTR);
2341 case EXT2_IOC_SETFLAGS:
2343 case EXT2_IOC_SETVERSION:
2344 error = file_has_perm(current, file, FILE__SETATTR);
2347 /* sys_ioctl() checks */
2351 error = file_has_perm(current, file, 0);
2356 error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2359 /* default case assumes that the command will go
2360 * to the file's ioctl() function.
2363 error = file_has_perm(current, file, FILE__IOCTL);
2369 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2371 #ifndef CONFIG_PPC32
2372 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2374 * We are making executable an anonymous mapping or a
2375 * private file mapping that will also be writable.
2376 * This has an additional check.
2378 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2385 /* read access is always possible with a mapping */
2386 u32 av = FILE__READ;
2388 /* write access only matters if the mapping is shared */
2389 if (shared && (prot & PROT_WRITE))
2392 if (prot & PROT_EXEC)
2393 av |= FILE__EXECUTE;
2395 return file_has_perm(current, file, av);
2400 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2401 unsigned long prot, unsigned long flags)
2405 rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2409 if (selinux_checkreqprot)
2412 return file_map_prot_check(file, prot,
2413 (flags & MAP_TYPE) == MAP_SHARED);
2416 static int selinux_file_mprotect(struct vm_area_struct *vma,
2417 unsigned long reqprot,
2422 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2426 if (selinux_checkreqprot)
2429 #ifndef CONFIG_PPC32
2430 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2432 if (vma->vm_start >= vma->vm_mm->start_brk &&
2433 vma->vm_end <= vma->vm_mm->brk) {
2434 rc = task_has_perm(current, current,
2436 } else if (!vma->vm_file &&
2437 vma->vm_start <= vma->vm_mm->start_stack &&
2438 vma->vm_end >= vma->vm_mm->start_stack) {
2439 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2440 } else if (vma->vm_file && vma->anon_vma) {
2442 * We are making executable a file mapping that has
2443 * had some COW done. Since pages might have been
2444 * written, check ability to execute the possibly
2445 * modified content. This typically should only
2446 * occur for text relocations.
2448 rc = file_has_perm(current, vma->vm_file,
2456 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2459 static int selinux_file_lock(struct file *file, unsigned int cmd)
2461 return file_has_perm(current, file, FILE__LOCK);
2464 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2471 if (!file->f_dentry || !file->f_dentry->d_inode) {
2476 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2477 err = file_has_perm(current, file,FILE__WRITE);
2486 /* Just check FD__USE permission */
2487 err = file_has_perm(current, file, 0);
2492 #if BITS_PER_LONG == 32
2497 if (!file->f_dentry || !file->f_dentry->d_inode) {
2501 err = file_has_perm(current, file, FILE__LOCK);
2508 static int selinux_file_set_fowner(struct file *file)
2510 struct task_security_struct *tsec;
2511 struct file_security_struct *fsec;
2513 tsec = current->security;
2514 fsec = file->f_security;
2515 fsec->fown_sid = tsec->sid;
2520 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2521 struct fown_struct *fown, int signum)
2525 struct task_security_struct *tsec;
2526 struct file_security_struct *fsec;
2528 /* struct fown_struct is never outside the context of a struct file */
2529 file = (struct file *)((long)fown - offsetof(struct file,f_owner));
2531 tsec = tsk->security;
2532 fsec = file->f_security;
2535 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2537 perm = signal_to_av(signum);
2539 return avc_has_perm(fsec->fown_sid, tsec->sid,
2540 SECCLASS_PROCESS, perm, NULL);
2543 static int selinux_file_receive(struct file *file)
2545 return file_has_perm(current, file, file_to_av(file));
2548 /* task security operations */
2550 static int selinux_task_create(unsigned long clone_flags)
2554 rc = secondary_ops->task_create(clone_flags);
2558 return task_has_perm(current, current, PROCESS__FORK);
2561 static int selinux_task_alloc_security(struct task_struct *tsk)
2563 struct task_security_struct *tsec1, *tsec2;
2566 tsec1 = current->security;
2568 rc = task_alloc_security(tsk);
2571 tsec2 = tsk->security;
2573 tsec2->osid = tsec1->osid;
2574 tsec2->sid = tsec1->sid;
2576 /* Retain the exec and create SIDs across fork */
2577 tsec2->exec_sid = tsec1->exec_sid;
2578 tsec2->create_sid = tsec1->create_sid;
2580 /* Retain ptracer SID across fork, if any.
