blob: e32f4b5f23a5627584196183285c659ecb3ebd85 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
Eric Paris828dfe12008-04-17 13:17:49 -04007 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070010 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
Eric Paris2069f452008-07-04 09:47:13 +100012 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070014 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
Eric Paris828dfe12008-04-17 13:17:49 -040015 * <dgoeddel@trustedcs.com>
Paul Mooreed6d76e2009-08-28 18:12:49 -040016 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
Paul Moore82c21bf2011-08-01 11:10:33 +000017 * Paul Moore <paul@paul-moore.com>
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +090018 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
Eric Paris828dfe12008-04-17 13:17:49 -040019 * Yuichi Nakamura <ynakam@hitachisoft.jp>
Linus Torvalds1da177e2005-04-16 15:20:36 -070020 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
Eric Paris828dfe12008-04-17 13:17:49 -040023 * as published by the Free Software Foundation.
Linus Torvalds1da177e2005-04-16 15:20:36 -070024 */
25
Linus Torvalds1da177e2005-04-16 15:20:36 -070026#include <linux/init.h>
Eric Paris0b24dcb2011-02-25 15:39:20 -050027#include <linux/kd.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070028#include <linux/kernel.h>
Roland McGrath0d094ef2008-07-25 19:45:49 -070029#include <linux/tracehook.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070030#include <linux/errno.h>
31#include <linux/sched.h>
Casey Schaufler3c4ed7b2015-05-02 15:10:46 -070032#include <linux/lsm_hooks.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070033#include <linux/xattr.h>
34#include <linux/capability.h>
35#include <linux/unistd.h>
36#include <linux/mm.h>
37#include <linux/mman.h>
38#include <linux/slab.h>
39#include <linux/pagemap.h>
Eric Paris0b24dcb2011-02-25 15:39:20 -050040#include <linux/proc_fs.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070041#include <linux/swap.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070042#include <linux/spinlock.h>
43#include <linux/syscalls.h>
Eric Paris2a7dba32011-02-01 11:05:39 -050044#include <linux/dcache.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070045#include <linux/file.h>
Al Viro9f3acc32008-04-24 07:44:08 -040046#include <linux/fdtable.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070047#include <linux/namei.h>
48#include <linux/mount.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070049#include <linux/netfilter_ipv4.h>
50#include <linux/netfilter_ipv6.h>
51#include <linux/tty.h>
52#include <net/icmp.h>
Stephen Hemminger227b60f2007-10-10 17:30:46 -070053#include <net/ip.h> /* for local_port_range[] */
Linus Torvalds1da177e2005-04-16 15:20:36 -070054#include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
Paul Moore47180062013-12-04 16:10:45 -050055#include <net/inet_connection_sock.h>
Paul Moore220deb92008-01-29 08:38:23 -050056#include <net/net_namespace.h>
Paul Moored621d352008-01-29 08:43:36 -050057#include <net/netlabel.h>
Eric Parisf5269712008-05-14 11:27:45 -040058#include <linux/uaccess.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070059#include <asm/ioctls.h>
Arun Sharma600634972011-07-26 16:09:06 -070060#include <linux/atomic.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070061#include <linux/bitops.h>
62#include <linux/interrupt.h>
63#include <linux/netdevice.h> /* for network interface checks */
Hong zhi guo77954982013-03-27 06:49:35 +000064#include <net/netlink.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070065#include <linux/tcp.h>
66#include <linux/udp.h>
James Morris2ee92d42006-11-13 16:09:01 -080067#include <linux/dccp.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070068#include <linux/quota.h>
69#include <linux/un.h> /* for Unix socket types */
70#include <net/af_unix.h> /* for Unix socket types */
71#include <linux/parser.h>
72#include <linux/nfs_mount.h>
73#include <net/ipv6.h>
74#include <linux/hugetlb.h>
75#include <linux/personality.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070076#include <linux/audit.h>
Eric Paris6931dfc2005-06-30 02:58:51 -070077#include <linux/string.h>
Catherine Zhang877ce7c2006-06-29 12:27:47 -070078#include <linux/selinux.h>
Eric Paris23970742006-09-25 23:32:01 -070079#include <linux/mutex.h>
Frank Mayharf06febc2008-09-12 09:54:39 -070080#include <linux/posix-timers.h>
Kees Cook00234592010-02-03 15:36:43 -080081#include <linux/syslog.h>
Serge E. Hallyn34867402011-03-23 16:43:17 -070082#include <linux/user_namespace.h>
Paul Gortmaker44fc7ea2011-05-26 20:52:10 -040083#include <linux/export.h>
Al Viro40401532012-02-13 03:58:52 +000084#include <linux/msg.h>
85#include <linux/shm.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070086
87#include "avc.h"
88#include "objsec.h"
89#include "netif.h"
Paul Moore224dfbd2008-01-29 08:38:13 -050090#include "netnode.h"
Paul Moore3e1121722008-04-10 10:48:14 -040091#include "netport.h"
Trent Jaegerd28d1e02005-12-13 23:12:40 -080092#include "xfrm.h"
Paul Moorec60475b2007-02-28 15:14:23 -050093#include "netlabel.h"
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +020094#include "audit.h"
James Morris7b98a582011-08-30 12:52:32 +100095#include "avc_ss.h"
Linus Torvalds1da177e2005-04-16 15:20:36 -070096
Paul Moored621d352008-01-29 08:43:36 -050097/* SECMARK reference count */
James Morris56a4ca92011-08-17 11:08:43 +100098static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
Paul Moored621d352008-01-29 08:43:36 -050099
Linus Torvalds1da177e2005-04-16 15:20:36 -0700100#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
Eric Paris828dfe12008-04-17 13:17:49 -0400101int selinux_enforcing;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700102
103static int __init enforcing_setup(char *str)
104{
Eric Parisf5269712008-05-14 11:27:45 -0400105 unsigned long enforcing;
Jingoo Han29707b22014-02-05 15:13:14 +0900106 if (!kstrtoul(str, 0, &enforcing))
Eric Parisf5269712008-05-14 11:27:45 -0400107 selinux_enforcing = enforcing ? 1 : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700108 return 1;
109}
110__setup("enforcing=", enforcing_setup);
111#endif
112
113#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
114int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
115
116static int __init selinux_enabled_setup(char *str)
117{
Eric Parisf5269712008-05-14 11:27:45 -0400118 unsigned long enabled;
Jingoo Han29707b22014-02-05 15:13:14 +0900119 if (!kstrtoul(str, 0, &enabled))
Eric Parisf5269712008-05-14 11:27:45 -0400120 selinux_enabled = enabled ? 1 : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700121 return 1;
122}
123__setup("selinux=", selinux_enabled_setup);
Stephen Smalley30d55282006-05-03 10:52:36 -0400124#else
125int selinux_enabled = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700126#endif
127
Christoph Lametere18b8902006-12-06 20:33:20 -0800128static struct kmem_cache *sel_inode_cache;
Sangwoo63205652015-10-21 17:44:30 -0400129static struct kmem_cache *file_security_cache;
James Morris7cae7e22006-03-22 00:09:22 -0800130
Paul Moored621d352008-01-29 08:43:36 -0500131/**
132 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
133 *
134 * Description:
135 * This function checks the SECMARK reference counter to see if any SECMARK
136 * targets are currently configured, if the reference counter is greater than
137 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
Chris PeBenito2be4d742013-05-03 09:05:39 -0400138 * enabled, false (0) if SECMARK is disabled. If the always_check_network
139 * policy capability is enabled, SECMARK is always considered enabled.
Paul Moored621d352008-01-29 08:43:36 -0500140 *
141 */
142static int selinux_secmark_enabled(void)
143{
Chris PeBenito2be4d742013-05-03 09:05:39 -0400144 return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
145}
146
147/**
148 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
149 *
150 * Description:
151 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
152 * (1) if any are enabled or false (0) if neither are enabled. If the
153 * always_check_network policy capability is enabled, peer labeling
154 * is always considered enabled.
155 *
156 */
157static int selinux_peerlbl_enabled(void)
158{
159 return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
Paul Moored621d352008-01-29 08:43:36 -0500160}
161
Paul Moore615e51f2014-06-26 14:33:56 -0400162static int selinux_netcache_avc_callback(u32 event)
163{
164 if (event == AVC_CALLBACK_RESET) {
165 sel_netif_flush();
166 sel_netnode_flush();
167 sel_netport_flush();
168 synchronize_net();
169 }
170 return 0;
171}
172
David Howellsd84f4f92008-11-14 10:39:23 +1100173/*
174 * initialise the security for the init task
175 */
176static void cred_init_security(void)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700177{
David Howells3b11a1d2008-11-14 10:39:26 +1100178 struct cred *cred = (struct cred *) current->real_cred;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700179 struct task_security_struct *tsec;
180
James Morris89d155e2005-10-30 14:59:21 -0800181 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700182 if (!tsec)
David Howellsd84f4f92008-11-14 10:39:23 +1100183 panic("SELinux: Failed to initialize initial task.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -0700184
David Howellsd84f4f92008-11-14 10:39:23 +1100185 tsec->osid = tsec->sid = SECINITSID_KERNEL;
David Howellsf1752ee2008-11-14 10:39:17 +1100186 cred->security = tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700187}
188
David Howells275bb412008-11-14 10:39:19 +1100189/*
David Howells88e67f32008-11-14 10:39:21 +1100190 * get the security ID of a set of credentials
191 */
192static inline u32 cred_sid(const struct cred *cred)
193{
194 const struct task_security_struct *tsec;
195
196 tsec = cred->security;
197 return tsec->sid;
198}
199
200/*
David Howells3b11a1d2008-11-14 10:39:26 +1100201 * get the objective security ID of a task
David Howells275bb412008-11-14 10:39:19 +1100202 */
203static inline u32 task_sid(const struct task_struct *task)
204{
David Howells275bb412008-11-14 10:39:19 +1100205 u32 sid;
206
207 rcu_read_lock();
David Howells88e67f32008-11-14 10:39:21 +1100208 sid = cred_sid(__task_cred(task));
David Howells275bb412008-11-14 10:39:19 +1100209 rcu_read_unlock();
210 return sid;
211}
212
213/*
David Howells3b11a1d2008-11-14 10:39:26 +1100214 * get the subjective security ID of the current task
David Howells275bb412008-11-14 10:39:19 +1100215 */
216static inline u32 current_sid(void)
217{
Paul Moore5fb49872010-04-22 14:46:19 -0400218 const struct task_security_struct *tsec = current_security();
David Howells275bb412008-11-14 10:39:19 +1100219
220 return tsec->sid;
221}
222
David Howells88e67f32008-11-14 10:39:21 +1100223/* Allocate and free functions for each kind of security blob. */
224
Linus Torvalds1da177e2005-04-16 15:20:36 -0700225static int inode_alloc_security(struct inode *inode)
226{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700227 struct inode_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +1100228 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700229
Josef Bacika02fe132008-04-04 09:35:05 +1100230 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700231 if (!isec)
232 return -ENOMEM;
233
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +0100234 spin_lock_init(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700235 INIT_LIST_HEAD(&isec->list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700236 isec->inode = inode;
237 isec->sid = SECINITSID_UNLABELED;
238 isec->sclass = SECCLASS_FILE;
David Howells275bb412008-11-14 10:39:19 +1100239 isec->task_sid = sid;
Andreas Gruenbacher42059112016-11-10 22:18:27 +0100240 isec->initialized = LABEL_INVALID;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700241 inode->i_security = isec;
242
243 return 0;
244}
245
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500246static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
247
248/*
249 * Try reloading inode security labels that have been marked as invalid. The
250 * @may_sleep parameter indicates when sleeping and thus reloading labels is
Andreas Gruenbacher42059112016-11-10 22:18:27 +0100251 * allowed; when set to false, returns -ECHILD when the label is
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500252 * invalid. The @opt_dentry parameter should be set to a dentry of the inode;
253 * when no dentry is available, set it to NULL instead.
254 */
255static int __inode_security_revalidate(struct inode *inode,
256 struct dentry *opt_dentry,
257 bool may_sleep)
258{
259 struct inode_security_struct *isec = inode->i_security;
260
261 might_sleep_if(may_sleep);
262
Paul Moore1ac424762016-04-18 16:41:38 -0400263 if (ss_initialized && isec->initialized != LABEL_INITIALIZED) {
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500264 if (!may_sleep)
265 return -ECHILD;
266
267 /*
268 * Try reloading the inode security label. This will fail if
269 * @opt_dentry is NULL and no dentry for this inode can be
270 * found; in that case, continue using the old label.
271 */
272 inode_doinit_with_dentry(inode, opt_dentry);
273 }
274 return 0;
275}
276
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500277static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
278{
279 return inode->i_security;
280}
281
282static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
283{
284 int error;
285
286 error = __inode_security_revalidate(inode, NULL, !rcu);
287 if (error)
288 return ERR_PTR(error);
289 return inode->i_security;
290}
291
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500292/*
293 * Get the security label of an inode.
294 */
295static struct inode_security_struct *inode_security(struct inode *inode)
296{
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500297 __inode_security_revalidate(inode, NULL, true);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500298 return inode->i_security;
299}
300
Paul Moore2c971652016-04-19 16:36:28 -0400301static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
302{
303 struct inode *inode = d_backing_inode(dentry);
304
305 return inode->i_security;
306}
307
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500308/*
309 * Get the security label of a dentry's backing inode.
310 */
311static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
312{
313 struct inode *inode = d_backing_inode(dentry);
314
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500315 __inode_security_revalidate(inode, dentry, true);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500316 return inode->i_security;
317}
318
Steven Rostedt3dc91d42014-01-09 21:46:34 -0500319static void inode_free_rcu(struct rcu_head *head)
320{
321 struct inode_security_struct *isec;
322
323 isec = container_of(head, struct inode_security_struct, rcu);
324 kmem_cache_free(sel_inode_cache, isec);
325}
326
Linus Torvalds1da177e2005-04-16 15:20:36 -0700327static void inode_free_security(struct inode *inode)
328{
329 struct inode_security_struct *isec = inode->i_security;
330 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
331
Waiman Long9629d042015-07-10 17:19:56 -0400332 /*
333 * As not all inode security structures are in a list, we check for
334 * empty list outside of the lock to make sure that we won't waste
335 * time taking a lock doing nothing.
336 *
337 * The list_del_init() function can be safely called more than once.
338 * It should not be possible for this function to be called with
339 * concurrent list_add(), but for better safety against future changes
340 * in the code, we use list_empty_careful() here.
341 */
342 if (!list_empty_careful(&isec->list)) {
343 spin_lock(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700344 list_del_init(&isec->list);
Waiman Long9629d042015-07-10 17:19:56 -0400345 spin_unlock(&sbsec->isec_lock);
346 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700347
Steven Rostedt3dc91d42014-01-09 21:46:34 -0500348 /*
349 * The inode may still be referenced in a path walk and
350 * a call to selinux_inode_permission() can be made
351 * after inode_free_security() is called. Ideally, the VFS
352 * wouldn't do this, but fixing that is a much harder
353 * job. For now, simply free the i_security via RCU, and
354 * leave the current inode->i_security pointer intact.
355 * The inode will be freed after the RCU grace period too.
356 */
357 call_rcu(&isec->rcu, inode_free_rcu);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700358}
359
360static int file_alloc_security(struct file *file)
361{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700362 struct file_security_struct *fsec;
David Howells275bb412008-11-14 10:39:19 +1100363 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700364
Sangwoo63205652015-10-21 17:44:30 -0400365 fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700366 if (!fsec)
367 return -ENOMEM;
368
David Howells275bb412008-11-14 10:39:19 +1100369 fsec->sid = sid;
370 fsec->fown_sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700371 file->f_security = fsec;
372
373 return 0;
374}
375
376static void file_free_security(struct file *file)
377{
378 struct file_security_struct *fsec = file->f_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700379 file->f_security = NULL;
Sangwoo63205652015-10-21 17:44:30 -0400380 kmem_cache_free(file_security_cache, fsec);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700381}
382
383static int superblock_alloc_security(struct super_block *sb)
384{
385 struct superblock_security_struct *sbsec;
386
James Morris89d155e2005-10-30 14:59:21 -0800387 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700388 if (!sbsec)
389 return -ENOMEM;
390
Eric Parisbc7e9822006-09-25 23:32:02 -0700391 mutex_init(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700392 INIT_LIST_HEAD(&sbsec->isec_head);
393 spin_lock_init(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700394 sbsec->sb = sb;
395 sbsec->sid = SECINITSID_UNLABELED;
396 sbsec->def_sid = SECINITSID_FILE;
Eric Parisc312feb2006-07-10 04:43:53 -0700397 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700398 sb->s_security = sbsec;
399
400 return 0;
401}
402
403static void superblock_free_security(struct super_block *sb)
404{
405 struct superblock_security_struct *sbsec = sb->s_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700406 sb->s_security = NULL;
407 kfree(sbsec);
408}
409
Linus Torvalds1da177e2005-04-16 15:20:36 -0700410/* The file system's label must be initialized prior to use. */
411
David Quigleyeb9ae682013-05-22 12:50:37 -0400412static const char *labeling_behaviors[7] = {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700413 "uses xattr",
414 "uses transition SIDs",
415 "uses task SIDs",
416 "uses genfs_contexts",
417 "not configured for labeling",
418 "uses mountpoint labeling",
David Quigleyeb9ae682013-05-22 12:50:37 -0400419 "uses native labeling",
Linus Torvalds1da177e2005-04-16 15:20:36 -0700420};
421
Linus Torvalds1da177e2005-04-16 15:20:36 -0700422static inline int inode_doinit(struct inode *inode)
423{
424 return inode_doinit_with_dentry(inode, NULL);
425}
426
427enum {
Eric Paris31e87932007-09-19 17:19:12 -0400428 Opt_error = -1,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700429 Opt_context = 1,
430 Opt_fscontext = 2,
Eric Parisc9180a52007-11-30 13:00:35 -0500431 Opt_defcontext = 3,
432 Opt_rootcontext = 4,
David P. Quigley11689d42009-01-16 09:22:03 -0500433 Opt_labelsupport = 5,
Eric Parisd355987f2012-08-24 15:58:53 -0400434 Opt_nextmntopt = 6,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700435};
436
Eric Parisd355987f2012-08-24 15:58:53 -0400437#define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1)
438
Steven Whitehousea447c092008-10-13 10:46:57 +0100439static const match_table_t tokens = {
Eric Paris832cbd92008-04-01 13:24:09 -0400440 {Opt_context, CONTEXT_STR "%s"},
441 {Opt_fscontext, FSCONTEXT_STR "%s"},
442 {Opt_defcontext, DEFCONTEXT_STR "%s"},
443 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
David P. Quigley11689d42009-01-16 09:22:03 -0500444 {Opt_labelsupport, LABELSUPP_STR},
Eric Paris31e87932007-09-19 17:19:12 -0400445 {Opt_error, NULL},
Linus Torvalds1da177e2005-04-16 15:20:36 -0700446};
447
448#define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
449
Eric Parisc312feb2006-07-10 04:43:53 -0700450static int may_context_mount_sb_relabel(u32 sid,
451 struct superblock_security_struct *sbsec,
David Howells275bb412008-11-14 10:39:19 +1100452 const struct cred *cred)
Eric Parisc312feb2006-07-10 04:43:53 -0700453{
David Howells275bb412008-11-14 10:39:19 +1100454 const struct task_security_struct *tsec = cred->security;
Eric Parisc312feb2006-07-10 04:43:53 -0700455 int rc;
456
457 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
458 FILESYSTEM__RELABELFROM, NULL);
459 if (rc)
460 return rc;
461
462 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
463 FILESYSTEM__RELABELTO, NULL);
464 return rc;
465}
466
Eric Paris08089252006-07-10 04:43:55 -0700467static int may_context_mount_inode_relabel(u32 sid,
468 struct superblock_security_struct *sbsec,
David Howells275bb412008-11-14 10:39:19 +1100469 const struct cred *cred)
Eric Paris08089252006-07-10 04:43:55 -0700470{
David Howells275bb412008-11-14 10:39:19 +1100471 const struct task_security_struct *tsec = cred->security;
Eric Paris08089252006-07-10 04:43:55 -0700472 int rc;
473 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
474 FILESYSTEM__RELABELFROM, NULL);
475 if (rc)
476 return rc;
477
478 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
479 FILESYSTEM__ASSOCIATE, NULL);
480 return rc;
481}
482
Eric Parisb43e7252012-10-10 14:27:35 -0400483static int selinux_is_sblabel_mnt(struct super_block *sb)
484{
485 struct superblock_security_struct *sbsec = sb->s_security;
486
Mark Salyzynd5f3a5f2015-02-04 11:34:30 -0500487 return sbsec->behavior == SECURITY_FS_USE_XATTR ||
488 sbsec->behavior == SECURITY_FS_USE_TRANS ||
489 sbsec->behavior == SECURITY_FS_USE_TASK ||
J. Bruce Fields9fc2b4b2015-06-04 15:57:25 -0400490 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
Mark Salyzynd5f3a5f2015-02-04 11:34:30 -0500491 /* Special handling. Genfs but also in-core setxattr handler */
492 !strcmp(sb->s_type->name, "sysfs") ||
493 !strcmp(sb->s_type->name, "pstore") ||
494 !strcmp(sb->s_type->name, "debugfs") ||
Yongqin Liua2c7c6f2017-01-09 10:07:30 -0500495 !strcmp(sb->s_type->name, "tracefs") ||
Mark Salyzynd5f3a5f2015-02-04 11:34:30 -0500496 !strcmp(sb->s_type->name, "rootfs");
Eric Parisb43e7252012-10-10 14:27:35 -0400497}
498
Eric Parisc9180a52007-11-30 13:00:35 -0500499static int sb_finish_set_opts(struct super_block *sb)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700500{
501 struct superblock_security_struct *sbsec = sb->s_security;
502 struct dentry *root = sb->s_root;
David Howellsc6f493d2015-03-17 22:26:22 +0000503 struct inode *root_inode = d_backing_inode(root);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700504 int rc = 0;
505
Linus Torvalds1da177e2005-04-16 15:20:36 -0700506 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
507 /* Make sure that the xattr handler exists and that no
508 error other than -ENODATA is returned by getxattr on
509 the root directory. -ENODATA is ok, as this may be
510 the first boot of the SELinux kernel before we have
511 assigned xattr values to the filesystem. */
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +0200512 if (!(root_inode->i_opflags & IOP_XATTR)) {
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800513 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
514 "xattr support\n", sb->s_id, sb->s_type->name);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700515 rc = -EOPNOTSUPP;
516 goto out;
517 }
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +0200518
519 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700520 if (rc < 0 && rc != -ENODATA) {
521 if (rc == -EOPNOTSUPP)
522 printk(KERN_WARNING "SELinux: (dev %s, type "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800523 "%s) has no security xattr handler\n",
524 sb->s_id, sb->s_type->name);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700525 else
526 printk(KERN_WARNING "SELinux: (dev %s, type "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800527 "%s) getxattr errno %d\n", sb->s_id,
528 sb->s_type->name, -rc);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700529 goto out;
530 }
531 }
532
Eric Parisc9180a52007-11-30 13:00:35 -0500533 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800534 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
535 sb->s_id, sb->s_type->name);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700536
Eric Pariseadcabc2012-08-24 15:59:14 -0400537 sbsec->flags |= SE_SBINITIALIZED;
Eric Parisb43e7252012-10-10 14:27:35 -0400538 if (selinux_is_sblabel_mnt(sb))
Eric Paris12f348b2012-10-09 10:56:25 -0400539 sbsec->flags |= SBLABEL_MNT;
David P. Quigleyddd29ec2009-09-09 14:25:37 -0400540
Linus Torvalds1da177e2005-04-16 15:20:36 -0700541 /* Initialize the root inode. */
Eric Parisc9180a52007-11-30 13:00:35 -0500542 rc = inode_doinit_with_dentry(root_inode, root);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700543
544 /* Initialize any other inodes associated with the superblock, e.g.
545 inodes created prior to initial policy load or inodes created
546 during get_sb by a pseudo filesystem that directly
547 populates itself. */
548 spin_lock(&sbsec->isec_lock);
549next_inode:
550 if (!list_empty(&sbsec->isec_head)) {
551 struct inode_security_struct *isec =
552 list_entry(sbsec->isec_head.next,
Eric Parisc9180a52007-11-30 13:00:35 -0500553 struct inode_security_struct, list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700554 struct inode *inode = isec->inode;
Stephen Smalley923190d2014-10-06 16:32:52 -0400555 list_del_init(&isec->list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700556 spin_unlock(&sbsec->isec_lock);
557 inode = igrab(inode);
558 if (inode) {
Eric Parisc9180a52007-11-30 13:00:35 -0500559 if (!IS_PRIVATE(inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700560 inode_doinit(inode);
561 iput(inode);
562 }
563 spin_lock(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700564 goto next_inode;
565 }
566 spin_unlock(&sbsec->isec_lock);
567out:
Eric Parisc9180a52007-11-30 13:00:35 -0500568 return rc;
569}
570
571/*
572 * This function should allow an FS to ask what it's mount security
573 * options were so it can use those later for submounts, displaying
574 * mount options, or whatever.
575 */
576static int selinux_get_mnt_opts(const struct super_block *sb,
Eric Parise0007522008-03-05 10:31:54 -0500577 struct security_mnt_opts *opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500578{
579 int rc = 0, i;
580 struct superblock_security_struct *sbsec = sb->s_security;
581 char *context = NULL;
582 u32 len;
583 char tmp;
584
Eric Parise0007522008-03-05 10:31:54 -0500585 security_init_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500586
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500587 if (!(sbsec->flags & SE_SBINITIALIZED))
Eric Parisc9180a52007-11-30 13:00:35 -0500588 return -EINVAL;
589
590 if (!ss_initialized)
591 return -EINVAL;
592
Eric Parisaf8e50c2012-08-24 15:59:00 -0400593 /* make sure we always check enough bits to cover the mask */
594 BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
595
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500596 tmp = sbsec->flags & SE_MNTMASK;
Eric Parisc9180a52007-11-30 13:00:35 -0500597 /* count the number of mount options for this sb */
Eric Parisaf8e50c2012-08-24 15:59:00 -0400598 for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
Eric Parisc9180a52007-11-30 13:00:35 -0500599 if (tmp & 0x01)
Eric Parise0007522008-03-05 10:31:54 -0500600 opts->num_mnt_opts++;
Eric Parisc9180a52007-11-30 13:00:35 -0500601 tmp >>= 1;
602 }
David P. Quigley11689d42009-01-16 09:22:03 -0500603 /* Check if the Label support flag is set */
Eric Paris0b4bdb32013-08-28 13:32:42 -0400604 if (sbsec->flags & SBLABEL_MNT)
David P. Quigley11689d42009-01-16 09:22:03 -0500605 opts->num_mnt_opts++;
Eric Parisc9180a52007-11-30 13:00:35 -0500606
Eric Parise0007522008-03-05 10:31:54 -0500607 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
608 if (!opts->mnt_opts) {
Eric Parisc9180a52007-11-30 13:00:35 -0500609 rc = -ENOMEM;
610 goto out_free;
611 }
612
Eric Parise0007522008-03-05 10:31:54 -0500613 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
614 if (!opts->mnt_opts_flags) {
Eric Parisc9180a52007-11-30 13:00:35 -0500615 rc = -ENOMEM;
616 goto out_free;
617 }
618
619 i = 0;
620 if (sbsec->flags & FSCONTEXT_MNT) {
621 rc = security_sid_to_context(sbsec->sid, &context, &len);
622 if (rc)
623 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500624 opts->mnt_opts[i] = context;
625 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500626 }
627 if (sbsec->flags & CONTEXT_MNT) {
628 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
629 if (rc)
630 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500631 opts->mnt_opts[i] = context;
632 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500633 }
634 if (sbsec->flags & DEFCONTEXT_MNT) {
635 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
636 if (rc)
637 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500638 opts->mnt_opts[i] = context;
639 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500640 }
641 if (sbsec->flags & ROOTCONTEXT_MNT) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500642 struct dentry *root = sbsec->sb->s_root;
643 struct inode_security_struct *isec = backing_inode_security(root);
Eric Parisc9180a52007-11-30 13:00:35 -0500644
645 rc = security_sid_to_context(isec->sid, &context, &len);
646 if (rc)
647 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500648 opts->mnt_opts[i] = context;
649 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500650 }
Eric Paris12f348b2012-10-09 10:56:25 -0400651 if (sbsec->flags & SBLABEL_MNT) {
David P. Quigley11689d42009-01-16 09:22:03 -0500652 opts->mnt_opts[i] = NULL;
Eric Paris12f348b2012-10-09 10:56:25 -0400653 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
David P. Quigley11689d42009-01-16 09:22:03 -0500654 }
Eric Parisc9180a52007-11-30 13:00:35 -0500655
Eric Parise0007522008-03-05 10:31:54 -0500656 BUG_ON(i != opts->num_mnt_opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500657
658 return 0;
659
660out_free:
Eric Parise0007522008-03-05 10:31:54 -0500661 security_free_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500662 return rc;
663}
664
665static int bad_option(struct superblock_security_struct *sbsec, char flag,
666 u32 old_sid, u32 new_sid)
667{
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500668 char mnt_flags = sbsec->flags & SE_MNTMASK;
669
Eric Parisc9180a52007-11-30 13:00:35 -0500670 /* check if the old mount command had the same options */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500671 if (sbsec->flags & SE_SBINITIALIZED)
Eric Parisc9180a52007-11-30 13:00:35 -0500672 if (!(sbsec->flags & flag) ||
673 (old_sid != new_sid))
674 return 1;
675
676 /* check if we were passed the same options twice,
677 * aka someone passed context=a,context=b
678 */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500679 if (!(sbsec->flags & SE_SBINITIALIZED))
680 if (mnt_flags & flag)
Eric Parisc9180a52007-11-30 13:00:35 -0500681 return 1;
682 return 0;
683}
Eric Parise0007522008-03-05 10:31:54 -0500684
Eric Parisc9180a52007-11-30 13:00:35 -0500685/*
686 * Allow filesystems with binary mount data to explicitly set mount point
687 * labeling information.
688 */
Eric Parise0007522008-03-05 10:31:54 -0500689static int selinux_set_mnt_opts(struct super_block *sb,
David Quigley649f6e72013-05-22 12:50:36 -0400690 struct security_mnt_opts *opts,
691 unsigned long kern_flags,
692 unsigned long *set_kern_flags)
Eric Parisc9180a52007-11-30 13:00:35 -0500693{
David Howells275bb412008-11-14 10:39:19 +1100694 const struct cred *cred = current_cred();
Eric Parisc9180a52007-11-30 13:00:35 -0500695 int rc = 0, i;
Eric Parisc9180a52007-11-30 13:00:35 -0500696 struct superblock_security_struct *sbsec = sb->s_security;
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800697 const char *name = sb->s_type->name;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500698 struct dentry *root = sbsec->sb->s_root;
Paul Moore2c971652016-04-19 16:36:28 -0400699 struct inode_security_struct *root_isec;
Eric Parisc9180a52007-11-30 13:00:35 -0500700 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
701 u32 defcontext_sid = 0;
Eric Parise0007522008-03-05 10:31:54 -0500702 char **mount_options = opts->mnt_opts;
703 int *flags = opts->mnt_opts_flags;
704 int num_opts = opts->num_mnt_opts;
Eric Parisc9180a52007-11-30 13:00:35 -0500705
706 mutex_lock(&sbsec->lock);
707
708 if (!ss_initialized) {
709 if (!num_opts) {
710 /* Defer initialization until selinux_complete_init,
711 after the initial policy is loaded and the security
712 server is ready to handle calls. */
Eric Parisc9180a52007-11-30 13:00:35 -0500713 goto out;
714 }
715 rc = -EINVAL;
Eric Paris744ba352008-04-17 11:52:44 -0400716 printk(KERN_WARNING "SELinux: Unable to set superblock options "
717 "before the security server is initialized\n");
Eric Parisc9180a52007-11-30 13:00:35 -0500718 goto out;
719 }
David Quigley649f6e72013-05-22 12:50:36 -0400720 if (kern_flags && !set_kern_flags) {
721 /* Specifying internal flags without providing a place to
722 * place the results is not allowed */
723 rc = -EINVAL;
724 goto out;
725 }
Eric Parisc9180a52007-11-30 13:00:35 -0500726
727 /*
Eric Parise0007522008-03-05 10:31:54 -0500728 * Binary mount data FS will come through this function twice. Once
729 * from an explicit call and once from the generic calls from the vfs.
730 * Since the generic VFS calls will not contain any security mount data
731 * we need to skip the double mount verification.
732 *
733 * This does open a hole in which we will not notice if the first
734 * mount using this sb set explict options and a second mount using
735 * this sb does not set any security options. (The first options
736 * will be used for both mounts)
737 */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500738 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
Eric Parise0007522008-03-05 10:31:54 -0500739 && (num_opts == 0))
Eric Parisf5269712008-05-14 11:27:45 -0400740 goto out;
Eric Parise0007522008-03-05 10:31:54 -0500741
Paul Moore2c971652016-04-19 16:36:28 -0400742 root_isec = backing_inode_security_novalidate(root);
743
Eric Parise0007522008-03-05 10:31:54 -0500744 /*
Eric Parisc9180a52007-11-30 13:00:35 -0500745 * parse the mount options, check if they are valid sids.
746 * also check if someone is trying to mount the same sb more
747 * than once with different security options.
