blob: 4bd6f9435e2f1705a649d581f9ba546157c1a925 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
Stephen Smalley7efbb602017-08-17 13:32:36 -04006 * Authors: Stephen Smalley, <sds@tycho.nsa.gov>
Eric Paris828dfe12008-04-17 13:17:49 -04007 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070010 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
Eric Paris2069f452008-07-04 09:47:13 +100012 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070014 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
Eric Paris828dfe12008-04-17 13:17:49 -040015 * <dgoeddel@trustedcs.com>
Paul Mooreed6d76e2009-08-28 18:12:49 -040016 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
Paul Moore82c21bf2011-08-01 11:10:33 +000017 * Paul Moore <paul@paul-moore.com>
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +090018 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
Eric Paris828dfe12008-04-17 13:17:49 -040019 * Yuichi Nakamura <ynakam@hitachisoft.jp>
Daniel Jurgens3a976fa2017-05-19 15:48:56 +030020 * Copyright (C) 2016 Mellanox Technologies
Linus Torvalds1da177e2005-04-16 15:20:36 -070021 *
22 * This program is free software; you can redistribute it and/or modify
23 * it under the terms of the GNU General Public License version 2,
Eric Paris828dfe12008-04-17 13:17:49 -040024 * as published by the Free Software Foundation.
Linus Torvalds1da177e2005-04-16 15:20:36 -070025 */
26
Linus Torvalds1da177e2005-04-16 15:20:36 -070027#include <linux/init.h>
Eric Paris0b24dcb2011-02-25 15:39:20 -050028#include <linux/kd.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070029#include <linux/kernel.h>
Roland McGrath0d094ef2008-07-25 19:45:49 -070030#include <linux/tracehook.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070031#include <linux/errno.h>
Ingo Molnar3f07c012017-02-08 18:51:30 +010032#include <linux/sched/signal.h>
Ingo Molnar29930022017-02-08 18:51:36 +010033#include <linux/sched/task.h>
Casey Schaufler3c4ed7b2015-05-02 15:10:46 -070034#include <linux/lsm_hooks.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070035#include <linux/xattr.h>
36#include <linux/capability.h>
37#include <linux/unistd.h>
38#include <linux/mm.h>
39#include <linux/mman.h>
40#include <linux/slab.h>
41#include <linux/pagemap.h>
Eric Paris0b24dcb2011-02-25 15:39:20 -050042#include <linux/proc_fs.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070043#include <linux/swap.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070044#include <linux/spinlock.h>
45#include <linux/syscalls.h>
Eric Paris2a7dba32011-02-01 11:05:39 -050046#include <linux/dcache.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070047#include <linux/file.h>
Al Viro9f3acc32008-04-24 07:44:08 -040048#include <linux/fdtable.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070049#include <linux/namei.h>
50#include <linux/mount.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070051#include <linux/netfilter_ipv4.h>
52#include <linux/netfilter_ipv6.h>
53#include <linux/tty.h>
54#include <net/icmp.h>
Stephen Hemminger227b60f2007-10-10 17:30:46 -070055#include <net/ip.h> /* for local_port_range[] */
Linus Torvalds1da177e2005-04-16 15:20:36 -070056#include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
Paul Moore47180062013-12-04 16:10:45 -050057#include <net/inet_connection_sock.h>
Paul Moore220deb92008-01-29 08:38:23 -050058#include <net/net_namespace.h>
Paul Moored621d352008-01-29 08:43:36 -050059#include <net/netlabel.h>
Eric Parisf5269712008-05-14 11:27:45 -040060#include <linux/uaccess.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070061#include <asm/ioctls.h>
Arun Sharma600634972011-07-26 16:09:06 -070062#include <linux/atomic.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070063#include <linux/bitops.h>
64#include <linux/interrupt.h>
65#include <linux/netdevice.h> /* for network interface checks */
Hong zhi guo77954982013-03-27 06:49:35 +000066#include <net/netlink.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070067#include <linux/tcp.h>
68#include <linux/udp.h>
James Morris2ee92d42006-11-13 16:09:01 -080069#include <linux/dccp.h>
Richard Hainesd4529302018-02-13 20:57:18 +000070#include <linux/sctp.h>
71#include <net/sctp/structs.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070072#include <linux/quota.h>
73#include <linux/un.h> /* for Unix socket types */
74#include <net/af_unix.h> /* for Unix socket types */
75#include <linux/parser.h>
76#include <linux/nfs_mount.h>
77#include <net/ipv6.h>
78#include <linux/hugetlb.h>
79#include <linux/personality.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070080#include <linux/audit.h>
Eric Paris6931dfc2005-06-30 02:58:51 -070081#include <linux/string.h>
Catherine Zhang877ce7c2006-06-29 12:27:47 -070082#include <linux/selinux.h>
Eric Paris23970742006-09-25 23:32:01 -070083#include <linux/mutex.h>
Frank Mayharf06febc2008-09-12 09:54:39 -070084#include <linux/posix-timers.h>
Kees Cook00234592010-02-03 15:36:43 -080085#include <linux/syslog.h>
Serge E. Hallyn34867402011-03-23 16:43:17 -070086#include <linux/user_namespace.h>
Paul Gortmaker44fc7ea2011-05-26 20:52:10 -040087#include <linux/export.h>
Al Viro40401532012-02-13 03:58:52 +000088#include <linux/msg.h>
89#include <linux/shm.h>
Chenbo Fengec27c352017-10-18 13:00:25 -070090#include <linux/bpf.h>
David Howellse262e32d2018-11-01 23:07:23 +000091#include <uapi/linux/mount.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070092
93#include "avc.h"
94#include "objsec.h"
95#include "netif.h"
Paul Moore224dfbd2008-01-29 08:38:13 -050096#include "netnode.h"
Paul Moore3e1121722008-04-10 10:48:14 -040097#include "netport.h"
Daniel Jurgens409dcf32017-05-19 15:48:59 +030098#include "ibpkey.h"
Trent Jaegerd28d1e02005-12-13 23:12:40 -080099#include "xfrm.h"
Paul Moorec60475b2007-02-28 15:14:23 -0500100#include "netlabel.h"
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +0200101#include "audit.h"
James Morris7b98a582011-08-30 12:52:32 +1000102#include "avc_ss.h"
Linus Torvalds1da177e2005-04-16 15:20:36 -0700103
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500104struct selinux_state selinux_state;
105
Paul Moored621d352008-01-29 08:43:36 -0500106/* SECMARK reference count */
James Morris56a4ca92011-08-17 11:08:43 +1000107static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
Paul Moored621d352008-01-29 08:43:36 -0500108
Linus Torvalds1da177e2005-04-16 15:20:36 -0700109#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500110static int selinux_enforcing_boot;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700111
112static int __init enforcing_setup(char *str)
113{
Eric Parisf5269712008-05-14 11:27:45 -0400114 unsigned long enforcing;
Jingoo Han29707b22014-02-05 15:13:14 +0900115 if (!kstrtoul(str, 0, &enforcing))
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500116 selinux_enforcing_boot = enforcing ? 1 : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700117 return 1;
118}
119__setup("enforcing=", enforcing_setup);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500120#else