2581 This will be reset by the ptrace hook upon any
2582 subsequent ptrace_attach operations. */
2583 tsec2->ptrace_sid = tsec1->ptrace_sid;
2588 static void selinux_task_free_security(struct task_struct *tsk)
2590 task_free_security(tsk);
2593 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2595 /* Since setuid only affects the current process, and
2596 since the SELinux controls are not based on the Linux
2597 identity attributes, SELinux does not need to control
2598 this operation. However, SELinux does control the use
2599 of the CAP_SETUID and CAP_SETGID capabilities using the
2604 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2606 return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2609 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2611 /* See the comment for setuid above. */
2615 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2617 return task_has_perm(current, p, PROCESS__SETPGID);
2620 static int selinux_task_getpgid(struct task_struct *p)
2622 return task_has_perm(current, p, PROCESS__GETPGID);
2625 static int selinux_task_getsid(struct task_struct *p)
2627 return task_has_perm(current, p, PROCESS__GETSESSION);
2630 static int selinux_task_setgroups(struct group_info *group_info)
2632 /* See the comment for setuid above. */
2636 static int selinux_task_setnice(struct task_struct *p, int nice)
2640 rc = secondary_ops->task_setnice(p, nice);
2644 return task_has_perm(current,p, PROCESS__SETSCHED);
2647 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2649 struct rlimit *old_rlim = current->signal->rlim + resource;
2652 rc = secondary_ops->task_setrlimit(resource, new_rlim);
2656 /* Control the ability to change the hard limit (whether
2657 lowering or raising it), so that the hard limit can
2658 later be used as a safe reset point for the soft limit
2659 upon context transitions. See selinux_bprm_apply_creds. */
2660 if (old_rlim->rlim_max != new_rlim->rlim_max)
2661 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2666 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2668 return task_has_perm(current, p, PROCESS__SETSCHED);
2671 static int selinux_task_getscheduler(struct task_struct *p)
2673 return task_has_perm(current, p, PROCESS__GETSCHED);
2676 static int selinux_task_kill(struct task_struct *p, struct siginfo *info, int sig)
2681 rc = secondary_ops->task_kill(p, info, sig);
2685 if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
2689 perm = PROCESS__SIGNULL; /* null signal; existence test */
2691 perm = signal_to_av(sig);
2693 return task_has_perm(current, p, perm);
2696 static int selinux_task_prctl(int option,
2702 /* The current prctl operations do not appear to require
2703 any SELinux controls since they merely observe or modify
2704 the state of the current process. */
2708 static int selinux_task_wait(struct task_struct *p)
2712 perm = signal_to_av(p->exit_signal);
2714 return task_has_perm(p, current, perm);
2717 static void selinux_task_reparent_to_init(struct task_struct *p)
2719 struct task_security_struct *tsec;
2721 secondary_ops->task_reparent_to_init(p);
2724 tsec->osid = tsec->sid;
2725 tsec->sid = SECINITSID_KERNEL;
2729 static void selinux_task_to_inode(struct task_struct *p,
2730 struct inode *inode)
2732 struct task_security_struct *tsec = p->security;
2733 struct inode_security_struct *isec = inode->i_security;
2735 isec->sid = tsec->sid;
2736 isec->initialized = 1;
2740 /* Returns error only if unable to parse addresses */
2741 static int selinux_parse_skb_ipv4(struct sk_buff *skb, struct avc_audit_data *ad)
2743 int offset, ihlen, ret = -EINVAL;
2744 struct iphdr _iph, *ih;
2746 offset = skb->nh.raw - skb->data;
2747 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2751 ihlen = ih->ihl * 4;
2752 if (ihlen < sizeof(_iph))
2755 ad->u.net.v4info.saddr = ih->saddr;
2756 ad->u.net.v4info.daddr = ih->daddr;
2759 switch (ih->protocol) {
2761 struct tcphdr _tcph, *th;
2763 if (ntohs(ih->frag_off) & IP_OFFSET)
2767 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2771 ad->u.net.sport = th->source;
2772 ad->u.net.dport = th->dest;
2777 struct udphdr _udph, *uh;
2779 if (ntohs(ih->frag_off) & IP_OFFSET)
2783 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2787 ad->u.net.sport = uh->source;
2788 ad->u.net.dport = uh->dest;
2799 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2801 /* Returns error only if unable to parse addresses */
2802 static int selinux_parse_skb_ipv6(struct sk_buff *skb, struct avc_audit_data *ad)
2805 int ret = -EINVAL, offset;
2806 struct ipv6hdr _ipv6h, *ip6;
2808 offset = skb->nh.raw - skb->data;
2809 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
2813 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
2814 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
2817 nexthdr = ip6->nexthdr;
2818 offset += sizeof(_ipv6h);
2819 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
2825 struct tcphdr _tcph, *th;
2827 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2831 ad->u.net.sport = th->source;
2832 ad->u.net.dport = th->dest;
2837 struct udphdr _udph, *uh;
2839 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2843 ad->u.net.sport = uh->source;
2844 ad->u.net.dport = uh->dest;
2848 /* includes fragments */
2858 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
2859 char **addrp, int *len, int src)
2863 switch (ad->u.net.family) {
2865 ret = selinux_parse_skb_ipv4(skb, ad);
2869 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
2870 &ad->u.net.v4info.daddr);
2873 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2875 ret = selinux_parse_skb_ipv6(skb, ad);
2879 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
2880 &ad->u.net.v6info.daddr);
2890 /* socket security operations */
2891 static int socket_has_perm(struct task_struct *task, struct socket *sock,
2894 struct inode_security_struct *isec;
2895 struct task_security_struct *tsec;
2896 struct avc_audit_data ad;
2899 tsec = task->security;
2900 isec = SOCK_INODE(sock)->i_security;
2902 if (isec->sid == SECINITSID_KERNEL)
2905 AVC_AUDIT_DATA_INIT(&ad,NET);
2906 ad.u.net.sk = sock->sk;
2907 err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
2913 static int selinux_socket_create(int family, int type,
2914 int protocol, int kern)
2917 struct task_security_struct *tsec;
2922 tsec = current->security;
2923 err = avc_has_perm(tsec->sid, tsec->sid,
2924 socket_type_to_security_class(family, type,
2925 protocol), SOCKET__CREATE, NULL);
2931 static void selinux_socket_post_create(struct socket *sock, int family,
2932 int type, int protocol, int kern)
2934 struct inode_security_struct *isec;
2935 struct task_security_struct *tsec;
2937 isec = SOCK_INODE(sock)->i_security;
2939 tsec = current->security;
2940 isec->sclass = socket_type_to_security_class(family, type, protocol);
2941 isec->sid = kern ? SECINITSID_KERNEL : tsec->sid;
2942 isec->initialized = 1;
2947 /* Range of port numbers used to automatically bind.
2948 Need to determine whether we should perform a name_bind
2949 permission check between the socket and the port number. */
2950 #define ip_local_port_range_0 sysctl_local_port_range[0]
2951 #define ip_local_port_range_1 sysctl_local_port_range[1]
2953 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
2958 err = socket_has_perm(current, sock, SOCKET__BIND);
2963 * If PF_INET or PF_INET6, check name_bind permission for the port.
2964 * Multiple address binding for SCTP is not supported yet: we just
2965 * check the first address now.