748 */
749 for (i = 0; i < num_opts; i++) {
750 u32 sid;
David P. Quigley11689d42009-01-16 09:22:03 -0500751
Eric Paris12f348b2012-10-09 10:56:25 -0400752 if (flags[i] == SBLABEL_MNT)
David P. Quigley11689d42009-01-16 09:22:03 -0500753 continue;
Rasmus Villemoes44be2f62015-10-21 17:44:25 -0400754 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
Eric Parisc9180a52007-11-30 13:00:35 -0500755 if (rc) {
Rasmus Villemoes44be2f62015-10-21 17:44:25 -0400756 printk(KERN_WARNING "SELinux: security_context_str_to_sid"
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800757 "(%s) failed for (dev %s, type %s) errno=%d\n",
758 mount_options[i], sb->s_id, name, rc);
Eric Parisc9180a52007-11-30 13:00:35 -0500759 goto out;
760 }
761 switch (flags[i]) {
762 case FSCONTEXT_MNT:
763 fscontext_sid = sid;
764
765 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
766 fscontext_sid))
767 goto out_double_mount;
768
769 sbsec->flags |= FSCONTEXT_MNT;
770 break;
771 case CONTEXT_MNT:
772 context_sid = sid;
773
774 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
775 context_sid))
776 goto out_double_mount;
777
778 sbsec->flags |= CONTEXT_MNT;
779 break;
780 case ROOTCONTEXT_MNT:
781 rootcontext_sid = sid;
782
783 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
784 rootcontext_sid))
785 goto out_double_mount;
786
787 sbsec->flags |= ROOTCONTEXT_MNT;
788
789 break;
790 case DEFCONTEXT_MNT:
791 defcontext_sid = sid;
792
793 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
794 defcontext_sid))
795 goto out_double_mount;
796
797 sbsec->flags |= DEFCONTEXT_MNT;
798
799 break;
800 default:
801 rc = -EINVAL;
802 goto out;
803 }
804 }
805
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500806 if (sbsec->flags & SE_SBINITIALIZED) {
Eric Parisc9180a52007-11-30 13:00:35 -0500807 /* previously mounted with options, but not on this attempt? */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500808 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500809 goto out_double_mount;
810 rc = 0;
811 goto out;
812 }
813
James Morris089be432008-07-15 18:32:49 +1000814 if (strcmp(sb->s_type->name, "proc") == 0)
Stephen Smalley134509d2015-06-04 16:22:17 -0400815 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
816
Stephen Smalley8e014722015-06-04 16:22:17 -0400817 if (!strcmp(sb->s_type->name, "debugfs") ||
818 !strcmp(sb->s_type->name, "sysfs") ||
819 !strcmp(sb->s_type->name, "pstore"))
Stephen Smalley134509d2015-06-04 16:22:17 -0400820 sbsec->flags |= SE_SBGENFS;
Eric Parisc9180a52007-11-30 13:00:35 -0500821
David Quigleyeb9ae682013-05-22 12:50:37 -0400822 if (!sbsec->behavior) {
823 /*
824 * Determine the labeling behavior to use for this
825 * filesystem type.
826 */
Paul Moore98f700f2013-09-18 13:52:20 -0400827 rc = security_fs_use(sb);
David Quigleyeb9ae682013-05-22 12:50:37 -0400828 if (rc) {
829 printk(KERN_WARNING
830 "%s: security_fs_use(%s) returned %d\n",
831 __func__, sb->s_type->name, rc);
832 goto out;
833 }
Eric Parisc9180a52007-11-30 13:00:35 -0500834 }
Seth Forsheeaad82892016-04-26 14:36:20 -0500835
836 /*
Stephen Smalley01593d32017-01-09 10:07:31 -0500837 * If this is a user namespace mount and the filesystem type is not
838 * explicitly whitelisted, then no contexts are allowed on the command
839 * line and security labels must be ignored.
Seth Forsheeaad82892016-04-26 14:36:20 -0500840 */
Stephen Smalley01593d32017-01-09 10:07:31 -0500841 if (sb->s_user_ns != &init_user_ns &&
842 strcmp(sb->s_type->name, "tmpfs") &&
843 strcmp(sb->s_type->name, "ramfs") &&
844 strcmp(sb->s_type->name, "devpts")) {
Seth Forsheeaad82892016-04-26 14:36:20 -0500845 if (context_sid || fscontext_sid || rootcontext_sid ||
846 defcontext_sid) {
847 rc = -EACCES;
848 goto out;
849 }
850 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
851 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
852 rc = security_transition_sid(current_sid(), current_sid(),
853 SECCLASS_FILE, NULL,
854 &sbsec->mntpoint_sid);
855 if (rc)
856 goto out;
857 }
858 goto out_set_opts;
859 }
860
Eric Parisc9180a52007-11-30 13:00:35 -0500861 /* sets the context of the superblock for the fs being mounted. */
862 if (fscontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100863 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500864 if (rc)
865 goto out;
866
867 sbsec->sid = fscontext_sid;
868 }
869
870 /*
871 * Switch to using mount point labeling behavior.
872 * sets the label used on all file below the mountpoint, and will set
873 * the superblock context if not already set.
874 */
David Quigleyeb9ae682013-05-22 12:50:37 -0400875 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
876 sbsec->behavior = SECURITY_FS_USE_NATIVE;
877 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
878 }
879
Eric Parisc9180a52007-11-30 13:00:35 -0500880 if (context_sid) {
881 if (!fscontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100882 rc = may_context_mount_sb_relabel(context_sid, sbsec,
883 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500884 if (rc)
885 goto out;
886 sbsec->sid = context_sid;
887 } else {
David Howells275bb412008-11-14 10:39:19 +1100888 rc = may_context_mount_inode_relabel(context_sid, sbsec,
889 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500890 if (rc)
891 goto out;
892 }
893 if (!rootcontext_sid)
894 rootcontext_sid = context_sid;
895
896 sbsec->mntpoint_sid = context_sid;
897 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
898 }
899
900 if (rootcontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100901 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
902 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500903 if (rc)
904 goto out;
905
906 root_isec->sid = rootcontext_sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -0500907 root_isec->initialized = LABEL_INITIALIZED;
Eric Parisc9180a52007-11-30 13:00:35 -0500908 }
909
910 if (defcontext_sid) {
David Quigleyeb9ae682013-05-22 12:50:37 -0400911 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
912 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
Eric Parisc9180a52007-11-30 13:00:35 -0500913 rc = -EINVAL;
914 printk(KERN_WARNING "SELinux: defcontext option is "
915 "invalid for this filesystem type\n");
916 goto out;
917 }
918
919 if (defcontext_sid != sbsec->def_sid) {
920 rc = may_context_mount_inode_relabel(defcontext_sid,
David Howells275bb412008-11-14 10:39:19 +1100921 sbsec, cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500922 if (rc)
923 goto out;
924 }
925
926 sbsec->def_sid = defcontext_sid;
927 }
928
Seth Forsheeaad82892016-04-26 14:36:20 -0500929out_set_opts:
Eric Parisc9180a52007-11-30 13:00:35 -0500930 rc = sb_finish_set_opts(sb);
931out:
Eric Parisbc7e9822006-09-25 23:32:02 -0700932 mutex_unlock(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700933 return rc;
Eric Parisc9180a52007-11-30 13:00:35 -0500934out_double_mount:
935 rc = -EINVAL;
936 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800937 "security settings for (dev %s, type %s)\n", sb->s_id, name);
Eric Parisc9180a52007-11-30 13:00:35 -0500938 goto out;
939}
940
Jeff Layton094f7b62013-04-01 08:14:24 -0400941static int selinux_cmp_sb_context(const struct super_block *oldsb,
942 const struct super_block *newsb)
943{
944 struct superblock_security_struct *old = oldsb->s_security;
945 struct superblock_security_struct *new = newsb->s_security;
946 char oldflags = old->flags & SE_MNTMASK;
947 char newflags = new->flags & SE_MNTMASK;
948
949 if (oldflags != newflags)
950 goto mismatch;
951 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
952 goto mismatch;
953 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
954 goto mismatch;
955 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
956 goto mismatch;
957 if (oldflags & ROOTCONTEXT_MNT) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500958 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
959 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
Jeff Layton094f7b62013-04-01 08:14:24 -0400960 if (oldroot->sid != newroot->sid)
961 goto mismatch;
962 }
963 return 0;
964mismatch:
965 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, "
966 "different security settings for (dev %s, "
967 "type %s)\n", newsb->s_id, newsb->s_type->name);
968 return -EBUSY;
969}
970
971static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
Eric Parisc9180a52007-11-30 13:00:35 -0500972 struct super_block *newsb)
973{
974 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
975 struct superblock_security_struct *newsbsec = newsb->s_security;
976
977 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
978 int set_context = (oldsbsec->flags & CONTEXT_MNT);
979 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
980
Eric Paris0f5e6422008-04-21 16:24:11 -0400981 /*
982 * if the parent was able to be mounted it clearly had no special lsm
Al Viroe8c26252010-03-23 06:36:54 -0400983 * mount options. thus we can safely deal with this superblock later
Eric Paris0f5e6422008-04-21 16:24:11 -0400984 */
Al Viroe8c26252010-03-23 06:36:54 -0400985 if (!ss_initialized)
Jeff Layton094f7b62013-04-01 08:14:24 -0400986 return 0;
Eric Parisc9180a52007-11-30 13:00:35 -0500987
Eric Parisc9180a52007-11-30 13:00:35 -0500988 /* how can we clone if the old one wasn't set up?? */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500989 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
Eric Parisc9180a52007-11-30 13:00:35 -0500990
Jeff Layton094f7b62013-04-01 08:14:24 -0400991 /* if fs is reusing a sb, make sure that the contexts match */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500992 if (newsbsec->flags & SE_SBINITIALIZED)
Jeff Layton094f7b62013-04-01 08:14:24 -0400993 return selinux_cmp_sb_context(oldsb, newsb);
Eric Paris5a552612008-04-09 14:08:35 -0400994
Eric Parisc9180a52007-11-30 13:00:35 -0500995 mutex_lock(&newsbsec->lock);
996
997 newsbsec->flags = oldsbsec->flags;
998
999 newsbsec->sid = oldsbsec->sid;
1000 newsbsec->def_sid = oldsbsec->def_sid;
1001 newsbsec->behavior = oldsbsec->behavior;
1002
1003 if (set_context) {
1004 u32 sid = oldsbsec->mntpoint_sid;
1005
1006 if (!set_fscontext)
1007 newsbsec->sid = sid;
1008 if (!set_rootcontext) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001009 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
Eric Parisc9180a52007-11-30 13:00:35 -05001010 newisec->sid = sid;
1011 }
1012 newsbsec->mntpoint_sid = sid;
1013 }
1014 if (set_rootcontext) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001015 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
1016 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
Eric Parisc9180a52007-11-30 13:00:35 -05001017
1018 newisec->sid = oldisec->sid;
1019 }
1020
1021 sb_finish_set_opts(newsb);
1022 mutex_unlock(&newsbsec->lock);
Jeff Layton094f7b62013-04-01 08:14:24 -04001023 return 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001024}
1025
Adrian Bunk2e1479d2008-03-17 22:29:23 +02001026static int selinux_parse_opts_str(char *options,
1027 struct security_mnt_opts *opts)
Eric Parisc9180a52007-11-30 13:00:35 -05001028{
Eric Parise0007522008-03-05 10:31:54 -05001029 char *p;
Eric Parisc9180a52007-11-30 13:00:35 -05001030 char *context = NULL, *defcontext = NULL;
1031 char *fscontext = NULL, *rootcontext = NULL;
Eric Parise0007522008-03-05 10:31:54 -05001032 int rc, num_mnt_opts = 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001033
Eric Parise0007522008-03-05 10:31:54 -05001034 opts->num_mnt_opts = 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001035
1036 /* Standard string-based options. */
1037 while ((p = strsep(&options, "|")) != NULL) {
1038 int token;
1039 substring_t args[MAX_OPT_ARGS];
1040
1041 if (!*p)
1042 continue;
1043
1044 token = match_token(p, tokens, args);
1045
1046 switch (token) {
1047 case Opt_context:
1048 if (context || defcontext) {
1049 rc = -EINVAL;
1050 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1051 goto out_err;
1052 }
1053 context = match_strdup(&args[0]);
1054 if (!context) {
1055 rc = -ENOMEM;
1056 goto out_err;
1057 }
1058 break;
1059
1060 case Opt_fscontext:
1061 if (fscontext) {
1062 rc = -EINVAL;
1063 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1064 goto out_err;
1065 }
1066 fscontext = match_strdup(&args[0]);
1067 if (!fscontext) {
1068 rc = -ENOMEM;
1069 goto out_err;
1070 }
1071 break;
1072
1073 case Opt_rootcontext:
1074 if (rootcontext) {
1075 rc = -EINVAL;
1076 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1077 goto out_err;
1078 }
1079 rootcontext = match_strdup(&args[0]);
1080 if (!rootcontext) {
1081 rc = -ENOMEM;
1082 goto out_err;
1083 }
1084 break;
1085
1086 case Opt_defcontext:
1087 if (context || defcontext) {
1088 rc = -EINVAL;
1089 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1090 goto out_err;
1091 }
1092 defcontext = match_strdup(&args[0]);
1093 if (!defcontext) {
1094 rc = -ENOMEM;
1095 goto out_err;
1096 }
1097 break;
David P. Quigley11689d42009-01-16 09:22:03 -05001098 case Opt_labelsupport:
1099 break;
Eric Parisc9180a52007-11-30 13:00:35 -05001100 default:
1101 rc = -EINVAL;
1102 printk(KERN_WARNING "SELinux: unknown mount option\n");
1103 goto out_err;
1104
1105 }
1106 }
1107
Eric Parise0007522008-03-05 10:31:54 -05001108 rc = -ENOMEM;
Tetsuo Handa8931c3b2016-11-14 20:16:12 +09001109 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_KERNEL);
Eric Parise0007522008-03-05 10:31:54 -05001110 if (!opts->mnt_opts)
1111 goto out_err;
1112
Tetsuo Handa8931c3b2016-11-14 20:16:12 +09001113 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int),
1114 GFP_KERNEL);
Eric Parise0007522008-03-05 10:31:54 -05001115 if (!opts->mnt_opts_flags) {
1116 kfree(opts->mnt_opts);
1117 goto out_err;
Eric Parisc9180a52007-11-30 13:00:35 -05001118 }
1119
Eric Parise0007522008-03-05 10:31:54 -05001120 if (fscontext) {
1121 opts->mnt_opts[num_mnt_opts] = fscontext;
1122 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1123 }
1124 if (context) {
1125 opts->mnt_opts[num_mnt_opts] = context;
1126 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1127 }
1128 if (rootcontext) {
1129 opts->mnt_opts[num_mnt_opts] = rootcontext;
1130 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1131 }
1132 if (defcontext) {
1133 opts->mnt_opts[num_mnt_opts] = defcontext;
1134 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1135 }
1136
1137 opts->num_mnt_opts = num_mnt_opts;
1138 return 0;
1139
Eric Parisc9180a52007-11-30 13:00:35 -05001140out_err:
1141 kfree(context);
1142 kfree(defcontext);
1143 kfree(fscontext);
1144 kfree(rootcontext);
1145 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001146}
Eric Parise0007522008-03-05 10:31:54 -05001147/*
1148 * string mount options parsing and call set the sbsec
1149 */
1150static int superblock_doinit(struct super_block *sb, void *data)
1151{
1152 int rc = 0;
1153 char *options = data;
1154 struct security_mnt_opts opts;
1155
1156 security_init_mnt_opts(&opts);
1157
1158 if (!data)
1159 goto out;
1160
1161 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1162
1163 rc = selinux_parse_opts_str(options, &opts);
1164 if (rc)
1165 goto out_err;
1166
1167out:
David Quigley649f6e72013-05-22 12:50:36 -04001168 rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
Eric Parise0007522008-03-05 10:31:54 -05001169
1170out_err:
1171 security_free_mnt_opts(&opts);
1172 return rc;
1173}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001174
Adrian Bunk3583a712008-07-22 20:21:23 +03001175static void selinux_write_opts(struct seq_file *m,
1176 struct security_mnt_opts *opts)
Eric Paris2069f452008-07-04 09:47:13 +10001177{
1178 int i;
1179 char *prefix;
1180
1181 for (i = 0; i < opts->num_mnt_opts; i++) {
David P. Quigley11689d42009-01-16 09:22:03 -05001182 char *has_comma;
1183
1184 if (opts->mnt_opts[i])
1185 has_comma = strchr(opts->mnt_opts[i], ',');
1186 else
1187 has_comma = NULL;
Eric Paris2069f452008-07-04 09:47:13 +10001188
1189 switch (opts->mnt_opts_flags[i]) {
1190 case CONTEXT_MNT:
1191 prefix = CONTEXT_STR;
1192 break;
1193 case FSCONTEXT_MNT:
1194 prefix = FSCONTEXT_STR;
1195 break;
1196 case ROOTCONTEXT_MNT:
1197 prefix = ROOTCONTEXT_STR;
1198 break;
1199 case DEFCONTEXT_MNT:
1200 prefix = DEFCONTEXT_STR;
1201 break;
Eric Paris12f348b2012-10-09 10:56:25 -04001202 case SBLABEL_MNT:
David P. Quigley11689d42009-01-16 09:22:03 -05001203 seq_putc(m, ',');
1204 seq_puts(m, LABELSUPP_STR);
1205 continue;
Eric Paris2069f452008-07-04 09:47:13 +10001206 default:
1207 BUG();
Eric Parisa35c6c832011-04-20 10:21:28 -04001208 return;
Eric Paris2069f452008-07-04 09:47:13 +10001209 };
1210 /* we need a comma before each option */
1211 seq_putc(m, ',');
1212 seq_puts(m, prefix);
1213 if (has_comma)
1214 seq_putc(m, '\"');
Kees Cooka068acf2015-09-04 15:44:57 -07001215 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
Eric Paris2069f452008-07-04 09:47:13 +10001216 if (has_comma)
1217 seq_putc(m, '\"');
1218 }
1219}
1220
1221static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1222{
1223 struct security_mnt_opts opts;
1224 int rc;
1225
1226 rc = selinux_get_mnt_opts(sb, &opts);
Eric Paris383795c2008-07-29 17:07:26 -04001227 if (rc) {
1228 /* before policy load we may get EINVAL, don't show anything */
1229 if (rc == -EINVAL)
1230 rc = 0;
Eric Paris2069f452008-07-04 09:47:13 +10001231 return rc;
Eric Paris383795c2008-07-29 17:07:26 -04001232 }
Eric Paris2069f452008-07-04 09:47:13 +10001233
1234 selinux_write_opts(m, &opts);
1235
1236 security_free_mnt_opts(&opts);
1237
1238 return rc;
1239}
1240
Linus Torvalds1da177e2005-04-16 15:20:36 -07001241static inline u16 inode_mode_to_security_class(umode_t mode)
1242{
1243 switch (mode & S_IFMT) {
1244 case S_IFSOCK:
1245 return SECCLASS_SOCK_FILE;
1246 case S_IFLNK:
1247 return SECCLASS_LNK_FILE;
1248 case S_IFREG:
1249 return SECCLASS_FILE;
1250 case S_IFBLK:
1251 return SECCLASS_BLK_FILE;
1252 case S_IFDIR:
1253 return SECCLASS_DIR;
1254 case S_IFCHR:
1255 return SECCLASS_CHR_FILE;
1256 case S_IFIFO:
1257 return SECCLASS_FIFO_FILE;
1258
1259 }
1260
1261 return SECCLASS_FILE;
1262}
1263
James Morris13402582005-09-30 14:24:34 -04001264static inline int default_protocol_stream(int protocol)
1265{
1266 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1267}
1268
1269static inline int default_protocol_dgram(int protocol)
1270{
1271 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1272}
1273
Linus Torvalds1da177e2005-04-16 15:20:36 -07001274static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1275{
Stephen Smalleyda69a532017-01-09 10:07:30 -05001276 int extsockclass = selinux_policycap_extsockclass;
1277
Linus Torvalds1da177e2005-04-16 15:20:36 -07001278 switch (family) {
1279 case PF_UNIX:
1280 switch (type) {
1281 case SOCK_STREAM:
1282 case SOCK_SEQPACKET:
1283 return SECCLASS_UNIX_STREAM_SOCKET;
1284 case SOCK_DGRAM:
1285 return SECCLASS_UNIX_DGRAM_SOCKET;
1286 }
1287 break;
1288 case PF_INET:
1289 case PF_INET6:
1290 switch (type) {
1291 case SOCK_STREAM:
Stephen Smalleyda69a532017-01-09 10:07:30 -05001292 case SOCK_SEQPACKET:
James Morris13402582005-09-30 14:24:34 -04001293 if (default_protocol_stream(protocol))
1294 return SECCLASS_TCP_SOCKET;
Stephen Smalleyda69a532017-01-09 10:07:30 -05001295 else if (extsockclass && protocol == IPPROTO_SCTP)
1296 return SECCLASS_SCTP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001297 else
1298 return SECCLASS_RAWIP_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001299 case SOCK_DGRAM:
James Morris13402582005-09-30 14:24:34 -04001300 if (default_protocol_dgram(protocol))
1301 return SECCLASS_UDP_SOCKET;
Stephen Smalleyef379792017-01-09 10:07:31 -05001302 else if (extsockclass && (protocol == IPPROTO_ICMP ||
1303 protocol == IPPROTO_ICMPV6))
Stephen Smalleyda69a532017-01-09 10:07:30 -05001304 return SECCLASS_ICMP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001305 else
1306 return SECCLASS_RAWIP_SOCKET;
James Morris2ee92d42006-11-13 16:09:01 -08001307 case SOCK_DCCP:
1308 return SECCLASS_DCCP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001309 default:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001310 return SECCLASS_RAWIP_SOCKET;
1311 }
1312 break;
1313 case PF_NETLINK:
1314 switch (protocol) {
1315 case NETLINK_ROUTE:
1316 return SECCLASS_NETLINK_ROUTE_SOCKET;
Pavel Emelyanov7f1fb602011-12-06 07:56:43 +00001317 case NETLINK_SOCK_DIAG:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001318 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1319 case NETLINK_NFLOG:
1320 return SECCLASS_NETLINK_NFLOG_SOCKET;
1321 case NETLINK_XFRM:
1322 return SECCLASS_NETLINK_XFRM_SOCKET;
1323 case NETLINK_SELINUX:
1324 return SECCLASS_NETLINK_SELINUX_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001325 case NETLINK_ISCSI:
1326 return SECCLASS_NETLINK_ISCSI_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001327 case NETLINK_AUDIT:
1328 return SECCLASS_NETLINK_AUDIT_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001329 case NETLINK_FIB_LOOKUP:
1330 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1331 case NETLINK_CONNECTOR:
1332 return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1333 case NETLINK_NETFILTER:
1334 return SECCLASS_NETLINK_NETFILTER_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001335 case NETLINK_DNRTMSG:
1336 return SECCLASS_NETLINK_DNRT_SOCKET;
James Morris0c9b7942005-04-16 15:24:13 -07001337 case NETLINK_KOBJECT_UEVENT:
1338 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001339 case NETLINK_GENERIC:
1340 return SECCLASS_NETLINK_GENERIC_SOCKET;
1341 case NETLINK_SCSITRANSPORT:
1342 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1343 case NETLINK_RDMA:
1344 return SECCLASS_NETLINK_RDMA_SOCKET;
1345 case NETLINK_CRYPTO:
1346 return SECCLASS_NETLINK_CRYPTO_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001347 default:
1348 return SECCLASS_NETLINK_SOCKET;
1349 }
1350 case PF_PACKET:
1351 return SECCLASS_PACKET_SOCKET;
1352 case PF_KEY:
1353 return SECCLASS_KEY_SOCKET;
Christopher J. PeBenito3e3ff152006-06-09 00:25:03 -07001354 case PF_APPLETALK:
1355 return SECCLASS_APPLETALK_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001356 }
1357
Stephen Smalleyda69a532017-01-09 10:07:30 -05001358 if (extsockclass) {
1359 switch (family) {
1360 case PF_AX25:
1361 return SECCLASS_AX25_SOCKET;
1362 case PF_IPX:
1363 return SECCLASS_IPX_SOCKET;
1364 case PF_NETROM:
1365 return SECCLASS_NETROM_SOCKET;
1366 case PF_BRIDGE:
1367 return SECCLASS_BRIDGE_SOCKET;
1368 case PF_ATMPVC:
1369 return SECCLASS_ATMPVC_SOCKET;
1370 case PF_X25:
1371 return SECCLASS_X25_SOCKET;
1372 case PF_ROSE:
1373 return SECCLASS_ROSE_SOCKET;
1374 case PF_DECnet:
1375 return SECCLASS_DECNET_SOCKET;
1376 case PF_ATMSVC:
1377 return SECCLASS_ATMSVC_SOCKET;
1378 case PF_RDS:
1379 return SECCLASS_RDS_SOCKET;
1380 case PF_IRDA:
1381 return SECCLASS_IRDA_SOCKET;
1382 case PF_PPPOX:
1383 return SECCLASS_PPPOX_SOCKET;
1384 case PF_LLC:
1385 return SECCLASS_LLC_SOCKET;
1386 case PF_IB:
1387 return SECCLASS_IB_SOCKET;
1388 case PF_MPLS:
1389 return SECCLASS_MPLS_SOCKET;
1390 case PF_CAN:
1391 return SECCLASS_CAN_SOCKET;
1392 case PF_TIPC:
1393 return SECCLASS_TIPC_SOCKET;
1394 case PF_BLUETOOTH:
1395 return SECCLASS_BLUETOOTH_SOCKET;
1396 case PF_IUCV:
1397 return SECCLASS_IUCV_SOCKET;
1398 case PF_RXRPC:
1399 return SECCLASS_RXRPC_SOCKET;
1400 case PF_ISDN:
1401 return SECCLASS_ISDN_SOCKET;
1402 case PF_PHONET:
1403 return SECCLASS_PHONET_SOCKET;
1404 case PF_IEEE802154:
1405 return SECCLASS_IEEE802154_SOCKET;
1406 case PF_CAIF:
1407 return SECCLASS_CAIF_SOCKET;
1408 case PF_ALG:
1409 return SECCLASS_ALG_SOCKET;
1410 case PF_NFC:
1411 return SECCLASS_NFC_SOCKET;
1412 case PF_VSOCK:
1413 return SECCLASS_VSOCK_SOCKET;
1414 case PF_KCM:
1415 return SECCLASS_KCM_SOCKET;
1416 case PF_QIPCRTR:
1417 return SECCLASS_QIPCRTR_SOCKET;
1418#if PF_MAX > 43
1419#error New address family defined, please update this function.
1420#endif
1421 }
1422 }
1423
Linus Torvalds1da177e2005-04-16 15:20:36 -07001424 return SECCLASS_SOCKET;
1425}
1426
Stephen Smalley134509d2015-06-04 16:22:17 -04001427static int selinux_genfs_get_sid(struct dentry *dentry,
1428 u16 tclass,
1429 u16 flags,
1430 u32 *sid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001431{
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001432 int rc;
Al Virofc640052016-04-10 01:33:30 -04001433 struct super_block *sb = dentry->d_sb;
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001434 char *buffer, *path;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001435
Eric Paris828dfe12008-04-17 13:17:49 -04001436 buffer = (char *)__get_free_page(GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001437 if (!buffer)
1438 return -ENOMEM;
1439
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001440 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1441 if (IS_ERR(path))
1442 rc = PTR_ERR(path);
1443 else {
Stephen Smalley134509d2015-06-04 16:22:17 -04001444 if (flags & SE_SBPROC) {
1445 /* each process gets a /proc/PID/ entry. Strip off the
1446 * PID part to get a valid selinux labeling.
1447 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1448 while (path[1] >= '0' && path[1] <= '9') {
1449 path[1] = '/';
1450 path++;
1451 }
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001452 }
Stephen Smalley134509d2015-06-04 16:22:17 -04001453 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001454 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001455 free_page((unsigned long)buffer);
1456 return rc;
1457}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001458
1459/* The inode's security attributes must be initialized before first use. */
1460static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1461{
1462 struct superblock_security_struct *sbsec = NULL;
1463 struct inode_security_struct *isec = inode->i_security;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001464 u32 task_sid, sid = 0;
1465 u16 sclass;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001466 struct dentry *dentry;
1467#define INITCONTEXTLEN 255
1468 char *context = NULL;
1469 unsigned len = 0;
1470 int rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001471
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05001472 if (isec->initialized == LABEL_INITIALIZED)
Andreas Gruenbacher13457d02016-11-10 22:18:29 +01001473 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001474
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001475 spin_lock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05001476 if (isec->initialized == LABEL_INITIALIZED)
Eric Paris23970742006-09-25 23:32:01 -07001477 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001478
Andreas Gruenbacher13457d02016-11-10 22:18:29 +01001479 if (isec->sclass == SECCLASS_FILE)
1480 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1481
Linus Torvalds1da177e2005-04-16 15:20:36 -07001482 sbsec = inode->i_sb->s_security;
David P. Quigley0d90a7e2009-01-16 09:22:02 -05001483 if (!(sbsec->flags & SE_SBINITIALIZED)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001484 /* Defer initialization until selinux_complete_init,
1485 after the initial policy is loaded and the security
1486 server is ready to handle calls. */
1487 spin_lock(&sbsec->isec_lock);
1488 if (list_empty(&isec->list))
1489 list_add(&isec->list, &sbsec->isec_head);
1490 spin_unlock(&sbsec->isec_lock);
Eric Paris23970742006-09-25 23:32:01 -07001491 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001492 }
1493
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001494 sclass = isec->sclass;
1495 task_sid = isec->task_sid;
1496 sid = isec->sid;
1497 isec->initialized = LABEL_PENDING;
1498 spin_unlock(&isec->lock);
1499
Linus Torvalds1da177e2005-04-16 15:20:36 -07001500 switch (sbsec->behavior) {
David Quigleyeb9ae682013-05-22 12:50:37 -04001501 case SECURITY_FS_USE_NATIVE:
1502 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001503 case SECURITY_FS_USE_XATTR:
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001504 if (!(inode->i_opflags & IOP_XATTR)) {
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001505 sid = sbsec->def_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001506 break;
1507 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001508 /* Need a dentry, since the xattr API requires one.
1509 Life would be simpler if we could just pass the inode. */
1510 if (opt_dentry) {
1511 /* Called from d_instantiate or d_splice_alias. */
1512 dentry = dget(opt_dentry);
1513 } else {
1514 /* Called from selinux_complete_init, try to find a dentry. */
1515 dentry = d_find_alias(inode);
1516 }
1517 if (!dentry) {
Eric Parisdf7f54c2009-03-09 14:35:58 -04001518 /*
1519 * this is can be hit on boot when a file is accessed
1520 * before the policy is loaded. When we load policy we
1521 * may find inodes that have no dentry on the
1522 * sbsec->isec_head list. No reason to complain as these
1523 * will get fixed up the next time we go through
1524 * inode_doinit with a dentry, before these inodes could
1525 * be used again by userspace.
1526 */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001527 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001528 }
1529
1530 len = INITCONTEXTLEN;
Eric Paris4cb912f2009-02-12 14:50:05 -05001531 context = kmalloc(len+1, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001532 if (!context) {
1533 rc = -ENOMEM;
1534 dput(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001535 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001536 }
Eric Paris4cb912f2009-02-12 14:50:05 -05001537 context[len] = '\0';
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001538 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001539 if (rc == -ERANGE) {
James Morris314dabb2009-08-10 22:00:13 +10001540 kfree(context);
1541
Linus Torvalds1da177e2005-04-16 15:20:36 -07001542 /* Need a larger buffer. Query for the right size. */
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001543 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001544 if (rc < 0) {
1545 dput(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001546 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001547 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001548 len = rc;
Eric Paris4cb912f2009-02-12 14:50:05 -05001549 context = kmalloc(len+1, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001550 if (!context) {
1551 rc = -ENOMEM;
1552 dput(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001553 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001554 }
Eric Paris4cb912f2009-02-12 14:50:05 -05001555 context[len] = '\0';
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001556 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001557 }
1558 dput(dentry);
1559 if (rc < 0) {
1560 if (rc != -ENODATA) {
Eric Paris744ba352008-04-17 11:52:44 -04001561 printk(KERN_WARNING "SELinux: %s: getxattr returned "
Harvey Harrisondd6f9532008-03-06 10:03:59 +11001562 "%d for dev=%s ino=%ld\n", __func__,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001563 -rc, inode->i_sb->s_id, inode->i_ino);
1564 kfree(context);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001565 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001566 }
1567 /* Map ENODATA to the default file SID */
1568 sid = sbsec->def_sid;
1569 rc = 0;
1570 } else {
James Morrisf5c1d5b2005-07-28 01:07:37 -07001571 rc = security_context_to_sid_default(context, rc, &sid,
Stephen Smalley869ab512008-04-04 08:46:05 -04001572 sbsec->def_sid,
1573 GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001574 if (rc) {
Eric Paris4ba0a8a2009-02-12 15:01:10 -05001575 char *dev = inode->i_sb->s_id;
1576 unsigned long ino = inode->i_ino;
1577
1578 if (rc == -EINVAL) {
1579 if (printk_ratelimit())
1580 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1581 "context=%s. This indicates you may need to relabel the inode or the "
1582 "filesystem in question.\n", ino, dev, context);
1583 } else {
1584 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1585 "returned %d for dev=%s ino=%ld\n",
1586 __func__, context, -rc, dev, ino);
1587 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001588 kfree(context);
1589 /* Leave with the unlabeled SID */
1590 rc = 0;
1591 break;
1592 }
1593 }
1594 kfree(context);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001595 break;
1596 case SECURITY_FS_USE_TASK:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001597 sid = task_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001598 break;
1599 case SECURITY_FS_USE_TRANS:
1600 /* Default to the fs SID. */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001601 sid = sbsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001602
1603 /* Try to obtain a transition SID. */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001604 rc = security_transition_sid(task_sid, sid, sclass, NULL, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001605 if (rc)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001606 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001607 break;
Eric Parisc312feb2006-07-10 04:43:53 -07001608 case SECURITY_FS_USE_MNTPOINT:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001609 sid = sbsec->mntpoint_sid;
Eric Parisc312feb2006-07-10 04:43:53 -07001610 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001611 default:
Eric Parisc312feb2006-07-10 04:43:53 -07001612 /* Default to the fs superblock SID. */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001613 sid = sbsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001614
Stephen Smalley134509d2015-06-04 16:22:17 -04001615 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
Paul Mooref64410e2014-03-19 16:46:18 -04001616 /* We must have a dentry to determine the label on
1617 * procfs inodes */
1618 if (opt_dentry)
1619 /* Called from d_instantiate or
1620 * d_splice_alias. */
1621 dentry = dget(opt_dentry);
1622 else
1623 /* Called from selinux_complete_init, try to
1624 * find a dentry. */
1625 dentry = d_find_alias(inode);
1626 /*
1627 * This can be hit on boot when a file is accessed
1628 * before the policy is loaded. When we load policy we
1629 * may find inodes that have no dentry on the
1630 * sbsec->isec_head list. No reason to complain as
1631 * these will get fixed up the next time we go through
1632 * inode_doinit() with a dentry, before these inodes
1633 * could be used again by userspace.