121#define selinux_enforcing_boot 1
Linus Torvalds1da177e2005-04-16 15:20:36 -0700122#endif
123
124#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
125int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
126
127static int __init selinux_enabled_setup(char *str)
128{
Eric Parisf5269712008-05-14 11:27:45 -0400129 unsigned long enabled;
Jingoo Han29707b22014-02-05 15:13:14 +0900130 if (!kstrtoul(str, 0, &enabled))
Eric Parisf5269712008-05-14 11:27:45 -0400131 selinux_enabled = enabled ? 1 : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700132 return 1;
133}
134__setup("selinux=", selinux_enabled_setup);
Stephen Smalley30d55282006-05-03 10:52:36 -0400135#else
136int selinux_enabled = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700137#endif
138
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500139static unsigned int selinux_checkreqprot_boot =
140 CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
141
142static int __init checkreqprot_setup(char *str)
143{
144 unsigned long checkreqprot;
145
146 if (!kstrtoul(str, 0, &checkreqprot))
147 selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
148 return 1;
149}
150__setup("checkreqprot=", checkreqprot_setup);
151
Christoph Lametere18b8902006-12-06 20:33:20 -0800152static struct kmem_cache *sel_inode_cache;
Sangwoo63205652015-10-21 17:44:30 -0400153static struct kmem_cache *file_security_cache;
James Morris7cae7e22006-03-22 00:09:22 -0800154
Paul Moored621d352008-01-29 08:43:36 -0500155/**
156 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
157 *
158 * Description:
159 * This function checks the SECMARK reference counter to see if any SECMARK
160 * targets are currently configured, if the reference counter is greater than
161 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
Chris PeBenito2be4d742013-05-03 09:05:39 -0400162 * enabled, false (0) if SECMARK is disabled. If the always_check_network
163 * policy capability is enabled, SECMARK is always considered enabled.
Paul Moored621d352008-01-29 08:43:36 -0500164 *
165 */
166static int selinux_secmark_enabled(void)
167{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500168 return (selinux_policycap_alwaysnetwork() ||
169 atomic_read(&selinux_secmark_refcount));
Chris PeBenito2be4d742013-05-03 09:05:39 -0400170}
171
172/**
173 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
174 *
175 * Description:
176 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
177 * (1) if any are enabled or false (0) if neither are enabled. If the
178 * always_check_network policy capability is enabled, peer labeling
179 * is always considered enabled.
180 *
181 */
182static int selinux_peerlbl_enabled(void)
183{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500184 return (selinux_policycap_alwaysnetwork() ||
185 netlbl_enabled() || selinux_xfrm_enabled());
Paul Moored621d352008-01-29 08:43:36 -0500186}
187
Paul Moore615e51f2014-06-26 14:33:56 -0400188static int selinux_netcache_avc_callback(u32 event)
189{
190 if (event == AVC_CALLBACK_RESET) {
191 sel_netif_flush();
192 sel_netnode_flush();
193 sel_netport_flush();
194 synchronize_net();
195 }
196 return 0;
197}
198
Daniel Jurgens8f408ab2017-05-19 15:48:53 +0300199static int selinux_lsm_notifier_avc_callback(u32 event)
200{
Daniel Jurgens409dcf32017-05-19 15:48:59 +0300201 if (event == AVC_CALLBACK_RESET) {
202 sel_ib_pkey_flush();
Daniel Jurgens8f408ab2017-05-19 15:48:53 +0300203 call_lsm_notifier(LSM_POLICY_CHANGE, NULL);
Daniel Jurgens409dcf32017-05-19 15:48:59 +0300204 }
Daniel Jurgens8f408ab2017-05-19 15:48:53 +0300205
206 return 0;
207}
208
David Howellsd84f4f92008-11-14 10:39:23 +1100209/*
210 * initialise the security for the init task
211 */
212static void cred_init_security(void)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700213{
David Howells3b11a1d2008-11-14 10:39:26 +1100214 struct cred *cred = (struct cred *) current->real_cred;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700215 struct task_security_struct *tsec;
216
James Morris89d155e2005-10-30 14:59:21 -0800217 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700218 if (!tsec)
David Howellsd84f4f92008-11-14 10:39:23 +1100219 panic("SELinux: Failed to initialize initial task.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -0700220
David Howellsd84f4f92008-11-14 10:39:23 +1100221 tsec->osid = tsec->sid = SECINITSID_KERNEL;
David Howellsf1752ee2008-11-14 10:39:17 +1100222 cred->security = tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700223}
224
David Howells275bb412008-11-14 10:39:19 +1100225/*
David Howells88e67f32008-11-14 10:39:21 +1100226 * get the security ID of a set of credentials
227 */
228static inline u32 cred_sid(const struct cred *cred)
229{
230 const struct task_security_struct *tsec;
231
232 tsec = cred->security;
233 return tsec->sid;
234}
235
236/*
David Howells3b11a1d2008-11-14 10:39:26 +1100237 * get the objective security ID of a task
David Howells275bb412008-11-14 10:39:19 +1100238 */
239static inline u32 task_sid(const struct task_struct *task)
240{
David Howells275bb412008-11-14 10:39:19 +1100241 u32 sid;
242
243 rcu_read_lock();
David Howells88e67f32008-11-14 10:39:21 +1100244 sid = cred_sid(__task_cred(task));
David Howells275bb412008-11-14 10:39:19 +1100245 rcu_read_unlock();
246 return sid;
247}
248
David Howells88e67f32008-11-14 10:39:21 +1100249/* Allocate and free functions for each kind of security blob. */
250
Linus Torvalds1da177e2005-04-16 15:20:36 -0700251static int inode_alloc_security(struct inode *inode)
252{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700253 struct inode_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +1100254 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700255
Josef Bacika02fe132008-04-04 09:35:05 +1100256 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700257 if (!isec)
258 return -ENOMEM;
259
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +0100260 spin_lock_init(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700261 INIT_LIST_HEAD(&isec->list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700262 isec->inode = inode;
263 isec->sid = SECINITSID_UNLABELED;
264 isec->sclass = SECCLASS_FILE;
David Howells275bb412008-11-14 10:39:19 +1100265 isec->task_sid = sid;
Andreas Gruenbacher42059112016-11-10 22:18:27 +0100266 isec->initialized = LABEL_INVALID;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700267 inode->i_security = isec;
268
269 return 0;
270}
271
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500272static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
273
274/*
275 * Try reloading inode security labels that have been marked as invalid. The
276 * @may_sleep parameter indicates when sleeping and thus reloading labels is
Andreas Gruenbacher42059112016-11-10 22:18:27 +0100277 * allowed; when set to false, returns -ECHILD when the label is
Al Viroe9193282018-04-24 21:31:02 -0400278 * invalid. The @dentry parameter should be set to a dentry of the inode.