2967 family = sock->sk->sk_family;
2968 if (family == PF_INET || family == PF_INET6) {
2970 struct inode_security_struct *isec;
2971 struct task_security_struct *tsec;
2972 struct avc_audit_data ad;
2973 struct sockaddr_in *addr4 = NULL;
2974 struct sockaddr_in6 *addr6 = NULL;
2975 unsigned short snum;
2976 struct sock *sk = sock->sk;
2977 u32 sid, node_perm, addrlen;
2979 tsec = current->security;
2980 isec = SOCK_INODE(sock)->i_security;
2982 if (family == PF_INET) {
2983 addr4 = (struct sockaddr_in *)address;
2984 snum = ntohs(addr4->sin_port);
2985 addrlen = sizeof(addr4->sin_addr.s_addr);
2986 addrp = (char *)&addr4->sin_addr.s_addr;
2988 addr6 = (struct sockaddr_in6 *)address;
2989 snum = ntohs(addr6->sin6_port);
2990 addrlen = sizeof(addr6->sin6_addr.s6_addr);
2991 addrp = (char *)&addr6->sin6_addr.s6_addr;
2994 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
2995 snum > ip_local_port_range_1)) {
2996 err = security_port_sid(sk->sk_family, sk->sk_type,
2997 sk->sk_protocol, snum, &sid);
3000 AVC_AUDIT_DATA_INIT(&ad,NET);
3001 ad.u.net.sport = htons(snum);
3002 ad.u.net.family = family;
3003 err = avc_has_perm(isec->sid, sid,
3005 SOCKET__NAME_BIND, &ad);
3010 switch(isec->sclass) {
3011 case SECCLASS_TCP_SOCKET:
3012 node_perm = TCP_SOCKET__NODE_BIND;
3015 case SECCLASS_UDP_SOCKET:
3016 node_perm = UDP_SOCKET__NODE_BIND;
3020 node_perm = RAWIP_SOCKET__NODE_BIND;
3024 err = security_node_sid(family, addrp, addrlen, &sid);
3028 AVC_AUDIT_DATA_INIT(&ad,NET);
3029 ad.u.net.sport = htons(snum);
3030 ad.u.net.family = family;
3032 if (family == PF_INET)
3033 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3035 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3037 err = avc_has_perm(isec->sid, sid,
3038 isec->sclass, node_perm, &ad);
3046 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3048 struct inode_security_struct *isec;
3051 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3056 * If a TCP socket, check name_connect permission for the port.
3058 isec = SOCK_INODE(sock)->i_security;
3059 if (isec->sclass == SECCLASS_TCP_SOCKET) {
3060 struct sock *sk = sock->sk;
3061 struct avc_audit_data ad;
3062 struct sockaddr_in *addr4 = NULL;
3063 struct sockaddr_in6 *addr6 = NULL;
3064 unsigned short snum;
3067 if (sk->sk_family == PF_INET) {
3068 addr4 = (struct sockaddr_in *)address;
3069 if (addrlen < sizeof(struct sockaddr_in))
3071 snum = ntohs(addr4->sin_port);
3073 addr6 = (struct sockaddr_in6 *)address;
3074 if (addrlen < SIN6_LEN_RFC2133)
3076 snum = ntohs(addr6->sin6_port);
3079 err = security_port_sid(sk->sk_family, sk->sk_type,
3080 sk->sk_protocol, snum, &sid);
3084 AVC_AUDIT_DATA_INIT(&ad,NET);
3085 ad.u.net.dport = htons(snum);
3086 ad.u.net.family = sk->sk_family;
3087 err = avc_has_perm(isec->sid, sid, isec->sclass,
3088 TCP_SOCKET__NAME_CONNECT, &ad);
3097 static int selinux_socket_listen(struct socket *sock, int backlog)
3099 return socket_has_perm(current, sock, SOCKET__LISTEN);
3102 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3105 struct inode_security_struct *isec;
3106 struct inode_security_struct *newisec;
3108 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3112 newisec = SOCK_INODE(newsock)->i_security;
3114 isec = SOCK_INODE(sock)->i_security;
3115 newisec->sclass = isec->sclass;
3116 newisec->sid = isec->sid;
3117 newisec->initialized = 1;
3122 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3125 return socket_has_perm(current, sock, SOCKET__WRITE);
3128 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3129 int size, int flags)
3131 return socket_has_perm(current, sock, SOCKET__READ);
3134 static int selinux_socket_getsockname(struct socket *sock)
3136 return socket_has_perm(current, sock, SOCKET__GETATTR);
3139 static int selinux_socket_getpeername(struct socket *sock)
3141 return socket_has_perm(current, sock, SOCKET__GETATTR);
3144 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3146 return socket_has_perm(current, sock, SOCKET__SETOPT);
3149 static int selinux_socket_getsockopt(struct socket *sock, int level,
3152 return socket_has_perm(current, sock, SOCKET__GETOPT);
3155 static int selinux_socket_shutdown(struct socket *sock, int how)
3157 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3160 static int selinux_socket_unix_stream_connect(struct socket *sock,
3161 struct socket *other,
3164 struct sk_security_struct *ssec;
3165 struct inode_security_struct *isec;
3166 struct inode_security_struct *other_isec;
3167 struct avc_audit_data ad;
3170 err = secondary_ops->unix_stream_connect(sock, other, newsk);
3174 isec = SOCK_INODE(sock)->i_security;
3175 other_isec = SOCK_INODE(other)->i_security;
3177 AVC_AUDIT_DATA_INIT(&ad,NET);
3178 ad.u.net.sk = other->sk;
3180 err = avc_has_perm(isec->sid, other_isec->sid,
3182 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3186 /* connecting socket */
3187 ssec = sock->sk->sk_security;
3188 ssec->peer_sid = other_isec->sid;
3190 /* server child socket */
3191 ssec = newsk->sk_security;
3192 ssec->peer_sid = isec->sid;
3197 static int selinux_socket_unix_may_send(struct socket *sock,
3198 struct socket *other)
3200 struct inode_security_struct *isec;
3201 struct inode_security_struct *other_isec;
3202 struct avc_audit_data ad;
3205 isec = SOCK_INODE(sock)->i_security;
3206 other_isec = SOCK_INODE(other)->i_security;
3208 AVC_AUDIT_DATA_INIT(&ad,NET);
3209 ad.u.net.sk = other->sk;
3211 err = avc_has_perm(isec->sid, other_isec->sid,
3212 isec->sclass, SOCKET__SENDTO, &ad);
3219 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3224 u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3227 struct socket *sock;
3228 struct net_device *dev;
3229 struct avc_audit_data ad;
3231 family = sk->sk_family;
3232 if (family != PF_INET && family != PF_INET6)
3235 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3236 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
3239 read_lock_bh(&sk->sk_callback_lock);