1634 */
1635 if (!dentry)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001636 goto out;
1637 rc = selinux_genfs_get_sid(dentry, sclass,
Stephen Smalley134509d2015-06-04 16:22:17 -04001638 sbsec->flags, &sid);
Paul Mooref64410e2014-03-19 16:46:18 -04001639 dput(dentry);
1640 if (rc)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001641 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001642 }
1643 break;
1644 }
1645
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001646out:
1647 spin_lock(&isec->lock);
1648 if (isec->initialized == LABEL_PENDING) {
1649 if (!sid || rc) {
1650 isec->initialized = LABEL_INVALID;
1651 goto out_unlock;
1652 }
1653
1654 isec->initialized = LABEL_INITIALIZED;
1655 isec->sid = sid;
1656 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001657
Eric Paris23970742006-09-25 23:32:01 -07001658out_unlock:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001659 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001660 return rc;
1661}
1662
1663/* Convert a Linux signal to an access vector. */
1664static inline u32 signal_to_av(int sig)
1665{
1666 u32 perm = 0;
1667
1668 switch (sig) {
1669 case SIGCHLD:
1670 /* Commonly granted from child to parent. */
1671 perm = PROCESS__SIGCHLD;
1672 break;
1673 case SIGKILL:
1674 /* Cannot be caught or ignored */
1675 perm = PROCESS__SIGKILL;
1676 break;
1677 case SIGSTOP:
1678 /* Cannot be caught or ignored */
1679 perm = PROCESS__SIGSTOP;
1680 break;
1681 default:
1682 /* All other signals. */
1683 perm = PROCESS__SIGNAL;
1684 break;
1685 }
1686
1687 return perm;
1688}
1689
David Howells275bb412008-11-14 10:39:19 +11001690/*
David Howellsd84f4f92008-11-14 10:39:23 +11001691 * Check permission between a pair of credentials
1692 * fork check, ptrace check, etc.
1693 */
1694static int cred_has_perm(const struct cred *actor,
1695 const struct cred *target,
1696 u32 perms)
1697{
1698 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1699
1700 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1701}
1702
1703/*
David Howells88e67f32008-11-14 10:39:21 +11001704 * Check permission between a pair of tasks, e.g. signal checks,
David Howells275bb412008-11-14 10:39:19 +11001705 * fork check, ptrace check, etc.
1706 * tsk1 is the actor and tsk2 is the target
David Howells3b11a1d2008-11-14 10:39:26 +11001707 * - this uses the default subjective creds of tsk1
David Howells275bb412008-11-14 10:39:19 +11001708 */
1709static int task_has_perm(const struct task_struct *tsk1,
1710 const struct task_struct *tsk2,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001711 u32 perms)
1712{
David Howells275bb412008-11-14 10:39:19 +11001713 const struct task_security_struct *__tsec1, *__tsec2;
1714 u32 sid1, sid2;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001715
David Howells275bb412008-11-14 10:39:19 +11001716 rcu_read_lock();
1717 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1718 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1719 rcu_read_unlock();
1720 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001721}
1722
David Howells3b11a1d2008-11-14 10:39:26 +11001723/*
1724 * Check permission between current and another task, e.g. signal checks,
1725 * fork check, ptrace check, etc.
1726 * current is the actor and tsk2 is the target
1727 * - this uses current's subjective creds
1728 */
1729static int current_has_perm(const struct task_struct *tsk,
1730 u32 perms)
1731{
1732 u32 sid, tsid;
1733
1734 sid = current_sid();
1735 tsid = task_sid(tsk);
1736 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1737}
1738
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001739#if CAP_LAST_CAP > 63
1740#error Fix SELinux to handle capabilities > 63.
1741#endif
1742
Linus Torvalds1da177e2005-04-16 15:20:36 -07001743/* Check whether a task is allowed to use a capability. */
Eric Paris6a9de492012-01-03 12:25:14 -05001744static int cred_has_capability(const struct cred *cred,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001745 int cap, int audit, bool initns)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001746{
Thomas Liu2bf49692009-07-14 12:14:09 -04001747 struct common_audit_data ad;
Eric Paris06112162008-11-11 22:02:50 +11001748 struct av_decision avd;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001749 u16 sclass;
David Howells3699c532009-01-06 22:27:01 +00001750 u32 sid = cred_sid(cred);
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001751 u32 av = CAP_TO_MASK(cap);
Eric Paris06112162008-11-11 22:02:50 +11001752 int rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001753
Eric Paris50c205f2012-04-04 15:01:43 -04001754 ad.type = LSM_AUDIT_DATA_CAP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001755 ad.u.cap = cap;
1756
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001757 switch (CAP_TO_INDEX(cap)) {
1758 case 0:
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001759 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001760 break;
1761 case 1:
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001762 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001763 break;
1764 default:
1765 printk(KERN_ERR
1766 "SELinux: out of range capability %d\n", cap);
1767 BUG();
Eric Parisa35c6c832011-04-20 10:21:28 -04001768 return -EINVAL;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001769 }
Eric Paris06112162008-11-11 22:02:50 +11001770
David Howells275bb412008-11-14 10:39:19 +11001771 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
Eric Paris9ade0cf2011-04-25 16:26:29 -04001772 if (audit == SECURITY_CAP_AUDIT) {
NeilBrown7b20ea22015-03-23 13:37:39 +11001773 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
Eric Paris9ade0cf2011-04-25 16:26:29 -04001774 if (rc2)
1775 return rc2;
1776 }
Eric Paris06112162008-11-11 22:02:50 +11001777 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001778}
1779
1780/* Check whether a task is allowed to use a system operation. */
1781static int task_has_system(struct task_struct *tsk,
1782 u32 perms)
1783{
David Howells275bb412008-11-14 10:39:19 +11001784 u32 sid = task_sid(tsk);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001785
David Howells275bb412008-11-14 10:39:19 +11001786 return avc_has_perm(sid, SECINITSID_KERNEL,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001787 SECCLASS_SYSTEM, perms, NULL);
1788}
1789
1790/* Check whether a task has a particular permission to an inode.
1791 The 'adp' parameter is optional and allows other audit
1792 data to be passed (e.g. the dentry). */
David Howells88e67f32008-11-14 10:39:21 +11001793static int inode_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001794 struct inode *inode,
1795 u32 perms,
Linus Torvalds19e49832013-10-04 12:54:11 -07001796 struct common_audit_data *adp)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001797{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001798 struct inode_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +11001799 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001800
David Howellse0e81732009-09-02 09:13:40 +01001801 validate_creds(cred);
1802
Eric Paris828dfe12008-04-17 13:17:49 -04001803 if (unlikely(IS_PRIVATE(inode)))
Stephen Smalleybbaca6c2007-02-14 00:34:16 -08001804 return 0;
1805
David Howells88e67f32008-11-14 10:39:21 +11001806 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001807 isec = inode->i_security;
1808
Linus Torvalds19e49832013-10-04 12:54:11 -07001809 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001810}
1811
1812/* Same as inode_has_perm, but pass explicit audit data containing
1813 the dentry to help the auditing code to more easily generate the
1814 pathname if needed. */
David Howells88e67f32008-11-14 10:39:21 +11001815static inline int dentry_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001816 struct dentry *dentry,
1817 u32 av)
1818{
David Howellsc6f493d2015-03-17 22:26:22 +00001819 struct inode *inode = d_backing_inode(dentry);
Thomas Liu2bf49692009-07-14 12:14:09 -04001820 struct common_audit_data ad;
David Howells88e67f32008-11-14 10:39:21 +11001821
Eric Paris50c205f2012-04-04 15:01:43 -04001822 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Paris2875fa02011-04-28 16:04:24 -04001823 ad.u.dentry = dentry;
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05001824 __inode_security_revalidate(inode, dentry, true);
Linus Torvalds19e49832013-10-04 12:54:11 -07001825 return inode_has_perm(cred, inode, av, &ad);
Eric Paris2875fa02011-04-28 16:04:24 -04001826}
1827
1828/* Same as inode_has_perm, but pass explicit audit data containing
1829 the path to help the auditing code to more easily generate the
1830 pathname if needed. */
1831static inline int path_has_perm(const struct cred *cred,
Al Viro3f7036a2015-03-08 19:28:30 -04001832 const struct path *path,
Eric Paris2875fa02011-04-28 16:04:24 -04001833 u32 av)
1834{
David Howellsc6f493d2015-03-17 22:26:22 +00001835 struct inode *inode = d_backing_inode(path->dentry);
Eric Paris2875fa02011-04-28 16:04:24 -04001836 struct common_audit_data ad;
1837
Eric Paris50c205f2012-04-04 15:01:43 -04001838 ad.type = LSM_AUDIT_DATA_PATH;
Eric Paris2875fa02011-04-28 16:04:24 -04001839 ad.u.path = *path;
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05001840 __inode_security_revalidate(inode, path->dentry, true);
Linus Torvalds19e49832013-10-04 12:54:11 -07001841 return inode_has_perm(cred, inode, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001842}
1843
David Howells13f8e982013-06-13 23:37:55 +01001844/* Same as path_has_perm, but uses the inode from the file struct. */
1845static inline int file_path_has_perm(const struct cred *cred,
1846 struct file *file,
1847 u32 av)
1848{
1849 struct common_audit_data ad;
1850
Vivek Goyal43af5de2016-09-09 11:37:49 -04001851 ad.type = LSM_AUDIT_DATA_FILE;
1852 ad.u.file = file;
Linus Torvalds19e49832013-10-04 12:54:11 -07001853 return inode_has_perm(cred, file_inode(file), av, &ad);
David Howells13f8e982013-06-13 23:37:55 +01001854}
1855
Linus Torvalds1da177e2005-04-16 15:20:36 -07001856/* Check whether a task can use an open file descriptor to
1857 access an inode in a given way. Check access to the
1858 descriptor itself, and then use dentry_has_perm to
1859 check a particular permission to the file.
1860 Access to the descriptor is implicitly granted if it
1861 has the same SID as the process. If av is zero, then
1862 access to the file is not checked, e.g. for cases
1863 where only the descriptor is affected like seek. */
David Howells88e67f32008-11-14 10:39:21 +11001864static int file_has_perm(const struct cred *cred,
1865 struct file *file,
1866 u32 av)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001867{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001868 struct file_security_struct *fsec = file->f_security;
Al Viro496ad9a2013-01-23 17:07:38 -05001869 struct inode *inode = file_inode(file);
Thomas Liu2bf49692009-07-14 12:14:09 -04001870 struct common_audit_data ad;
David Howells88e67f32008-11-14 10:39:21 +11001871 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001872 int rc;
1873
Vivek Goyal43af5de2016-09-09 11:37:49 -04001874 ad.type = LSM_AUDIT_DATA_FILE;
1875 ad.u.file = file;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001876
David Howells275bb412008-11-14 10:39:19 +11001877 if (sid != fsec->sid) {
1878 rc = avc_has_perm(sid, fsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001879 SECCLASS_FD,
1880 FD__USE,
1881 &ad);
1882 if (rc)
David Howells88e67f32008-11-14 10:39:21 +11001883 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001884 }
1885
1886 /* av is zero if only checking access to the descriptor. */
David Howells88e67f32008-11-14 10:39:21 +11001887 rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001888 if (av)
Linus Torvalds19e49832013-10-04 12:54:11 -07001889 rc = inode_has_perm(cred, inode, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001890
David Howells88e67f32008-11-14 10:39:21 +11001891out:
1892 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001893}
1894
David Howellsc3c188b2015-07-10 17:19:58 -04001895/*
1896 * Determine the label for an inode that might be unioned.
1897 */
Vivek Goyalc957f6d2016-07-13 10:44:51 -04001898static int
1899selinux_determine_inode_label(const struct task_security_struct *tsec,
1900 struct inode *dir,
1901 const struct qstr *name, u16 tclass,
1902 u32 *_new_isid)
David Howellsc3c188b2015-07-10 17:19:58 -04001903{
1904 const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
David Howellsc3c188b2015-07-10 17:19:58 -04001905
1906 if ((sbsec->flags & SE_SBINITIALIZED) &&
1907 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1908 *_new_isid = sbsec->mntpoint_sid;
1909 } else if ((sbsec->flags & SBLABEL_MNT) &&
1910 tsec->create_sid) {
1911 *_new_isid = tsec->create_sid;
1912 } else {
Paul Moore20cdef82016-04-04 14:14:42 -04001913 const struct inode_security_struct *dsec = inode_security(dir);
David Howellsc3c188b2015-07-10 17:19:58 -04001914 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1915 name, _new_isid);
1916 }
1917
1918 return 0;
1919}
1920
Linus Torvalds1da177e2005-04-16 15:20:36 -07001921/* Check whether a task can create a file. */
1922static int may_create(struct inode *dir,
1923 struct dentry *dentry,
1924 u16 tclass)
1925{
Paul Moore5fb49872010-04-22 14:46:19 -04001926 const struct task_security_struct *tsec = current_security();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001927 struct inode_security_struct *dsec;
1928 struct superblock_security_struct *sbsec;
David Howells275bb412008-11-14 10:39:19 +11001929 u32 sid, newsid;
Thomas Liu2bf49692009-07-14 12:14:09 -04001930 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001931 int rc;
1932
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001933 dsec = inode_security(dir);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001934 sbsec = dir->i_sb->s_security;
1935
David Howells275bb412008-11-14 10:39:19 +11001936 sid = tsec->sid;
David Howells275bb412008-11-14 10:39:19 +11001937
Eric Paris50c205f2012-04-04 15:01:43 -04001938 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04001939 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001940
David Howells275bb412008-11-14 10:39:19 +11001941 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001942 DIR__ADD_NAME | DIR__SEARCH,
1943 &ad);
1944 if (rc)
1945 return rc;
1946
Vivek Goyalc957f6d2016-07-13 10:44:51 -04001947 rc = selinux_determine_inode_label(current_security(), dir,
1948 &dentry->d_name, tclass, &newsid);
David Howellsc3c188b2015-07-10 17:19:58 -04001949 if (rc)
1950 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001951
David Howells275bb412008-11-14 10:39:19 +11001952 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001953 if (rc)
1954 return rc;
1955
1956 return avc_has_perm(newsid, sbsec->sid,
1957 SECCLASS_FILESYSTEM,
1958 FILESYSTEM__ASSOCIATE, &ad);
1959}
1960
Michael LeMay4eb582c2006-06-26 00:24:57 -07001961/* Check whether a task can create a key. */
1962static int may_create_key(u32 ksid,
1963 struct task_struct *ctx)
1964{
David Howells275bb412008-11-14 10:39:19 +11001965 u32 sid = task_sid(ctx);
Michael LeMay4eb582c2006-06-26 00:24:57 -07001966
David Howells275bb412008-11-14 10:39:19 +11001967 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
Michael LeMay4eb582c2006-06-26 00:24:57 -07001968}
1969
Eric Paris828dfe12008-04-17 13:17:49 -04001970#define MAY_LINK 0
1971#define MAY_UNLINK 1
1972#define MAY_RMDIR 2
Linus Torvalds1da177e2005-04-16 15:20:36 -07001973
1974/* Check whether a task can link, unlink, or rmdir a file/directory. */
1975static int may_link(struct inode *dir,
1976 struct dentry *dentry,
1977 int kind)
1978
1979{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001980 struct inode_security_struct *dsec, *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04001981 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11001982 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001983 u32 av;
1984 int rc;
1985
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001986 dsec = inode_security(dir);
1987 isec = backing_inode_security(dentry);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001988
Eric Paris50c205f2012-04-04 15:01:43 -04001989 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04001990 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001991
1992 av = DIR__SEARCH;
1993 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
David Howells275bb412008-11-14 10:39:19 +11001994 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001995 if (rc)
1996 return rc;
1997
1998 switch (kind) {
1999 case MAY_LINK:
2000 av = FILE__LINK;
2001 break;
2002 case MAY_UNLINK:
2003 av = FILE__UNLINK;
2004 break;
2005 case MAY_RMDIR:
2006 av = DIR__RMDIR;
2007 break;
2008 default:
Eric Paris744ba352008-04-17 11:52:44 -04002009 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
2010 __func__, kind);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002011 return 0;
2012 }
2013
David Howells275bb412008-11-14 10:39:19 +11002014 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002015 return rc;
2016}
2017
2018static inline int may_rename(struct inode *old_dir,
2019 struct dentry *old_dentry,
2020 struct inode *new_dir,
2021 struct dentry *new_dentry)
2022{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002023 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04002024 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11002025 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002026 u32 av;
2027 int old_is_dir, new_is_dir;
2028 int rc;
2029
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002030 old_dsec = inode_security(old_dir);
2031 old_isec = backing_inode_security(old_dentry);
David Howellse36cb0b2015-01-29 12:02:35 +00002032 old_is_dir = d_is_dir(old_dentry);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002033 new_dsec = inode_security(new_dir);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002034
Eric Paris50c205f2012-04-04 15:01:43 -04002035 ad.type = LSM_AUDIT_DATA_DENTRY;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002036
Eric Parisa2694342011-04-25 13:10:27 -04002037 ad.u.dentry = old_dentry;
David Howells275bb412008-11-14 10:39:19 +11002038 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002039 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
2040 if (rc)
2041 return rc;
David Howells275bb412008-11-14 10:39:19 +11002042 rc = avc_has_perm(sid, old_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002043 old_isec->sclass, FILE__RENAME, &ad);
2044 if (rc)
2045 return rc;
2046 if (old_is_dir && new_dir != old_dir) {
David Howells275bb412008-11-14 10:39:19 +11002047 rc = avc_has_perm(sid, old_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002048 old_isec->sclass, DIR__REPARENT, &ad);
2049 if (rc)
2050 return rc;
2051 }
2052
Eric Parisa2694342011-04-25 13:10:27 -04002053 ad.u.dentry = new_dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002054 av = DIR__ADD_NAME | DIR__SEARCH;
David Howells2c616d42015-01-29 12:02:33 +00002055 if (d_is_positive(new_dentry))
Linus Torvalds1da177e2005-04-16 15:20:36 -07002056 av |= DIR__REMOVE_NAME;
David Howells275bb412008-11-14 10:39:19 +11002057 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002058 if (rc)
2059 return rc;
David Howells2c616d42015-01-29 12:02:33 +00002060 if (d_is_positive(new_dentry)) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002061 new_isec = backing_inode_security(new_dentry);
David Howellse36cb0b2015-01-29 12:02:35 +00002062 new_is_dir = d_is_dir(new_dentry);
David Howells275bb412008-11-14 10:39:19 +11002063 rc = avc_has_perm(sid, new_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002064 new_isec->sclass,
2065 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
2066 if (rc)
2067 return rc;
2068 }
2069
2070 return 0;
2071}
2072
2073/* Check whether a task can perform a filesystem operation. */
David Howells88e67f32008-11-14 10:39:21 +11002074static int superblock_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002075 struct super_block *sb,
2076 u32 perms,
Thomas Liu2bf49692009-07-14 12:14:09 -04002077 struct common_audit_data *ad)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002078{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002079 struct superblock_security_struct *sbsec;
David Howells88e67f32008-11-14 10:39:21 +11002080 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002081
Linus Torvalds1da177e2005-04-16 15:20:36 -07002082 sbsec = sb->s_security;
David Howells275bb412008-11-14 10:39:19 +11002083 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002084}
2085
2086/* Convert a Linux mode and permission mask to an access vector. */
2087static inline u32 file_mask_to_av(int mode, int mask)
2088{
2089 u32 av = 0;
2090
Al Virodba19c62011-07-25 20:49:29 -04002091 if (!S_ISDIR(mode)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002092 if (mask & MAY_EXEC)
2093 av |= FILE__EXECUTE;
2094 if (mask & MAY_READ)
2095 av |= FILE__READ;
2096
2097 if (mask & MAY_APPEND)
2098 av |= FILE__APPEND;
2099 else if (mask & MAY_WRITE)
2100 av |= FILE__WRITE;
2101
2102 } else {
2103 if (mask & MAY_EXEC)
2104 av |= DIR__SEARCH;
2105 if (mask & MAY_WRITE)
2106 av |= DIR__WRITE;
2107 if (mask & MAY_READ)
2108 av |= DIR__READ;
2109 }
2110
2111 return av;
2112}
2113
2114/* Convert a Linux file to an access vector. */
2115static inline u32 file_to_av(struct file *file)
2116{
2117 u32 av = 0;
2118
2119 if (file->f_mode & FMODE_READ)
2120 av |= FILE__READ;
2121 if (file->f_mode & FMODE_WRITE) {
2122 if (file->f_flags & O_APPEND)
2123 av |= FILE__APPEND;
2124 else
2125 av |= FILE__WRITE;
2126 }
Stephen Smalley0794c662008-03-17 08:55:18 -04002127 if (!av) {
2128 /*
2129 * Special file opened with flags 3 for ioctl-only use.
2130 */
2131 av = FILE__IOCTL;
2132 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002133
2134 return av;
2135}
2136
Eric Paris8b6a5a32008-10-29 17:06:46 -04002137/*
2138 * Convert a file to an access vector and include the correct open
2139 * open permission.
2140 */
2141static inline u32 open_file_to_av(struct file *file)
2142{
2143 u32 av = file_to_av(file);
2144
Eric Paris49b7b8d2010-07-23 11:44:09 -04002145 if (selinux_policycap_openperm)
2146 av |= FILE__OPEN;
2147
Eric Paris8b6a5a32008-10-29 17:06:46 -04002148 return av;
2149}
2150
Linus Torvalds1da177e2005-04-16 15:20:36 -07002151/* Hook functions begin here. */
2152
Stephen Smalley79af7302015-01-21 10:54:10 -05002153static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2154{
2155 u32 mysid = current_sid();
2156 u32 mgrsid = task_sid(mgr);
2157
2158 return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
2159 BINDER__SET_CONTEXT_MGR, NULL);
2160}
2161
2162static int selinux_binder_transaction(struct task_struct *from,
2163 struct task_struct *to)
2164{
2165 u32 mysid = current_sid();
2166 u32 fromsid = task_sid(from);
2167 u32 tosid = task_sid(to);
2168 int rc;
2169
2170 if (mysid != fromsid) {
2171 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
2172 BINDER__IMPERSONATE, NULL);
2173 if (rc)
2174 return rc;
2175 }
2176
2177 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2178 NULL);
2179}
2180
2181static int selinux_binder_transfer_binder(struct task_struct *from,
2182 struct task_struct *to)
2183{
2184 u32 fromsid = task_sid(from);
2185 u32 tosid = task_sid(to);
2186
2187 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2188 NULL);
2189}
2190
2191static int selinux_binder_transfer_file(struct task_struct *from,
2192 struct task_struct *to,
2193 struct file *file)
2194{
2195 u32 sid = task_sid(to);
2196 struct file_security_struct *fsec = file->f_security;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002197 struct dentry *dentry = file->f_path.dentry;
Paul Moore20cdef82016-04-04 14:14:42 -04002198 struct inode_security_struct *isec;
Stephen Smalley79af7302015-01-21 10:54:10 -05002199 struct common_audit_data ad;
2200 int rc;
2201
2202 ad.type = LSM_AUDIT_DATA_PATH;
2203 ad.u.path = file->f_path;
2204
2205 if (sid != fsec->sid) {
2206 rc = avc_has_perm(sid, fsec->sid,
2207 SECCLASS_FD,
2208 FD__USE,
2209 &ad);
2210 if (rc)
2211 return rc;
2212 }
2213
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002214 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
Stephen Smalley79af7302015-01-21 10:54:10 -05002215 return 0;
2216
Paul Moore20cdef82016-04-04 14:14:42 -04002217 isec = backing_inode_security(dentry);
Stephen Smalley79af7302015-01-21 10:54:10 -05002218 return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2219 &ad);
2220}
2221
Ingo Molnar9e488582009-05-07 19:26:19 +10002222static int selinux_ptrace_access_check(struct task_struct *child,
David Howells5cd9c582008-08-14 11:37:28 +01002223 unsigned int mode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002224{
Eric Paris69f594a2012-01-03 12:25:15 -05002225 if (mode & PTRACE_MODE_READ) {
David Howells275bb412008-11-14 10:39:19 +11002226 u32 sid = current_sid();
2227 u32 csid = task_sid(child);
2228 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
Stephen Smalley006ebb42008-05-19 08:32:49 -04002229 }
2230
David Howells3b11a1d2008-11-14 10:39:26 +11002231 return current_has_perm(child, PROCESS__PTRACE);
David Howells5cd9c582008-08-14 11:37:28 +01002232}
2233
2234static int selinux_ptrace_traceme(struct task_struct *parent)
2235{
David Howells5cd9c582008-08-14 11:37:28 +01002236 return task_has_perm(parent, current, PROCESS__PTRACE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002237}
2238
2239static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
Eric Paris828dfe12008-04-17 13:17:49 -04002240 kernel_cap_t *inheritable, kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002241{
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07002242 return current_has_perm(target, PROCESS__GETCAP);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002243}
2244
David Howellsd84f4f92008-11-14 10:39:23 +11002245static int selinux_capset(struct cred *new, const struct cred *old,
2246 const kernel_cap_t *effective,
2247 const kernel_cap_t *inheritable,
2248 const kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002249{
David Howellsd84f4f92008-11-14 10:39:23 +11002250 return cred_has_perm(old, new, PROCESS__SETCAP);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002251}
2252
James Morris5626d3e2009-01-30 10:05:06 +11002253/*
2254 * (This comment used to live with the selinux_task_setuid hook,
2255 * which was removed).
2256 *
2257 * Since setuid only affects the current process, and since the SELinux
2258 * controls are not based on the Linux identity attributes, SELinux does not
2259 * need to control this operation. However, SELinux does control the use of
2260 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2261 */
2262
Eric Paris6a9de492012-01-03 12:25:14 -05002263static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2264 int cap, int audit)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002265{
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04002266 return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002267}
2268
Linus Torvalds1da177e2005-04-16 15:20:36 -07002269static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2270{
David Howells88e67f32008-11-14 10:39:21 +11002271 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002272 int rc = 0;
2273
2274 if (!sb)
2275 return 0;
2276
2277 switch (cmds) {
Eric Paris828dfe12008-04-17 13:17:49 -04002278 case Q_SYNC:
2279 case Q_QUOTAON:
2280 case Q_QUOTAOFF:
2281 case Q_SETINFO:
2282 case Q_SETQUOTA:
David Howells88e67f32008-11-14 10:39:21 +11002283 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04002284 break;
2285 case Q_GETFMT:
2286 case Q_GETINFO:
2287 case Q_GETQUOTA:
David Howells88e67f32008-11-14 10:39:21 +11002288 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04002289 break;
2290 default:
2291 rc = 0; /* let the kernel handle invalid cmds */
2292 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002293 }
2294 return rc;
2295}
2296
2297static int selinux_quota_on(struct dentry *dentry)
2298{
David Howells88e67f32008-11-14 10:39:21 +11002299 const struct cred *cred = current_cred();
2300
Eric Paris2875fa02011-04-28 16:04:24 -04002301 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002302}
2303
Eric Paris12b30522010-11-15 18:36:29 -05002304static int selinux_syslog(int type)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002305{
2306 int rc;
2307
Linus Torvalds1da177e2005-04-16 15:20:36 -07002308 switch (type) {
Kees Cookd78ca3c2010-02-03 15:37:13 -08002309 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2310 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
Eric Paris828dfe12008-04-17 13:17:49 -04002311 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2312 break;
Kees Cookd78ca3c2010-02-03 15:37:13 -08002313 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2314 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2315 /* Set level of messages printed to console */
2316 case SYSLOG_ACTION_CONSOLE_LEVEL:
Eric Paris828dfe12008-04-17 13:17:49 -04002317 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2318 break;
Kees Cookd78ca3c2010-02-03 15:37:13 -08002319 case SYSLOG_ACTION_CLOSE: /* Close log */
2320 case SYSLOG_ACTION_OPEN: /* Open log */
2321 case SYSLOG_ACTION_READ: /* Read from log */
2322 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
2323 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
Eric Paris828dfe12008-04-17 13:17:49 -04002324 default:
2325 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2326 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002327 }
2328 return rc;
2329}
2330
2331/*
2332 * Check that a process has enough memory to allocate a new virtual
2333 * mapping. 0 means there is enough memory for the allocation to
2334 * succeed and -ENOMEM implies there is not.
2335 *
Linus Torvalds1da177e2005-04-16 15:20:36 -07002336 * Do not audit the selinux permission check, as this is applied to all
2337 * processes that allocate mappings.
2338 */
Alan Cox34b4e4a2007-08-22 14:01:28 -07002339static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002340{
2341 int rc, cap_sys_admin = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002342
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07002343 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04002344 SECURITY_CAP_NOAUDIT, true);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002345 if (rc == 0)
2346 cap_sys_admin = 1;
2347
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07002348 return cap_sys_admin;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002349}
2350
2351/* binprm security operations */
2352
Paul Moore0c6181c2016-03-30 21:41:21 -04002353static u32 ptrace_parent_sid(struct task_struct *task)
2354{
2355 u32 sid = 0;
2356 struct task_struct *tracer;
2357
2358 rcu_read_lock();
2359 tracer = ptrace_parent(task);
2360 if (tracer)
2361 sid = task_sid(tracer);
2362 rcu_read_unlock();
2363
2364 return sid;
2365}
2366
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002367static int check_nnp_nosuid(const struct linux_binprm *bprm,
2368 const struct task_security_struct *old_tsec,
2369 const struct task_security_struct *new_tsec)
2370{
2371 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
Andy Lutomirski380cf5b2016-06-23 16:41:05 -05002372 int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002373 int rc;
2374
2375 if (!nnp && !nosuid)
2376 return 0; /* neither NNP nor nosuid */
2377
2378 if (new_tsec->sid == old_tsec->sid)
2379 return 0; /* No change in credentials */
2380
2381 /*
2382 * The only transitions we permit under NNP or nosuid
2383 * are transitions to bounded SIDs, i.e. SIDs that are
2384 * guaranteed to only be allowed a subset of the permissions
2385 * of the current SID.
2386 */
2387 rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2388 if (rc) {
2389 /*
2390 * On failure, preserve the errno values for NNP vs nosuid.
2391 * NNP: Operation not permitted for caller.
2392 * nosuid: Permission denied to file.
2393 */
2394 if (nnp)
2395 return -EPERM;
2396 else
2397 return -EACCES;
2398 }
2399 return 0;
2400}
2401
David Howellsa6f76f22008-11-14 10:39:24 +11002402static int selinux_bprm_set_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002403{
David Howellsa6f76f22008-11-14 10:39:24 +11002404 const struct task_security_struct *old_tsec;
2405 struct task_security_struct *new_tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002406 struct inode_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04002407 struct common_audit_data ad;
Al Viro496ad9a2013-01-23 17:07:38 -05002408 struct inode *inode = file_inode(bprm->file);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002409 int rc;
2410
David Howellsa6f76f22008-11-14 10:39:24 +11002411 /* SELinux context only depends on initial program or script and not
2412 * the script interpreter */
2413 if (bprm->cred_prepared)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002414 return 0;
2415
David Howellsa6f76f22008-11-14 10:39:24 +11002416 old_tsec = current_security();
2417 new_tsec = bprm->cred->security;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002418 isec = inode_security(inode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002419
2420 /* Default to the current task SID. */
David Howellsa6f76f22008-11-14 10:39:24 +11002421 new_tsec->sid = old_tsec->sid;
2422 new_tsec->osid = old_tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002423
Michael LeMay28eba5b2006-06-27 02:53:42 -07002424 /* Reset fs, key, and sock SIDs on execve. */
David Howellsa6f76f22008-11-14 10:39:24 +11002425 new_tsec->create_sid = 0;
2426 new_tsec->keycreate_sid = 0;
2427 new_tsec->sockcreate_sid = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002428
David Howellsa6f76f22008-11-14 10:39:24 +11002429 if (old_tsec->exec_sid) {
2430 new_tsec->sid = old_tsec->exec_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002431 /* Reset exec SID on execve. */
David Howellsa6f76f22008-11-14 10:39:24 +11002432 new_tsec->exec_sid = 0;
Andy Lutomirski259e5e62012-04-12 16:47:50 -05002433
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002434 /* Fail on NNP or nosuid if not an allowed transition. */
2435 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2436 if (rc)
2437 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002438 } else {
2439 /* Check for a default transition on this program. */
David Howellsa6f76f22008-11-14 10:39:24 +11002440 rc = security_transition_sid(old_tsec->sid, isec->sid,
Eric Paris652bb9b2011-02-01 11:05:40 -05002441 SECCLASS_PROCESS, NULL,
2442 &new_tsec->sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002443 if (rc)
2444 return rc;
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002445
2446 /*
2447 * Fallback to old SID on NNP or nosuid if not an allowed
2448 * transition.