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500279 */
280static int __inode_security_revalidate(struct inode *inode,
Al Viroe9193282018-04-24 21:31:02 -0400281 struct dentry *dentry,
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500282 bool may_sleep)
283{
284 struct inode_security_struct *isec = inode->i_security;
285
286 might_sleep_if(may_sleep);
287
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500288 if (selinux_state.initialized &&
289 isec->initialized != LABEL_INITIALIZED) {
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500290 if (!may_sleep)
291 return -ECHILD;
292
293 /*
294 * Try reloading the inode security label. This will fail if
295 * @opt_dentry is NULL and no dentry for this inode can be
296 * found; in that case, continue using the old label.
297 */
Al Viroe9193282018-04-24 21:31:02 -0400298 inode_doinit_with_dentry(inode, dentry);
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500299 }
300 return 0;
301}
302
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500303static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
304{
305 return inode->i_security;
306}
307
308static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
309{
310 int error;
311
312 error = __inode_security_revalidate(inode, NULL, !rcu);
313 if (error)
314 return ERR_PTR(error);
315 return inode->i_security;
316}
317
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500318/*
319 * Get the security label of an inode.
320 */
321static struct inode_security_struct *inode_security(struct inode *inode)
322{
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500323 __inode_security_revalidate(inode, NULL, true);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500324 return inode->i_security;
325}
326
Paul Moore2c971652016-04-19 16:36:28 -0400327static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
328{
329 struct inode *inode = d_backing_inode(dentry);
330
331 return inode->i_security;
332}
333
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500334/*
335 * Get the security label of a dentry's backing inode.
336 */
337static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
338{
339 struct inode *inode = d_backing_inode(dentry);
340
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500341 __inode_security_revalidate(inode, dentry, true);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500342 return inode->i_security;
343}
344
Steven Rostedt3dc91d42014-01-09 21:46:34 -0500345static void inode_free_rcu(struct rcu_head *head)
346{
347 struct inode_security_struct *isec;
348
349 isec = container_of(head, struct inode_security_struct, rcu);
350 kmem_cache_free(sel_inode_cache, isec);
351}
352
Linus Torvalds1da177e2005-04-16 15:20:36 -0700353static void inode_free_security(struct inode *inode)
354{
355 struct inode_security_struct *isec = inode->i_security;
356 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
357
Waiman Long9629d042015-07-10 17:19:56 -0400358 /*
359 * As not all inode security structures are in a list, we check for
360 * empty list outside of the lock to make sure that we won't waste
361 * time taking a lock doing nothing.
362 *
363 * The list_del_init() function can be safely called more than once.
364 * It should not be possible for this function to be called with
365 * concurrent list_add(), but for better safety against future changes
366 * in the code, we use list_empty_careful() here.
367 */
368 if (!list_empty_careful(&isec->list)) {
369 spin_lock(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700370 list_del_init(&isec->list);
Waiman Long9629d042015-07-10 17:19:56 -0400371 spin_unlock(&sbsec->isec_lock);
372 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700373
Steven Rostedt3dc91d42014-01-09 21:46:34 -0500374 /*
375 * The inode may still be referenced in a path walk and
376 * a call to selinux_inode_permission() can be made
377 * after inode_free_security() is called. Ideally, the VFS
378 * wouldn't do this, but fixing that is a much harder
379 * job. For now, simply free the i_security via RCU, and
380 * leave the current inode->i_security pointer intact.
381 * The inode will be freed after the RCU grace period too.
382 */
383 call_rcu(&isec->rcu, inode_free_rcu);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700384}
385
386static int file_alloc_security(struct file *file)
387{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700388 struct file_security_struct *fsec;
David Howells275bb412008-11-14 10:39:19 +1100389 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700390
Sangwoo63205652015-10-21 17:44:30 -0400391 fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700392 if (!fsec)
393 return -ENOMEM;
394
David Howells275bb412008-11-14 10:39:19 +1100395 fsec->sid = sid;
396 fsec->fown_sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700397 file->f_security = fsec;
398
399 return 0;
400}
401
402static void file_free_security(struct file *file)
403{
404 struct file_security_struct *fsec = file->f_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700405 file->f_security = NULL;
Sangwoo63205652015-10-21 17:44:30 -0400406 kmem_cache_free(file_security_cache, fsec);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700407}
408
409static int superblock_alloc_security(struct super_block *sb)
410{
411 struct superblock_security_struct *sbsec;
412
James Morris89d155e2005-10-30 14:59:21 -0800413 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700414 if (!sbsec)
415 return -ENOMEM;
416
Eric Parisbc7e9822006-09-25 23:32:02 -0700417 mutex_init(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700418 INIT_LIST_HEAD(&sbsec->isec_head);
419 spin_lock_init(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700420 sbsec->sb = sb;
421 sbsec->sid = SECINITSID_UNLABELED;
422 sbsec->def_sid = SECINITSID_FILE;
Eric Parisc312feb2006-07-10 04:43:53 -0700423 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700424 sb->s_security = sbsec;
425
426 return 0;
427}
428
429static void superblock_free_security(struct super_block *sb)
430{
431 struct superblock_security_struct *sbsec = sb->s_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700432 sb->s_security = NULL;
433 kfree(sbsec);
434}
435
Linus Torvalds1da177e2005-04-16 15:20:36 -0700436static inline int inode_doinit(struct inode *inode)
437{
438 return inode_doinit_with_dentry(inode, NULL);
439}
440
441enum {