3240 sock = sk->sk_socket;
3242 struct inode *inode;
3243 inode = SOCK_INODE(sock);
3245 struct inode_security_struct *isec;
3246 isec = inode->i_security;
3247 sock_sid = isec->sid;
3248 sock_class = isec->sclass;
3251 read_unlock_bh(&sk->sk_callback_lock);
3259 err = sel_netif_sids(dev, &if_sid, NULL);
3263 switch (sock_class) {
3264 case SECCLASS_UDP_SOCKET:
3265 netif_perm = NETIF__UDP_RECV;
3266 node_perm = NODE__UDP_RECV;
3267 recv_perm = UDP_SOCKET__RECV_MSG;
3270 case SECCLASS_TCP_SOCKET:
3271 netif_perm = NETIF__TCP_RECV;
3272 node_perm = NODE__TCP_RECV;
3273 recv_perm = TCP_SOCKET__RECV_MSG;
3277 netif_perm = NETIF__RAWIP_RECV;
3278 node_perm = NODE__RAWIP_RECV;
3282 AVC_AUDIT_DATA_INIT(&ad, NET);
3283 ad.u.net.netif = dev->name;
3284 ad.u.net.family = family;
3286 err = selinux_parse_skb(skb, &ad, &addrp, &len, 1);
3290 err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, &ad);
3294 /* Fixme: this lookup is inefficient */
3295 err = security_node_sid(family, addrp, len, &node_sid);
3299 err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, &ad);
3306 /* Fixme: make this more efficient */
3307 err = security_port_sid(sk->sk_family, sk->sk_type,
3308 sk->sk_protocol, ntohs(ad.u.net.sport),
3313 err = avc_has_perm(sock_sid, port_sid,
3314 sock_class, recv_perm, &ad);
3318 err = selinux_xfrm_sock_rcv_skb(sock_sid, skb);
3324 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
3325 int __user *optlen, unsigned len)
3330 struct sk_security_struct *ssec;
3331 struct inode_security_struct *isec;
3334 isec = SOCK_INODE(sock)->i_security;
3336 /* if UNIX_STREAM check peer_sid, if TCP check dst for labelled sa */
3337 if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET) {
3338 ssec = sock->sk->sk_security;
3339 peer_sid = ssec->peer_sid;
3341 else if (isec->sclass == SECCLASS_TCP_SOCKET) {
3342 peer_sid = selinux_socket_getpeer_stream(sock->sk);
3344 if (peer_sid == SECSID_NULL) {
3354 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
3359 if (scontext_len > len) {
3364 if (copy_to_user(optval, scontext, scontext_len))
3368 if (put_user(scontext_len, optlen))
3376 static int selinux_socket_getpeersec_dgram(struct sk_buff *skb, char **secdata, u32 *seclen)
3379 u32 peer_sid = selinux_socket_getpeer_dgram(skb);
3381 if (peer_sid == SECSID_NULL)
3384 err = security_sid_to_context(peer_sid, secdata, seclen);
3393 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
3395 return sk_alloc_security(sk, family, priority);
3398 static void selinux_sk_free_security(struct sock *sk)
3400 sk_free_security(sk);
3403 static unsigned int selinux_sk_getsid_security(struct sock *sk, struct flowi *fl, u8 dir)
3405 struct inode_security_struct *isec;
3406 u32 sock_sid = SECINITSID_ANY_SOCKET;
3409 return selinux_no_sk_sid(fl);
3411 read_lock_bh(&sk->sk_callback_lock);
3412 isec = get_sock_isec(sk);
3415 sock_sid = isec->sid;
3417 read_unlock_bh(&sk->sk_callback_lock);
3421 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3425 struct nlmsghdr *nlh;
3426 struct socket *sock = sk->sk_socket;
3427 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3429 if (skb->len < NLMSG_SPACE(0)) {
3433 nlh = (struct nlmsghdr *)skb->data;
3435 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3437 if (err == -EINVAL) {
3438 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
3439 "SELinux: unrecognized netlink message"
3440 " type=%hu for sclass=%hu\n",
3441 nlh->nlmsg_type, isec->sclass);
3442 if (!selinux_enforcing)
3452 err = socket_has_perm(current, sock, perm);
3457 #ifdef CONFIG_NETFILTER
3459 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3460 struct sk_buff **pskb,
3461 const struct net_device *in,
3462 const struct net_device *out,
3463 int (*okfn)(struct sk_buff *),
3467 int len, err = NF_ACCEPT;
3468 u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
3470 struct socket *sock;
3471 struct inode *inode;
3472 struct sk_buff *skb = *pskb;
3473 struct inode_security_struct *isec;
3474 struct avc_audit_data ad;
3475 struct net_device *dev = (struct net_device *)out;
3481 sock = sk->sk_socket;
3485 inode = SOCK_INODE(sock);
3489 err = sel_netif_sids(dev, &if_sid, NULL);
3493 isec = inode->i_security;
3495 switch (isec->sclass) {
3496 case SECCLASS_UDP_SOCKET:
3497 netif_perm = NETIF__UDP_SEND;
3498 node_perm = NODE__UDP_SEND;
3499 send_perm = UDP_SOCKET__SEND_MSG;
3502 case SECCLASS_TCP_SOCKET:
3503 netif_perm = NETIF__TCP_SEND;
3504 node_perm = NODE__TCP_SEND;
3505 send_perm = TCP_SOCKET__SEND_MSG;
3509 netif_perm = NETIF__RAWIP_SEND;
3510 node_perm = NODE__RAWIP_SEND;
3515 AVC_AUDIT_DATA_INIT(&ad, NET);
3516 ad.u.net.netif = dev->name;
3517 ad.u.net.family = family;
3519 err = selinux_parse_skb(skb, &ad, &addrp,
3520 &len, 0) ? NF_DROP : NF_ACCEPT;
3521 if (err != NF_ACCEPT)
3524 err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF,
3525 netif_perm, &ad) ? NF_DROP : NF_ACCEPT;
3526 if (err != NF_ACCEPT)
3529 /* Fixme: this lookup is inefficient */
3530 err = security_node_sid(family, addrp, len,
3531 &node_sid) ? NF_DROP : NF_ACCEPT;
3532 if (err != NF_ACCEPT)
3535 err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE,
3536 node_perm, &ad) ? NF_DROP : NF_ACCEPT;
3537 if (err != NF_ACCEPT)
3543 /* Fixme: make this more efficient */
3544 err = security_port_sid(sk->sk_family,
3547 ntohs(ad.u.net.dport),
3548 &port_sid) ? NF_DROP : NF_ACCEPT;
3549 if (err != NF_ACCEPT)
3552 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3553 send_perm, &ad) ? NF_DROP : NF_ACCEPT;
3556 if (err != NF_ACCEPT)
3559 err = selinux_xfrm_postroute_last(isec->sid, skb);
3565 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3566 struct sk_buff **pskb,
3567 const struct net_device *in,
3568 const struct net_device *out,
3569 int (*okfn)(struct sk_buff *))
3571 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3574 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3576 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3577 struct sk_buff **pskb,