2449 */
2450 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2451 if (rc)
2452 new_tsec->sid = old_tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002453 }
2454
Vivek Goyal43af5de2016-09-09 11:37:49 -04002455 ad.type = LSM_AUDIT_DATA_FILE;
2456 ad.u.file = bprm->file;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002457
David Howellsa6f76f22008-11-14 10:39:24 +11002458 if (new_tsec->sid == old_tsec->sid) {
2459 rc = avc_has_perm(old_tsec->sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002460 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2461 if (rc)
2462 return rc;
2463 } else {
2464 /* Check permissions for the transition. */
David Howellsa6f76f22008-11-14 10:39:24 +11002465 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002466 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2467 if (rc)
2468 return rc;
2469
David Howellsa6f76f22008-11-14 10:39:24 +11002470 rc = avc_has_perm(new_tsec->sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002471 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2472 if (rc)
2473 return rc;
2474
David Howellsa6f76f22008-11-14 10:39:24 +11002475 /* Check for shared state */
2476 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2477 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2478 SECCLASS_PROCESS, PROCESS__SHARE,
2479 NULL);
2480 if (rc)
2481 return -EPERM;
2482 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002483
David Howellsa6f76f22008-11-14 10:39:24 +11002484 /* Make sure that anyone attempting to ptrace over a task that
2485 * changes its SID has the appropriate permit */
2486 if (bprm->unsafe &
2487 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
Paul Moore0c6181c2016-03-30 21:41:21 -04002488 u32 ptsid = ptrace_parent_sid(current);
David Howellsa6f76f22008-11-14 10:39:24 +11002489 if (ptsid != 0) {
2490 rc = avc_has_perm(ptsid, new_tsec->sid,
2491 SECCLASS_PROCESS,
2492 PROCESS__PTRACE, NULL);
2493 if (rc)
2494 return -EPERM;
2495 }
2496 }
2497
2498 /* Clear any possibly unsafe personality bits on exec: */
2499 bprm->per_clear |= PER_CLEAR_ON_SETID;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002500 }
2501
Linus Torvalds1da177e2005-04-16 15:20:36 -07002502 return 0;
2503}
2504
Eric Paris828dfe12008-04-17 13:17:49 -04002505static int selinux_bprm_secureexec(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002506{
Paul Moore5fb49872010-04-22 14:46:19 -04002507 const struct task_security_struct *tsec = current_security();
David Howells275bb412008-11-14 10:39:19 +11002508 u32 sid, osid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002509 int atsecure = 0;
2510
David Howells275bb412008-11-14 10:39:19 +11002511 sid = tsec->sid;
2512 osid = tsec->osid;
2513
2514 if (osid != sid) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002515 /* Enable secure mode for SIDs transitions unless
2516 the noatsecure permission is granted between
2517 the two SIDs, i.e. ahp returns 0. */
David Howells275bb412008-11-14 10:39:19 +11002518 atsecure = avc_has_perm(osid, sid,
David Howellsa6f76f22008-11-14 10:39:24 +11002519 SECCLASS_PROCESS,
2520 PROCESS__NOATSECURE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002521 }
2522
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07002523 return !!atsecure;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002524}
2525
Al Viroc3c073f2012-08-21 22:32:06 -04002526static int match_file(const void *p, struct file *file, unsigned fd)
2527{
2528 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2529}
2530
Linus Torvalds1da177e2005-04-16 15:20:36 -07002531/* Derived from fs/exec.c:flush_old_files. */
David Howells745ca242008-11-14 10:39:22 +11002532static inline void flush_unauthorized_files(const struct cred *cred,
2533 struct files_struct *files)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002534{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002535 struct file *file, *devnull = NULL;
Stephen Smalleyb20c8122006-09-25 23:32:03 -07002536 struct tty_struct *tty;
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002537 int drop_tty = 0;
Al Viroc3c073f2012-08-21 22:32:06 -04002538 unsigned n;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002539
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002540 tty = get_current_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002541 if (tty) {
Peter Hurley4a510962016-01-09 21:35:23 -08002542 spin_lock(&tty->files_lock);
Eric Paris37dd0bd2008-10-31 17:40:00 -04002543 if (!list_empty(&tty->tty_files)) {
Nick Piggind996b622010-08-18 04:37:36 +10002544 struct tty_file_private *file_priv;
Eric Paris37dd0bd2008-10-31 17:40:00 -04002545
Linus Torvalds1da177e2005-04-16 15:20:36 -07002546 /* Revalidate access to controlling tty.
David Howells13f8e982013-06-13 23:37:55 +01002547 Use file_path_has_perm on the tty path directly
2548 rather than using file_has_perm, as this particular
2549 open file may belong to another process and we are
2550 only interested in the inode-based check here. */
Nick Piggind996b622010-08-18 04:37:36 +10002551 file_priv = list_first_entry(&tty->tty_files,
2552 struct tty_file_private, list);
2553 file = file_priv->file;
David Howells13f8e982013-06-13 23:37:55 +01002554 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002555 drop_tty = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002556 }
Peter Hurley4a510962016-01-09 21:35:23 -08002557 spin_unlock(&tty->files_lock);
Alan Cox452a00d2008-10-13 10:39:13 +01002558 tty_kref_put(tty);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002559 }
Eric W. Biederman98a27ba2007-05-08 00:26:56 -07002560 /* Reset controlling tty. */
2561 if (drop_tty)
2562 no_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002563
2564 /* Revalidate access to inherited open files. */
Al Viroc3c073f2012-08-21 22:32:06 -04002565 n = iterate_fd(files, 0, match_file, cred);
2566 if (!n) /* none found? */
2567 return;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002568
Al Viroc3c073f2012-08-21 22:32:06 -04002569 devnull = dentry_open(&selinux_null, O_RDWR, cred);
Al Viro45525b22012-10-16 13:30:07 -04002570 if (IS_ERR(devnull))
2571 devnull = NULL;
2572 /* replace all the matching ones with this */
2573 do {
2574 replace_fd(n - 1, devnull, 0);
2575 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2576 if (devnull)
Al Viroc3c073f2012-08-21 22:32:06 -04002577 fput(devnull);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002578}
2579
Linus Torvalds1da177e2005-04-16 15:20:36 -07002580/*
David Howellsa6f76f22008-11-14 10:39:24 +11002581 * Prepare a process for imminent new credential changes due to exec
Linus Torvalds1da177e2005-04-16 15:20:36 -07002582 */
David Howellsa6f76f22008-11-14 10:39:24 +11002583static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002584{
David Howellsa6f76f22008-11-14 10:39:24 +11002585 struct task_security_struct *new_tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002586 struct rlimit *rlim, *initrlim;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002587 int rc, i;
2588
David Howellsa6f76f22008-11-14 10:39:24 +11002589 new_tsec = bprm->cred->security;
2590 if (new_tsec->sid == new_tsec->osid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002591 return;
2592
2593 /* Close files for which the new task SID is not authorized. */
David Howellsa6f76f22008-11-14 10:39:24 +11002594 flush_unauthorized_files(bprm->cred, current->files);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002595
David Howellsa6f76f22008-11-14 10:39:24 +11002596 /* Always clear parent death signal on SID transitions. */
2597 current->pdeath_signal = 0;
2598
2599 /* Check whether the new SID can inherit resource limits from the old
2600 * SID. If not, reset all soft limits to the lower of the current
2601 * task's hard limit and the init task's soft limit.
2602 *
2603 * Note that the setting of hard limits (even to lower them) can be
2604 * controlled by the setrlimit check. The inclusion of the init task's
2605 * soft limit into the computation is to avoid resetting soft limits
2606 * higher than the default soft limit for cases where the default is
2607 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2608 */
2609 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2610 PROCESS__RLIMITINH, NULL);
2611 if (rc) {
Oleg Nesteroveb2d55a2010-06-23 22:43:32 +02002612 /* protect against do_prlimit() */
2613 task_lock(current);
David Howellsa6f76f22008-11-14 10:39:24 +11002614 for (i = 0; i < RLIM_NLIMITS; i++) {
2615 rlim = current->signal->rlim + i;
2616 initrlim = init_task.signal->rlim + i;
2617 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2618 }
Oleg Nesteroveb2d55a2010-06-23 22:43:32 +02002619 task_unlock(current);
Nicolas Pitrebaa73d92016-11-11 00:10:10 -05002620 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2621 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
David Howellsa6f76f22008-11-14 10:39:24 +11002622 }
2623}
2624
2625/*
2626 * Clean up the process immediately after the installation of new credentials
2627 * due to exec
2628 */
2629static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2630{
2631 const struct task_security_struct *tsec = current_security();
2632 struct itimerval itimer;
David Howellsa6f76f22008-11-14 10:39:24 +11002633 u32 osid, sid;
2634 int rc, i;
David Howellsa6f76f22008-11-14 10:39:24 +11002635
David Howellsa6f76f22008-11-14 10:39:24 +11002636 osid = tsec->osid;
2637 sid = tsec->sid;
2638
2639 if (sid == osid)
2640 return;
2641
2642 /* Check whether the new SID can inherit signal state from the old SID.
2643 * If not, clear itimers to avoid subsequent signal generation and
2644 * flush and unblock signals.
2645 *
2646 * This must occur _after_ the task SID has been updated so that any
2647 * kill done after the flush will be checked against the new SID.
2648 */
2649 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002650 if (rc) {
Nicolas Pitrebaa73d92016-11-11 00:10:10 -05002651 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) {
2652 memset(&itimer, 0, sizeof itimer);
2653 for (i = 0; i < 3; i++)
2654 do_setitimer(i, &itimer, NULL);
2655 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002656 spin_lock_irq(&current->sighand->siglock);
Oleg Nesterov9e7c8f82015-06-04 16:22:16 -04002657 if (!fatal_signal_pending(current)) {
2658 flush_sigqueue(&current->pending);
2659 flush_sigqueue(&current->signal->shared_pending);
David Howells3bcac022009-04-29 13:45:05 +01002660 flush_signal_handlers(current, 1);
2661 sigemptyset(&current->blocked);
Oleg Nesterov9e7c8f82015-06-04 16:22:16 -04002662 recalc_sigpending();
David Howells3bcac022009-04-29 13:45:05 +01002663 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002664 spin_unlock_irq(&current->sighand->siglock);
2665 }
2666
David Howellsa6f76f22008-11-14 10:39:24 +11002667 /* Wake up the parent if it is waiting so that it can recheck
2668 * wait permission to the new task SID. */
Oleg Nesterovecd6de32009-04-29 16:02:24 +02002669 read_lock(&tasklist_lock);
Oleg Nesterov0b7570e2009-09-23 15:56:46 -07002670 __wake_up_parent(current, current->real_parent);
Oleg Nesterovecd6de32009-04-29 16:02:24 +02002671 read_unlock(&tasklist_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002672}
2673
2674/* superblock security operations */
2675
2676static int selinux_sb_alloc_security(struct super_block *sb)
2677{
2678 return superblock_alloc_security(sb);
2679}
2680
2681static void selinux_sb_free_security(struct super_block *sb)
2682{
2683 superblock_free_security(sb);
2684}
2685
2686static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2687{
2688 if (plen > olen)
2689 return 0;
2690
2691 return !memcmp(prefix, option, plen);
2692}
2693
2694static inline int selinux_option(char *option, int len)
2695{
Eric Paris832cbd92008-04-01 13:24:09 -04002696 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2697 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2698 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
David P. Quigley11689d42009-01-16 09:22:03 -05002699 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2700 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
Linus Torvalds1da177e2005-04-16 15:20:36 -07002701}
2702
2703static inline void take_option(char **to, char *from, int *first, int len)
2704{
2705 if (!*first) {
2706 **to = ',';
2707 *to += 1;
Cory Olmo3528a952006-09-29 01:58:44 -07002708 } else
Linus Torvalds1da177e2005-04-16 15:20:36 -07002709 *first = 0;
2710 memcpy(*to, from, len);
2711 *to += len;
2712}
2713
Eric Paris828dfe12008-04-17 13:17:49 -04002714static inline void take_selinux_option(char **to, char *from, int *first,
2715 int len)
Cory Olmo3528a952006-09-29 01:58:44 -07002716{
2717 int current_size = 0;
2718
2719 if (!*first) {
2720 **to = '|';
2721 *to += 1;
Eric Paris828dfe12008-04-17 13:17:49 -04002722 } else
Cory Olmo3528a952006-09-29 01:58:44 -07002723 *first = 0;
2724
2725 while (current_size < len) {
2726 if (*from != '"') {
2727 **to = *from;
2728 *to += 1;
2729 }
2730 from += 1;
2731 current_size += 1;
2732 }
2733}
2734
Eric Parise0007522008-03-05 10:31:54 -05002735static int selinux_sb_copy_data(char *orig, char *copy)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002736{
2737 int fnosec, fsec, rc = 0;
2738 char *in_save, *in_curr, *in_end;
2739 char *sec_curr, *nosec_save, *nosec;
Cory Olmo3528a952006-09-29 01:58:44 -07002740 int open_quote = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002741
2742 in_curr = orig;
2743 sec_curr = copy;
2744
Linus Torvalds1da177e2005-04-16 15:20:36 -07002745 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2746 if (!nosec) {
2747 rc = -ENOMEM;
2748 goto out;
2749 }
2750
2751 nosec_save = nosec;
2752 fnosec = fsec = 1;
2753 in_save = in_end = orig;
2754
2755 do {
Cory Olmo3528a952006-09-29 01:58:44 -07002756 if (*in_end == '"')
2757 open_quote = !open_quote;
2758 if ((*in_end == ',' && open_quote == 0) ||
2759 *in_end == '\0') {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002760 int len = in_end - in_curr;
2761
2762 if (selinux_option(in_curr, len))
Cory Olmo3528a952006-09-29 01:58:44 -07002763 take_selinux_option(&sec_curr, in_curr, &fsec, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002764 else
2765 take_option(&nosec, in_curr, &fnosec, len);
2766
2767 in_curr = in_end + 1;
2768 }
2769 } while (*in_end++);
2770
Eric Paris6931dfc2005-06-30 02:58:51 -07002771 strcpy(in_save, nosec_save);
Gerald Schaeferda3caa22005-06-21 17:15:18 -07002772 free_page((unsigned long)nosec_save);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002773out:
2774 return rc;
2775}
2776
Eric Paris026eb162011-03-03 16:09:14 -05002777static int selinux_sb_remount(struct super_block *sb, void *data)
2778{
2779 int rc, i, *flags;
2780 struct security_mnt_opts opts;
2781 char *secdata, **mount_options;
2782 struct superblock_security_struct *sbsec = sb->s_security;
2783
2784 if (!(sbsec->flags & SE_SBINITIALIZED))
2785 return 0;
2786
2787 if (!data)
2788 return 0;
2789
2790 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2791 return 0;
2792
2793 security_init_mnt_opts(&opts);
2794 secdata = alloc_secdata();
2795 if (!secdata)
2796 return -ENOMEM;
2797 rc = selinux_sb_copy_data(data, secdata);
2798 if (rc)
2799 goto out_free_secdata;
2800
2801 rc = selinux_parse_opts_str(secdata, &opts);
2802 if (rc)
2803 goto out_free_secdata;
2804
2805 mount_options = opts.mnt_opts;
2806 flags = opts.mnt_opts_flags;
2807
2808 for (i = 0; i < opts.num_mnt_opts; i++) {
2809 u32 sid;
Eric Paris026eb162011-03-03 16:09:14 -05002810
Eric Paris12f348b2012-10-09 10:56:25 -04002811 if (flags[i] == SBLABEL_MNT)
Eric Paris026eb162011-03-03 16:09:14 -05002812 continue;
Rasmus Villemoes44be2f62015-10-21 17:44:25 -04002813 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
Eric Paris026eb162011-03-03 16:09:14 -05002814 if (rc) {
Rasmus Villemoes44be2f62015-10-21 17:44:25 -04002815 printk(KERN_WARNING "SELinux: security_context_str_to_sid"
Linus Torvalds29b1deb2013-12-15 11:17:45 -08002816 "(%s) failed for (dev %s, type %s) errno=%d\n",
2817 mount_options[i], sb->s_id, sb->s_type->name, rc);
Eric Paris026eb162011-03-03 16:09:14 -05002818 goto out_free_opts;
2819 }
2820 rc = -EINVAL;
2821 switch (flags[i]) {
2822 case FSCONTEXT_MNT:
2823 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2824 goto out_bad_option;
2825 break;
2826 case CONTEXT_MNT:
2827 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2828 goto out_bad_option;
2829 break;
2830 case ROOTCONTEXT_MNT: {
2831 struct inode_security_struct *root_isec;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002832 root_isec = backing_inode_security(sb->s_root);
Eric Paris026eb162011-03-03 16:09:14 -05002833
2834 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2835 goto out_bad_option;
2836 break;
2837 }
2838 case DEFCONTEXT_MNT:
2839 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2840 goto out_bad_option;
2841 break;
2842 default:
2843 goto out_free_opts;
2844 }
2845 }
2846
2847 rc = 0;
2848out_free_opts:
2849 security_free_mnt_opts(&opts);
2850out_free_secdata:
2851 free_secdata(secdata);
2852 return rc;
2853out_bad_option:
2854 printk(KERN_WARNING "SELinux: unable to change security options "
Linus Torvalds29b1deb2013-12-15 11:17:45 -08002855 "during remount (dev %s, type=%s)\n", sb->s_id,
2856 sb->s_type->name);
Eric Paris026eb162011-03-03 16:09:14 -05002857 goto out_free_opts;
2858}
2859
James Morris12204e22008-12-19 10:44:42 +11002860static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002861{
David Howells88e67f32008-11-14 10:39:21 +11002862 const struct cred *cred = current_cred();
Thomas Liu2bf49692009-07-14 12:14:09 -04002863 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002864 int rc;
2865
2866 rc = superblock_doinit(sb, data);
2867 if (rc)
2868 return rc;
2869
James Morris74192242008-12-19 11:41:10 +11002870 /* Allow all mounts performed by the kernel */
2871 if (flags & MS_KERNMOUNT)
2872 return 0;
2873
Eric Paris50c205f2012-04-04 15:01:43 -04002874 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04002875 ad.u.dentry = sb->s_root;
David Howells88e67f32008-11-14 10:39:21 +11002876 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002877}
2878
David Howells726c3342006-06-23 02:02:58 -07002879static int selinux_sb_statfs(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002880{
David Howells88e67f32008-11-14 10:39:21 +11002881 const struct cred *cred = current_cred();
Thomas Liu2bf49692009-07-14 12:14:09 -04002882 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002883
Eric Paris50c205f2012-04-04 15:01:43 -04002884 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04002885 ad.u.dentry = dentry->d_sb->s_root;
David Howells88e67f32008-11-14 10:39:21 +11002886 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002887}
2888
Al Viro808d4e32012-10-11 11:42:01 -04002889static int selinux_mount(const char *dev_name,
Al Viro8a04c432016-03-25 14:52:53 -04002890 const struct path *path,
Al Viro808d4e32012-10-11 11:42:01 -04002891 const char *type,
Eric Paris828dfe12008-04-17 13:17:49 -04002892 unsigned long flags,
2893 void *data)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002894{
David Howells88e67f32008-11-14 10:39:21 +11002895 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002896
2897 if (flags & MS_REMOUNT)
Al Virod8c95842011-12-07 18:16:57 -05002898 return superblock_has_perm(cred, path->dentry->d_sb,
Eric Paris828dfe12008-04-17 13:17:49 -04002899 FILESYSTEM__REMOUNT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002900 else
Eric Paris2875fa02011-04-28 16:04:24 -04002901 return path_has_perm(cred, path, FILE__MOUNTON);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002902}
2903
2904static int selinux_umount(struct vfsmount *mnt, int flags)
2905{
David Howells88e67f32008-11-14 10:39:21 +11002906 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002907
David Howells88e67f32008-11-14 10:39:21 +11002908 return superblock_has_perm(cred, mnt->mnt_sb,
Eric Paris828dfe12008-04-17 13:17:49 -04002909 FILESYSTEM__UNMOUNT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002910}
2911
2912/* inode security operations */
2913
2914static int selinux_inode_alloc_security(struct inode *inode)
2915{
2916 return inode_alloc_security(inode);
2917}
2918
2919static void selinux_inode_free_security(struct inode *inode)
2920{
2921 inode_free_security(inode);
2922}
2923
David Quigleyd47be3d2013-05-22 12:50:34 -04002924static int selinux_dentry_init_security(struct dentry *dentry, int mode,
Al Viro4f3ccd72016-07-20 16:06:15 -04002925 const struct qstr *name, void **ctx,
David Quigleyd47be3d2013-05-22 12:50:34 -04002926 u32 *ctxlen)
2927{
David Quigleyd47be3d2013-05-22 12:50:34 -04002928 u32 newsid;
2929 int rc;
2930
Vivek Goyalc957f6d2016-07-13 10:44:51 -04002931 rc = selinux_determine_inode_label(current_security(),
2932 d_inode(dentry->d_parent), name,
David Howellsc3c188b2015-07-10 17:19:58 -04002933 inode_mode_to_security_class(mode),
2934 &newsid);
2935 if (rc)
2936 return rc;
David Quigleyd47be3d2013-05-22 12:50:34 -04002937
2938 return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2939}
2940
Vivek Goyala518b0a2016-07-13 10:44:53 -04002941static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2942 struct qstr *name,
2943 const struct cred *old,
2944 struct cred *new)
2945{
2946 u32 newsid;
2947 int rc;
2948 struct task_security_struct *tsec;
2949
2950 rc = selinux_determine_inode_label(old->security,
2951 d_inode(dentry->d_parent), name,
2952 inode_mode_to_security_class(mode),
2953 &newsid);
2954 if (rc)
2955 return rc;
2956
2957 tsec = new->security;
2958 tsec->create_sid = newsid;
2959 return 0;
2960}
2961
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002962static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
Tetsuo Handa95489062013-07-25 05:44:02 +09002963 const struct qstr *qstr,
2964 const char **name,
Eric Paris2a7dba32011-02-01 11:05:39 -05002965 void **value, size_t *len)
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002966{
Paul Moore5fb49872010-04-22 14:46:19 -04002967 const struct task_security_struct *tsec = current_security();
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002968 struct superblock_security_struct *sbsec;
David Howells275bb412008-11-14 10:39:19 +11002969 u32 sid, newsid, clen;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002970 int rc;
Tetsuo Handa95489062013-07-25 05:44:02 +09002971 char *context;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002972
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002973 sbsec = dir->i_sb->s_security;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002974
David Howells275bb412008-11-14 10:39:19 +11002975 sid = tsec->sid;
2976 newsid = tsec->create_sid;
2977
Vivek Goyalc957f6d2016-07-13 10:44:51 -04002978 rc = selinux_determine_inode_label(current_security(),
David Howellsc3c188b2015-07-10 17:19:58 -04002979 dir, qstr,
2980 inode_mode_to_security_class(inode->i_mode),
2981 &newsid);
2982 if (rc)
2983 return rc;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002984
Eric Paris296fddf2006-09-25 23:32:00 -07002985 /* Possibly defer initialization to selinux_complete_init. */
David P. Quigley0d90a7e2009-01-16 09:22:02 -05002986 if (sbsec->flags & SE_SBINITIALIZED) {
Eric Paris296fddf2006-09-25 23:32:00 -07002987 struct inode_security_struct *isec = inode->i_security;
2988 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2989 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05002990 isec->initialized = LABEL_INITIALIZED;
Eric Paris296fddf2006-09-25 23:32:00 -07002991 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002992
Eric Paris12f348b2012-10-09 10:56:25 -04002993 if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
Stephen Smalley25a74f32005-11-08 21:34:33 -08002994 return -EOPNOTSUPP;
2995
Tetsuo Handa95489062013-07-25 05:44:02 +09002996 if (name)
2997 *name = XATTR_SELINUX_SUFFIX;
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002998
2999 if (value && len) {
Stephen Smalley12b29f32008-05-07 13:03:20 -04003000 rc = security_sid_to_context_force(newsid, &context, &clen);
Tetsuo Handa95489062013-07-25 05:44:02 +09003001 if (rc)
Stephen Smalley570bc1c2005-09-09 13:01:43 -07003002 return rc;
Stephen Smalley570bc1c2005-09-09 13:01:43 -07003003 *value = context;
3004 *len = clen;
3005 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003006
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003007 return 0;
3008}
3009
Al Viro4acdaf22011-07-26 01:42:34 -04003010static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003011{
3012 return may_create(dir, dentry, SECCLASS_FILE);
3013}
3014
Linus Torvalds1da177e2005-04-16 15:20:36 -07003015static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
3016{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003017 return may_link(dir, old_dentry, MAY_LINK);
3018}
3019
Linus Torvalds1da177e2005-04-16 15:20:36 -07003020static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
3021{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003022 return may_link(dir, dentry, MAY_UNLINK);
3023}
3024
3025static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
3026{
3027 return may_create(dir, dentry, SECCLASS_LNK_FILE);
3028}
3029
Al Viro18bb1db2011-07-26 01:41:39 -04003030static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003031{
3032 return may_create(dir, dentry, SECCLASS_DIR);
3033}
3034
Linus Torvalds1da177e2005-04-16 15:20:36 -07003035static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
3036{
3037 return may_link(dir, dentry, MAY_RMDIR);
3038}
3039
Al Viro1a67aaf2011-07-26 01:52:52 -04003040static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003041{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003042 return may_create(dir, dentry, inode_mode_to_security_class(mode));
3043}
3044
Linus Torvalds1da177e2005-04-16 15:20:36 -07003045static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
Eric Paris828dfe12008-04-17 13:17:49 -04003046 struct inode *new_inode, struct dentry *new_dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003047{
3048 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
3049}
3050
Linus Torvalds1da177e2005-04-16 15:20:36 -07003051static int selinux_inode_readlink(struct dentry *dentry)
3052{
David Howells88e67f32008-11-14 10:39:21 +11003053 const struct cred *cred = current_cred();
3054
Eric Paris2875fa02011-04-28 16:04:24 -04003055 return dentry_has_perm(cred, dentry, FILE__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003056}
3057
NeilBrownbda0be72015-03-23 13:37:39 +11003058static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
3059 bool rcu)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003060{
David Howells88e67f32008-11-14 10:39:21 +11003061 const struct cred *cred = current_cred();
NeilBrownbda0be72015-03-23 13:37:39 +11003062 struct common_audit_data ad;
3063 struct inode_security_struct *isec;
3064 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003065
NeilBrownbda0be72015-03-23 13:37:39 +11003066 validate_creds(cred);
3067
3068 ad.type = LSM_AUDIT_DATA_DENTRY;
3069 ad.u.dentry = dentry;
3070 sid = cred_sid(cred);
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05003071 isec = inode_security_rcu(inode, rcu);
3072 if (IS_ERR(isec))
3073 return PTR_ERR(isec);
NeilBrownbda0be72015-03-23 13:37:39 +11003074
3075 return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
3076 rcu ? MAY_NOT_BLOCK : 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003077}
3078
Eric Parisd4cf970d2012-04-04 15:01:42 -04003079static noinline int audit_inode_permission(struct inode *inode,
3080 u32 perms, u32 audited, u32 denied,
Stephen Smalley626b9742014-04-29 11:29:04 -07003081 int result,
Eric Parisd4cf970d2012-04-04 15:01:42 -04003082 unsigned flags)
3083{
3084 struct common_audit_data ad;
Eric Parisd4cf970d2012-04-04 15:01:42 -04003085 struct inode_security_struct *isec = inode->i_security;
3086 int rc;
3087
Eric Paris50c205f2012-04-04 15:01:43 -04003088 ad.type = LSM_AUDIT_DATA_INODE;
Eric Parisd4cf970d2012-04-04 15:01:42 -04003089 ad.u.inode = inode;
3090
3091 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
Stephen Smalley626b9742014-04-29 11:29:04 -07003092 audited, denied, result, &ad, flags);
Eric Parisd4cf970d2012-04-04 15:01:42 -04003093 if (rc)
3094 return rc;
3095 return 0;
3096}
3097
Al Viroe74f71e2011-06-20 19:38:15 -04003098static int selinux_inode_permission(struct inode *inode, int mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003099{
David Howells88e67f32008-11-14 10:39:21 +11003100 const struct cred *cred = current_cred();
Eric Parisb782e0a2010-07-23 11:44:03 -04003101 u32 perms;
3102 bool from_access;
Al Virocf1dd1d2011-06-20 19:44:08 -04003103 unsigned flags = mask & MAY_NOT_BLOCK;
Eric Paris2e334052012-04-04 15:01:42 -04003104 struct inode_security_struct *isec;
3105 u32 sid;
3106 struct av_decision avd;
3107 int rc, rc2;
3108 u32 audited, denied;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003109
Eric Parisb782e0a2010-07-23 11:44:03 -04003110 from_access = mask & MAY_ACCESS;
Eric Parisd09ca732010-07-23 11:43:57 -04003111 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3112
Eric Parisb782e0a2010-07-23 11:44:03 -04003113 /* No permission to check. Existence test. */
3114 if (!mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003115 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003116
Eric Paris2e334052012-04-04 15:01:42 -04003117 validate_creds(cred);
Eric Parisb782e0a2010-07-23 11:44:03 -04003118
Eric Paris2e334052012-04-04 15:01:42 -04003119 if (unlikely(IS_PRIVATE(inode)))
3120 return 0;
Eric Parisb782e0a2010-07-23 11:44:03 -04003121
3122 perms = file_mask_to_av(inode->i_mode, mask);
3123
Eric Paris2e334052012-04-04 15:01:42 -04003124 sid = cred_sid(cred);
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05003125 isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3126 if (IS_ERR(isec))
3127 return PTR_ERR(isec);
Eric Paris2e334052012-04-04 15:01:42 -04003128
3129 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
3130 audited = avc_audit_required(perms, &avd, rc,
3131 from_access ? FILE__AUDIT_ACCESS : 0,
3132 &denied);
3133 if (likely(!audited))
3134 return rc;
3135
Stephen Smalley626b9742014-04-29 11:29:04 -07003136 rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
Eric Paris2e334052012-04-04 15:01:42 -04003137 if (rc2)
3138 return rc2;
3139 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003140}
3141
3142static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3143{
David Howells88e67f32008-11-14 10:39:21 +11003144 const struct cred *cred = current_cred();
Amerigo Wangbc6a6002009-08-20 19:29:02 -07003145 unsigned int ia_valid = iattr->ia_valid;
Eric Paris95dbf732012-04-04 13:45:34 -04003146 __u32 av = FILE__WRITE;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003147
Amerigo Wangbc6a6002009-08-20 19:29:02 -07003148 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3149 if (ia_valid & ATTR_FORCE) {
3150 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3151 ATTR_FORCE);
3152 if (!ia_valid)
3153 return 0;
3154 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003155
Amerigo Wangbc6a6002009-08-20 19:29:02 -07003156 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3157 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
Eric Paris2875fa02011-04-28 16:04:24 -04003158 return dentry_has_perm(cred, dentry, FILE__SETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003159
Jeff Vander Stoep44d37ad2015-10-21 17:44:25 -04003160 if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE)
3161 && !(ia_valid & ATTR_FILE))
Eric Paris95dbf732012-04-04 13:45:34 -04003162 av |= FILE__OPEN;
3163
3164 return dentry_has_perm(cred, dentry, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003165}
3166
Al Viro3f7036a2015-03-08 19:28:30 -04003167static int selinux_inode_getattr(const struct path *path)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003168{
Al Viro3f7036a2015-03-08 19:28:30 -04003169 return path_has_perm(current_cred(), path, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003170}
3171
David Howells8f0cfa52008-04-29 00:59:41 -07003172static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
Serge E. Hallynb5376772007-10-16 23:31:36 -07003173{
David Howells88e67f32008-11-14 10:39:21 +11003174 const struct cred *cred = current_cred();
3175
Serge E. Hallynb5376772007-10-16 23:31:36 -07003176 if (!strncmp(name, XATTR_SECURITY_PREFIX,
3177 sizeof XATTR_SECURITY_PREFIX - 1)) {
3178 if (!strcmp(name, XATTR_NAME_CAPS)) {
3179 if (!capable(CAP_SETFCAP))
3180 return -EPERM;
3181 } else if (!capable(CAP_SYS_ADMIN)) {
3182 /* A different attribute in the security namespace.