Eric Paris31e87932007-09-19 17:19:12 -0400442 Opt_error = -1,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700443 Opt_context = 1,
444 Opt_fscontext = 2,
Eric Parisc9180a52007-11-30 13:00:35 -0500445 Opt_defcontext = 3,
446 Opt_rootcontext = 4,
David P. Quigley11689d42009-01-16 09:22:03 -0500447 Opt_labelsupport = 5,
Eric Parisd355987f2012-08-24 15:58:53 -0400448 Opt_nextmntopt = 6,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700449};
450
Eric Parisd355987f2012-08-24 15:58:53 -0400451#define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1)
452
Steven Whitehousea447c092008-10-13 10:46:57 +0100453static const match_table_t tokens = {
Eric Paris832cbd92008-04-01 13:24:09 -0400454 {Opt_context, CONTEXT_STR "%s"},
455 {Opt_fscontext, FSCONTEXT_STR "%s"},
456 {Opt_defcontext, DEFCONTEXT_STR "%s"},
457 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
David P. Quigley11689d42009-01-16 09:22:03 -0500458 {Opt_labelsupport, LABELSUPP_STR},
Eric Paris31e87932007-09-19 17:19:12 -0400459 {Opt_error, NULL},
Linus Torvalds1da177e2005-04-16 15:20:36 -0700460};
461
462#define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
463
Eric Parisc312feb2006-07-10 04:43:53 -0700464static int may_context_mount_sb_relabel(u32 sid,
465 struct superblock_security_struct *sbsec,
David Howells275bb412008-11-14 10:39:19 +1100466 const struct cred *cred)
Eric Parisc312feb2006-07-10 04:43:53 -0700467{
David Howells275bb412008-11-14 10:39:19 +1100468 const struct task_security_struct *tsec = cred->security;
Eric Parisc312feb2006-07-10 04:43:53 -0700469 int rc;
470
Stephen Smalley6b6bc622018-03-05 11:47:56 -0500471 rc = avc_has_perm(&selinux_state,
472 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
Eric Parisc312feb2006-07-10 04:43:53 -0700473 FILESYSTEM__RELABELFROM, NULL);
474 if (rc)
475 return rc;
476
Stephen Smalley6b6bc622018-03-05 11:47:56 -0500477 rc = avc_has_perm(&selinux_state,
478 tsec->sid, sid, SECCLASS_FILESYSTEM,
Eric Parisc312feb2006-07-10 04:43:53 -0700479 FILESYSTEM__RELABELTO, NULL);
480 return rc;
481}
482
Eric Paris08089252006-07-10 04:43:55 -0700483static int may_context_mount_inode_relabel(u32 sid,
484 struct superblock_security_struct *sbsec,
David Howells275bb412008-11-14 10:39:19 +1100485 const struct cred *cred)
Eric Paris08089252006-07-10 04:43:55 -0700486{
David Howells275bb412008-11-14 10:39:19 +1100487 const struct task_security_struct *tsec = cred->security;
Eric Paris08089252006-07-10 04:43:55 -0700488 int rc;
Stephen Smalley6b6bc622018-03-05 11:47:56 -0500489 rc = avc_has_perm(&selinux_state,
490 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
Eric Paris08089252006-07-10 04:43:55 -0700491 FILESYSTEM__RELABELFROM, NULL);
492 if (rc)
493 return rc;
494
Stephen Smalley6b6bc622018-03-05 11:47:56 -0500495 rc = avc_has_perm(&selinux_state,
496 sid, sbsec->sid, SECCLASS_FILESYSTEM,
Eric Paris08089252006-07-10 04:43:55 -0700497 FILESYSTEM__ASSOCIATE, NULL);
498 return rc;
499}
500
Eric Parisb43e7252012-10-10 14:27:35 -0400501static int selinux_is_sblabel_mnt(struct super_block *sb)
502{
503 struct superblock_security_struct *sbsec = sb->s_security;
504
Mark Salyzynd5f3a5f2015-02-04 11:34:30 -0500505 return sbsec->behavior == SECURITY_FS_USE_XATTR ||
506 sbsec->behavior == SECURITY_FS_USE_TRANS ||
507 sbsec->behavior == SECURITY_FS_USE_TASK ||
J. Bruce Fields9fc2b4b2015-06-04 15:57:25 -0400508 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
Mark Salyzynd5f3a5f2015-02-04 11:34:30 -0500509 /* Special handling. Genfs but also in-core setxattr handler */
510 !strcmp(sb->s_type->name, "sysfs") ||
511 !strcmp(sb->s_type->name, "pstore") ||
512 !strcmp(sb->s_type->name, "debugfs") ||
Yongqin Liua2c7c6f2017-01-09 10:07:30 -0500513 !strcmp(sb->s_type->name, "tracefs") ||
Stephen Smalley2651225b2017-02-28 10:35:56 -0500514 !strcmp(sb->s_type->name, "rootfs") ||
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500515 (selinux_policycap_cgroupseclabel() &&
Stephen Smalley2651225b2017-02-28 10:35:56 -0500516 (!strcmp(sb->s_type->name, "cgroup") ||
517 !strcmp(sb->s_type->name, "cgroup2")));
Eric Parisb43e7252012-10-10 14:27:35 -0400518}
519
Eric Parisc9180a52007-11-30 13:00:35 -0500520static int sb_finish_set_opts(struct super_block *sb)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700521{
522 struct superblock_security_struct *sbsec = sb->s_security;
523 struct dentry *root = sb->s_root;
David Howellsc6f493d2015-03-17 22:26:22 +0000524 struct inode *root_inode = d_backing_inode(root);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700525 int rc = 0;
526
Linus Torvalds1da177e2005-04-16 15:20:36 -0700527 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
528 /* Make sure that the xattr handler exists and that no
529 error other than -ENODATA is returned by getxattr on
530 the root directory. -ENODATA is ok, as this may be
531 the first boot of the SELinux kernel before we have
532 assigned xattr values to the filesystem. */
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +0200533 if (!(root_inode->i_opflags & IOP_XATTR)) {
peter enderborgc103a912018-06-12 10:09:03 +0200534 pr_warn("SELinux: (dev %s, type %s) has no "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800535 "xattr support\n", sb->s_id, sb->s_type->name);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700536 rc = -EOPNOTSUPP;
537 goto out;
538 }
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +0200539
540 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700541 if (rc < 0 && rc != -ENODATA) {
542 if (rc == -EOPNOTSUPP)
peter enderborgc103a912018-06-12 10:09:03 +0200543 pr_warn("SELinux: (dev %s, type "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800544 "%s) has no security xattr handler\n",
545 sb->s_id, sb->s_type->name);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700546 else
peter enderborgc103a912018-06-12 10:09:03 +0200547 pr_warn("SELinux: (dev %s, type "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800548 "%s) getxattr errno %d\n", sb->s_id,
549 sb->s_type->name, -rc);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700550 goto out;
551 }
552 }
553
Eric Pariseadcabc2012-08-24 15:59:14 -0400554 sbsec->flags |= SE_SBINITIALIZED;
Scott Mayhew0b4d3452017-06-05 11:45:04 -0400555
556 /*
557 * Explicitly set or clear SBLABEL_MNT. It's not sufficient to simply
558 * leave the flag untouched because sb_clone_mnt_opts might be handing
559 * us a superblock that needs the flag to be cleared.