3578 const struct net_device *in,
3579 const struct net_device *out,
3580 int (*okfn)(struct sk_buff *))
3582 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3587 #endif /* CONFIG_NETFILTER */
3589 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3591 struct task_security_struct *tsec;
3592 struct av_decision avd;
3595 err = secondary_ops->netlink_send(sk, skb);
3599 tsec = current->security;
3602 avc_has_perm_noaudit(tsec->sid, tsec->sid,
3603 SECCLASS_CAPABILITY, ~0, &avd);
3604 cap_mask(NETLINK_CB(skb).eff_cap, avd.allowed);
3606 if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
3607 err = selinux_nlmsg_perm(sk, skb);
3612 static int selinux_netlink_recv(struct sk_buff *skb)
3614 if (!cap_raised(NETLINK_CB(skb).eff_cap, CAP_NET_ADMIN))
3619 static int ipc_alloc_security(struct task_struct *task,
3620 struct kern_ipc_perm *perm,
3623 struct task_security_struct *tsec = task->security;
3624 struct ipc_security_struct *isec;
3626 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
3630 isec->sclass = sclass;
3631 isec->ipc_perm = perm;
3632 isec->sid = tsec->sid;
3633 perm->security = isec;
3638 static void ipc_free_security(struct kern_ipc_perm *perm)
3640 struct ipc_security_struct *isec = perm->security;
3641 perm->security = NULL;
3645 static int msg_msg_alloc_security(struct msg_msg *msg)
3647 struct msg_security_struct *msec;
3649 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
3654 msec->sid = SECINITSID_UNLABELED;
3655 msg->security = msec;
3660 static void msg_msg_free_security(struct msg_msg *msg)
3662 struct msg_security_struct *msec = msg->security;
3664 msg->security = NULL;
3668 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
3671 struct task_security_struct *tsec;
3672 struct ipc_security_struct *isec;
3673 struct avc_audit_data ad;
3675 tsec = current->security;
3676 isec = ipc_perms->security;
3678 AVC_AUDIT_DATA_INIT(&ad, IPC);
3679 ad.u.ipc_id = ipc_perms->key;
3681 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3684 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
3686 return msg_msg_alloc_security(msg);
3689 static void selinux_msg_msg_free_security(struct msg_msg *msg)
3691 msg_msg_free_security(msg);
3694 /* message queue security operations */
3695 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
3697 struct task_security_struct *tsec;
3698 struct ipc_security_struct *isec;
3699 struct avc_audit_data ad;
3702 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
3706 tsec = current->security;
3707 isec = msq->q_perm.security;
3709 AVC_AUDIT_DATA_INIT(&ad, IPC);
3710 ad.u.ipc_id = msq->q_perm.key;
3712 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3715 ipc_free_security(&msq->q_perm);
3721 static void selinux_msg_queue_free_security(struct msg_queue *msq)
3723 ipc_free_security(&msq->q_perm);
3726 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
3728 struct task_security_struct *tsec;
3729 struct ipc_security_struct *isec;
3730 struct avc_audit_data ad;
3732 tsec = current->security;
3733 isec = msq->q_perm.security;
3735 AVC_AUDIT_DATA_INIT(&ad, IPC);
3736 ad.u.ipc_id = msq->q_perm.key;
3738 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3739 MSGQ__ASSOCIATE, &ad);
3742 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
3750 /* No specific object, just general system-wide information. */
3751 return task_has_system(current, SYSTEM__IPC_INFO);
3754 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
3757 perms = MSGQ__SETATTR;
3760 perms = MSGQ__DESTROY;
3766 err = ipc_has_perm(&msq->q_perm, perms);
3770 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
3772 struct task_security_struct *tsec;
3773 struct ipc_security_struct *isec;
3774 struct msg_security_struct *msec;
3775 struct avc_audit_data ad;
3778 tsec = current->security;
3779 isec = msq->q_perm.security;
3780 msec = msg->security;
3783 * First time through, need to assign label to the message
3785 if (msec->sid == SECINITSID_UNLABELED) {
3787 * Compute new sid based on current process and
3788 * message queue this message will be stored in
3790 rc = security_transition_sid(tsec->sid,
3798 AVC_AUDIT_DATA_INIT(&ad, IPC);
3799 ad.u.ipc_id = msq->q_perm.key;
3801 /* Can this process write to the queue? */
3802 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3805 /* Can this process send the message */
3806 rc = avc_has_perm(tsec->sid, msec->sid,
3807 SECCLASS_MSG, MSG__SEND, &ad);
3809 /* Can the message be put in the queue? */
3810 rc = avc_has_perm(msec->sid, isec->sid,
3811 SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
3816 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
3817 struct task_struct *target,
3818 long type, int mode)
3820 struct task_security_struct *tsec;
3821 struct ipc_security_struct *isec;
3822 struct msg_security_struct *msec;
3823 struct avc_audit_data ad;
3826 tsec = target->security;
3827 isec = msq->q_perm.security;
3828 msec = msg->security;
3830 AVC_AUDIT_DATA_INIT(&ad, IPC);
3831 ad.u.ipc_id = msq->q_perm.key;
3833 rc = avc_has_perm(tsec->sid, isec->sid,
3834 SECCLASS_MSGQ, MSGQ__READ, &ad);
3836 rc = avc_has_perm(tsec->sid, msec->sid,
3837 SECCLASS_MSG, MSG__RECEIVE, &ad);
3841 /* Shared Memory security operations */
3842 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
3844 struct task_security_struct *tsec;
3845 struct ipc_security_struct *isec;
3846 struct avc_audit_data ad;
3849 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
3853 tsec = current->security;
3854 isec = shp->shm_perm.security;
3856 AVC_AUDIT_DATA_INIT(&ad, IPC);
3857 ad.u.ipc_id = shp->shm_perm.key;
3859 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3862 ipc_free_security(&shp->shm_perm);
3868 static void selinux_shm_free_security(struct shmid_kernel *shp)
3870 ipc_free_security(&shp->shm_perm);
3873 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
3875 struct task_security_struct *tsec;
3876 struct ipc_security_struct *isec;