3183 Restrict to administrator. */
3184 return -EPERM;
3185 }
3186 }
3187
3188 /* Not an attribute we recognize, so just check the
3189 ordinary setattr permission. */
Eric Paris2875fa02011-04-28 16:04:24 -04003190 return dentry_has_perm(cred, dentry, FILE__SETATTR);
Serge E. Hallynb5376772007-10-16 23:31:36 -07003191}
3192
David Howells8f0cfa52008-04-29 00:59:41 -07003193static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3194 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003195{
David Howellsc6f493d2015-03-17 22:26:22 +00003196 struct inode *inode = d_backing_inode(dentry);
Paul Moore20cdef82016-04-04 14:14:42 -04003197 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003198 struct superblock_security_struct *sbsec;
Thomas Liu2bf49692009-07-14 12:14:09 -04003199 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11003200 u32 newsid, sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003201 int rc = 0;
3202
Serge E. Hallynb5376772007-10-16 23:31:36 -07003203 if (strcmp(name, XATTR_NAME_SELINUX))
3204 return selinux_inode_setotherxattr(dentry, name);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003205
3206 sbsec = inode->i_sb->s_security;
Eric Paris12f348b2012-10-09 10:56:25 -04003207 if (!(sbsec->flags & SBLABEL_MNT))
Linus Torvalds1da177e2005-04-16 15:20:36 -07003208 return -EOPNOTSUPP;
3209
Serge E. Hallyn2e149672011-03-23 16:43:26 -07003210 if (!inode_owner_or_capable(inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -07003211 return -EPERM;
3212
Eric Paris50c205f2012-04-04 15:01:43 -04003213 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04003214 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003215
Paul Moore20cdef82016-04-04 14:14:42 -04003216 isec = backing_inode_security(dentry);
David Howells275bb412008-11-14 10:39:19 +11003217 rc = avc_has_perm(sid, isec->sid, isec->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003218 FILE__RELABELFROM, &ad);
3219 if (rc)
3220 return rc;
3221
Nikolay Aleksandrov52a4c642014-03-07 12:44:19 +01003222 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
Stephen Smalley12b29f32008-05-07 13:03:20 -04003223 if (rc == -EINVAL) {
Eric Parisd6ea83e2012-04-04 13:45:49 -04003224 if (!capable(CAP_MAC_ADMIN)) {
3225 struct audit_buffer *ab;
3226 size_t audit_size;
3227 const char *str;
3228
3229 /* We strip a nul only if it is at the end, otherwise the
3230 * context contains a nul and we should audit that */
Al Viroe3fea3f2012-06-09 08:15:16 +01003231 if (value) {
3232 str = value;
3233 if (str[size - 1] == '\0')
3234 audit_size = size - 1;
3235 else
3236 audit_size = size;
3237 } else {
3238 str = "";
3239 audit_size = 0;
3240 }
Eric Parisd6ea83e2012-04-04 13:45:49 -04003241 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3242 audit_log_format(ab, "op=setxattr invalid_context=");
3243 audit_log_n_untrustedstring(ab, value, audit_size);
3244 audit_log_end(ab);
3245
Stephen Smalley12b29f32008-05-07 13:03:20 -04003246 return rc;
Eric Parisd6ea83e2012-04-04 13:45:49 -04003247 }
Stephen Smalley12b29f32008-05-07 13:03:20 -04003248 rc = security_context_to_sid_force(value, size, &newsid);
3249 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003250 if (rc)
3251 return rc;
3252
David Howells275bb412008-11-14 10:39:19 +11003253 rc = avc_has_perm(sid, newsid, isec->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003254 FILE__RELABELTO, &ad);
3255 if (rc)
3256 return rc;
3257
David Howells275bb412008-11-14 10:39:19 +11003258 rc = security_validate_transition(isec->sid, newsid, sid,
Eric Paris828dfe12008-04-17 13:17:49 -04003259 isec->sclass);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003260 if (rc)
3261 return rc;
3262
3263 return avc_has_perm(newsid,
3264 sbsec->sid,
3265 SECCLASS_FILESYSTEM,
3266 FILESYSTEM__ASSOCIATE,
3267 &ad);
3268}
3269
David Howells8f0cfa52008-04-29 00:59:41 -07003270static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
Eric Parisf5269712008-05-14 11:27:45 -04003271 const void *value, size_t size,
David Howells8f0cfa52008-04-29 00:59:41 -07003272 int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003273{
David Howellsc6f493d2015-03-17 22:26:22 +00003274 struct inode *inode = d_backing_inode(dentry);
Paul Moore20cdef82016-04-04 14:14:42 -04003275 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003276 u32 newsid;
3277 int rc;
3278
3279 if (strcmp(name, XATTR_NAME_SELINUX)) {
3280 /* Not an attribute we recognize, so nothing to do. */
3281 return;
3282 }
3283
Stephen Smalley12b29f32008-05-07 13:03:20 -04003284 rc = security_context_to_sid_force(value, size, &newsid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003285 if (rc) {
Stephen Smalley12b29f32008-05-07 13:03:20 -04003286 printk(KERN_ERR "SELinux: unable to map context to SID"
3287 "for (%s, %lu), rc=%d\n",
3288 inode->i_sb->s_id, inode->i_ino, -rc);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003289 return;
3290 }
3291
Paul Moore20cdef82016-04-04 14:14:42 -04003292 isec = backing_inode_security(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003293 spin_lock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003294 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003295 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05003296 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003297 spin_unlock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003298
Linus Torvalds1da177e2005-04-16 15:20:36 -07003299 return;
3300}
3301
David Howells8f0cfa52008-04-29 00:59:41 -07003302static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003303{
David Howells88e67f32008-11-14 10:39:21 +11003304 const struct cred *cred = current_cred();
3305
Eric Paris2875fa02011-04-28 16:04:24 -04003306 return dentry_has_perm(cred, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003307}
3308
Eric Paris828dfe12008-04-17 13:17:49 -04003309static int selinux_inode_listxattr(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003310{
David Howells88e67f32008-11-14 10:39:21 +11003311 const struct cred *cred = current_cred();
3312
Eric Paris2875fa02011-04-28 16:04:24 -04003313 return dentry_has_perm(cred, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003314}
3315
David Howells8f0cfa52008-04-29 00:59:41 -07003316static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003317{
Serge E. Hallynb5376772007-10-16 23:31:36 -07003318 if (strcmp(name, XATTR_NAME_SELINUX))
3319 return selinux_inode_setotherxattr(dentry, name);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003320
3321 /* No one is allowed to remove a SELinux security label.
3322 You can change the label, but all data must be labeled. */
3323 return -EACCES;
3324}
3325
James Morrisd381d8a2005-10-30 14:59:22 -08003326/*
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003327 * Copy the inode security context value to the user.
James Morrisd381d8a2005-10-30 14:59:22 -08003328 *
3329 * Permission check is handled by selinux_inode_getxattr hook.
3330 */
Andreas Gruenbacherea861df2015-12-24 11:09:39 -05003331static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003332{
David P. Quigley42492592008-02-04 22:29:39 -08003333 u32 size;
3334 int error;
3335 char *context = NULL;
Paul Moore20cdef82016-04-04 14:14:42 -04003336 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003337
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00003338 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3339 return -EOPNOTSUPP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003340
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003341 /*
3342 * If the caller has CAP_MAC_ADMIN, then get the raw context
3343 * value even if it is not defined by current policy; otherwise,
3344 * use the in-core value under current policy.
3345 * Use the non-auditing forms of the permission checks since
3346 * getxattr may be called by unprivileged processes commonly
3347 * and lack of permission just means that we fall back to the
3348 * in-core context value, not a denial.
3349 */
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07003350 error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3351 SECURITY_CAP_NOAUDIT);
3352 if (!error)
3353 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04003354 SECURITY_CAP_NOAUDIT, true);
Paul Moore20cdef82016-04-04 14:14:42 -04003355 isec = inode_security(inode);
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003356 if (!error)
3357 error = security_sid_to_context_force(isec->sid, &context,
3358 &size);
3359 else
3360 error = security_sid_to_context(isec->sid, &context, &size);
David P. Quigley42492592008-02-04 22:29:39 -08003361 if (error)
3362 return error;
3363 error = size;
3364 if (alloc) {
3365 *buffer = context;
3366 goto out_nofree;
3367 }
3368 kfree(context);
3369out_nofree:
3370 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003371}
3372
3373static int selinux_inode_setsecurity(struct inode *inode, const char *name,
Eric Paris828dfe12008-04-17 13:17:49 -04003374 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003375{
Paul Moore2c971652016-04-19 16:36:28 -04003376 struct inode_security_struct *isec = inode_security_novalidate(inode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003377 u32 newsid;
3378 int rc;
3379
3380 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3381 return -EOPNOTSUPP;
3382
3383 if (!value || !size)
3384 return -EACCES;
3385
Rasmus Villemoes20ba96a2015-10-21 17:44:26 -04003386 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003387 if (rc)
3388 return rc;
3389
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003390 spin_lock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003391 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003392 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05003393 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003394 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003395 return 0;
3396}
3397
3398static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3399{
3400 const int len = sizeof(XATTR_NAME_SELINUX);
3401 if (buffer && len <= buffer_size)
3402 memcpy(buffer, XATTR_NAME_SELINUX, len);
3403 return len;
3404}
3405
Andreas Gruenbacherd6335d72015-12-24 11:09:39 -05003406static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02003407{
Andreas Gruenbachere817c2f2016-02-18 12:04:08 +01003408 struct inode_security_struct *isec = inode_security_novalidate(inode);
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02003409 *secid = isec->sid;
3410}
3411
Vivek Goyal56909eb2016-07-13 10:44:48 -04003412static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3413{
3414 u32 sid;
3415 struct task_security_struct *tsec;
3416 struct cred *new_creds = *new;
3417
3418 if (new_creds == NULL) {
3419 new_creds = prepare_creds();
3420 if (!new_creds)
3421 return -ENOMEM;
3422 }
3423
3424 tsec = new_creds->security;
3425 /* Get label from overlay inode and set it in create_sid */
3426 selinux_inode_getsecid(d_inode(src), &sid);
3427 tsec->create_sid = sid;
3428 *new = new_creds;
3429 return 0;
3430}
3431
Vivek Goyal19472b62016-07-13 10:44:50 -04003432static int selinux_inode_copy_up_xattr(const char *name)
3433{
3434 /* The copy_up hook above sets the initial context on an inode, but we
3435 * don't then want to overwrite it by blindly copying all the lower
3436 * xattrs up. Instead, we have to filter out SELinux-related xattrs.
3437 */
3438 if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3439 return 1; /* Discard */
3440 /*
3441 * Any other attribute apart from SELINUX is not claimed, supported
3442 * by selinux.
3443 */
3444 return -EOPNOTSUPP;
3445}
3446
Linus Torvalds1da177e2005-04-16 15:20:36 -07003447/* file security operations */
3448
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003449static int selinux_revalidate_file_permission(struct file *file, int mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003450{
David Howells88e67f32008-11-14 10:39:21 +11003451 const struct cred *cred = current_cred();
Al Viro496ad9a2013-01-23 17:07:38 -05003452 struct inode *inode = file_inode(file);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003453
Linus Torvalds1da177e2005-04-16 15:20:36 -07003454 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3455 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3456 mask |= MAY_APPEND;
3457
Paul Moore389fb8002009-03-27 17:10:34 -04003458 return file_has_perm(cred, file,
3459 file_mask_to_av(inode->i_mode, mask));
Linus Torvalds1da177e2005-04-16 15:20:36 -07003460}
3461
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003462static int selinux_file_permission(struct file *file, int mask)
3463{
Al Viro496ad9a2013-01-23 17:07:38 -05003464 struct inode *inode = file_inode(file);
Stephen Smalley20dda182009-06-22 14:54:53 -04003465 struct file_security_struct *fsec = file->f_security;
Andreas Gruenbacherb1973672016-01-05 23:12:33 +01003466 struct inode_security_struct *isec;
Stephen Smalley20dda182009-06-22 14:54:53 -04003467 u32 sid = current_sid();
3468
Paul Moore389fb8002009-03-27 17:10:34 -04003469 if (!mask)
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003470 /* No permission to check. Existence test. */
3471 return 0;
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003472
Andreas Gruenbacherb1973672016-01-05 23:12:33 +01003473 isec = inode_security(inode);
Stephen Smalley20dda182009-06-22 14:54:53 -04003474 if (sid == fsec->sid && fsec->isid == isec->sid &&
3475 fsec->pseqno == avc_policy_seqno())
Eric Paris83d49852012-04-04 13:45:40 -04003476 /* No change since file_open check. */
Stephen Smalley20dda182009-06-22 14:54:53 -04003477 return 0;
3478
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003479 return selinux_revalidate_file_permission(file, mask);
3480}
3481
Linus Torvalds1da177e2005-04-16 15:20:36 -07003482static int selinux_file_alloc_security(struct file *file)
3483{
3484 return file_alloc_security(file);
3485}
3486
3487static void selinux_file_free_security(struct file *file)
3488{
3489 file_free_security(file);
3490}
3491
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003492/*
3493 * Check whether a task has the ioctl permission and cmd
3494 * operation to an inode.
3495 */
Geliang Tang1d2a1682015-10-21 17:44:27 -04003496static int ioctl_has_perm(const struct cred *cred, struct file *file,
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003497 u32 requested, u16 cmd)
3498{
3499 struct common_audit_data ad;
3500 struct file_security_struct *fsec = file->f_security;
3501 struct inode *inode = file_inode(file);
Paul Moore20cdef82016-04-04 14:14:42 -04003502 struct inode_security_struct *isec;
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003503 struct lsm_ioctlop_audit ioctl;
3504 u32 ssid = cred_sid(cred);
3505 int rc;
3506 u8 driver = cmd >> 8;
3507 u8 xperm = cmd & 0xff;
3508
3509 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3510 ad.u.op = &ioctl;
3511 ad.u.op->cmd = cmd;
3512 ad.u.op->path = file->f_path;
3513
3514 if (ssid != fsec->sid) {
3515 rc = avc_has_perm(ssid, fsec->sid,
3516 SECCLASS_FD,
3517 FD__USE,
3518 &ad);
3519 if (rc)
3520 goto out;
3521 }
3522
3523 if (unlikely(IS_PRIVATE(inode)))
3524 return 0;
3525
Paul Moore20cdef82016-04-04 14:14:42 -04003526 isec = inode_security(inode);
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003527 rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3528 requested, driver, xperm, &ad);
3529out:
3530 return rc;
3531}
3532
Linus Torvalds1da177e2005-04-16 15:20:36 -07003533static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3534 unsigned long arg)
3535{
David Howells88e67f32008-11-14 10:39:21 +11003536 const struct cred *cred = current_cred();
Eric Paris0b24dcb2011-02-25 15:39:20 -05003537 int error = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003538
Eric Paris0b24dcb2011-02-25 15:39:20 -05003539 switch (cmd) {
3540 case FIONREAD:
3541 /* fall through */
3542 case FIBMAP:
3543 /* fall through */
3544 case FIGETBSZ:
3545 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003546 case FS_IOC_GETFLAGS:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003547 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003548 case FS_IOC_GETVERSION:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003549 error = file_has_perm(cred, file, FILE__GETATTR);
3550 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003551
Al Viro2f99c362012-03-23 16:04:05 -04003552 case FS_IOC_SETFLAGS:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003553 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003554 case FS_IOC_SETVERSION:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003555 error = file_has_perm(cred, file, FILE__SETATTR);
3556 break;
3557
3558 /* sys_ioctl() checks */
3559 case FIONBIO:
3560 /* fall through */
3561 case FIOASYNC:
3562 error = file_has_perm(cred, file, 0);
3563 break;
3564
3565 case KDSKBENT:
3566 case KDSKBSENT:
Eric Paris6a9de492012-01-03 12:25:14 -05003567 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04003568 SECURITY_CAP_AUDIT, true);
Eric Paris0b24dcb2011-02-25 15:39:20 -05003569 break;
3570
3571 /* default case assumes that the command will go
3572 * to the file's ioctl() function.
3573 */
3574 default:
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003575 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
Eric Paris0b24dcb2011-02-25 15:39:20 -05003576 }
3577 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003578}
3579
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003580static int default_noexec;
3581
Linus Torvalds1da177e2005-04-16 15:20:36 -07003582static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3583{
David Howells88e67f32008-11-14 10:39:21 +11003584 const struct cred *cred = current_cred();
David Howellsd84f4f92008-11-14 10:39:23 +11003585 int rc = 0;
David Howells88e67f32008-11-14 10:39:21 +11003586
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003587 if (default_noexec &&
Stephen Smalley892e8ca2015-07-10 09:40:59 -04003588 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3589 (!shared && (prot & PROT_WRITE)))) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07003590 /*
3591 * We are making executable an anonymous mapping or a
3592 * private file mapping that will also be writable.
3593 * This has an additional check.
3594 */
David Howellsd84f4f92008-11-14 10:39:23 +11003595 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003596 if (rc)
David Howellsd84f4f92008-11-14 10:39:23 +11003597 goto error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003598 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003599
3600 if (file) {
3601 /* read access is always possible with a mapping */
3602 u32 av = FILE__READ;
3603
3604 /* write access only matters if the mapping is shared */
3605 if (shared && (prot & PROT_WRITE))
3606 av |= FILE__WRITE;
3607
3608 if (prot & PROT_EXEC)
3609 av |= FILE__EXECUTE;
3610
David Howells88e67f32008-11-14 10:39:21 +11003611 return file_has_perm(cred, file, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003612 }
David Howellsd84f4f92008-11-14 10:39:23 +11003613
3614error:
3615 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003616}
3617
Al Viroe5467852012-05-30 13:30:51 -04003618static int selinux_mmap_addr(unsigned long addr)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003619{
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07003620 int rc = 0;
Paul Moore98883bf2014-03-19 16:46:11 -04003621
3622 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3623 u32 sid = current_sid();
3624 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3625 MEMPROTECT__MMAP_ZERO, NULL);
3626 }
3627
3628 return rc;
Al Viroe5467852012-05-30 13:30:51 -04003629}
Linus Torvalds1da177e2005-04-16 15:20:36 -07003630
Al Viroe5467852012-05-30 13:30:51 -04003631static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3632 unsigned long prot, unsigned long flags)
3633{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003634 if (selinux_checkreqprot)
3635 prot = reqprot;
3636
3637 return file_map_prot_check(file, prot,
3638 (flags & MAP_TYPE) == MAP_SHARED);
3639}
3640
3641static int selinux_file_mprotect(struct vm_area_struct *vma,
3642 unsigned long reqprot,
3643 unsigned long prot)
3644{
David Howells88e67f32008-11-14 10:39:21 +11003645 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003646
3647 if (selinux_checkreqprot)
3648 prot = reqprot;
3649
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003650 if (default_noexec &&
3651 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
James Morrisd541bbe2009-01-29 12:19:51 +11003652 int rc = 0;
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003653 if (vma->vm_start >= vma->vm_mm->start_brk &&
3654 vma->vm_end <= vma->vm_mm->brk) {
David Howellsd84f4f92008-11-14 10:39:23 +11003655 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003656 } else if (!vma->vm_file &&
Stephen Smalleyc2316db2016-04-08 13:55:03 -04003657 ((vma->vm_start <= vma->vm_mm->start_stack &&
3658 vma->vm_end >= vma->vm_mm->start_stack) ||
Andy Lutomirskid17af502016-09-30 10:58:58 -07003659 vma_is_stack_for_current(vma))) {
David Howells3b11a1d2008-11-14 10:39:26 +11003660 rc = current_has_perm(current, PROCESS__EXECSTACK);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003661 } else if (vma->vm_file && vma->anon_vma) {
3662 /*
3663 * We are making executable a file mapping that has
3664 * had some COW done. Since pages might have been
3665 * written, check ability to execute the possibly
3666 * modified content. This typically should only
3667 * occur for text relocations.
3668 */
David Howellsd84f4f92008-11-14 10:39:23 +11003669 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003670 }
Lorenzo Hernandez García-Hierro6b992192005-06-25 14:54:34 -07003671 if (rc)
3672 return rc;
3673 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003674
3675 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3676}
3677
3678static int selinux_file_lock(struct file *file, unsigned int cmd)
3679{
David Howells88e67f32008-11-14 10:39:21 +11003680 const struct cred *cred = current_cred();
3681
3682 return file_has_perm(cred, file, FILE__LOCK);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003683}
3684
3685static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3686 unsigned long arg)
3687{
David Howells88e67f32008-11-14 10:39:21 +11003688 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003689 int err = 0;
3690
3691 switch (cmd) {
Eric Paris828dfe12008-04-17 13:17:49 -04003692 case F_SETFL:
Eric Paris828dfe12008-04-17 13:17:49 -04003693 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
David Howells88e67f32008-11-14 10:39:21 +11003694 err = file_has_perm(cred, file, FILE__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003695 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003696 }
3697 /* fall through */
3698 case F_SETOWN:
3699 case F_SETSIG:
3700 case F_GETFL:
3701 case F_GETOWN:
3702 case F_GETSIG:
Cyrill Gorcunov1d151c32012-07-30 14:43:00 -07003703 case F_GETOWNER_UIDS:
Eric Paris828dfe12008-04-17 13:17:49 -04003704 /* Just check FD__USE permission */
David Howells88e67f32008-11-14 10:39:21 +11003705 err = file_has_perm(cred, file, 0);
Eric Paris828dfe12008-04-17 13:17:49 -04003706 break;
3707 case F_GETLK:
3708 case F_SETLK:
3709 case F_SETLKW:
Jeff Layton0d3f7a22014-04-22 08:23:58 -04003710 case F_OFD_GETLK:
3711 case F_OFD_SETLK:
3712 case F_OFD_SETLKW:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003713#if BITS_PER_LONG == 32
Eric Paris828dfe12008-04-17 13:17:49 -04003714 case F_GETLK64:
3715 case F_SETLK64:
3716 case F_SETLKW64:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003717#endif
David Howells88e67f32008-11-14 10:39:21 +11003718 err = file_has_perm(cred, file, FILE__LOCK);
Eric Paris828dfe12008-04-17 13:17:49 -04003719 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003720 }
3721
3722 return err;
3723}
3724
Jeff Laytone0b93ed2014-08-22 11:27:32 -04003725static void selinux_file_set_fowner(struct file *file)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003726{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003727 struct file_security_struct *fsec;
3728
Linus Torvalds1da177e2005-04-16 15:20:36 -07003729 fsec = file->f_security;
David Howells275bb412008-11-14 10:39:19 +11003730 fsec->fown_sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003731}
3732
3733static int selinux_file_send_sigiotask(struct task_struct *tsk,
3734 struct fown_struct *fown, int signum)
3735{
Eric Paris828dfe12008-04-17 13:17:49 -04003736 struct file *file;
Stephen Smalley65c90bc2009-05-04 15:43:18 -04003737 u32 sid = task_sid(tsk);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003738 u32 perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003739 struct file_security_struct *fsec;
3740
3741 /* struct fown_struct is never outside the context of a struct file */
Eric Paris828dfe12008-04-17 13:17:49 -04003742 file = container_of(fown, struct file, f_owner);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003743
Linus Torvalds1da177e2005-04-16 15:20:36 -07003744 fsec = file->f_security;
3745
3746 if (!signum)
3747 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3748 else
3749 perm = signal_to_av(signum);
3750
David Howells275bb412008-11-14 10:39:19 +11003751 return avc_has_perm(fsec->fown_sid, sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003752 SECCLASS_PROCESS, perm, NULL);
3753}
3754
3755static int selinux_file_receive(struct file *file)
3756{
David Howells88e67f32008-11-14 10:39:21 +11003757 const struct cred *cred = current_cred();
3758
3759 return file_has_perm(cred, file, file_to_av(file));
Linus Torvalds1da177e2005-04-16 15:20:36 -07003760}
3761
Eric Paris83d49852012-04-04 13:45:40 -04003762static int selinux_file_open(struct file *file, const struct cred *cred)
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003763{
3764 struct file_security_struct *fsec;
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003765 struct inode_security_struct *isec;
David Howellsd84f4f92008-11-14 10:39:23 +11003766
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003767 fsec = file->f_security;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05003768 isec = inode_security(file_inode(file));
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003769 /*
3770 * Save inode label and policy sequence number
3771 * at open-time so that selinux_file_permission
3772 * can determine whether revalidation is necessary.
3773 * Task label is already saved in the file security
3774 * struct as its SID.
3775 */
3776 fsec->isid = isec->sid;
3777 fsec->pseqno = avc_policy_seqno();
3778 /*
3779 * Since the inode label or policy seqno may have changed
3780 * between the selinux_inode_permission check and the saving
3781 * of state above, recheck that access is still permitted.
3782 * Otherwise, access might never be revalidated against the
3783 * new inode label or new policy.
3784 * This check is not redundant - do not remove.
3785 */
David Howells13f8e982013-06-13 23:37:55 +01003786 return file_path_has_perm(cred, file, open_file_to_av(file));
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003787}
3788
Linus Torvalds1da177e2005-04-16 15:20:36 -07003789/* task security operations */
3790
3791static int selinux_task_create(unsigned long clone_flags)
3792{
David Howells3b11a1d2008-11-14 10:39:26 +11003793 return current_has_perm(current, PROCESS__FORK);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003794}
3795
David Howellsf1752ee2008-11-14 10:39:17 +11003796/*
David Howellsee18d642009-09-02 09:14:21 +01003797 * allocate the SELinux part of blank credentials
3798 */
3799static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3800{
3801 struct task_security_struct *tsec;
3802
3803 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3804 if (!tsec)
3805 return -ENOMEM;
3806
3807 cred->security = tsec;
3808 return 0;
3809}
3810
3811/*
David Howellsf1752ee2008-11-14 10:39:17 +11003812 * detach and free the LSM part of a set of credentials
3813 */
3814static void selinux_cred_free(struct cred *cred)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003815{
David Howellsf1752ee2008-11-14 10:39:17 +11003816 struct task_security_struct *tsec = cred->security;
David Howellse0e81732009-09-02 09:13:40 +01003817
Tetsuo Handa2edeaa32011-02-07 13:36:10 +00003818 /*
3819 * cred->security == NULL if security_cred_alloc_blank() or
3820 * security_prepare_creds() returned an error.
3821 */
3822 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
David Howellse0e81732009-09-02 09:13:40 +01003823 cred->security = (void *) 0x7UL;
David Howellsf1752ee2008-11-14 10:39:17 +11003824 kfree(tsec);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003825}
3826
David Howellsd84f4f92008-11-14 10:39:23 +11003827/*
3828 * prepare a new set of credentials for modification
3829 */
3830static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3831 gfp_t gfp)
3832{
3833 const struct task_security_struct *old_tsec;
3834 struct task_security_struct *tsec;
3835
3836 old_tsec = old->security;
3837
3838 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3839 if (!tsec)
3840 return -ENOMEM;
3841
3842 new->security = tsec;
3843 return 0;
3844}
3845
3846/*
David Howellsee18d642009-09-02 09:14:21 +01003847 * transfer the SELinux data to a blank set of creds
3848 */
3849static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3850{
3851 const struct task_security_struct *old_tsec = old->security;
3852 struct task_security_struct *tsec = new->security;
3853
3854 *tsec = *old_tsec;
3855}
3856
3857/*
David Howells3a3b7ce2008-11-14 10:39:28 +11003858 * set the security data for a kernel service
3859 * - all the creation contexts are set to unlabelled
3860 */
3861static int selinux_kernel_act_as(struct cred *new, u32 secid)
3862{
3863 struct task_security_struct *tsec = new->security;
3864 u32 sid = current_sid();
3865 int ret;
3866
3867 ret = avc_has_perm(sid, secid,
3868 SECCLASS_KERNEL_SERVICE,
3869 KERNEL_SERVICE__USE_AS_OVERRIDE,
3870 NULL);
3871 if (ret == 0) {
3872 tsec->sid = secid;
3873 tsec->create_sid = 0;
3874 tsec->keycreate_sid = 0;
3875 tsec->sockcreate_sid = 0;
3876 }
3877 return ret;
3878}
3879
3880/*
3881 * set the file creation context in a security record to the same as the
3882 * objective context of the specified inode
3883 */
3884static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3885{
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05003886 struct inode_security_struct *isec = inode_security(inode);
David Howells3a3b7ce2008-11-14 10:39:28 +11003887 struct task_security_struct *tsec = new->security;
3888 u32 sid = current_sid();
3889 int ret;
3890
3891 ret = avc_has_perm(sid, isec->sid,
3892 SECCLASS_KERNEL_SERVICE,
3893 KERNEL_SERVICE__CREATE_FILES_AS,
3894 NULL);
3895
3896 if (ret == 0)
3897 tsec->create_sid = isec->sid;
David Howellsef574712010-02-26 01:56:16 +00003898 return ret;
David Howells3a3b7ce2008-11-14 10:39:28 +11003899}
3900
Eric Parisdd8dbf22009-11-03 16:35:32 +11003901static int selinux_kernel_module_request(char *kmod_name)
Eric Paris25354c42009-08-13 09:45:03 -04003902{
Eric Parisdd8dbf22009-11-03 16:35:32 +11003903 u32 sid;
3904 struct common_audit_data ad;
3905
3906 sid = task_sid(current);
3907
Eric Paris50c205f2012-04-04 15:01:43 -04003908 ad.type = LSM_AUDIT_DATA_KMOD;
Eric Parisdd8dbf22009-11-03 16:35:32 +11003909 ad.u.kmod_name = kmod_name;
3910
3911 return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3912 SYSTEM__MODULE_REQUEST, &ad);
Eric Paris25354c42009-08-13 09:45:03 -04003913}
3914
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003915static int selinux_kernel_module_from_file(struct file *file)
3916{
3917 struct common_audit_data ad;
3918 struct inode_security_struct *isec;
3919 struct file_security_struct *fsec;
3920 u32 sid = current_sid();
3921 int rc;
3922
3923 /* init_module */
3924 if (file == NULL)
3925 return avc_has_perm(sid, sid, SECCLASS_SYSTEM,
3926 SYSTEM__MODULE_LOAD, NULL);
3927
3928 /* finit_module */
Paul Moore20cdef82016-04-04 14:14:42 -04003929
Vivek Goyal43af5de2016-09-09 11:37:49 -04003930 ad.type = LSM_AUDIT_DATA_FILE;
3931 ad.u.file = file;
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003932
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003933 fsec = file->f_security;
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003934 if (sid != fsec->sid) {
3935 rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3936 if (rc)
3937 return rc;
3938 }
3939
Paul Moore20cdef82016-04-04 14:14:42 -04003940 isec = inode_security(file_inode(file));
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003941 return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM,
3942 SYSTEM__MODULE_LOAD, &ad);
3943}
3944
3945static int selinux_kernel_read_file(struct file *file,
3946 enum kernel_read_file_id id)
3947{
3948 int rc = 0;
3949
3950 switch (id) {
3951 case READING_MODULE:
3952 rc = selinux_kernel_module_from_file(file);
3953 break;
3954 default:
3955 break;
3956 }
3957
3958 return rc;
3959}
3960
Linus Torvalds1da177e2005-04-16 15:20:36 -07003961static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3962{
David Howells3b11a1d2008-11-14 10:39:26 +11003963 return current_has_perm(p, PROCESS__SETPGID);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003964}
3965
3966static int selinux_task_getpgid(struct task_struct *p)
3967{
David Howells3b11a1d2008-11-14 10:39:26 +11003968 return current_has_perm(p, PROCESS__GETPGID);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003969}
3970
3971static int selinux_task_getsid(struct task_struct *p)
3972{
David Howells3b11a1d2008-11-14 10:39:26 +11003973 return current_has_perm(p, PROCESS__GETSESSION);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003974}
3975
David Quigleyf9008e4c2006-06-30 01:55:46 -07003976static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3977{
David Howells275bb412008-11-14 10:39:19 +11003978 *secid = task_sid(p);
David Quigleyf9008e4c2006-06-30 01:55:46 -07003979}
3980
Linus Torvalds1da177e2005-04-16 15:20:36 -07003981static int selinux_task_setnice(struct task_struct *p, int nice)
3982{
David Howells3b11a1d2008-11-14 10:39:26 +11003983 return current_has_perm(p, PROCESS__SETSCHED);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003984}
3985
James Morris03e68062006-06-23 02:03:58 -07003986static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3987{
David Howells3b11a1d2008-11-14 10:39:26 +11003988 return current_has_perm(p, PROCESS__SETSCHED);
James Morris03e68062006-06-23 02:03:58 -07003989}
3990
David Quigleya1836a42006-06-30 01:55:49 -07003991static int selinux_task_getioprio(struct task_struct *p)
3992{
David Howells3b11a1d2008-11-14 10:39:26 +11003993 return current_has_perm(p, PROCESS__GETSCHED);
David Quigleya1836a42006-06-30 01:55:49 -07003994}
3995
Jiri Slaby8fd00b42009-08-26 18:41:16 +02003996static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3997 struct rlimit *new_rlim)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003998{
Jiri Slaby8fd00b42009-08-26 18:41:16 +02003999 struct rlimit *old_rlim = p->signal->rlim + resource;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004000
4001 /* Control the ability to change the hard limit (whether
4002 lowering or raising it), so that the hard limit can
4003 later be used as a safe reset point for the soft limit
David Howellsd84f4f92008-11-14 10:39:23 +11004004 upon context transitions. See selinux_bprm_committing_creds. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07004005 if (old_rlim->rlim_max != new_rlim->rlim_max)
Jiri Slaby8fd00b42009-08-26 18:41:16 +02004006 return current_has_perm(p, PROCESS__SETRLIMIT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004007
4008 return 0;
4009}
4010
KOSAKI Motohirob0ae1982010-10-15 04:21:18 +09004011static int selinux_task_setscheduler(struct task_struct *p)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004012{
David Howells3b11a1d2008-11-14 10:39:26 +11004013 return current_has_perm(p, PROCESS__SETSCHED);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004014}
4015
4016static int selinux_task_getscheduler(struct task_struct *p)
4017{
David Howells3b11a1d2008-11-14 10:39:26 +11004018 return current_has_perm(p, PROCESS__GETSCHED);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004019}
4020
David Quigley35601542006-06-23 02:04:01 -07004021static int selinux_task_movememory(struct task_struct *p)
4022{
David Howells3b11a1d2008-11-14 10:39:26 +11004023 return current_has_perm(p, PROCESS__SETSCHED);
David Quigley35601542006-06-23 02:04:01 -07004024}
4025
David Quigleyf9008e4c2006-06-30 01:55:46 -07004026static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
4027 int sig, u32 secid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004028{
4029 u32 perm;
4030 int rc;
4031
Linus Torvalds1da177e2005-04-16 15:20:36 -07004032 if (!sig)
4033 perm = PROCESS__SIGNULL; /* null signal; existence test */
4034 else
4035 perm = signal_to_av(sig);
David Quigleyf9008e4c2006-06-30 01:55:46 -07004036 if (secid)
David Howells275bb412008-11-14 10:39:19 +11004037 rc = avc_has_perm(secid, task_sid(p),
4038 SECCLASS_PROCESS, perm, NULL);
David Quigleyf9008e4c2006-06-30 01:55:46 -07004039 else
David Howells3b11a1d2008-11-14 10:39:26 +11004040 rc = current_has_perm(p, perm);
David Quigleyf9008e4c2006-06-30 01:55:46 -07004041 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004042}
4043
Linus Torvalds1da177e2005-04-16 15:20:36 -07004044static int selinux_task_wait(struct task_struct *p)
4045{
Eric Paris8a535142007-10-22 16:10:31 -04004046 return task_has_perm(p, current, PROCESS__SIGCHLD);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004047}
4048
Linus Torvalds1da177e2005-04-16 15:20:36 -07004049static void selinux_task_to_inode(struct task_struct *p,
4050 struct inode *inode)
4051{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004052 struct inode_security_struct *isec = inode->i_security;
David Howells275bb412008-11-14 10:39:19 +11004053 u32 sid = task_sid(p);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004054
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004055 spin_lock(&isec->lock);
Andreas Gruenbacherdb978da2016-11-10 22:18:28 +01004056 isec->sclass = inode_mode_to_security_class(inode->i_mode);
David Howells275bb412008-11-14 10:39:19 +11004057 isec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05004058 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004059 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004060}
4061
Linus Torvalds1da177e2005-04-16 15:20:36 -07004062/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004063static int selinux_parse_skb_ipv4(struct sk_buff *skb,
Thomas Liu2bf49692009-07-14 12:14:09 -04004064 struct common_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004065{
4066 int offset, ihlen, ret = -EINVAL;
4067 struct iphdr _iph, *ih;
4068
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03004069 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004070 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4071 if (ih == NULL)
4072 goto out;
4073
4074 ihlen = ih->ihl * 4;
4075 if (ihlen < sizeof(_iph))
4076 goto out;
4077
Eric Paris48c62af2012-04-02 13:15:44 -04004078 ad->u.net->v4info.saddr = ih->saddr;
4079 ad->u.net->v4info.daddr = ih->daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004080 ret = 0;
4081
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004082 if (proto)
4083 *proto = ih->protocol;
4084
Linus Torvalds1da177e2005-04-16 15:20:36 -07004085 switch (ih->protocol) {
Eric Paris828dfe12008-04-17 13:17:49 -04004086 case IPPROTO_TCP: {
4087 struct tcphdr _tcph, *th;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004088
Eric Paris828dfe12008-04-17 13:17:49 -04004089 if (ntohs(ih->frag_off) & IP_OFFSET)
4090 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004091
4092 offset += ihlen;
4093 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4094 if (th == NULL)
4095 break;
4096
Eric Paris48c62af2012-04-02 13:15:44 -04004097 ad->u.net->sport = th->source;
4098 ad->u.net->dport = th->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004099 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004100 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004101
Eric Paris828dfe12008-04-17 13:17:49 -04004102 case IPPROTO_UDP: {
4103 struct udphdr _udph, *uh;
4104
4105 if (ntohs(ih->frag_off) & IP_OFFSET)
4106 break;
4107
4108 offset += ihlen;
4109 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4110 if (uh == NULL)
4111 break;
4112
Eric Paris48c62af2012-04-02 13:15:44 -04004113 ad->u.net->sport = uh->source;
4114 ad->u.net->dport = uh->dest;
Eric Paris828dfe12008-04-17 13:17:49 -04004115 break;
4116 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004117
James Morris2ee92d42006-11-13 16:09:01 -08004118 case IPPROTO_DCCP: {
4119 struct dccp_hdr _dccph, *dh;
4120
4121 if (ntohs(ih->frag_off) & IP_OFFSET)
4122 break;
4123
4124 offset += ihlen;
4125 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4126 if (dh == NULL)
4127 break;
4128
Eric Paris48c62af2012-04-02 13:15:44 -04004129 ad->u.net->sport = dh->dccph_sport;
4130 ad->u.net->dport = dh->dccph_dport;
James Morris2ee92d42006-11-13 16:09:01 -08004131 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004132 }
James Morris2ee92d42006-11-13 16:09:01 -08004133
Eric Paris828dfe12008-04-17 13:17:49 -04004134 default:
4135 break;
4136 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004137out:
4138 return ret;
4139}
4140
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04004141#if IS_ENABLED(CONFIG_IPV6)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004142
4143/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004144static int selinux_parse_skb_ipv6(struct sk_buff *skb,
Thomas Liu2bf49692009-07-14 12:14:09 -04004145 struct common_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004146{
4147 u8 nexthdr;
4148 int ret = -EINVAL, offset;
4149 struct ipv6hdr _ipv6h, *ip6;
Jesse Gross75f28112011-11-30 17:05:51 -08004150 __be16 frag_off;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004151
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03004152 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004153 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4154 if (ip6 == NULL)
4155 goto out;
4156
Eric Paris48c62af2012-04-02 13:15:44 -04004157 ad->u.net->v6info.saddr = ip6->saddr;
4158 ad->u.net->v6info.daddr = ip6->daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004159 ret = 0;
4160
4161 nexthdr = ip6->nexthdr;
4162 offset += sizeof(_ipv6h);
Jesse Gross75f28112011-11-30 17:05:51 -08004163 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004164 if (offset < 0)
4165 goto out;
4166
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004167 if (proto)
4168 *proto = nexthdr;
4169
Linus Torvalds1da177e2005-04-16 15:20:36 -07004170 switch (nexthdr) {
4171 case IPPROTO_TCP: {
Eric Paris828dfe12008-04-17 13:17:49 -04004172 struct tcphdr _tcph, *th;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004173
4174 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4175 if (th == NULL)
4176 break;
4177
Eric Paris48c62af2012-04-02 13:15:44 -04004178 ad->u.net->sport = th->source;
4179 ad->u.net->dport = th->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004180 break;
4181 }
4182
4183 case IPPROTO_UDP: {
4184 struct udphdr _udph, *uh;
4185
4186 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4187 if (uh == NULL)
4188 break;
4189
Eric Paris48c62af2012-04-02 13:15:44 -04004190 ad->u.net->sport = uh->source;
4191 ad->u.net->dport = uh->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004192 break;
4193 }
4194
James Morris2ee92d42006-11-13 16:09:01 -08004195 case IPPROTO_DCCP: {
4196 struct dccp_hdr _dccph, *dh;
4197
4198 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4199 if (dh == NULL)
4200 break;
4201
Eric Paris48c62af2012-04-02 13:15:44 -04004202 ad->u.net->sport = dh->dccph_sport;
4203 ad->u.net->dport = dh->dccph_dport;
James Morris2ee92d42006-11-13 16:09:01 -08004204 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004205 }
James Morris2ee92d42006-11-13 16:09:01 -08004206
Linus Torvalds1da177e2005-04-16 15:20:36 -07004207 /* includes fragments */
4208 default:
4209 break;
4210 }
4211out:
4212 return ret;
4213}
4214
4215#endif /* IPV6 */
4216
Thomas Liu2bf49692009-07-14 12:14:09 -04004217static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
David Howellscf9481e2008-07-27 21:31:07 +10004218 char **_addrp, int src, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004219{
David Howellscf9481e2008-07-27 21:31:07 +10004220 char *addrp;
4221 int ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004222
Eric Paris48c62af2012-04-02 13:15:44 -04004223 switch (ad->u.net->family) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07004224 case PF_INET:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004225 ret = selinux_parse_skb_ipv4(skb, ad, proto);
David Howellscf9481e2008-07-27 21:31:07 +10004226 if (ret)
4227 goto parse_error;
Eric Paris48c62af2012-04-02 13:15:44 -04004228 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4229 &ad->u.net->v4info.daddr);
David Howellscf9481e2008-07-27 21:31:07 +10004230 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004231
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04004232#if IS_ENABLED(CONFIG_IPV6)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004233 case PF_INET6:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004234 ret = selinux_parse_skb_ipv6(skb, ad, proto);
David Howellscf9481e2008-07-27 21:31:07 +10004235 if (ret)
4236 goto parse_error;
Eric Paris48c62af2012-04-02 13:15:44 -04004237 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4238 &ad->u.net->v6info.daddr);
David Howellscf9481e2008-07-27 21:31:07 +10004239 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004240#endif /* IPV6 */
4241 default:
David Howellscf9481e2008-07-27 21:31:07 +10004242 addrp = NULL;
4243 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004244 }
4245
David Howellscf9481e2008-07-27 21:31:07 +10004246parse_error:
4247 printk(KERN_WARNING
4248 "SELinux: failure in selinux_parse_skb(),"
4249 " unable to parse packet\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07004250 return ret;
David Howellscf9481e2008-07-27 21:31:07 +10004251
4252okay:
4253 if (_addrp)
4254 *_addrp = addrp;
4255 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004256}
4257
Paul Moore4f6a9932007-03-01 14:35:22 -05004258/**
Paul Moore220deb92008-01-29 08:38:23 -05004259 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
Paul Moore4f6a9932007-03-01 14:35:22 -05004260 * @skb: the packet
Paul Moore75e22912008-01-29 08:38:04 -05004261 * @family: protocol family
Paul Moore220deb92008-01-29 08:38:23 -05004262 * @sid: the packet's peer label SID
Paul Moore4f6a9932007-03-01 14:35:22 -05004263 *
4264 * Description:
Paul Moore220deb92008-01-29 08:38:23 -05004265 * Check the various different forms of network peer labeling and determine
4266 * the peer label/SID for the packet; most of the magic actually occurs in
4267 * the security server function security_net_peersid_cmp(). The function
4268 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4269 * or -EACCES if @sid is invalid due to inconsistencies with the different
4270 * peer labels.