560 */
Eric Parisb43e7252012-10-10 14:27:35 -0400561 if (selinux_is_sblabel_mnt(sb))
Eric Paris12f348b2012-10-09 10:56:25 -0400562 sbsec->flags |= SBLABEL_MNT;
Scott Mayhew0b4d3452017-06-05 11:45:04 -0400563 else
564 sbsec->flags &= ~SBLABEL_MNT;
David P. Quigleyddd29ec2009-09-09 14:25:37 -0400565
Linus Torvalds1da177e2005-04-16 15:20:36 -0700566 /* Initialize the root inode. */
Eric Parisc9180a52007-11-30 13:00:35 -0500567 rc = inode_doinit_with_dentry(root_inode, root);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700568
569 /* Initialize any other inodes associated with the superblock, e.g.
570 inodes created prior to initial policy load or inodes created
571 during get_sb by a pseudo filesystem that directly
572 populates itself. */
573 spin_lock(&sbsec->isec_lock);
574next_inode:
575 if (!list_empty(&sbsec->isec_head)) {
576 struct inode_security_struct *isec =
577 list_entry(sbsec->isec_head.next,
Eric Parisc9180a52007-11-30 13:00:35 -0500578 struct inode_security_struct, list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700579 struct inode *inode = isec->inode;
Stephen Smalley923190d2014-10-06 16:32:52 -0400580 list_del_init(&isec->list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700581 spin_unlock(&sbsec->isec_lock);
582 inode = igrab(inode);
583 if (inode) {
Eric Parisc9180a52007-11-30 13:00:35 -0500584 if (!IS_PRIVATE(inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700585 inode_doinit(inode);
586 iput(inode);
587 }
588 spin_lock(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700589 goto next_inode;
590 }
591 spin_unlock(&sbsec->isec_lock);
592out:
Eric Parisc9180a52007-11-30 13:00:35 -0500593 return rc;
594}
595
596/*
597 * This function should allow an FS to ask what it's mount security
598 * options were so it can use those later for submounts, displaying
599 * mount options, or whatever.
600 */
601static int selinux_get_mnt_opts(const struct super_block *sb,
Eric Parise0007522008-03-05 10:31:54 -0500602 struct security_mnt_opts *opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500603{
604 int rc = 0, i;
605 struct superblock_security_struct *sbsec = sb->s_security;
606 char *context = NULL;
607 u32 len;
608 char tmp;
609
Eric Parise0007522008-03-05 10:31:54 -0500610 security_init_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500611
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500612 if (!(sbsec->flags & SE_SBINITIALIZED))
Eric Parisc9180a52007-11-30 13:00:35 -0500613 return -EINVAL;
614
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500615 if (!selinux_state.initialized)
Eric Parisc9180a52007-11-30 13:00:35 -0500616 return -EINVAL;
617
Eric Parisaf8e50c2012-08-24 15:59:00 -0400618 /* make sure we always check enough bits to cover the mask */
619 BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
620
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500621 tmp = sbsec->flags & SE_MNTMASK;
Eric Parisc9180a52007-11-30 13:00:35 -0500622 /* count the number of mount options for this sb */
Eric Parisaf8e50c2012-08-24 15:59:00 -0400623 for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
Eric Parisc9180a52007-11-30 13:00:35 -0500624 if (tmp & 0x01)
Eric Parise0007522008-03-05 10:31:54 -0500625 opts->num_mnt_opts++;
Eric Parisc9180a52007-11-30 13:00:35 -0500626 tmp >>= 1;
627 }
David P. Quigley11689d42009-01-16 09:22:03 -0500628 /* Check if the Label support flag is set */
Eric Paris0b4bdb32013-08-28 13:32:42 -0400629 if (sbsec->flags & SBLABEL_MNT)
David P. Quigley11689d42009-01-16 09:22:03 -0500630 opts->num_mnt_opts++;
Eric Parisc9180a52007-11-30 13:00:35 -0500631
Eric Parise0007522008-03-05 10:31:54 -0500632 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
633 if (!opts->mnt_opts) {
Eric Parisc9180a52007-11-30 13:00:35 -0500634 rc = -ENOMEM;
635 goto out_free;
636 }
637
Eric Parise0007522008-03-05 10:31:54 -0500638 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
639 if (!opts->mnt_opts_flags) {
Eric Parisc9180a52007-11-30 13:00:35 -0500640 rc = -ENOMEM;
641 goto out_free;
642 }
643
644 i = 0;
645 if (sbsec->flags & FSCONTEXT_MNT) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500646 rc = security_sid_to_context(&selinux_state, sbsec->sid,
647 &context, &len);
Eric Parisc9180a52007-11-30 13:00:35 -0500648 if (rc)
649 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500650 opts->mnt_opts[i] = context;
651 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500652 }
653 if (sbsec->flags & CONTEXT_MNT) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500654 rc = security_sid_to_context(&selinux_state,
655 sbsec->mntpoint_sid,
656 &context, &len);
Eric Parisc9180a52007-11-30 13:00:35 -0500657 if (rc)
658 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500659 opts->mnt_opts[i] = context;
660 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500661 }
662 if (sbsec->flags & DEFCONTEXT_MNT) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500663 rc = security_sid_to_context(&selinux_state, sbsec->def_sid,
664 &context, &len);
Eric Parisc9180a52007-11-30 13:00:35 -0500665 if (rc)
666 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500667 opts->mnt_opts[i] = context;
668 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500669 }
670 if (sbsec->flags & ROOTCONTEXT_MNT) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500671 struct dentry *root = sbsec->sb->s_root;
672 struct inode_security_struct *isec = backing_inode_security(root);
Eric Parisc9180a52007-11-30 13:00:35 -0500673
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500674 rc = security_sid_to_context(&selinux_state, isec->sid,
675 &context, &len);
Eric Parisc9180a52007-11-30 13:00:35 -0500676 if (rc)
677 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500678 opts->mnt_opts[i] = context;
679 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500680 }
Eric Paris12f348b2012-10-09 10:56:25 -0400681 if (sbsec->flags & SBLABEL_MNT) {
David P. Quigley11689d42009-01-16 09:22:03 -0500682 opts->mnt_opts[i] = NULL;
Eric Paris12f348b2012-10-09 10:56:25 -0400683 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
David P. Quigley11689d42009-01-16 09:22:03 -0500684 }
Eric Parisc9180a52007-11-30 13:00:35 -0500685
Eric Parise0007522008-03-05 10:31:54 -0500686 BUG_ON(i != opts->num_mnt_opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500687
688 return 0;
689
690out_free:
Eric Parise0007522008-03-05 10:31:54 -0500691 security_free_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500692 return rc;
693}
694
695static int bad_option(struct superblock_security_struct *sbsec, char flag,
696 u32 old_sid, u32 new_sid)
697{
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500698 char mnt_flags = sbsec->flags & SE_MNTMASK;
699
Eric Parisc9180a52007-11-30 13:00:35 -0500700 /* check if the old mount command had the same options */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500701 if (sbsec->flags & SE_SBINITIALIZED)
Eric Parisc9180a52007-11-30 13:00:35 -0500702 if (!(sbsec->flags & flag) ||
703 (old_sid != new_sid))
704 return 1;
705
706 /* check if we were passed the same options twice,
707 * aka someone passed context=a,context=b
708 */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500709 if (!(sbsec->flags & SE_SBINITIALIZED))
710 if (mnt_flags & flag)
Eric Parisc9180a52007-11-30 13:00:35 -0500711 return 1;
712 return 0;
713}
Eric Parise0007522008-03-05 10:31:54 -0500714
Eric Parisc9180a52007-11-30 13:00:35 -0500715/*
716 * Allow filesystems with binary mount data to explicitly set mount point
717 * labeling information.