3877 struct avc_audit_data ad;
3879 tsec = current->security;
3880 isec = shp->shm_perm.security;
3882 AVC_AUDIT_DATA_INIT(&ad, IPC);
3883 ad.u.ipc_id = shp->shm_perm.key;
3885 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3886 SHM__ASSOCIATE, &ad);
3889 /* Note, at this point, shp is locked down */
3890 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
3898 /* No specific object, just general system-wide information. */
3899 return task_has_system(current, SYSTEM__IPC_INFO);
3902 perms = SHM__GETATTR | SHM__ASSOCIATE;
3905 perms = SHM__SETATTR;
3912 perms = SHM__DESTROY;
3918 err = ipc_has_perm(&shp->shm_perm, perms);
3922 static int selinux_shm_shmat(struct shmid_kernel *shp,
3923 char __user *shmaddr, int shmflg)
3928 rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
3932 if (shmflg & SHM_RDONLY)
3935 perms = SHM__READ | SHM__WRITE;
3937 return ipc_has_perm(&shp->shm_perm, perms);
3940 /* Semaphore security operations */
3941 static int selinux_sem_alloc_security(struct sem_array *sma)
3943 struct task_security_struct *tsec;
3944 struct ipc_security_struct *isec;
3945 struct avc_audit_data ad;
3948 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
3952 tsec = current->security;
3953 isec = sma->sem_perm.security;
3955 AVC_AUDIT_DATA_INIT(&ad, IPC);
3956 ad.u.ipc_id = sma->sem_perm.key;
3958 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
3961 ipc_free_security(&sma->sem_perm);
3967 static void selinux_sem_free_security(struct sem_array *sma)
3969 ipc_free_security(&sma->sem_perm);
3972 static int selinux_sem_associate(struct sem_array *sma, int semflg)
3974 struct task_security_struct *tsec;
3975 struct ipc_security_struct *isec;
3976 struct avc_audit_data ad;
3978 tsec = current->security;
3979 isec = sma->sem_perm.security;
3981 AVC_AUDIT_DATA_INIT(&ad, IPC);
3982 ad.u.ipc_id = sma->sem_perm.key;
3984 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
3985 SEM__ASSOCIATE, &ad);
3988 /* Note, at this point, sma is locked down */
3989 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
3997 /* No specific object, just general system-wide information. */
3998 return task_has_system(current, SYSTEM__IPC_INFO);
4002 perms = SEM__GETATTR;
4013 perms = SEM__DESTROY;
4016 perms = SEM__SETATTR;
4020 perms = SEM__GETATTR | SEM__ASSOCIATE;
4026 err = ipc_has_perm(&sma->sem_perm, perms);
4030 static int selinux_sem_semop(struct sem_array *sma,
4031 struct sembuf *sops, unsigned nsops, int alter)
4036 perms = SEM__READ | SEM__WRITE;
4040 return ipc_has_perm(&sma->sem_perm, perms);
4043 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4049 av |= IPC__UNIX_READ;
4051 av |= IPC__UNIX_WRITE;
4056 return ipc_has_perm(ipcp, av);
4059 /* module stacking operations */
4060 static int selinux_register_security (const char *name, struct security_operations *ops)
4062 if (secondary_ops != original_ops) {
4063 printk(KERN_INFO "%s: There is already a secondary security "
4064 "module registered.\n", __FUNCTION__);
4068 secondary_ops = ops;
4070 printk(KERN_INFO "%s: Registering secondary module %s\n",
4077 static int selinux_unregister_security (const char *name, struct security_operations *ops)
4079 if (ops != secondary_ops) {
4080 printk (KERN_INFO "%s: trying to unregister a security module "
4081 "that is not registered.\n", __FUNCTION__);
4085 secondary_ops = original_ops;
4090 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4093 inode_doinit_with_dentry(inode, dentry);
4096 static int selinux_getprocattr(struct task_struct *p,
4097 char *name, void *value, size_t size)
4099 struct task_security_struct *tsec;
4104 error = task_has_perm(current, p, PROCESS__GETATTR);
4111 if (!strcmp(name, "current"))
4113 else if (!strcmp(name, "prev"))
4115 else if (!strcmp(name, "exec"))
4116 sid = tsec->exec_sid;
4117 else if (!strcmp(name, "fscreate"))
4118 sid = tsec->create_sid;
4125 return selinux_getsecurity(sid, value, size);
4128 static int selinux_setprocattr(struct task_struct *p,
4129 char *name, void *value, size_t size)
4131 struct task_security_struct *tsec;
4137 /* SELinux only allows a process to change its own
4138 security attributes. */
4143 * Basic control over ability to set these attributes at all.
4144 * current == p, but we'll pass them separately in case the
4145 * above restriction is ever removed.
4147 if (!strcmp(name, "exec"))
4148 error = task_has_perm(current, p, PROCESS__SETEXEC);
4149 else if (!strcmp(name, "fscreate"))
4150 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4151 else if (!strcmp(name, "current"))
4152 error = task_has_perm(current, p, PROCESS__SETCURRENT);
4158 /* Obtain a SID for the context, if one was specified. */
4159 if (size && str[1] && str[1] != '\n') {
4160 if (str[size-1] == '\n') {
4164 error = security_context_to_sid(value, size, &sid);
4169 /* Permission checking based on the specified context is
4170 performed during the actual operation (execve,
4171 open/mkdir/...), when we know the full context of the
4172 operation. See selinux_bprm_set_security for the execve
4173 checks and may_create for the file creation checks. The
4174 operation will then fail if the context is not permitted. */
4176 if (!strcmp(name, "exec"))
4177 tsec->exec_sid = sid;
4178 else if (!strcmp(name, "fscreate"))
4179 tsec->create_sid = sid;
4180 else if (!strcmp(name, "current")) {
4181 struct av_decision avd;
4186 /* Only allow single threaded processes to change context */
4187 if (atomic_read(&p->mm->mm_users) != 1) {
4188 struct task_struct *g, *t;
4189 struct mm_struct *mm = p->mm;
4190 read_lock(&tasklist_lock);
4191 do_each_thread(g, t)
4192 if (t->mm == mm && t != p) {
4193 read_unlock(&tasklist_lock);
4196 while_each_thread(g, t);
4197 read_unlock(&tasklist_lock);
4200 /* Check permissions for the transition. */
4201 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
4202 PROCESS__DYNTRANSITION, NULL);
4206 /* Check for ptracing, and update the task SID if ok.