Paul Moore4f6a9932007-03-01 14:35:22 -05004271 *
4272 */
Paul Moore220deb92008-01-29 08:38:23 -05004273static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
Paul Moore4f6a9932007-03-01 14:35:22 -05004274{
Paul Moore71f1cb02008-01-29 08:51:16 -05004275 int err;
Paul Moore4f6a9932007-03-01 14:35:22 -05004276 u32 xfrm_sid;
4277 u32 nlbl_sid;
Paul Moore220deb92008-01-29 08:38:23 -05004278 u32 nlbl_type;
Paul Moore4f6a9932007-03-01 14:35:22 -05004279
Paul Moore817eff72013-12-10 14:57:54 -05004280 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
Paul Moorebed4d7e2013-07-23 17:38:40 -04004281 if (unlikely(err))
4282 return -EACCES;
4283 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4284 if (unlikely(err))
4285 return -EACCES;
Paul Moore220deb92008-01-29 08:38:23 -05004286
Paul Moore71f1cb02008-01-29 08:51:16 -05004287 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
4288 if (unlikely(err)) {
4289 printk(KERN_WARNING
4290 "SELinux: failure in selinux_skb_peerlbl_sid(),"
4291 " unable to determine packet's peer label\n");
Paul Moore220deb92008-01-29 08:38:23 -05004292 return -EACCES;
Paul Moore71f1cb02008-01-29 08:51:16 -05004293 }
Paul Moore220deb92008-01-29 08:38:23 -05004294
4295 return 0;
Paul Moore4f6a9932007-03-01 14:35:22 -05004296}
4297
Paul Moore446b8022013-12-04 16:10:51 -05004298/**
4299 * selinux_conn_sid - Determine the child socket label for a connection
4300 * @sk_sid: the parent socket's SID
4301 * @skb_sid: the packet's SID
4302 * @conn_sid: the resulting connection SID
4303 *
4304 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4305 * combined with the MLS information from @skb_sid in order to create
4306 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
4307 * of @sk_sid. Returns zero on success, negative values on failure.
4308 *
4309 */
4310static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4311{
4312 int err = 0;
4313
4314 if (skb_sid != SECSID_NULL)
4315 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4316 else
4317 *conn_sid = sk_sid;
4318
4319 return err;
4320}
4321
Linus Torvalds1da177e2005-04-16 15:20:36 -07004322/* socket security operations */
Paul Moored4f2d972010-04-22 14:46:18 -04004323
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004324static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4325 u16 secclass, u32 *socksid)
Paul Moored4f2d972010-04-22 14:46:18 -04004326{
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004327 if (tsec->sockcreate_sid > SECSID_NULL) {
4328 *socksid = tsec->sockcreate_sid;
4329 return 0;
4330 }
4331
4332 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4333 socksid);
Paul Moored4f2d972010-04-22 14:46:18 -04004334}
4335
Paul Moore253bfae2010-04-22 14:46:19 -04004336static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004337{
Paul Moore253bfae2010-04-22 14:46:19 -04004338 struct sk_security_struct *sksec = sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004339 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004340 struct lsm_network_audit net = {0,};
Paul Moore253bfae2010-04-22 14:46:19 -04004341 u32 tsid = task_sid(task);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004342
Paul Moore253bfae2010-04-22 14:46:19 -04004343 if (sksec->sid == SECINITSID_KERNEL)
4344 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004345
Eric Paris50c205f2012-04-04 15:01:43 -04004346 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004347 ad.u.net = &net;
4348 ad.u.net->sk = sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004349
Paul Moore253bfae2010-04-22 14:46:19 -04004350 return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004351}
4352
4353static int selinux_socket_create(int family, int type,
4354 int protocol, int kern)
4355{
Paul Moore5fb49872010-04-22 14:46:19 -04004356 const struct task_security_struct *tsec = current_security();
Paul Moored4f2d972010-04-22 14:46:18 -04004357 u32 newsid;
David Howells275bb412008-11-14 10:39:19 +11004358 u16 secclass;
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004359 int rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004360
4361 if (kern)
Paul Moored4f2d972010-04-22 14:46:18 -04004362 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004363
David Howells275bb412008-11-14 10:39:19 +11004364 secclass = socket_type_to_security_class(family, type, protocol);
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004365 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4366 if (rc)
4367 return rc;
4368
Paul Moored4f2d972010-04-22 14:46:18 -04004369 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004370}
4371
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07004372static int selinux_socket_post_create(struct socket *sock, int family,
4373 int type, int protocol, int kern)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004374{
Paul Moore5fb49872010-04-22 14:46:19 -04004375 const struct task_security_struct *tsec = current_security();
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05004376 struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004377 struct sk_security_struct *sksec;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004378 u16 sclass = socket_type_to_security_class(family, type, protocol);
4379 u32 sid = SECINITSID_KERNEL;
David Howells275bb412008-11-14 10:39:19 +11004380 int err = 0;
4381
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004382 if (!kern) {
4383 err = socket_sockcreate_sid(tsec, sclass, &sid);
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004384 if (err)
4385 return err;
4386 }
David Howells275bb412008-11-14 10:39:19 +11004387
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004388 isec->sclass = sclass;
4389 isec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05004390 isec->initialized = LABEL_INITIALIZED;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004391
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004392 if (sock->sk) {
4393 sksec = sock->sk->sk_security;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004394 sksec->sclass = sclass;
4395 sksec->sid = sid;
Paul Moore389fb8002009-03-27 17:10:34 -04004396 err = selinux_netlbl_socket_post_create(sock->sk, family);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004397 }
4398
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07004399 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004400}
4401
4402/* Range of port numbers used to automatically bind.
4403 Need to determine whether we should perform a name_bind
4404 permission check between the socket and the port number. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07004405
4406static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4407{
Paul Moore253bfae2010-04-22 14:46:19 -04004408 struct sock *sk = sock->sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004409 u16 family;
4410 int err;
4411
Paul Moore253bfae2010-04-22 14:46:19 -04004412 err = sock_has_perm(current, sk, SOCKET__BIND);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004413 if (err)
4414 goto out;
4415
4416 /*
4417 * If PF_INET or PF_INET6, check name_bind permission for the port.
James Morris13402582005-09-30 14:24:34 -04004418 * Multiple address binding for SCTP is not supported yet: we just
4419 * check the first address now.
Linus Torvalds1da177e2005-04-16 15:20:36 -07004420 */
Paul Moore253bfae2010-04-22 14:46:19 -04004421 family = sk->sk_family;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004422 if (family == PF_INET || family == PF_INET6) {
4423 char *addrp;
Paul Moore253bfae2010-04-22 14:46:19 -04004424 struct sk_security_struct *sksec = sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004425 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004426 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004427 struct sockaddr_in *addr4 = NULL;
4428 struct sockaddr_in6 *addr6 = NULL;
4429 unsigned short snum;
James Morrise399f982008-06-12 01:39:58 +10004430 u32 sid, node_perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004431
Linus Torvalds1da177e2005-04-16 15:20:36 -07004432 if (family == PF_INET) {
4433 addr4 = (struct sockaddr_in *)address;
4434 snum = ntohs(addr4->sin_port);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004435 addrp = (char *)&addr4->sin_addr.s_addr;
4436 } else {
4437 addr6 = (struct sockaddr_in6 *)address;
4438 snum = ntohs(addr6->sin6_port);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004439 addrp = (char *)&addr6->sin6_addr.s6_addr;
4440 }
4441
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004442 if (snum) {
4443 int low, high;
4444
Eric W. Biederman0bbf87d2013-09-28 14:10:59 -07004445 inet_get_local_port_range(sock_net(sk), &low, &high);
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004446
4447 if (snum < max(PROT_SOCK, low) || snum > high) {
Paul Moore3e1121722008-04-10 10:48:14 -04004448 err = sel_netport_sid(sk->sk_protocol,
4449 snum, &sid);
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004450 if (err)
4451 goto out;
Eric Paris50c205f2012-04-04 15:01:43 -04004452 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004453 ad.u.net = &net;
4454 ad.u.net->sport = htons(snum);
4455 ad.u.net->family = family;
Paul Moore253bfae2010-04-22 14:46:19 -04004456 err = avc_has_perm(sksec->sid, sid,
4457 sksec->sclass,
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004458 SOCKET__NAME_BIND, &ad);
4459 if (err)
4460 goto out;
4461 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004462 }
Eric Paris828dfe12008-04-17 13:17:49 -04004463
Paul Moore253bfae2010-04-22 14:46:19 -04004464 switch (sksec->sclass) {
James Morris13402582005-09-30 14:24:34 -04004465 case SECCLASS_TCP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004466 node_perm = TCP_SOCKET__NODE_BIND;
4467 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004468
James Morris13402582005-09-30 14:24:34 -04004469 case SECCLASS_UDP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004470 node_perm = UDP_SOCKET__NODE_BIND;
4471 break;
James Morris2ee92d42006-11-13 16:09:01 -08004472
4473 case SECCLASS_DCCP_SOCKET:
4474 node_perm = DCCP_SOCKET__NODE_BIND;
4475 break;
4476
Linus Torvalds1da177e2005-04-16 15:20:36 -07004477 default:
4478 node_perm = RAWIP_SOCKET__NODE_BIND;
4479 break;
4480 }
Eric Paris828dfe12008-04-17 13:17:49 -04004481
Paul Moore224dfbd2008-01-29 08:38:13 -05004482 err = sel_netnode_sid(addrp, family, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004483 if (err)
4484 goto out;
Eric Paris828dfe12008-04-17 13:17:49 -04004485
Eric Paris50c205f2012-04-04 15:01:43 -04004486 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004487 ad.u.net = &net;
4488 ad.u.net->sport = htons(snum);
4489 ad.u.net->family = family;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004490
4491 if (family == PF_INET)
Eric Paris48c62af2012-04-02 13:15:44 -04004492 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004493 else
Eric Paris48c62af2012-04-02 13:15:44 -04004494 ad.u.net->v6info.saddr = addr6->sin6_addr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004495
Paul Moore253bfae2010-04-22 14:46:19 -04004496 err = avc_has_perm(sksec->sid, sid,
4497 sksec->sclass, node_perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004498 if (err)
4499 goto out;
4500 }
4501out:
4502 return err;
4503}
4504
4505static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4506{
Paul Moore014ab192008-10-10 10:16:33 -04004507 struct sock *sk = sock->sk;
Paul Moore253bfae2010-04-22 14:46:19 -04004508 struct sk_security_struct *sksec = sk->sk_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004509 int err;
4510
Paul Moore253bfae2010-04-22 14:46:19 -04004511 err = sock_has_perm(current, sk, SOCKET__CONNECT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004512 if (err)
4513 return err;
4514
4515 /*
James Morris2ee92d42006-11-13 16:09:01 -08004516 * If a TCP or DCCP socket, check name_connect permission for the port.
Linus Torvalds1da177e2005-04-16 15:20:36 -07004517 */
Paul Moore253bfae2010-04-22 14:46:19 -04004518 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4519 sksec->sclass == SECCLASS_DCCP_SOCKET) {
Thomas Liu2bf49692009-07-14 12:14:09 -04004520 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004521 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004522 struct sockaddr_in *addr4 = NULL;
4523 struct sockaddr_in6 *addr6 = NULL;
4524 unsigned short snum;
James Morris2ee92d42006-11-13 16:09:01 -08004525 u32 sid, perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004526
4527 if (sk->sk_family == PF_INET) {
4528 addr4 = (struct sockaddr_in *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07004529 if (addrlen < sizeof(struct sockaddr_in))
Linus Torvalds1da177e2005-04-16 15:20:36 -07004530 return -EINVAL;
4531 snum = ntohs(addr4->sin_port);
4532 } else {
4533 addr6 = (struct sockaddr_in6 *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07004534 if (addrlen < SIN6_LEN_RFC2133)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004535 return -EINVAL;
4536 snum = ntohs(addr6->sin6_port);
4537 }
4538
Paul Moore3e1121722008-04-10 10:48:14 -04004539 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004540 if (err)
4541 goto out;
4542
Paul Moore253bfae2010-04-22 14:46:19 -04004543 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
James Morris2ee92d42006-11-13 16:09:01 -08004544 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4545
Eric Paris50c205f2012-04-04 15:01:43 -04004546 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004547 ad.u.net = &net;
4548 ad.u.net->dport = htons(snum);
4549 ad.u.net->family = sk->sk_family;
Paul Moore253bfae2010-04-22 14:46:19 -04004550 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004551 if (err)
4552 goto out;
4553 }
4554
Paul Moore014ab192008-10-10 10:16:33 -04004555 err = selinux_netlbl_socket_connect(sk, address);
4556
Linus Torvalds1da177e2005-04-16 15:20:36 -07004557out:
4558 return err;
4559}
4560
4561static int selinux_socket_listen(struct socket *sock, int backlog)
4562{
Paul Moore253bfae2010-04-22 14:46:19 -04004563 return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004564}
4565
4566static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4567{
4568 int err;
4569 struct inode_security_struct *isec;
4570 struct inode_security_struct *newisec;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004571 u16 sclass;
4572 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004573
Paul Moore253bfae2010-04-22 14:46:19 -04004574 err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004575 if (err)
4576 return err;
4577
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05004578 isec = inode_security_novalidate(SOCK_INODE(sock));
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004579 spin_lock(&isec->lock);
4580 sclass = isec->sclass;
4581 sid = isec->sid;
4582 spin_unlock(&isec->lock);
4583
4584 newisec = inode_security_novalidate(SOCK_INODE(newsock));
4585 newisec->sclass = sclass;
4586 newisec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05004587 newisec->initialized = LABEL_INITIALIZED;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004588
4589 return 0;
4590}
4591
4592static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
Eric Paris828dfe12008-04-17 13:17:49 -04004593 int size)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004594{
Paul Moore253bfae2010-04-22 14:46:19 -04004595 return sock_has_perm(current, sock->sk, SOCKET__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004596}
4597
4598static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4599 int size, int flags)
4600{
Paul Moore253bfae2010-04-22 14:46:19 -04004601 return sock_has_perm(current, sock->sk, SOCKET__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004602}
4603
4604static int selinux_socket_getsockname(struct socket *sock)
4605{
Paul Moore253bfae2010-04-22 14:46:19 -04004606 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004607}
4608
4609static int selinux_socket_getpeername(struct socket *sock)
4610{
Paul Moore253bfae2010-04-22 14:46:19 -04004611 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004612}
4613
Eric Paris828dfe12008-04-17 13:17:49 -04004614static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004615{
Paul Mooref8687af2006-10-30 15:22:15 -08004616 int err;
4617
Paul Moore253bfae2010-04-22 14:46:19 -04004618 err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
Paul Mooref8687af2006-10-30 15:22:15 -08004619 if (err)
4620 return err;
4621
4622 return selinux_netlbl_socket_setsockopt(sock, level, optname);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004623}
4624
4625static int selinux_socket_getsockopt(struct socket *sock, int level,
4626 int optname)
4627{
Paul Moore253bfae2010-04-22 14:46:19 -04004628 return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004629}
4630
4631static int selinux_socket_shutdown(struct socket *sock, int how)
4632{
Paul Moore253bfae2010-04-22 14:46:19 -04004633 return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004634}
4635
David S. Miller3610cda2011-01-05 15:38:53 -08004636static int selinux_socket_unix_stream_connect(struct sock *sock,
4637 struct sock *other,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004638 struct sock *newsk)
4639{
David S. Miller3610cda2011-01-05 15:38:53 -08004640 struct sk_security_struct *sksec_sock = sock->sk_security;
4641 struct sk_security_struct *sksec_other = other->sk_security;
Paul Moore4d1e2452010-04-22 14:46:18 -04004642 struct sk_security_struct *sksec_new = newsk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004643 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004644 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004645 int err;
4646
Eric Paris50c205f2012-04-04 15:01:43 -04004647 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004648 ad.u.net = &net;
4649 ad.u.net->sk = other;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004650
Paul Moore4d1e2452010-04-22 14:46:18 -04004651 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4652 sksec_other->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004653 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4654 if (err)
4655 return err;
4656
Linus Torvalds1da177e2005-04-16 15:20:36 -07004657 /* server child socket */
Paul Moore4d1e2452010-04-22 14:46:18 -04004658 sksec_new->peer_sid = sksec_sock->sid;
4659 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4660 &sksec_new->sid);
4661 if (err)
4662 return err;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004663
Paul Moore4d1e2452010-04-22 14:46:18 -04004664 /* connecting socket */
4665 sksec_sock->peer_sid = sksec_new->sid;
4666
4667 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004668}
4669
4670static int selinux_socket_unix_may_send(struct socket *sock,
4671 struct socket *other)
4672{
Paul Moore253bfae2010-04-22 14:46:19 -04004673 struct sk_security_struct *ssec = sock->sk->sk_security;
4674 struct sk_security_struct *osec = other->sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004675 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004676 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004677
Eric Paris50c205f2012-04-04 15:01:43 -04004678 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004679 ad.u.net = &net;
4680 ad.u.net->sk = other->sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004681
Paul Moore253bfae2010-04-22 14:46:19 -04004682 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4683 &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004684}
4685
Paul Moorecbe0d6e2014-09-10 17:09:57 -04004686static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4687 char *addrp, u16 family, u32 peer_sid,
Thomas Liu2bf49692009-07-14 12:14:09 -04004688 struct common_audit_data *ad)
Paul Mooreeffad8d2008-01-29 08:49:27 -05004689{
4690 int err;
4691 u32 if_sid;
4692 u32 node_sid;
4693
Paul Moorecbe0d6e2014-09-10 17:09:57 -04004694 err = sel_netif_sid(ns, ifindex, &if_sid);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004695 if (err)
4696 return err;
4697 err = avc_has_perm(peer_sid, if_sid,
4698 SECCLASS_NETIF, NETIF__INGRESS, ad);
4699 if (err)
4700 return err;
4701
4702 err = sel_netnode_sid(addrp, family, &node_sid);
4703 if (err)
4704 return err;
4705 return avc_has_perm(peer_sid, node_sid,
4706 SECCLASS_NODE, NODE__RECVFROM, ad);
4707}
4708
Paul Moore220deb92008-01-29 08:38:23 -05004709static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
Paul Moored8395c82008-10-10 10:16:30 -04004710 u16 family)
Paul Moore220deb92008-01-29 08:38:23 -05004711{
Paul Moore277d3422008-12-31 12:54:11 -05004712 int err = 0;
Paul Moore220deb92008-01-29 08:38:23 -05004713 struct sk_security_struct *sksec = sk->sk_security;
Paul Moore220deb92008-01-29 08:38:23 -05004714 u32 sk_sid = sksec->sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04004715 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004716 struct lsm_network_audit net = {0,};
Paul Moored8395c82008-10-10 10:16:30 -04004717 char *addrp;
4718
Eric Paris50c205f2012-04-04 15:01:43 -04004719 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004720 ad.u.net = &net;
4721 ad.u.net->netif = skb->skb_iif;
4722 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04004723 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4724 if (err)
4725 return err;
Paul Moore220deb92008-01-29 08:38:23 -05004726
Paul Moore58bfbb52009-03-27 17:10:41 -04004727 if (selinux_secmark_enabled()) {
Paul Moore220deb92008-01-29 08:38:23 -05004728 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
Paul Moored8395c82008-10-10 10:16:30 -04004729 PACKET__RECV, &ad);
Paul Moore58bfbb52009-03-27 17:10:41 -04004730 if (err)
4731 return err;
4732 }
Paul Moore220deb92008-01-29 08:38:23 -05004733
Steffen Klassertb9679a72011-02-23 12:55:21 +01004734 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4735 if (err)
4736 return err;
4737 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004738
James Morris4e5ab4c2006-06-09 00:33:33 -07004739 return err;
4740}
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004741
James Morris4e5ab4c2006-06-09 00:33:33 -07004742static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4743{
Paul Moore220deb92008-01-29 08:38:23 -05004744 int err;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004745 struct sk_security_struct *sksec = sk->sk_security;
Paul Moore220deb92008-01-29 08:38:23 -05004746 u16 family = sk->sk_family;
4747 u32 sk_sid = sksec->sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04004748 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004749 struct lsm_network_audit net = {0,};
Paul Moore220deb92008-01-29 08:38:23 -05004750 char *addrp;
Paul Moored8395c82008-10-10 10:16:30 -04004751 u8 secmark_active;
4752 u8 peerlbl_active;
James Morris4e5ab4c2006-06-09 00:33:33 -07004753
James Morris4e5ab4c2006-06-09 00:33:33 -07004754 if (family != PF_INET && family != PF_INET6)
Paul Moore220deb92008-01-29 08:38:23 -05004755 return 0;
James Morris4e5ab4c2006-06-09 00:33:33 -07004756
4757 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
Al Viro87fcd702006-12-04 22:00:55 +00004758 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
James Morris4e5ab4c2006-06-09 00:33:33 -07004759 family = PF_INET;
4760
Paul Moored8395c82008-10-10 10:16:30 -04004761 /* If any sort of compatibility mode is enabled then handoff processing
4762 * to the selinux_sock_rcv_skb_compat() function to deal with the
4763 * special handling. We do this in an attempt to keep this function
4764 * as fast and as clean as possible. */
Paul Moore58bfbb52009-03-27 17:10:41 -04004765 if (!selinux_policycap_netpeer)
Paul Moored8395c82008-10-10 10:16:30 -04004766 return selinux_sock_rcv_skb_compat(sk, skb, family);
4767
4768 secmark_active = selinux_secmark_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04004769 peerlbl_active = selinux_peerlbl_enabled();
Paul Moored8395c82008-10-10 10:16:30 -04004770 if (!secmark_active && !peerlbl_active)
4771 return 0;
4772
Eric Paris50c205f2012-04-04 15:01:43 -04004773 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004774 ad.u.net = &net;
4775 ad.u.net->netif = skb->skb_iif;
4776 ad.u.net->family = family;
Paul Moore224dfbd2008-01-29 08:38:13 -05004777 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
James Morris4e5ab4c2006-06-09 00:33:33 -07004778 if (err)
Paul Moore220deb92008-01-29 08:38:23 -05004779 return err;
James Morris4e5ab4c2006-06-09 00:33:33 -07004780
Paul Moored8395c82008-10-10 10:16:30 -04004781 if (peerlbl_active) {
Paul Moored621d352008-01-29 08:43:36 -05004782 u32 peer_sid;
4783
4784 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4785 if (err)
4786 return err;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04004787 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4788 addrp, family, peer_sid, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04004789 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04004790 selinux_netlbl_err(skb, family, err, 0);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004791 return err;
Paul Mooredfaebe92008-10-10 10:16:31 -04004792 }
Paul Moored621d352008-01-29 08:43:36 -05004793 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4794 PEER__RECV, &ad);
Chad Hanson46d01d62013-12-23 17:45:01 -05004795 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04004796 selinux_netlbl_err(skb, family, err, 0);
Chad Hanson46d01d62013-12-23 17:45:01 -05004797 return err;
4798 }
Paul Moored621d352008-01-29 08:43:36 -05004799 }
4800
Paul Moored8395c82008-10-10 10:16:30 -04004801 if (secmark_active) {
Paul Mooreeffad8d2008-01-29 08:49:27 -05004802 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4803 PACKET__RECV, &ad);
4804 if (err)
4805 return err;
4806 }
4807
Paul Moored621d352008-01-29 08:43:36 -05004808 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004809}
4810
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004811static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4812 int __user *optlen, unsigned len)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004813{
4814 int err = 0;
4815 char *scontext;
4816 u32 scontext_len;
Paul Moore253bfae2010-04-22 14:46:19 -04004817 struct sk_security_struct *sksec = sock->sk->sk_security;
Paul Moore3de4bab2006-11-17 17:38:54 -05004818 u32 peer_sid = SECSID_NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004819
Paul Moore253bfae2010-04-22 14:46:19 -04004820 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4821 sksec->sclass == SECCLASS_TCP_SOCKET)
Eric Parisdd3e7832010-04-07 15:08:46 -04004822 peer_sid = sksec->peer_sid;
Paul Moore253bfae2010-04-22 14:46:19 -04004823 if (peer_sid == SECSID_NULL)
4824 return -ENOPROTOOPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004825
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004826 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004827 if (err)
Paul Moore253bfae2010-04-22 14:46:19 -04004828 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004829
4830 if (scontext_len > len) {
4831 err = -ERANGE;
4832 goto out_len;
4833 }
4834
4835 if (copy_to_user(optval, scontext, scontext_len))
4836 err = -EFAULT;
4837
4838out_len:
4839 if (put_user(scontext_len, optlen))
4840 err = -EFAULT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004841 kfree(scontext);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004842 return err;
4843}
4844
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07004845static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004846{
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07004847 u32 peer_secid = SECSID_NULL;
Paul Moore75e22912008-01-29 08:38:04 -05004848 u16 family;
Paul Moore899134f2016-03-28 15:19:10 -04004849 struct inode_security_struct *isec;
Catherine Zhang877ce7c2006-06-29 12:27:47 -07004850
Paul Mooreaa862902008-10-10 10:16:29 -04004851 if (skb && skb->protocol == htons(ETH_P_IP))
4852 family = PF_INET;
4853 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4854 family = PF_INET6;
4855 else if (sock)
Paul Moore75e22912008-01-29 08:38:04 -05004856 family = sock->sk->sk_family;
Paul Moore75e22912008-01-29 08:38:04 -05004857 else
4858 goto out;
4859
Paul Moore899134f2016-03-28 15:19:10 -04004860 if (sock && family == PF_UNIX) {
4861 isec = inode_security_novalidate(SOCK_INODE(sock));
4862 peer_secid = isec->sid;
4863 } else if (skb)
Paul Moore220deb92008-01-29 08:38:23 -05004864 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004865
Paul Moore75e22912008-01-29 08:38:04 -05004866out:
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07004867 *secid = peer_secid;
Paul Moore75e22912008-01-29 08:38:04 -05004868 if (peer_secid == SECSID_NULL)
4869 return -EINVAL;
4870 return 0;
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004871}
4872
Al Viro7d877f32005-10-21 03:20:43 -04004873static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004874{
Paul Moore84914b72010-04-22 14:46:18 -04004875 struct sk_security_struct *sksec;
4876
4877 sksec = kzalloc(sizeof(*sksec), priority);
4878 if (!sksec)
4879 return -ENOMEM;
4880
4881 sksec->peer_sid = SECINITSID_UNLABELED;
4882 sksec->sid = SECINITSID_UNLABELED;
Stephen Smalley5dee25d2015-07-10 17:19:57 -04004883 sksec->sclass = SECCLASS_SOCKET;
Paul Moore84914b72010-04-22 14:46:18 -04004884 selinux_netlbl_sk_security_reset(sksec);
4885 sk->sk_security = sksec;
4886
4887 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004888}
4889
4890static void selinux_sk_free_security(struct sock *sk)
4891{
Paul Moore84914b72010-04-22 14:46:18 -04004892 struct sk_security_struct *sksec = sk->sk_security;
4893
4894 sk->sk_security = NULL;
4895 selinux_netlbl_sk_security_free(sksec);
4896 kfree(sksec);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004897}
4898
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004899static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4900{
Eric Parisdd3e7832010-04-07 15:08:46 -04004901 struct sk_security_struct *sksec = sk->sk_security;
4902 struct sk_security_struct *newsksec = newsk->sk_security;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004903
Eric Parisdd3e7832010-04-07 15:08:46 -04004904 newsksec->sid = sksec->sid;
4905 newsksec->peer_sid = sksec->peer_sid;
4906 newsksec->sclass = sksec->sclass;
Paul Moore99f59ed2006-08-29 17:53:48 -07004907
Eric Parisdd3e7832010-04-07 15:08:46 -04004908 selinux_netlbl_sk_security_reset(newsksec);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004909}
4910
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07004911static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004912{
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004913 if (!sk)
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07004914 *secid = SECINITSID_ANY_SOCKET;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004915 else {
4916 struct sk_security_struct *sksec = sk->sk_security;
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004917
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07004918 *secid = sksec->sid;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004919 }
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004920}
4921
Eric Paris828dfe12008-04-17 13:17:49 -04004922static void selinux_sock_graft(struct sock *sk, struct socket *parent)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004923{
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05004924 struct inode_security_struct *isec =
4925 inode_security_novalidate(SOCK_INODE(parent));
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004926 struct sk_security_struct *sksec = sk->sk_security;
4927
Paul Moore2873ead2014-07-28 10:42:48 -04004928 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4929 sk->sk_family == PF_UNIX)
David Woodhouse2148ccc2006-09-29 15:50:25 -07004930 isec->sid = sksec->sid;
Paul Moore220deb92008-01-29 08:38:23 -05004931 sksec->sclass = isec->sclass;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004932}
4933
Adrian Bunk9a673e52006-08-15 00:03:53 -07004934static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4935 struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004936{
4937 struct sk_security_struct *sksec = sk->sk_security;
4938 int err;
Paul Moore0b1f24e2013-12-03 11:39:13 -05004939 u16 family = req->rsk_ops->family;
Paul Moore446b8022013-12-04 16:10:51 -05004940 u32 connsid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004941 u32 peersid;
4942
Paul Mooreaa862902008-10-10 10:16:29 -04004943 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
Paul Moore220deb92008-01-29 08:38:23 -05004944 if (err)
4945 return err;
Paul Moore446b8022013-12-04 16:10:51 -05004946 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4947 if (err)
4948 return err;
4949 req->secid = connsid;
4950 req->peer_secid = peersid;
Venkat Yekkiralaa51c64f2006-07-27 22:01:34 -07004951
Paul Moore389fb8002009-03-27 17:10:34 -04004952 return selinux_netlbl_inet_conn_request(req, family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004953}
4954
Adrian Bunk9a673e52006-08-15 00:03:53 -07004955static void selinux_inet_csk_clone(struct sock *newsk,
4956 const struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004957{
4958 struct sk_security_struct *newsksec = newsk->sk_security;
4959
4960 newsksec->sid = req->secid;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004961 newsksec->peer_sid = req->peer_secid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004962 /* NOTE: Ideally, we should also get the isec->sid for the
4963 new socket in sync, but we don't have the isec available yet.