718 */
Eric Parise0007522008-03-05 10:31:54 -0500719static int selinux_set_mnt_opts(struct super_block *sb,
David Quigley649f6e72013-05-22 12:50:36 -0400720 struct security_mnt_opts *opts,
721 unsigned long kern_flags,
722 unsigned long *set_kern_flags)
Eric Parisc9180a52007-11-30 13:00:35 -0500723{
David Howells275bb412008-11-14 10:39:19 +1100724 const struct cred *cred = current_cred();
Eric Parisc9180a52007-11-30 13:00:35 -0500725 int rc = 0, i;
Eric Parisc9180a52007-11-30 13:00:35 -0500726 struct superblock_security_struct *sbsec = sb->s_security;
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800727 const char *name = sb->s_type->name;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500728 struct dentry *root = sbsec->sb->s_root;
Paul Moore2c971652016-04-19 16:36:28 -0400729 struct inode_security_struct *root_isec;
Eric Parisc9180a52007-11-30 13:00:35 -0500730 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
731 u32 defcontext_sid = 0;
Eric Parise0007522008-03-05 10:31:54 -0500732 char **mount_options = opts->mnt_opts;
733 int *flags = opts->mnt_opts_flags;
734 int num_opts = opts->num_mnt_opts;
Eric Parisc9180a52007-11-30 13:00:35 -0500735
736 mutex_lock(&sbsec->lock);
737
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500738 if (!selinux_state.initialized) {
Eric Parisc9180a52007-11-30 13:00:35 -0500739 if (!num_opts) {
740 /* Defer initialization until selinux_complete_init,
741 after the initial policy is loaded and the security
742 server is ready to handle calls. */
Eric Parisc9180a52007-11-30 13:00:35 -0500743 goto out;
744 }
745 rc = -EINVAL;
peter enderborgc103a912018-06-12 10:09:03 +0200746 pr_warn("SELinux: Unable to set superblock options "
Eric Paris744ba352008-04-17 11:52:44 -0400747 "before the security server is initialized\n");
Eric Parisc9180a52007-11-30 13:00:35 -0500748 goto out;
749 }
David Quigley649f6e72013-05-22 12:50:36 -0400750 if (kern_flags && !set_kern_flags) {
751 /* Specifying internal flags without providing a place to
752 * place the results is not allowed */
753 rc = -EINVAL;
754 goto out;
755 }
Eric Parisc9180a52007-11-30 13:00:35 -0500756
757 /*
Eric Parise0007522008-03-05 10:31:54 -0500758 * Binary mount data FS will come through this function twice. Once
759 * from an explicit call and once from the generic calls from the vfs.
760 * Since the generic VFS calls will not contain any security mount data
761 * we need to skip the double mount verification.
762 *
763 * This does open a hole in which we will not notice if the first
764 * mount using this sb set explict options and a second mount using
765 * this sb does not set any security options. (The first options
766 * will be used for both mounts)
767 */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500768 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
Eric Parise0007522008-03-05 10:31:54 -0500769 && (num_opts == 0))
Eric Parisf5269712008-05-14 11:27:45 -0400770 goto out;
Eric Parise0007522008-03-05 10:31:54 -0500771
Paul Moore2c971652016-04-19 16:36:28 -0400772 root_isec = backing_inode_security_novalidate(root);
773
Eric Parise0007522008-03-05 10:31:54 -0500774 /*
Eric Parisc9180a52007-11-30 13:00:35 -0500775 * parse the mount options, check if they are valid sids.
776 * also check if someone is trying to mount the same sb more
777 * than once with different security options.
778 */
779 for (i = 0; i < num_opts; i++) {
780 u32 sid;
David P. Quigley11689d42009-01-16 09:22:03 -0500781
Eric Paris12f348b2012-10-09 10:56:25 -0400782 if (flags[i] == SBLABEL_MNT)
David P. Quigley11689d42009-01-16 09:22:03 -0500783 continue;
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500784 rc = security_context_str_to_sid(&selinux_state,
785 mount_options[i], &sid,
786 GFP_KERNEL);
Eric Parisc9180a52007-11-30 13:00:35 -0500787 if (rc) {
peter enderborgc103a912018-06-12 10:09:03 +0200788 pr_warn("SELinux: security_context_str_to_sid"
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800789 "(%s) failed for (dev %s, type %s) errno=%d\n",
790 mount_options[i], sb->s_id, name, rc);
Eric Parisc9180a52007-11-30 13:00:35 -0500791 goto out;
792 }
793 switch (flags[i]) {
794 case FSCONTEXT_MNT:
795 fscontext_sid = sid;
796
797 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
798 fscontext_sid))
799 goto out_double_mount;
800
801 sbsec->flags |= FSCONTEXT_MNT;
802 break;
803 case CONTEXT_MNT:
804 context_sid = sid;
805
806 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
807 context_sid))
808 goto out_double_mount;
809
810 sbsec->flags |= CONTEXT_MNT;
811 break;
812 case ROOTCONTEXT_MNT:
813 rootcontext_sid = sid;
814
815 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
816 rootcontext_sid))
817 goto out_double_mount;
818
819 sbsec->flags |= ROOTCONTEXT_MNT;
820
821 break;
822 case DEFCONTEXT_MNT:
823 defcontext_sid = sid;
824
825 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
826 defcontext_sid))
827 goto out_double_mount;
828
829 sbsec->flags |= DEFCONTEXT_MNT;
830
831 break;
832 default:
833 rc = -EINVAL;
834 goto out;
835 }
836 }
837
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500838 if (sbsec->flags & SE_SBINITIALIZED) {
Eric Parisc9180a52007-11-30 13:00:35 -0500839 /* previously mounted with options, but not on this attempt? */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500840 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500841 goto out_double_mount;
842 rc = 0;
843 goto out;
844 }
845
James Morris089be432008-07-15 18:32:49 +1000846 if (strcmp(sb->s_type->name, "proc") == 0)
Stephen Smalley134509d2015-06-04 16:22:17 -0400847 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
848
Stephen Smalley8e014722015-06-04 16:22:17 -0400849 if (!strcmp(sb->s_type->name, "debugfs") ||
Jeff Vander Stoep6a391182017-06-20 09:35:33 -0700850 !strcmp(sb->s_type->name, "tracefs") ||
Stephen Smalley8e014722015-06-04 16:22:17 -0400851 !strcmp(sb->s_type->name, "sysfs") ||
Antonio Murdaca901ef842017-02-09 17:02:42 +0100852 !strcmp(sb->s_type->name, "pstore") ||
853 !strcmp(sb->s_type->name, "cgroup") ||
854 !strcmp(sb->s_type->name, "cgroup2"))
Stephen Smalley134509d2015-06-04 16:22:17 -0400855 sbsec->flags |= SE_SBGENFS;
Eric Parisc9180a52007-11-30 13:00:35 -0500856
David Quigleyeb9ae682013-05-22 12:50:37 -0400857 if (!sbsec->behavior) {
858 /*
859 * Determine the labeling behavior to use for this
860 * filesystem type.