4207 Otherwise, leave SID unchanged and fail. */
4209 if (p->ptrace & PT_PTRACED) {
4210 error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
4212 PROCESS__PTRACE, &avd);
4216 avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
4217 PROCESS__PTRACE, &avd, error, NULL);
4231 static struct security_operations selinux_ops = {
4232 .ptrace = selinux_ptrace,
4233 .capget = selinux_capget,
4234 .capset_check = selinux_capset_check,
4235 .capset_set = selinux_capset_set,
4236 .sysctl = selinux_sysctl,
4237 .capable = selinux_capable,
4238 .quotactl = selinux_quotactl,
4239 .quota_on = selinux_quota_on,
4240 .syslog = selinux_syslog,
4241 .vm_enough_memory = selinux_vm_enough_memory,
4243 .netlink_send = selinux_netlink_send,
4244 .netlink_recv = selinux_netlink_recv,
4246 .bprm_alloc_security = selinux_bprm_alloc_security,
4247 .bprm_free_security = selinux_bprm_free_security,
4248 .bprm_apply_creds = selinux_bprm_apply_creds,
4249 .bprm_post_apply_creds = selinux_bprm_post_apply_creds,
4250 .bprm_set_security = selinux_bprm_set_security,
4251 .bprm_check_security = selinux_bprm_check_security,
4252 .bprm_secureexec = selinux_bprm_secureexec,
4254 .sb_alloc_security = selinux_sb_alloc_security,
4255 .sb_free_security = selinux_sb_free_security,
4256 .sb_copy_data = selinux_sb_copy_data,
4257 .sb_kern_mount = selinux_sb_kern_mount,
4258 .sb_statfs = selinux_sb_statfs,
4259 .sb_mount = selinux_mount,
4260 .sb_umount = selinux_umount,
4262 .inode_alloc_security = selinux_inode_alloc_security,
4263 .inode_free_security = selinux_inode_free_security,
4264 .inode_init_security = selinux_inode_init_security,
4265 .inode_create = selinux_inode_create,
4266 .inode_link = selinux_inode_link,
4267 .inode_unlink = selinux_inode_unlink,
4268 .inode_symlink = selinux_inode_symlink,
4269 .inode_mkdir = selinux_inode_mkdir,
4270 .inode_rmdir = selinux_inode_rmdir,
4271 .inode_mknod = selinux_inode_mknod,
4272 .inode_rename = selinux_inode_rename,
4273 .inode_readlink = selinux_inode_readlink,
4274 .inode_follow_link = selinux_inode_follow_link,
4275 .inode_permission = selinux_inode_permission,
4276 .inode_setattr = selinux_inode_setattr,
4277 .inode_getattr = selinux_inode_getattr,
4278 .inode_setxattr = selinux_inode_setxattr,
4279 .inode_post_setxattr = selinux_inode_post_setxattr,
4280 .inode_getxattr = selinux_inode_getxattr,
4281 .inode_listxattr = selinux_inode_listxattr,
4282 .inode_removexattr = selinux_inode_removexattr,
4283 .inode_xattr_getsuffix = selinux_inode_xattr_getsuffix,
4284 .inode_getsecurity = selinux_inode_getsecurity,
4285 .inode_setsecurity = selinux_inode_setsecurity,
4286 .inode_listsecurity = selinux_inode_listsecurity,
4288 .file_permission = selinux_file_permission,
4289 .file_alloc_security = selinux_file_alloc_security,
4290 .file_free_security = selinux_file_free_security,
4291 .file_ioctl = selinux_file_ioctl,
4292 .file_mmap = selinux_file_mmap,
4293 .file_mprotect = selinux_file_mprotect,
4294 .file_lock = selinux_file_lock,
4295 .file_fcntl = selinux_file_fcntl,
4296 .file_set_fowner = selinux_file_set_fowner,
4297 .file_send_sigiotask = selinux_file_send_sigiotask,
4298 .file_receive = selinux_file_receive,
4300 .task_create = selinux_task_create,
4301 .task_alloc_security = selinux_task_alloc_security,
4302 .task_free_security = selinux_task_free_security,
4303 .task_setuid = selinux_task_setuid,
4304 .task_post_setuid = selinux_task_post_setuid,
4305 .task_setgid = selinux_task_setgid,
4306 .task_setpgid = selinux_task_setpgid,
4307 .task_getpgid = selinux_task_getpgid,
4308 .task_getsid = selinux_task_getsid,
4309 .task_setgroups = selinux_task_setgroups,
4310 .task_setnice = selinux_task_setnice,
4311 .task_setrlimit = selinux_task_setrlimit,
4312 .task_setscheduler = selinux_task_setscheduler,
4313 .task_getscheduler = selinux_task_getscheduler,
4314 .task_kill = selinux_task_kill,
4315 .task_wait = selinux_task_wait,
4316 .task_prctl = selinux_task_prctl,
4317 .task_reparent_to_init = selinux_task_reparent_to_init,
4318 .task_to_inode = selinux_task_to_inode,
4320 .ipc_permission = selinux_ipc_permission,
4322 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
4323 .msg_msg_free_security = selinux_msg_msg_free_security,
4325 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
4326 .msg_queue_free_security = selinux_msg_queue_free_security,
4327 .msg_queue_associate = selinux_msg_queue_associate,
4328 .msg_queue_msgctl = selinux_msg_queue_msgctl,
4329 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
4330 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
4332 .shm_alloc_security = selinux_shm_alloc_security,
4333 .shm_free_security = selinux_shm_free_security,
4334 .shm_associate = selinux_shm_associate,
4335 .shm_shmctl = selinux_shm_shmctl,
4336 .shm_shmat = selinux_shm_shmat,
4338 .sem_alloc_security = selinux_sem_alloc_security,
4339 .sem_free_security = selinux_sem_free_security,
4340 .sem_associate = selinux_sem_associate,
4341 .sem_semctl = selinux_sem_semctl,
4342 .sem_semop = selinux_sem_semop,
4344 .register_security = selinux_register_security,
4345 .unregister_security = selinux_unregister_security,
4347 .d_instantiate = selinux_d_instantiate,
4349 .getprocattr = selinux_getprocattr,
4350 .setprocattr = selinux_setprocattr,
4352 .unix_stream_connect = selinux_socket_unix_stream_connect,
4353 .unix_may_send = selinux_socket_unix_may_send,
4355 .socket_create = selinux_socket_create,