4964 So we will wait until sock_graft to do it, by which
4965 time it will have been created and available. */
Paul Moore99f59ed2006-08-29 17:53:48 -07004966
Paul Moore9f2ad662006-11-17 17:38:53 -05004967 /* We don't need to take any sort of lock here as we are the only
4968 * thread with access to newsksec */
Paul Moore389fb8002009-03-27 17:10:34 -04004969 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004970}
4971
Paul Moore014ab192008-10-10 10:16:33 -04004972static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004973{
Paul Mooreaa862902008-10-10 10:16:29 -04004974 u16 family = sk->sk_family;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004975 struct sk_security_struct *sksec = sk->sk_security;
4976
Paul Mooreaa862902008-10-10 10:16:29 -04004977 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4978 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4979 family = PF_INET;
4980
4981 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004982}
4983
Eric Paris2606fd12010-10-13 16:24:41 -04004984static int selinux_secmark_relabel_packet(u32 sid)
4985{
4986 const struct task_security_struct *__tsec;
4987 u32 tsid;
4988
4989 __tsec = current_security();
4990 tsid = __tsec->sid;
4991
4992 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4993}
4994
4995static void selinux_secmark_refcount_inc(void)
4996{
4997 atomic_inc(&selinux_secmark_refcount);
4998}
4999
5000static void selinux_secmark_refcount_dec(void)
5001{
5002 atomic_dec(&selinux_secmark_refcount);
5003}
5004
Adrian Bunk9a673e52006-08-15 00:03:53 -07005005static void selinux_req_classify_flow(const struct request_sock *req,
5006 struct flowi *fl)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005007{
David S. Miller1d28f422011-03-12 00:29:39 -05005008 fl->flowi_secid = req->secid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005009}
5010
Paul Moore5dbbaf22013-01-14 07:12:19 +00005011static int selinux_tun_dev_alloc_security(void **security)
5012{
5013 struct tun_security_struct *tunsec;
5014
5015 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5016 if (!tunsec)
5017 return -ENOMEM;
5018 tunsec->sid = current_sid();
5019
5020 *security = tunsec;
5021 return 0;
5022}
5023
5024static void selinux_tun_dev_free_security(void *security)
5025{
5026 kfree(security);
5027}
5028
Paul Mooreed6d76e2009-08-28 18:12:49 -04005029static int selinux_tun_dev_create(void)
5030{
5031 u32 sid = current_sid();
5032
5033 /* we aren't taking into account the "sockcreate" SID since the socket
5034 * that is being created here is not a socket in the traditional sense,
5035 * instead it is a private sock, accessible only to the kernel, and
5036 * representing a wide range of network traffic spanning multiple
5037 * connections unlike traditional sockets - check the TUN driver to
5038 * get a better understanding of why this socket is special */
5039
5040 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5041 NULL);
5042}
5043
Paul Moore5dbbaf22013-01-14 07:12:19 +00005044static int selinux_tun_dev_attach_queue(void *security)
Paul Mooreed6d76e2009-08-28 18:12:49 -04005045{
Paul Moore5dbbaf22013-01-14 07:12:19 +00005046 struct tun_security_struct *tunsec = security;
5047
5048 return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5049 TUN_SOCKET__ATTACH_QUEUE, NULL);
5050}
5051
5052static int selinux_tun_dev_attach(struct sock *sk, void *security)
5053{
5054 struct tun_security_struct *tunsec = security;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005055 struct sk_security_struct *sksec = sk->sk_security;
5056
5057 /* we don't currently perform any NetLabel based labeling here and it
5058 * isn't clear that we would want to do so anyway; while we could apply
5059 * labeling without the support of the TUN user the resulting labeled
5060 * traffic from the other end of the connection would almost certainly
5061 * cause confusion to the TUN user that had no idea network labeling
5062 * protocols were being used */
5063
Paul Moore5dbbaf22013-01-14 07:12:19 +00005064 sksec->sid = tunsec->sid;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005065 sksec->sclass = SECCLASS_TUN_SOCKET;
Paul Moore5dbbaf22013-01-14 07:12:19 +00005066
5067 return 0;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005068}
5069
Paul Moore5dbbaf22013-01-14 07:12:19 +00005070static int selinux_tun_dev_open(void *security)
Paul Mooreed6d76e2009-08-28 18:12:49 -04005071{
Paul Moore5dbbaf22013-01-14 07:12:19 +00005072 struct tun_security_struct *tunsec = security;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005073 u32 sid = current_sid();
5074 int err;
5075
Paul Moore5dbbaf22013-01-14 07:12:19 +00005076 err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
Paul Mooreed6d76e2009-08-28 18:12:49 -04005077 TUN_SOCKET__RELABELFROM, NULL);
5078 if (err)
5079 return err;
5080 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
5081 TUN_SOCKET__RELABELTO, NULL);
5082 if (err)
5083 return err;
Paul Moore5dbbaf22013-01-14 07:12:19 +00005084 tunsec->sid = sid;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005085
5086 return 0;
5087}
5088
Linus Torvalds1da177e2005-04-16 15:20:36 -07005089static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5090{
5091 int err = 0;
5092 u32 perm;
5093 struct nlmsghdr *nlh;
Paul Moore253bfae2010-04-22 14:46:19 -04005094 struct sk_security_struct *sksec = sk->sk_security;
Eric Paris828dfe12008-04-17 13:17:49 -04005095
Hong zhi guo77954982013-03-27 06:49:35 +00005096 if (skb->len < NLMSG_HDRLEN) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005097 err = -EINVAL;
5098 goto out;
5099 }
Arnaldo Carvalho de Melob529ccf2007-04-25 19:08:35 -07005100 nlh = nlmsg_hdr(skb);
Eric Paris828dfe12008-04-17 13:17:49 -04005101
Paul Moore253bfae2010-04-22 14:46:19 -04005102 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005103 if (err) {
5104 if (err == -EINVAL) {
Vladis Dronov76319942015-12-24 11:09:41 -05005105 pr_warn_ratelimited("SELinux: unrecognized netlink"
5106 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5107 " pig=%d comm=%s\n",
Marek Milkoviccded3ff2015-06-04 16:22:16 -04005108 sk->sk_protocol, nlh->nlmsg_type,
Vladis Dronov76319942015-12-24 11:09:41 -05005109 secclass_map[sksec->sclass - 1].name,
5110 task_pid_nr(current), current->comm);
Eric Paris39c9aed2008-11-05 09:34:42 -05005111 if (!selinux_enforcing || security_get_allow_unknown())
Linus Torvalds1da177e2005-04-16 15:20:36 -07005112 err = 0;
5113 }
5114
5115 /* Ignore */
5116 if (err == -ENOENT)
5117 err = 0;
5118 goto out;
5119 }
5120
Paul Moore253bfae2010-04-22 14:46:19 -04005121 err = sock_has_perm(current, sk, perm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005122out:
5123 return err;
5124}
5125
5126#ifdef CONFIG_NETFILTER
5127
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005128static unsigned int selinux_ip_forward(struct sk_buff *skb,
5129 const struct net_device *indev,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005130 u16 family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005131{
Paul Mooredfaebe92008-10-10 10:16:31 -04005132 int err;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005133 char *addrp;
5134 u32 peer_sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04005135 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005136 struct lsm_network_audit net = {0,};
Paul Mooreeffad8d2008-01-29 08:49:27 -05005137 u8 secmark_active;
Paul Moore948bf852008-10-10 10:16:32 -04005138 u8 netlbl_active;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005139 u8 peerlbl_active;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005140
Paul Mooreeffad8d2008-01-29 08:49:27 -05005141 if (!selinux_policycap_netpeer)
5142 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005143
Paul Mooreeffad8d2008-01-29 08:49:27 -05005144 secmark_active = selinux_secmark_enabled();
Paul Moore948bf852008-10-10 10:16:32 -04005145 netlbl_active = netlbl_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04005146 peerlbl_active = selinux_peerlbl_enabled();
Paul Mooreeffad8d2008-01-29 08:49:27 -05005147 if (!secmark_active && !peerlbl_active)
5148 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005149
Paul Moored8395c82008-10-10 10:16:30 -04005150 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5151 return NF_DROP;
5152
Eric Paris50c205f2012-04-04 15:01:43 -04005153 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005154 ad.u.net = &net;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005155 ad.u.net->netif = indev->ifindex;
Eric Paris48c62af2012-04-02 13:15:44 -04005156 ad.u.net->family = family;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005157 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5158 return NF_DROP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005159
Paul Mooredfaebe92008-10-10 10:16:31 -04005160 if (peerlbl_active) {
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005161 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5162 addrp, family, peer_sid, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04005163 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04005164 selinux_netlbl_err(skb, family, err, 1);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005165 return NF_DROP;
Paul Mooredfaebe92008-10-10 10:16:31 -04005166 }
5167 }
Paul Mooreeffad8d2008-01-29 08:49:27 -05005168
5169 if (secmark_active)
5170 if (avc_has_perm(peer_sid, skb->secmark,
5171 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5172 return NF_DROP;
5173
Paul Moore948bf852008-10-10 10:16:32 -04005174 if (netlbl_active)
5175 /* we do this in the FORWARD path and not the POST_ROUTING
5176 * path because we want to make sure we apply the necessary
5177 * labeling before IPsec is applied so we can leverage AH
5178 * protection */
5179 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5180 return NF_DROP;
5181
Paul Mooreeffad8d2008-01-29 08:49:27 -05005182 return NF_ACCEPT;
5183}
5184
Eric W. Biederman06198b32015-09-18 14:33:06 -05005185static unsigned int selinux_ipv4_forward(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005186 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005187 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005188{
David S. Miller238e54c2015-04-03 20:32:56 -04005189 return selinux_ip_forward(skb, state->in, PF_INET);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005190}
5191
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005192#if IS_ENABLED(CONFIG_IPV6)
Eric W. Biederman06198b32015-09-18 14:33:06 -05005193static unsigned int selinux_ipv6_forward(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005194 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005195 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005196{
David S. Miller238e54c2015-04-03 20:32:56 -04005197 return selinux_ip_forward(skb, state->in, PF_INET6);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005198}
5199#endif /* IPV6 */
5200
Paul Moore948bf852008-10-10 10:16:32 -04005201static unsigned int selinux_ip_output(struct sk_buff *skb,
5202 u16 family)
5203{
Paul Moore47180062013-12-04 16:10:45 -05005204 struct sock *sk;
Paul Moore948bf852008-10-10 10:16:32 -04005205 u32 sid;
5206
5207 if (!netlbl_enabled())
5208 return NF_ACCEPT;
5209
5210 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5211 * because we want to make sure we apply the necessary labeling
5212 * before IPsec is applied so we can leverage AH protection */
Paul Moore47180062013-12-04 16:10:45 -05005213 sk = skb->sk;
5214 if (sk) {
5215 struct sk_security_struct *sksec;
5216
Eric Dumazete446f9d2015-10-08 05:01:55 -07005217 if (sk_listener(sk))
Paul Moore47180062013-12-04 16:10:45 -05005218 /* if the socket is the listening state then this
5219 * packet is a SYN-ACK packet which means it needs to
5220 * be labeled based on the connection/request_sock and
5221 * not the parent socket. unfortunately, we can't
5222 * lookup the request_sock yet as it isn't queued on
5223 * the parent socket until after the SYN-ACK is sent.
5224 * the "solution" is to simply pass the packet as-is
5225 * as any IP option based labeling should be copied
5226 * from the initial connection request (in the IP
5227 * layer). it is far from ideal, but until we get a
5228 * security label in the packet itself this is the
5229 * best we can do. */
5230 return NF_ACCEPT;
5231
5232 /* standard practice, label using the parent socket */
5233 sksec = sk->sk_security;
Paul Moore948bf852008-10-10 10:16:32 -04005234 sid = sksec->sid;
5235 } else
5236 sid = SECINITSID_KERNEL;
5237 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5238 return NF_DROP;
5239
5240 return NF_ACCEPT;
5241}
5242
Eric W. Biederman06198b32015-09-18 14:33:06 -05005243static unsigned int selinux_ipv4_output(void *priv,
Paul Moore948bf852008-10-10 10:16:32 -04005244 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005245 const struct nf_hook_state *state)
Paul Moore948bf852008-10-10 10:16:32 -04005246{
5247 return selinux_ip_output(skb, PF_INET);
5248}
5249
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005250#if IS_ENABLED(CONFIG_IPV6)
Huw Davies2917f572016-06-27 15:06:15 -04005251static unsigned int selinux_ipv6_output(void *priv,
5252 struct sk_buff *skb,
5253 const struct nf_hook_state *state)
5254{
5255 return selinux_ip_output(skb, PF_INET6);
5256}
5257#endif /* IPV6 */
5258
Paul Mooreeffad8d2008-01-29 08:49:27 -05005259static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5260 int ifindex,
Paul Moored8395c82008-10-10 10:16:30 -04005261 u16 family)
James Morris4e5ab4c2006-06-09 00:33:33 -07005262{
Eric Dumazet54abc682015-11-08 10:54:07 -08005263 struct sock *sk = skb_to_full_sk(skb);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005264 struct sk_security_struct *sksec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005265 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005266 struct lsm_network_audit net = {0,};
Paul Moored8395c82008-10-10 10:16:30 -04005267 char *addrp;
5268 u8 proto;
James Morris4e5ab4c2006-06-09 00:33:33 -07005269
Paul Mooreeffad8d2008-01-29 08:49:27 -05005270 if (sk == NULL)
5271 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005272 sksec = sk->sk_security;
James Morris4e5ab4c2006-06-09 00:33:33 -07005273
Eric Paris50c205f2012-04-04 15:01:43 -04005274 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005275 ad.u.net = &net;
5276 ad.u.net->netif = ifindex;
5277 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04005278 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5279 return NF_DROP;
5280
Paul Moore58bfbb52009-03-27 17:10:41 -04005281 if (selinux_secmark_enabled())
Paul Mooreeffad8d2008-01-29 08:49:27 -05005282 if (avc_has_perm(sksec->sid, skb->secmark,
Paul Moored8395c82008-10-10 10:16:30 -04005283 SECCLASS_PACKET, PACKET__SEND, &ad))
Eric Paris2fe66ec2010-11-23 06:28:08 +00005284 return NF_DROP_ERR(-ECONNREFUSED);
James Morris4e5ab4c2006-06-09 00:33:33 -07005285
Steffen Klassertb9679a72011-02-23 12:55:21 +01005286 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5287 return NF_DROP_ERR(-ECONNREFUSED);
James Morris4e5ab4c2006-06-09 00:33:33 -07005288
Paul Mooreeffad8d2008-01-29 08:49:27 -05005289 return NF_ACCEPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005290}
5291
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005292static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5293 const struct net_device *outdev,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005294 u16 family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005295{
Paul Mooreeffad8d2008-01-29 08:49:27 -05005296 u32 secmark_perm;
5297 u32 peer_sid;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005298 int ifindex = outdev->ifindex;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005299 struct sock *sk;
Thomas Liu2bf49692009-07-14 12:14:09 -04005300 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005301 struct lsm_network_audit net = {0,};
Paul Mooreeffad8d2008-01-29 08:49:27 -05005302 char *addrp;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005303 u8 secmark_active;
5304 u8 peerlbl_active;
5305
Paul Mooreeffad8d2008-01-29 08:49:27 -05005306 /* If any sort of compatibility mode is enabled then handoff processing
5307 * to the selinux_ip_postroute_compat() function to deal with the
5308 * special handling. We do this in an attempt to keep this function
5309 * as fast and as clean as possible. */
Paul Moore58bfbb52009-03-27 17:10:41 -04005310 if (!selinux_policycap_netpeer)
Paul Moored8395c82008-10-10 10:16:30 -04005311 return selinux_ip_postroute_compat(skb, ifindex, family);
Paul Moorec0828e52013-12-10 14:58:01 -05005312
Paul Mooreeffad8d2008-01-29 08:49:27 -05005313 secmark_active = selinux_secmark_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04005314 peerlbl_active = selinux_peerlbl_enabled();
Paul Mooreeffad8d2008-01-29 08:49:27 -05005315 if (!secmark_active && !peerlbl_active)
5316 return NF_ACCEPT;
5317
Eric Dumazet54abc682015-11-08 10:54:07 -08005318 sk = skb_to_full_sk(skb);
Paul Moorec0828e52013-12-10 14:58:01 -05005319
Paul Mooreeffad8d2008-01-29 08:49:27 -05005320#ifdef CONFIG_XFRM
5321 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5322 * packet transformation so allow the packet to pass without any checks
5323 * since we'll have another chance to perform access control checks
5324 * when the packet is on it's final way out.
5325 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
Paul Moorec0828e52013-12-10 14:58:01 -05005326 * is NULL, in this case go ahead and apply access control.
5327 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5328 * TCP listening state we cannot wait until the XFRM processing
5329 * is done as we will miss out on the SA label if we do;
5330 * unfortunately, this means more work, but it is only once per
5331 * connection. */
5332 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
Eric Dumazete446f9d2015-10-08 05:01:55 -07005333 !(sk && sk_listener(sk)))
Paul Mooreeffad8d2008-01-29 08:49:27 -05005334 return NF_ACCEPT;
5335#endif
Paul Mooreeffad8d2008-01-29 08:49:27 -05005336
Paul Moored8395c82008-10-10 10:16:30 -04005337 if (sk == NULL) {
Paul Moore446b8022013-12-04 16:10:51 -05005338 /* Without an associated socket the packet is either coming
5339 * from the kernel or it is being forwarded; check the packet
5340 * to determine which and if the packet is being forwarded
5341 * query the packet directly to determine the security label. */
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005342 if (skb->skb_iif) {
5343 secmark_perm = PACKET__FORWARD_OUT;
Paul Moored8395c82008-10-10 10:16:30 -04005344 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005345 return NF_DROP;
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005346 } else {
5347 secmark_perm = PACKET__SEND;
Paul Moored8395c82008-10-10 10:16:30 -04005348 peer_sid = SECINITSID_KERNEL;
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005349 }
Eric Dumazete446f9d2015-10-08 05:01:55 -07005350 } else if (sk_listener(sk)) {
Paul Moore446b8022013-12-04 16:10:51 -05005351 /* Locally generated packet but the associated socket is in the
5352 * listening state which means this is a SYN-ACK packet. In
5353 * this particular case the correct security label is assigned
5354 * to the connection/request_sock but unfortunately we can't
5355 * query the request_sock as it isn't queued on the parent
5356 * socket until after the SYN-ACK packet is sent; the only
5357 * viable choice is to regenerate the label like we do in
5358 * selinux_inet_conn_request(). See also selinux_ip_output()
5359 * for similar problems. */
5360 u32 skb_sid;
Eric Dumazete446f9d2015-10-08 05:01:55 -07005361 struct sk_security_struct *sksec;
5362
Eric Dumazete446f9d2015-10-08 05:01:55 -07005363 sksec = sk->sk_security;
Paul Moore446b8022013-12-04 16:10:51 -05005364 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5365 return NF_DROP;
Paul Moorec0828e52013-12-10 14:58:01 -05005366 /* At this point, if the returned skb peerlbl is SECSID_NULL
5367 * and the packet has been through at least one XFRM
5368 * transformation then we must be dealing with the "final"
5369 * form of labeled IPsec packet; since we've already applied
5370 * all of our access controls on this packet we can safely
5371 * pass the packet. */
5372 if (skb_sid == SECSID_NULL) {
5373 switch (family) {
5374 case PF_INET:
5375 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5376 return NF_ACCEPT;
5377 break;
5378 case PF_INET6:
5379 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5380 return NF_ACCEPT;
Paul Moorea7a91a12014-09-03 10:51:59 -04005381 break;
Paul Moorec0828e52013-12-10 14:58:01 -05005382 default:
5383 return NF_DROP_ERR(-ECONNREFUSED);
5384 }
5385 }
Paul Moore446b8022013-12-04 16:10:51 -05005386 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5387 return NF_DROP;
5388 secmark_perm = PACKET__SEND;
Paul Moored8395c82008-10-10 10:16:30 -04005389 } else {
Paul Moore446b8022013-12-04 16:10:51 -05005390 /* Locally generated packet, fetch the security label from the
5391 * associated socket. */
Paul Mooreeffad8d2008-01-29 08:49:27 -05005392 struct sk_security_struct *sksec = sk->sk_security;
5393 peer_sid = sksec->sid;
5394 secmark_perm = PACKET__SEND;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005395 }
5396
Eric Paris50c205f2012-04-04 15:01:43 -04005397 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005398 ad.u.net = &net;
5399 ad.u.net->netif = ifindex;
5400 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04005401 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
Eric Paris04f6d702010-11-23 06:28:02 +00005402 return NF_DROP;
Paul Moored8395c82008-10-10 10:16:30 -04005403
Paul Mooreeffad8d2008-01-29 08:49:27 -05005404 if (secmark_active)
5405 if (avc_has_perm(peer_sid, skb->secmark,
5406 SECCLASS_PACKET, secmark_perm, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005407 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005408
5409 if (peerlbl_active) {
5410 u32 if_sid;
5411 u32 node_sid;
5412
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005413 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005414 return NF_DROP;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005415 if (avc_has_perm(peer_sid, if_sid,
5416 SECCLASS_NETIF, NETIF__EGRESS, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005417 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005418
5419 if (sel_netnode_sid(addrp, family, &node_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005420 return NF_DROP;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005421 if (avc_has_perm(peer_sid, node_sid,
5422 SECCLASS_NODE, NODE__SENDTO, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005423 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005424 }
5425
5426 return NF_ACCEPT;
5427}
5428
Eric W. Biederman06198b32015-09-18 14:33:06 -05005429static unsigned int selinux_ipv4_postroute(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005430 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005431 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005432{
David S. Miller238e54c2015-04-03 20:32:56 -04005433 return selinux_ip_postroute(skb, state->out, PF_INET);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005434}
5435
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005436#if IS_ENABLED(CONFIG_IPV6)
Eric W. Biederman06198b32015-09-18 14:33:06 -05005437static unsigned int selinux_ipv6_postroute(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005438 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005439 const struct nf_hook_state *state)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005440{
David S. Miller238e54c2015-04-03 20:32:56 -04005441 return selinux_ip_postroute(skb, state->out, PF_INET6);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005442}
Linus Torvalds1da177e2005-04-16 15:20:36 -07005443#endif /* IPV6 */
5444
5445#endif /* CONFIG_NETFILTER */
5446
Linus Torvalds1da177e2005-04-16 15:20:36 -07005447static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5448{
Stephen Smalley941fc5b2009-10-01 14:48:23 -04005449 return selinux_nlmsg_perm(sk, skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005450}
5451
Linus Torvalds1da177e2005-04-16 15:20:36 -07005452static int ipc_alloc_security(struct task_struct *task,
5453 struct kern_ipc_perm *perm,
5454 u16 sclass)
5455{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005456 struct ipc_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +11005457 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005458
James Morris89d155e2005-10-30 14:59:21 -08005459 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005460 if (!isec)
5461 return -ENOMEM;
5462
David Howells275bb412008-11-14 10:39:19 +11005463 sid = task_sid(task);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005464 isec->sclass = sclass;
David Howells275bb412008-11-14 10:39:19 +11005465 isec->sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005466 perm->security = isec;
5467
5468 return 0;
5469}
5470
5471static void ipc_free_security(struct kern_ipc_perm *perm)
5472{
5473 struct ipc_security_struct *isec = perm->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005474 perm->security = NULL;
5475 kfree(isec);
5476}
5477
5478static int msg_msg_alloc_security(struct msg_msg *msg)
5479{
5480 struct msg_security_struct *msec;
5481
James Morris89d155e2005-10-30 14:59:21 -08005482 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005483 if (!msec)
5484 return -ENOMEM;
5485
Linus Torvalds1da177e2005-04-16 15:20:36 -07005486 msec->sid = SECINITSID_UNLABELED;
5487 msg->security = msec;
5488
5489 return 0;
5490}
5491
5492static void msg_msg_free_security(struct msg_msg *msg)
5493{
5494 struct msg_security_struct *msec = msg->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005495
5496 msg->security = NULL;
5497 kfree(msec);
5498}
5499
5500static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
Stephen Smalley6af963f2005-05-01 08:58:39 -07005501 u32 perms)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005502{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005503 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005504 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005505 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005506
Linus Torvalds1da177e2005-04-16 15:20:36 -07005507 isec = ipc_perms->security;
5508
Eric Paris50c205f2012-04-04 15:01:43 -04005509 ad.type = LSM_AUDIT_DATA_IPC;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005510 ad.u.ipc_id = ipc_perms->key;
5511
David Howells275bb412008-11-14 10:39:19 +11005512 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005513}
5514
5515static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5516{
5517 return msg_msg_alloc_security(msg);
5518}
5519
5520static void selinux_msg_msg_free_security(struct msg_msg *msg)
5521{
5522 msg_msg_free_security(msg);
5523}
5524
5525/* message queue security operations */
5526static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5527{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005528 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005529 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005530 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005531 int rc;
5532
5533 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5534 if (rc)
5535 return rc;
5536
Linus Torvalds1da177e2005-04-16 15:20:36 -07005537 isec = msq->q_perm.security;
5538
Eric Paris50c205f2012-04-04 15:01:43 -04005539 ad.type = LSM_AUDIT_DATA_IPC;
Eric Paris828dfe12008-04-17 13:17:49 -04005540 ad.u.ipc_id = msq->q_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005541
David Howells275bb412008-11-14 10:39:19 +11005542 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005543 MSGQ__CREATE, &ad);
5544 if (rc) {
5545 ipc_free_security(&msq->q_perm);
5546 return rc;
5547 }
5548 return 0;
5549}
5550
5551static void selinux_msg_queue_free_security(struct msg_queue *msq)
5552{
5553 ipc_free_security(&msq->q_perm);
5554}
5555
5556static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5557{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005558 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005559 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005560 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005561
Linus Torvalds1da177e2005-04-16 15:20:36 -07005562 isec = msq->q_perm.security;
5563
Eric Paris50c205f2012-04-04 15:01:43 -04005564 ad.type = LSM_AUDIT_DATA_IPC;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005565 ad.u.ipc_id = msq->q_perm.key;
5566
David Howells275bb412008-11-14 10:39:19 +11005567 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005568 MSGQ__ASSOCIATE, &ad);
5569}
5570
5571static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5572{
5573 int err;
5574 int perms;
5575
Eric Paris828dfe12008-04-17 13:17:49 -04005576 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005577 case IPC_INFO:
5578 case MSG_INFO:
5579 /* No specific object, just general system-wide information. */
5580 return task_has_system(current, SYSTEM__IPC_INFO);
5581 case IPC_STAT:
5582 case MSG_STAT:
5583 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5584 break;
5585 case IPC_SET:
5586 perms = MSGQ__SETATTR;
5587 break;
5588 case IPC_RMID:
5589 perms = MSGQ__DESTROY;
5590 break;
5591 default:
5592 return 0;
5593 }
5594
Stephen Smalley6af963f2005-05-01 08:58:39 -07005595 err = ipc_has_perm(&msq->q_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005596 return err;
5597}
5598
5599static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5600{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005601 struct ipc_security_struct *isec;
5602 struct msg_security_struct *msec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005603 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005604 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005605 int rc;
5606
Linus Torvalds1da177e2005-04-16 15:20:36 -07005607 isec = msq->q_perm.security;
5608 msec = msg->security;
5609
5610 /*
5611 * First time through, need to assign label to the message
5612 */
5613 if (msec->sid == SECINITSID_UNLABELED) {
5614 /*
5615 * Compute new sid based on current process and
5616 * message queue this message will be stored in
5617 */
David Howells275bb412008-11-14 10:39:19 +11005618 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
Eric Paris652bb9b2011-02-01 11:05:40 -05005619 NULL, &msec->sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005620 if (rc)
5621 return rc;
5622 }
5623
Eric Paris50c205f2012-04-04 15:01:43 -04005624 ad.type = LSM_AUDIT_DATA_IPC;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005625 ad.u.ipc_id = msq->q_perm.key;
5626
5627 /* Can this process write to the queue? */
David Howells275bb412008-11-14 10:39:19 +11005628 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005629 MSGQ__WRITE, &ad);
5630 if (!rc)
5631 /* Can this process send the message */
David Howells275bb412008-11-14 10:39:19 +11005632 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5633 MSG__SEND, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005634 if (!rc)
5635 /* Can the message be put in the queue? */
David Howells275bb412008-11-14 10:39:19 +11005636 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5637 MSGQ__ENQUEUE, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005638
5639 return rc;
5640}
5641
5642static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5643 struct task_struct *target,
5644 long type, int mode)
5645{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005646 struct ipc_security_struct *isec;
5647 struct msg_security_struct *msec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005648 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005649 u32 sid = task_sid(target);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005650 int rc;
5651
Linus Torvalds1da177e2005-04-16 15:20:36 -07005652 isec = msq->q_perm.security;
5653 msec = msg->security;
5654
Eric Paris50c205f2012-04-04 15:01:43 -04005655 ad.type = LSM_AUDIT_DATA_IPC;
Eric Paris828dfe12008-04-17 13:17:49 -04005656 ad.u.ipc_id = msq->q_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005657
David Howells275bb412008-11-14 10:39:19 +11005658 rc = avc_has_perm(sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005659 SECCLASS_MSGQ, MSGQ__READ, &ad);
5660 if (!rc)
David Howells275bb412008-11-14 10:39:19 +11005661 rc = avc_has_perm(sid, msec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005662 SECCLASS_MSG, MSG__RECEIVE, &ad);
5663 return rc;
5664}
5665
5666/* Shared Memory security operations */
5667static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5668{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005669 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005670 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005671 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005672 int rc;
5673
5674 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5675 if (rc)
5676 return rc;
5677
Linus Torvalds1da177e2005-04-16 15:20:36 -07005678 isec = shp->shm_perm.security;
5679
Eric Paris50c205f2012-04-04 15:01:43 -04005680 ad.type = LSM_AUDIT_DATA_IPC;
Eric Paris828dfe12008-04-17 13:17:49 -04005681 ad.u.ipc_id = shp->shm_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005682
David Howells275bb412008-11-14 10:39:19 +11005683 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005684 SHM__CREATE, &ad);
5685 if (rc) {
5686 ipc_free_security(&shp->shm_perm);
5687 return rc;
5688 }
5689 return 0;
5690}
5691
5692static void selinux_shm_free_security(struct shmid_kernel *shp)
5693{
5694 ipc_free_security(&shp->shm_perm);
5695}
5696
5697static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5698{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005699 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005700 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005701 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005702
Linus Torvalds1da177e2005-04-16 15:20:36 -07005703 isec = shp->shm_perm.security;
5704
Eric Paris50c205f2012-04-04 15:01:43 -04005705 ad.type = LSM_AUDIT_DATA_IPC;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005706 ad.u.ipc_id = shp->shm_perm.key;
5707
David Howells275bb412008-11-14 10:39:19 +11005708 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005709 SHM__ASSOCIATE, &ad);
5710}
5711
5712/* Note, at this point, shp is locked down */
5713static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5714{
5715 int perms;
5716 int err;
5717
Eric Paris828dfe12008-04-17 13:17:49 -04005718 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005719 case IPC_INFO:
5720 case SHM_INFO:
5721 /* No specific object, just general system-wide information. */
5722 return task_has_system(current, SYSTEM__IPC_INFO);
5723 case IPC_STAT:
5724 case SHM_STAT:
5725 perms = SHM__GETATTR | SHM__ASSOCIATE;
5726 break;
5727 case IPC_SET:
5728 perms = SHM__SETATTR;
5729 break;
5730 case SHM_LOCK:
5731 case SHM_UNLOCK:
5732 perms = SHM__LOCK;
5733 break;
5734 case IPC_RMID:
5735 perms = SHM__DESTROY;
5736 break;
5737 default:
5738 return 0;
5739 }
5740
Stephen Smalley6af963f2005-05-01 08:58:39 -07005741 err = ipc_has_perm(&shp->shm_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005742 return err;
5743}
5744
5745static int selinux_shm_shmat(struct shmid_kernel *shp,
5746 char __user *shmaddr, int shmflg)
5747{
5748 u32 perms;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005749
5750 if (shmflg & SHM_RDONLY)
5751 perms = SHM__READ;
5752 else
5753 perms = SHM__READ | SHM__WRITE;
5754
Stephen Smalley6af963f2005-05-01 08:58:39 -07005755 return ipc_has_perm(&shp->shm_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005756}
5757
5758/* Semaphore security operations */
5759static int selinux_sem_alloc_security(struct sem_array *sma)
5760{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005761 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005762 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005763 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005764 int rc;
5765
5766 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5767 if (rc)
5768 return rc;
5769
Linus Torvalds1da177e2005-04-16 15:20:36 -07005770 isec = sma->sem_perm.security;
5771
Eric Paris50c205f2012-04-04 15:01:43 -04005772 ad.type = LSM_AUDIT_DATA_IPC;
Eric Paris828dfe12008-04-17 13:17:49 -04005773 ad.u.ipc_id = sma->sem_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005774
David Howells275bb412008-11-14 10:39:19 +11005775 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005776 SEM__CREATE, &ad);
5777 if (rc) {
5778 ipc_free_security(&sma->sem_perm);
5779 return rc;
5780 }
5781 return 0;
5782}
5783
5784static void selinux_sem_free_security(struct sem_array *sma)
5785{
5786 ipc_free_security(&sma->sem_perm);
5787}
5788
5789static int selinux_sem_associate(struct sem_array *sma, int semflg)
5790{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005791 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005792 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005793 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005794
Linus Torvalds1da177e2005-04-16 15:20:36 -07005795 isec = sma->sem_perm.security;
5796
Eric Paris50c205f2012-04-04 15:01:43 -04005797 ad.type = LSM_AUDIT_DATA_IPC;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005798 ad.u.ipc_id = sma->sem_perm.key;
5799
David Howells275bb412008-11-14 10:39:19 +11005800 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005801 SEM__ASSOCIATE, &ad);
5802}
5803
5804/* Note, at this point, sma is locked down */
5805static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5806{
5807 int err;
5808 u32 perms;
5809
Eric Paris828dfe12008-04-17 13:17:49 -04005810 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005811 case IPC_INFO:
5812 case SEM_INFO:
5813 /* No specific object, just general system-wide information. */
5814 return task_has_system(current, SYSTEM__IPC_INFO);
5815 case GETPID:
5816 case GETNCNT:
5817 case GETZCNT:
5818 perms = SEM__GETATTR;
5819 break;
5820 case GETVAL:
5821 case GETALL:
5822 perms = SEM__READ;
5823 break;
5824 case SETVAL:
5825 case SETALL:
5826 perms = SEM__WRITE;
5827 break;
5828 case IPC_RMID:
5829 perms = SEM__DESTROY;
5830 break;
5831 case IPC_SET:
5832 perms = SEM__SETATTR;
5833 break;
5834 case IPC_STAT:
5835 case SEM_STAT:
5836 perms = SEM__GETATTR | SEM__ASSOCIATE;
5837 break;
5838 default:
5839 return 0;
5840 }
5841
Stephen Smalley6af963f2005-05-01 08:58:39 -07005842 err = ipc_has_perm(&sma->sem_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005843 return err;
5844}
5845
5846static int selinux_sem_semop(struct sem_array *sma,
5847 struct sembuf *sops, unsigned nsops, int alter)
5848{
5849 u32 perms;
5850
5851 if (alter)
5852 perms = SEM__READ | SEM__WRITE;
5853 else
5854 perms = SEM__READ;
5855
Stephen Smalley6af963f2005-05-01 08:58:39 -07005856 return ipc_has_perm(&sma->sem_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005857}
5858
5859static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5860{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005861 u32 av = 0;
5862
Linus Torvalds1da177e2005-04-16 15:20:36 -07005863 av = 0;
5864 if (flag & S_IRUGO)
5865 av |= IPC__UNIX_READ;
5866 if (flag & S_IWUGO)
5867 av |= IPC__UNIX_WRITE;
5868
5869 if (av == 0)
5870 return 0;
5871
Stephen Smalley6af963f2005-05-01 08:58:39 -07005872 return ipc_has_perm(ipcp, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005873}
5874
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02005875static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5876{
5877 struct ipc_security_struct *isec = ipcp->security;
5878 *secid = isec->sid;
5879}
5880
Eric Paris828dfe12008-04-17 13:17:49 -04005881static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005882{
5883 if (inode)
5884 inode_doinit_with_dentry(inode, dentry);
5885}
5886
5887static int selinux_getprocattr(struct task_struct *p,
Al Viro04ff9702007-03-12 16:17:58 +00005888 char *name, char **value)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005889{
David Howells275bb412008-11-14 10:39:19 +11005890 const struct task_security_struct *__tsec;
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00005891 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005892 int error;
Al Viro04ff9702007-03-12 16:17:58 +00005893 unsigned len;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005894
5895 if (current != p) {
David Howells3b11a1d2008-11-14 10:39:26 +11005896 error = current_has_perm(p, PROCESS__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005897 if (error)
5898 return error;
5899 }
5900
David Howells275bb412008-11-14 10:39:19 +11005901 rcu_read_lock();
5902 __tsec = __task_cred(p)->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005903
5904 if (!strcmp(name, "current"))
David Howells275bb412008-11-14 10:39:19 +11005905 sid = __tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005906 else if (!strcmp(name, "prev"))
David Howells275bb412008-11-14 10:39:19 +11005907 sid = __tsec->osid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005908 else if (!strcmp(name, "exec"))
David Howells275bb412008-11-14 10:39:19 +11005909 sid = __tsec->exec_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005910 else if (!strcmp(name, "fscreate"))
David Howells275bb412008-11-14 10:39:19 +11005911 sid = __tsec->create_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07005912 else if (!strcmp(name, "keycreate"))
David Howells275bb412008-11-14 10:39:19 +11005913 sid = __tsec->keycreate_sid;
Eric Paris42c3e032006-06-26 00:26:03 -07005914 else if (!strcmp(name, "sockcreate"))
David Howells275bb412008-11-14 10:39:19 +11005915 sid = __tsec->sockcreate_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005916 else
David Howells275bb412008-11-14 10:39:19 +11005917 goto invalid;
5918 rcu_read_unlock();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005919
5920 if (!sid)
5921 return 0;
5922
Al Viro04ff9702007-03-12 16:17:58 +00005923 error = security_sid_to_context(sid, value, &len);
5924 if (error)
5925 return error;
5926 return len;
David Howells275bb412008-11-14 10:39:19 +11005927
5928invalid:
5929 rcu_read_unlock();
5930 return -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005931}
5932
5933static int selinux_setprocattr(struct task_struct *p,
5934 char *name, void *value, size_t size)
5935{
5936 struct task_security_struct *tsec;
David Howellsd84f4f92008-11-14 10:39:23 +11005937 struct cred *new;
5938 u32 sid = 0, ptsid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005939 int error;
5940 char *str = value;
5941
5942 if (current != p) {
5943 /* SELinux only allows a process to change its own
5944 security attributes. */
5945 return -EACCES;
5946 }
5947
5948 /*
5949 * Basic control over ability to set these attributes at all.