861 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500862 rc = security_fs_use(&selinux_state, sb);
David Quigleyeb9ae682013-05-22 12:50:37 -0400863 if (rc) {
peter enderborgc103a912018-06-12 10:09:03 +0200864 pr_warn("%s: security_fs_use(%s) returned %d\n",
David Quigleyeb9ae682013-05-22 12:50:37 -0400865 __func__, sb->s_type->name, rc);
866 goto out;
867 }
Eric Parisc9180a52007-11-30 13:00:35 -0500868 }
Seth Forsheeaad82892016-04-26 14:36:20 -0500869
870 /*
Stephen Smalley01593d32017-01-09 10:07:31 -0500871 * If this is a user namespace mount and the filesystem type is not
872 * explicitly whitelisted, then no contexts are allowed on the command
873 * line and security labels must be ignored.
Seth Forsheeaad82892016-04-26 14:36:20 -0500874 */
Stephen Smalley01593d32017-01-09 10:07:31 -0500875 if (sb->s_user_ns != &init_user_ns &&
876 strcmp(sb->s_type->name, "tmpfs") &&
877 strcmp(sb->s_type->name, "ramfs") &&
878 strcmp(sb->s_type->name, "devpts")) {
Seth Forsheeaad82892016-04-26 14:36:20 -0500879 if (context_sid || fscontext_sid || rootcontext_sid ||
880 defcontext_sid) {
881 rc = -EACCES;
882 goto out;
883 }
884 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
885 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500886 rc = security_transition_sid(&selinux_state,
887 current_sid(),
888 current_sid(),
Seth Forsheeaad82892016-04-26 14:36:20 -0500889 SECCLASS_FILE, NULL,
890 &sbsec->mntpoint_sid);
891 if (rc)
892 goto out;
893 }
894 goto out_set_opts;
895 }
896
Eric Parisc9180a52007-11-30 13:00:35 -0500897 /* sets the context of the superblock for the fs being mounted. */
898 if (fscontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100899 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500900 if (rc)
901 goto out;
902
903 sbsec->sid = fscontext_sid;
904 }
905
906 /*
907 * Switch to using mount point labeling behavior.
908 * sets the label used on all file below the mountpoint, and will set
909 * the superblock context if not already set.
910 */
David Quigleyeb9ae682013-05-22 12:50:37 -0400911 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
912 sbsec->behavior = SECURITY_FS_USE_NATIVE;
913 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
914 }
915
Eric Parisc9180a52007-11-30 13:00:35 -0500916 if (context_sid) {
917 if (!fscontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100918 rc = may_context_mount_sb_relabel(context_sid, sbsec,
919 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500920 if (rc)
921 goto out;
922 sbsec->sid = context_sid;
923 } else {
David Howells275bb412008-11-14 10:39:19 +1100924 rc = may_context_mount_inode_relabel(context_sid, sbsec,
925 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500926 if (rc)
927 goto out;
928 }
929 if (!rootcontext_sid)
930 rootcontext_sid = context_sid;
931
932 sbsec->mntpoint_sid = context_sid;
933 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
934 }
935
936 if (rootcontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100937 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
938 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500939 if (rc)
940 goto out;
941
942 root_isec->sid = rootcontext_sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -0500943 root_isec->initialized = LABEL_INITIALIZED;
Eric Parisc9180a52007-11-30 13:00:35 -0500944 }
945
946 if (defcontext_sid) {
David Quigleyeb9ae682013-05-22 12:50:37 -0400947 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
948 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
Eric Parisc9180a52007-11-30 13:00:35 -0500949 rc = -EINVAL;
peter enderborgc103a912018-06-12 10:09:03 +0200950 pr_warn("SELinux: defcontext option is "
Eric Parisc9180a52007-11-30 13:00:35 -0500951 "invalid for this filesystem type\n");
952 goto out;
953 }
954
955 if (defcontext_sid != sbsec->def_sid) {
956 rc = may_context_mount_inode_relabel(defcontext_sid,
David Howells275bb412008-11-14 10:39:19 +1100957 sbsec, cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500958 if (rc)
959 goto out;
960 }
961
962 sbsec->def_sid = defcontext_sid;
963 }
964
Seth Forsheeaad82892016-04-26 14:36:20 -0500965out_set_opts:
Eric Parisc9180a52007-11-30 13:00:35 -0500966 rc = sb_finish_set_opts(sb);
967out:
Eric Parisbc7e9822006-09-25 23:32:02 -0700968 mutex_unlock(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700969 return rc;
Eric Parisc9180a52007-11-30 13:00:35 -0500970out_double_mount:
971 rc = -EINVAL;
peter enderborgc103a912018-06-12 10:09:03 +0200972 pr_warn("SELinux: mount invalid. Same superblock, different "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800973 "security settings for (dev %s, type %s)\n", sb->s_id, name);
Eric Parisc9180a52007-11-30 13:00:35 -0500974 goto out;
975}
976
Jeff Layton094f7b62013-04-01 08:14:24 -0400977static int selinux_cmp_sb_context(const struct super_block *oldsb,
978 const struct super_block *newsb)
979{
980 struct superblock_security_struct *old = oldsb->s_security;
981 struct superblock_security_struct *new = newsb->s_security;
982 char oldflags = old->flags & SE_MNTMASK;
983 char newflags = new->flags & SE_MNTMASK;
984
985 if (oldflags != newflags)
986 goto mismatch;
987 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
988 goto mismatch;
989 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
990 goto mismatch;
991 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
992 goto mismatch;
993 if (oldflags & ROOTCONTEXT_MNT) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500994 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
995 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
Jeff Layton094f7b62013-04-01 08:14:24 -0400996 if (oldroot->sid != newroot->sid)
997 goto mismatch;
998 }
999 return 0;
1000mismatch:
peter enderborgc103a912018-06-12 10:09:03 +02001001 pr_warn("SELinux: mount invalid. Same superblock, "
Jeff Layton094f7b62013-04-01 08:14:24 -04001002 "different security settings for (dev %s, "
1003 "type %s)\n", newsb->s_id, newsb->s_type->name);
1004 return -EBUSY;
1005}
1006
1007static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001008 struct super_block *newsb,
1009 unsigned long kern_flags,
1010 unsigned long *set_kern_flags)
Eric Parisc9180a52007-11-30 13:00:35 -05001011{
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001012 int rc = 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001013 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
1014 struct superblock_security_struct *newsbsec = newsb->s_security;
1015
1016 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
1017 int set_context = (oldsbsec->flags & CONTEXT_MNT);
1018 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
1019
Eric Paris0f5e6422008-04-21 16:24:11 -04001020 /*
1021 * if the parent was able to be mounted it clearly had no special lsm
Al Viroe8c26252010-03-23 06:36:54 -04001022 * mount options. thus we can safely deal with this superblock later
Eric Paris0f5e6422008-04-21 16:24:11 -04001023 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001024 if (!selinux_state.initialized)
Jeff Layton094f7b62013-04-01 08:14:24 -04001025 return 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001026
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001027 /*
1028 * Specifying internal flags without providing a place to
1029 * place the results is not allowed.