4356 .socket_post_create = selinux_socket_post_create,
4357 .socket_bind = selinux_socket_bind,
4358 .socket_connect = selinux_socket_connect,
4359 .socket_listen = selinux_socket_listen,
4360 .socket_accept = selinux_socket_accept,
4361 .socket_sendmsg = selinux_socket_sendmsg,
4362 .socket_recvmsg = selinux_socket_recvmsg,
4363 .socket_getsockname = selinux_socket_getsockname,
4364 .socket_getpeername = selinux_socket_getpeername,
4365 .socket_getsockopt = selinux_socket_getsockopt,
4366 .socket_setsockopt = selinux_socket_setsockopt,
4367 .socket_shutdown = selinux_socket_shutdown,
4368 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
4369 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
4370 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
4371 .sk_alloc_security = selinux_sk_alloc_security,
4372 .sk_free_security = selinux_sk_free_security,
4373 .sk_getsid = selinux_sk_getsid_security,
4375 #ifdef CONFIG_SECURITY_NETWORK_XFRM
4376 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
4377 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
4378 .xfrm_policy_free_security = selinux_xfrm_policy_free,
4379 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
4380 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
4381 .xfrm_state_free_security = selinux_xfrm_state_free,
4382 .xfrm_state_delete_security = selinux_xfrm_state_delete,
4383 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
4387 static __init int selinux_init(void)
4389 struct task_security_struct *tsec;
4391 if (!selinux_enabled) {
4392 printk(KERN_INFO "SELinux: Disabled at boot.\n");
4396 printk(KERN_INFO "SELinux: Initializing.\n");
4398 /* Set the security state for the initial task. */
4399 if (task_alloc_security(current))
4400 panic("SELinux: Failed to initialize initial task.\n");
4401 tsec = current->security;
4402 tsec->osid = tsec->sid = SECINITSID_KERNEL;
4404 sel_inode_cache = kmem_cache_create("selinux_inode_security",
4405 sizeof(struct inode_security_struct),
4406 0, SLAB_PANIC, NULL, NULL);
4409 original_ops = secondary_ops = security_ops;
4411 panic ("SELinux: No initial security operations\n");
4412 if (register_security (&selinux_ops))
4413 panic("SELinux: Unable to register with kernel.\n");
4415 if (selinux_enforcing) {
4416 printk(KERN_INFO "SELinux: Starting in enforcing mode\n");
4418 printk(KERN_INFO "SELinux: Starting in permissive mode\n");
4423 void selinux_complete_init(void)
4425 printk(KERN_INFO "SELinux: Completing initialization.\n");
4427 /* Set up any superblocks initialized prior to the policy load. */
4428 printk(KERN_INFO "SELinux: Setting up existing superblocks.\n");
4429 spin_lock(&sb_lock);
4430 spin_lock(&sb_security_lock);
4432 if (!list_empty(&superblock_security_head)) {
4433 struct superblock_security_struct *sbsec =
4434 list_entry(superblock_security_head.next,
4435 struct superblock_security_struct,
4437 struct super_block *sb = sbsec->sb;
4439 spin_unlock(&sb_security_lock);
4440 spin_unlock(&sb_lock);
4441 down_read(&sb->s_umount);
4443 superblock_doinit(sb, NULL);
4445 spin_lock(&sb_lock);
4446 spin_lock(&sb_security_lock);
4447 list_del_init(&sbsec->list);
4450 spin_unlock(&sb_security_lock);
4451 spin_unlock(&sb_lock);
4454 /* SELinux requires early initialization in order to label
4455 all processes and objects when they are created. */
4456 security_initcall(selinux_init);
4458 #if defined(CONFIG_NETFILTER)
4460 static struct nf_hook_ops selinux_ipv4_op = {
4461 .hook = selinux_ipv4_postroute_last,
4462 .owner = THIS_MODULE,
4464 .hooknum = NF_IP_POST_ROUTING,
4465 .priority = NF_IP_PRI_SELINUX_LAST,
4468 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4470 static struct nf_hook_ops selinux_ipv6_op = {
4471 .hook = selinux_ipv6_postroute_last,
4472 .owner = THIS_MODULE,
4474 .hooknum = NF_IP6_POST_ROUTING,
4475 .priority = NF_IP6_PRI_SELINUX_LAST,
4480 static int __init selinux_nf_ip_init(void)
4484 if (!selinux_enabled)
4487 printk(KERN_INFO "SELinux: Registering netfilter hooks\n");
4489 err = nf_register_hook(&selinux_ipv4_op);
4491 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
4493 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4495 err = nf_register_hook(&selinux_ipv6_op);
4497 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
4505 __initcall(selinux_nf_ip_init);
4507 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4508 static void selinux_nf_ip_exit(void)
4510 printk(KERN_INFO "SELinux: Unregistering netfilter hooks\n");
4512 nf_unregister_hook(&selinux_ipv4_op);
4513 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4514 nf_unregister_hook(&selinux_ipv6_op);
4519 #else /* CONFIG_NETFILTER */
4521 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4522 #define selinux_nf_ip_exit()
4525 #endif /* CONFIG_NETFILTER */
4527 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4528 int selinux_disable(void)
4530 extern void exit_sel_fs(void);
4531 static int selinux_disabled = 0;
4533 if (ss_initialized) {
4534 /* Not permitted after initial policy load. */
4538 if (selinux_disabled) {
4539 /* Only do this once. */
4543 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
4545 selinux_disabled = 1;
4546 selinux_enabled = 0;
4548 /* Reset security_ops to the secondary module, dummy or capability. */
4549 security_ops = secondary_ops;
4551 /* Unregister netfilter hooks. */
4552 selinux_nf_ip_exit();
4554 /* Unregister selinuxfs. */