5950 * current == p, but we'll pass them separately in case the
5951 * above restriction is ever removed.
5952 */
5953 if (!strcmp(name, "exec"))
David Howells3b11a1d2008-11-14 10:39:26 +11005954 error = current_has_perm(p, PROCESS__SETEXEC);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005955 else if (!strcmp(name, "fscreate"))
David Howells3b11a1d2008-11-14 10:39:26 +11005956 error = current_has_perm(p, PROCESS__SETFSCREATE);
Michael LeMay4eb582c2006-06-26 00:24:57 -07005957 else if (!strcmp(name, "keycreate"))
David Howells3b11a1d2008-11-14 10:39:26 +11005958 error = current_has_perm(p, PROCESS__SETKEYCREATE);
Eric Paris42c3e032006-06-26 00:26:03 -07005959 else if (!strcmp(name, "sockcreate"))
David Howells3b11a1d2008-11-14 10:39:26 +11005960 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005961 else if (!strcmp(name, "current"))
David Howells3b11a1d2008-11-14 10:39:26 +11005962 error = current_has_perm(p, PROCESS__SETCURRENT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005963 else
5964 error = -EINVAL;
5965 if (error)
5966 return error;
5967
5968 /* Obtain a SID for the context, if one was specified. */
5969 if (size && str[1] && str[1] != '\n') {
5970 if (str[size-1] == '\n') {
5971 str[size-1] = 0;
5972 size--;
5973 }
Nikolay Aleksandrov52a4c642014-03-07 12:44:19 +01005974 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
Stephen Smalley12b29f32008-05-07 13:03:20 -04005975 if (error == -EINVAL && !strcmp(name, "fscreate")) {
Eric Parisd6ea83e2012-04-04 13:45:49 -04005976 if (!capable(CAP_MAC_ADMIN)) {
5977 struct audit_buffer *ab;
5978 size_t audit_size;
5979
5980 /* We strip a nul only if it is at the end, otherwise the
5981 * context contains a nul and we should audit that */
5982 if (str[size - 1] == '\0')
5983 audit_size = size - 1;
5984 else
5985 audit_size = size;
5986 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5987 audit_log_format(ab, "op=fscreate invalid_context=");
5988 audit_log_n_untrustedstring(ab, value, audit_size);
5989 audit_log_end(ab);
5990
Stephen Smalley12b29f32008-05-07 13:03:20 -04005991 return error;
Eric Parisd6ea83e2012-04-04 13:45:49 -04005992 }
Stephen Smalley12b29f32008-05-07 13:03:20 -04005993 error = security_context_to_sid_force(value, size,
5994 &sid);
5995 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07005996 if (error)
5997 return error;
5998 }
5999
David Howellsd84f4f92008-11-14 10:39:23 +11006000 new = prepare_creds();
6001 if (!new)
6002 return -ENOMEM;
6003
Linus Torvalds1da177e2005-04-16 15:20:36 -07006004 /* Permission checking based on the specified context is
6005 performed during the actual operation (execve,
6006 open/mkdir/...), when we know the full context of the
David Howellsd84f4f92008-11-14 10:39:23 +11006007 operation. See selinux_bprm_set_creds for the execve
Linus Torvalds1da177e2005-04-16 15:20:36 -07006008 checks and may_create for the file creation checks. The
6009 operation will then fail if the context is not permitted. */
David Howellsd84f4f92008-11-14 10:39:23 +11006010 tsec = new->security;
6011 if (!strcmp(name, "exec")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006012 tsec->exec_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006013 } else if (!strcmp(name, "fscreate")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006014 tsec->create_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006015 } else if (!strcmp(name, "keycreate")) {
Michael LeMay4eb582c2006-06-26 00:24:57 -07006016 error = may_create_key(sid, p);
6017 if (error)
David Howellsd84f4f92008-11-14 10:39:23 +11006018 goto abort_change;
Michael LeMay4eb582c2006-06-26 00:24:57 -07006019 tsec->keycreate_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006020 } else if (!strcmp(name, "sockcreate")) {
Eric Paris42c3e032006-06-26 00:26:03 -07006021 tsec->sockcreate_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006022 } else if (!strcmp(name, "current")) {
6023 error = -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006024 if (sid == 0)
David Howellsd84f4f92008-11-14 10:39:23 +11006025 goto abort_change;
KaiGai Koheid9250de2008-08-28 16:35:57 +09006026
David Howellsd84f4f92008-11-14 10:39:23 +11006027 /* Only allow single threaded processes to change context */
6028 error = -EPERM;
Oleg Nesterov5bb459b2009-07-10 03:48:23 +02006029 if (!current_is_single_threaded()) {
David Howellsd84f4f92008-11-14 10:39:23 +11006030 error = security_bounded_transition(tsec->sid, sid);
6031 if (error)
6032 goto abort_change;
Eric Paris828dfe12008-04-17 13:17:49 -04006033 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07006034
6035 /* Check permissions for the transition. */
6036 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
Eric Paris828dfe12008-04-17 13:17:49 -04006037 PROCESS__DYNTRANSITION, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006038 if (error)
David Howellsd84f4f92008-11-14 10:39:23 +11006039 goto abort_change;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006040
6041 /* Check for ptracing, and update the task SID if ok.
6042 Otherwise, leave SID unchanged and fail. */
Paul Moore0c6181c2016-03-30 21:41:21 -04006043 ptsid = ptrace_parent_sid(p);
6044 if (ptsid != 0) {
David Howellsd84f4f92008-11-14 10:39:23 +11006045 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
6046 PROCESS__PTRACE, NULL);
6047 if (error)
6048 goto abort_change;
6049 }
6050
6051 tsec->sid = sid;
6052 } else {
6053 error = -EINVAL;
6054 goto abort_change;
6055 }
6056
6057 commit_creds(new);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006058 return size;
David Howellsd84f4f92008-11-14 10:39:23 +11006059
6060abort_change:
6061 abort_creds(new);
6062 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006063}
6064
David Quigley746df9b2013-05-22 12:50:35 -04006065static int selinux_ismaclabel(const char *name)
6066{
6067 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6068}
6069
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006070static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6071{
6072 return security_sid_to_context(secid, secdata, seclen);
6073}
6074
David Howells7bf570d2008-04-29 20:52:51 +01006075static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
David Howells63cb3442008-01-15 23:47:35 +00006076{
Nikolay Aleksandrov52a4c642014-03-07 12:44:19 +01006077 return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
David Howells63cb3442008-01-15 23:47:35 +00006078}
6079
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006080static void selinux_release_secctx(char *secdata, u32 seclen)
6081{
Paul Moore088999e2007-08-01 11:12:58 -04006082 kfree(secdata);
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006083}
6084
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006085static void selinux_inode_invalidate_secctx(struct inode *inode)
6086{
6087 struct inode_security_struct *isec = inode->i_security;
6088
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01006089 spin_lock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006090 isec->initialized = LABEL_INVALID;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01006091 spin_unlock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006092}
6093
David P. Quigley1ee65e32009-09-03 14:25:57 -04006094/*
6095 * called with inode->i_mutex locked
6096 */
6097static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6098{
6099 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
6100}
6101
6102/*
6103 * called with inode->i_mutex locked
6104 */
6105static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6106{
6107 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6108}
6109
6110static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6111{
6112 int len = 0;
6113 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6114 ctx, true);
6115 if (len < 0)
6116 return len;
6117 *ctxlen = len;
6118 return 0;
6119}
Michael LeMayd7200242006-06-22 14:47:17 -07006120#ifdef CONFIG_KEYS
6121
David Howellsd84f4f92008-11-14 10:39:23 +11006122static int selinux_key_alloc(struct key *k, const struct cred *cred,
David Howells7e047ef2006-06-26 00:24:50 -07006123 unsigned long flags)
Michael LeMayd7200242006-06-22 14:47:17 -07006124{
David Howellsd84f4f92008-11-14 10:39:23 +11006125 const struct task_security_struct *tsec;
Michael LeMayd7200242006-06-22 14:47:17 -07006126 struct key_security_struct *ksec;
6127
6128 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6129 if (!ksec)
6130 return -ENOMEM;
6131
David Howellsd84f4f92008-11-14 10:39:23 +11006132 tsec = cred->security;
6133 if (tsec->keycreate_sid)
6134 ksec->sid = tsec->keycreate_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07006135 else
David Howellsd84f4f92008-11-14 10:39:23 +11006136 ksec->sid = tsec->sid;
Michael LeMayd7200242006-06-22 14:47:17 -07006137
David Howells275bb412008-11-14 10:39:19 +11006138 k->security = ksec;
Michael LeMayd7200242006-06-22 14:47:17 -07006139 return 0;
6140}
6141
6142static void selinux_key_free(struct key *k)
6143{
6144 struct key_security_struct *ksec = k->security;
6145
6146 k->security = NULL;
6147 kfree(ksec);
6148}
6149
6150static int selinux_key_permission(key_ref_t key_ref,
David Howellsd84f4f92008-11-14 10:39:23 +11006151 const struct cred *cred,
David Howellsf5895942014-03-14 17:44:49 +00006152 unsigned perm)
Michael LeMayd7200242006-06-22 14:47:17 -07006153{
6154 struct key *key;
Michael LeMayd7200242006-06-22 14:47:17 -07006155 struct key_security_struct *ksec;
David Howells275bb412008-11-14 10:39:19 +11006156 u32 sid;
Michael LeMayd7200242006-06-22 14:47:17 -07006157
6158 /* if no specific permissions are requested, we skip the
6159 permission check. No serious, additional covert channels
6160 appear to be created. */
6161 if (perm == 0)
6162 return 0;
6163
David Howellsd84f4f92008-11-14 10:39:23 +11006164 sid = cred_sid(cred);
David Howells275bb412008-11-14 10:39:19 +11006165
6166 key = key_ref_to_ptr(key_ref);
6167 ksec = key->security;
6168
6169 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
Michael LeMayd7200242006-06-22 14:47:17 -07006170}
6171
David Howells70a5bb72008-04-29 01:01:26 -07006172static int selinux_key_getsecurity(struct key *key, char **_buffer)
6173{
6174 struct key_security_struct *ksec = key->security;
6175 char *context = NULL;
6176 unsigned len;
6177 int rc;
6178
6179 rc = security_sid_to_context(ksec->sid, &context, &len);
6180 if (!rc)
6181 rc = len;
6182 *_buffer = context;
6183 return rc;
6184}
6185
Michael LeMayd7200242006-06-22 14:47:17 -07006186#endif
6187
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07006188static struct security_hook_list selinux_hooks[] = {
Casey Schauflere20b0432015-05-02 15:11:36 -07006189 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6190 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6191 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6192 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02006193
Casey Schauflere20b0432015-05-02 15:11:36 -07006194 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6195 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6196 LSM_HOOK_INIT(capget, selinux_capget),
6197 LSM_HOOK_INIT(capset, selinux_capset),
6198 LSM_HOOK_INIT(capable, selinux_capable),
6199 LSM_HOOK_INIT(quotactl, selinux_quotactl),
6200 LSM_HOOK_INIT(quota_on, selinux_quota_on),
6201 LSM_HOOK_INIT(syslog, selinux_syslog),
6202 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
Stephen Smalley79af7302015-01-21 10:54:10 -05006203
Casey Schauflere20b0432015-05-02 15:11:36 -07006204 LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006205
Casey Schauflere20b0432015-05-02 15:11:36 -07006206 LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6207 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6208 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6209 LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006210
Casey Schauflere20b0432015-05-02 15:11:36 -07006211 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6212 LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6213 LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
6214 LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6215 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6216 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6217 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6218 LSM_HOOK_INIT(sb_mount, selinux_mount),
6219 LSM_HOOK_INIT(sb_umount, selinux_umount),
6220 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6221 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6222 LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006223
Casey Schauflere20b0432015-05-02 15:11:36 -07006224 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
Vivek Goyala518b0a2016-07-13 10:44:53 -04006225 LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
Eric Parise0007522008-03-05 10:31:54 -05006226
Casey Schauflere20b0432015-05-02 15:11:36 -07006227 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6228 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6229 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6230 LSM_HOOK_INIT(inode_create, selinux_inode_create),
6231 LSM_HOOK_INIT(inode_link, selinux_inode_link),
6232 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6233 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6234 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6235 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6236 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6237 LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6238 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6239 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6240 LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6241 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6242 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6243 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6244 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6245 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6246 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6247 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6248 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6249 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6250 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6251 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
Vivek Goyal56909eb2016-07-13 10:44:48 -04006252 LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
Vivek Goyal19472b62016-07-13 10:44:50 -04006253 LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006254
Casey Schauflere20b0432015-05-02 15:11:36 -07006255 LSM_HOOK_INIT(file_permission, selinux_file_permission),
6256 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6257 LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
6258 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6259 LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6260 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6261 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6262 LSM_HOOK_INIT(file_lock, selinux_file_lock),
6263 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6264 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6265 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6266 LSM_HOOK_INIT(file_receive, selinux_file_receive),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006267
Casey Schauflere20b0432015-05-02 15:11:36 -07006268 LSM_HOOK_INIT(file_open, selinux_file_open),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006269
Casey Schauflere20b0432015-05-02 15:11:36 -07006270 LSM_HOOK_INIT(task_create, selinux_task_create),
6271 LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
6272 LSM_HOOK_INIT(cred_free, selinux_cred_free),
6273 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6274 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6275 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6276 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6277 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07006278 LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
Casey Schauflere20b0432015-05-02 15:11:36 -07006279 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6280 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6281 LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6282 LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6283 LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6284 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6285 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
6286 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6287 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6288 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6289 LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6290 LSM_HOOK_INIT(task_kill, selinux_task_kill),
6291 LSM_HOOK_INIT(task_wait, selinux_task_wait),
6292 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09006293
Casey Schauflere20b0432015-05-02 15:11:36 -07006294 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6295 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006296
Casey Schauflere20b0432015-05-02 15:11:36 -07006297 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6298 LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006299
Casey Schauflere20b0432015-05-02 15:11:36 -07006300 LSM_HOOK_INIT(msg_queue_alloc_security,
6301 selinux_msg_queue_alloc_security),
6302 LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6303 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6304 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6305 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6306 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006307
Casey Schauflere20b0432015-05-02 15:11:36 -07006308 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6309 LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6310 LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6311 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6312 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006313
Casey Schauflere20b0432015-05-02 15:11:36 -07006314 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6315 LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6316 LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6317 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6318 LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006319
Casey Schauflere20b0432015-05-02 15:11:36 -07006320 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006321
Casey Schauflere20b0432015-05-02 15:11:36 -07006322 LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6323 LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006324
Casey Schauflere20b0432015-05-02 15:11:36 -07006325 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6326 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6327 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6328 LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006329 LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
Casey Schauflere20b0432015-05-02 15:11:36 -07006330 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6331 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6332 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006333
Casey Schauflere20b0432015-05-02 15:11:36 -07006334 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6335 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006336
Casey Schauflere20b0432015-05-02 15:11:36 -07006337 LSM_HOOK_INIT(socket_create, selinux_socket_create),
6338 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6339 LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6340 LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6341 LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6342 LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6343 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6344 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6345 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6346 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6347 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6348 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6349 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6350 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6351 LSM_HOOK_INIT(socket_getpeersec_stream,
6352 selinux_socket_getpeersec_stream),
6353 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6354 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6355 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6356 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6357 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6358 LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6359 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6360 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6361 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6362 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6363 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6364 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6365 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6366 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6367 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6368 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6369 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6370 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6371 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
Trent Jaegerd28d1e02005-12-13 23:12:40 -08006372
6373#ifdef CONFIG_SECURITY_NETWORK_XFRM
Casey Schauflere20b0432015-05-02 15:11:36 -07006374 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6375 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6376 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6377 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6378 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6379 LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6380 selinux_xfrm_state_alloc_acquire),
6381 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6382 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6383 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6384 LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6385 selinux_xfrm_state_pol_flow_match),
6386 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006387#endif
Michael LeMayd7200242006-06-22 14:47:17 -07006388
6389#ifdef CONFIG_KEYS
Casey Schauflere20b0432015-05-02 15:11:36 -07006390 LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6391 LSM_HOOK_INIT(key_free, selinux_key_free),
6392 LSM_HOOK_INIT(key_permission, selinux_key_permission),
6393 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
Michael LeMayd7200242006-06-22 14:47:17 -07006394#endif
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +02006395
6396#ifdef CONFIG_AUDIT
Casey Schauflere20b0432015-05-02 15:11:36 -07006397 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6398 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6399 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6400 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +02006401#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07006402};
6403
6404static __init int selinux_init(void)
6405{
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07006406 if (!security_module_enable("selinux")) {
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02006407 selinux_enabled = 0;
6408 return 0;
6409 }
6410
Linus Torvalds1da177e2005-04-16 15:20:36 -07006411 if (!selinux_enabled) {
6412 printk(KERN_INFO "SELinux: Disabled at boot.\n");
6413 return 0;
6414 }
6415
6416 printk(KERN_INFO "SELinux: Initializing.\n");
6417
6418 /* Set the security state for the initial task. */
David Howellsd84f4f92008-11-14 10:39:23 +11006419 cred_init_security();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006420
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04006421 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6422
James Morris7cae7e22006-03-22 00:09:22 -08006423 sel_inode_cache = kmem_cache_create("selinux_inode_security",
6424 sizeof(struct inode_security_struct),
Paul Mundt20c2df82007-07-20 10:11:58 +09006425 0, SLAB_PANIC, NULL);
Sangwoo63205652015-10-21 17:44:30 -04006426 file_security_cache = kmem_cache_create("selinux_file_security",
6427 sizeof(struct file_security_struct),
6428 0, SLAB_PANIC, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006429 avc_init();
6430
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07006431 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
Linus Torvalds1da177e2005-04-16 15:20:36 -07006432
Paul Moore615e51f2014-06-26 14:33:56 -04006433 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6434 panic("SELinux: Unable to register AVC netcache callback\n");
6435
Eric Paris828dfe12008-04-17 13:17:49 -04006436 if (selinux_enforcing)
Eric Parisfadcdb42007-02-22 18:11:31 -05006437 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
Eric Paris828dfe12008-04-17 13:17:49 -04006438 else
Eric Parisfadcdb42007-02-22 18:11:31 -05006439 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
Michael LeMayd7200242006-06-22 14:47:17 -07006440
Linus Torvalds1da177e2005-04-16 15:20:36 -07006441 return 0;
6442}
6443
Al Viroe8c26252010-03-23 06:36:54 -04006444static void delayed_superblock_init(struct super_block *sb, void *unused)
6445{
6446 superblock_doinit(sb, NULL);
6447}
6448
Linus Torvalds1da177e2005-04-16 15:20:36 -07006449void selinux_complete_init(void)
6450{
Eric Parisfadcdb42007-02-22 18:11:31 -05006451 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07006452
6453 /* Set up any superblocks initialized prior to the policy load. */
Eric Parisfadcdb42007-02-22 18:11:31 -05006454 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
Al Viroe8c26252010-03-23 06:36:54 -04006455 iterate_supers(delayed_superblock_init, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006456}
6457
6458/* SELinux requires early initialization in order to label
6459 all processes and objects when they are created. */
6460security_initcall(selinux_init);
6461
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08006462#if defined(CONFIG_NETFILTER)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006463
Jiri Pirko25db6be2014-09-03 17:42:13 +02006464static struct nf_hook_ops selinux_nf_ops[] = {
Paul Mooreeffad8d2008-01-29 08:49:27 -05006465 {
6466 .hook = selinux_ipv4_postroute,
Alban Crequy2597a832012-05-14 03:56:39 +00006467 .pf = NFPROTO_IPV4,
Paul Mooreeffad8d2008-01-29 08:49:27 -05006468 .hooknum = NF_INET_POST_ROUTING,
6469 .priority = NF_IP_PRI_SELINUX_LAST,
6470 },
6471 {
6472 .hook = selinux_ipv4_forward,
Alban Crequy2597a832012-05-14 03:56:39 +00006473 .pf = NFPROTO_IPV4,
Paul Mooreeffad8d2008-01-29 08:49:27 -05006474 .hooknum = NF_INET_FORWARD,
6475 .priority = NF_IP_PRI_SELINUX_FIRST,
Paul Moore948bf852008-10-10 10:16:32 -04006476 },
6477 {
6478 .hook = selinux_ipv4_output,
Alban Crequy2597a832012-05-14 03:56:39 +00006479 .pf = NFPROTO_IPV4,
Paul Moore948bf852008-10-10 10:16:32 -04006480 .hooknum = NF_INET_LOCAL_OUT,
6481 .priority = NF_IP_PRI_SELINUX_FIRST,
Jiri Pirko25db6be2014-09-03 17:42:13 +02006482 },
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04006483#if IS_ENABLED(CONFIG_IPV6)
Paul Mooreeffad8d2008-01-29 08:49:27 -05006484 {
6485 .hook = selinux_ipv6_postroute,
Alban Crequy2597a832012-05-14 03:56:39 +00006486 .pf = NFPROTO_IPV6,
Paul Mooreeffad8d2008-01-29 08:49:27 -05006487 .hooknum = NF_INET_POST_ROUTING,
6488 .priority = NF_IP6_PRI_SELINUX_LAST,
6489 },
6490 {
6491 .hook = selinux_ipv6_forward,
Alban Crequy2597a832012-05-14 03:56:39 +00006492 .pf = NFPROTO_IPV6,
Paul Mooreeffad8d2008-01-29 08:49:27 -05006493 .hooknum = NF_INET_FORWARD,
6494 .priority = NF_IP6_PRI_SELINUX_FIRST,
Jiri Pirko25db6be2014-09-03 17:42:13 +02006495 },
Huw Davies2917f572016-06-27 15:06:15 -04006496 {
6497 .hook = selinux_ipv6_output,
6498 .pf = NFPROTO_IPV6,
6499 .hooknum = NF_INET_LOCAL_OUT,
6500 .priority = NF_IP6_PRI_SELINUX_FIRST,
6501 },
Linus Torvalds1da177e2005-04-16 15:20:36 -07006502#endif /* IPV6 */
Jiri Pirko25db6be2014-09-03 17:42:13 +02006503};
Linus Torvalds1da177e2005-04-16 15:20:36 -07006504
6505static int __init selinux_nf_ip_init(void)
6506{
Jiri Pirko25db6be2014-09-03 17:42:13 +02006507 int err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006508
6509 if (!selinux_enabled)
Jiri Pirko25db6be2014-09-03 17:42:13 +02006510 return 0;
Eric Parisfadcdb42007-02-22 18:11:31 -05006511
6512 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
6513
Jiri Pirko25db6be2014-09-03 17:42:13 +02006514 err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
Alexey Dobriyan6c5a9d22008-07-26 17:48:15 -07006515 if (err)
Jiri Pirko25db6be2014-09-03 17:42:13 +02006516 panic("SELinux: nf_register_hooks: error %d\n", err);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006517
Jiri Pirko25db6be2014-09-03 17:42:13 +02006518 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006519}
6520
6521__initcall(selinux_nf_ip_init);
6522
6523#ifdef CONFIG_SECURITY_SELINUX_DISABLE
6524static void selinux_nf_ip_exit(void)
6525{
Eric Parisfadcdb42007-02-22 18:11:31 -05006526 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07006527
Jiri Pirko25db6be2014-09-03 17:42:13 +02006528 nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
Linus Torvalds1da177e2005-04-16 15:20:36 -07006529}
6530#endif
6531
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08006532#else /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07006533
6534#ifdef CONFIG_SECURITY_SELINUX_DISABLE
6535#define selinux_nf_ip_exit()
6536#endif
6537
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08006538#endif /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07006539
6540#ifdef CONFIG_SECURITY_SELINUX_DISABLE
Eric Paris828dfe12008-04-17 13:17:49 -04006541static int selinux_disabled;
6542
Linus Torvalds1da177e2005-04-16 15:20:36 -07006543int selinux_disable(void)
6544{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006545 if (ss_initialized) {
6546 /* Not permitted after initial policy load. */
6547 return -EINVAL;
6548 }
6549
6550 if (selinux_disabled) {
6551 /* Only do this once. */
6552 return -EINVAL;
6553 }
6554
6555 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
6556
6557 selinux_disabled = 1;
Stephen Smalley30d55282006-05-03 10:52:36 -04006558 selinux_enabled = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006559
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07006560 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
Linus Torvalds1da177e2005-04-16 15:20:36 -07006561
Eric Parisaf8ff042009-09-20 21:23:01 -04006562 /* Try to destroy the avc node cache */
6563 avc_disable();
6564
Linus Torvalds1da177e2005-04-16 15:20:36 -07006565 /* Unregister netfilter hooks. */
6566 selinux_nf_ip_exit();
6567
6568 /* Unregister selinuxfs. */
6569 exit_sel_fs();
6570
6571 return 0;
6572}
6573#endif