1030 */
1031 if (kern_flags && !set_kern_flags)
1032 return -EINVAL;
1033
Eric Parisc9180a52007-11-30 13:00:35 -05001034 /* how can we clone if the old one wasn't set up?? */
David P. Quigley0d90a7e2009-01-16 09:22:02 -05001035 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
Eric Parisc9180a52007-11-30 13:00:35 -05001036
Jeff Layton094f7b62013-04-01 08:14:24 -04001037 /* if fs is reusing a sb, make sure that the contexts match */
David P. Quigley0d90a7e2009-01-16 09:22:02 -05001038 if (newsbsec->flags & SE_SBINITIALIZED)
Jeff Layton094f7b62013-04-01 08:14:24 -04001039 return selinux_cmp_sb_context(oldsb, newsb);
Eric Paris5a552612008-04-09 14:08:35 -04001040
Eric Parisc9180a52007-11-30 13:00:35 -05001041 mutex_lock(&newsbsec->lock);
1042
1043 newsbsec->flags = oldsbsec->flags;
1044
1045 newsbsec->sid = oldsbsec->sid;
1046 newsbsec->def_sid = oldsbsec->def_sid;
1047 newsbsec->behavior = oldsbsec->behavior;
1048
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001049 if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
1050 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001051 rc = security_fs_use(&selinux_state, newsb);
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001052 if (rc)
1053 goto out;
1054 }
1055
1056 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
1057 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
1058 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
1059 }
1060
Eric Parisc9180a52007-11-30 13:00:35 -05001061 if (set_context) {
1062 u32 sid = oldsbsec->mntpoint_sid;
1063
1064 if (!set_fscontext)
1065 newsbsec->sid = sid;
1066 if (!set_rootcontext) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001067 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
Eric Parisc9180a52007-11-30 13:00:35 -05001068 newisec->sid = sid;
1069 }
1070 newsbsec->mntpoint_sid = sid;
1071 }
1072 if (set_rootcontext) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001073 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
1074 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
Eric Parisc9180a52007-11-30 13:00:35 -05001075
1076 newisec->sid = oldisec->sid;
1077 }
1078
1079 sb_finish_set_opts(newsb);
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001080out:
Eric Parisc9180a52007-11-30 13:00:35 -05001081 mutex_unlock(&newsbsec->lock);
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001082 return rc;
Eric Parisc9180a52007-11-30 13:00:35 -05001083}
1084
Adrian Bunk2e1479d2008-03-17 22:29:23 +02001085static int selinux_parse_opts_str(char *options,
1086 struct security_mnt_opts *opts)
Eric Parisc9180a52007-11-30 13:00:35 -05001087{
Eric Parise0007522008-03-05 10:31:54 -05001088 char *p;
Eric Parisc9180a52007-11-30 13:00:35 -05001089 char *context = NULL, *defcontext = NULL;
1090 char *fscontext = NULL, *rootcontext = NULL;
Eric Parise0007522008-03-05 10:31:54 -05001091 int rc, num_mnt_opts = 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001092
Eric Parise0007522008-03-05 10:31:54 -05001093 opts->num_mnt_opts = 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001094
1095 /* Standard string-based options. */
1096 while ((p = strsep(&options, "|")) != NULL) {
1097 int token;
1098 substring_t args[MAX_OPT_ARGS];
1099
1100 if (!*p)
1101 continue;
1102
1103 token = match_token(p, tokens, args);
1104
1105 switch (token) {
1106 case Opt_context:
1107 if (context || defcontext) {
1108 rc = -EINVAL;
peter enderborgc103a912018-06-12 10:09:03 +02001109 pr_warn(SEL_MOUNT_FAIL_MSG);
Eric Parisc9180a52007-11-30 13:00:35 -05001110 goto out_err;
1111 }
1112 context = match_strdup(&args[0]);
1113 if (!context) {
1114 rc = -ENOMEM;
1115 goto out_err;
1116 }
1117 break;
1118
1119 case Opt_fscontext:
1120 if (fscontext) {
1121 rc = -EINVAL;
peter enderborgc103a912018-06-12 10:09:03 +02001122 pr_warn(SEL_MOUNT_FAIL_MSG);
Eric Parisc9180a52007-11-30 13:00:35 -05001123 goto out_err;
1124 }
1125 fscontext = match_strdup(&args[0]);
1126 if (!fscontext) {
1127 rc = -ENOMEM;
1128 goto out_err;
1129 }
1130 break;
1131
1132 case Opt_rootcontext:
1133 if (rootcontext) {
1134 rc = -EINVAL;
peter enderborgc103a912018-06-12 10:09:03 +02001135 pr_warn(SEL_MOUNT_FAIL_MSG);
Eric Parisc9180a52007-11-30 13:00:35 -05001136 goto out_err;
1137 }
1138 rootcontext = match_strdup(&args[0]);
1139 if (!rootcontext) {
1140 rc = -ENOMEM;
1141 goto out_err;
1142 }
1143 break;
1144
1145 case Opt_defcontext:
1146 if (context || defcontext) {
1147 rc = -EINVAL;
peter enderborgc103a912018-06-12 10:09:03 +02001148 pr_warn(SEL_MOUNT_FAIL_MSG);
Eric Parisc9180a52007-11-30 13:00:35 -05001149 goto out_err;
1150 }
1151 defcontext = match_strdup(&args[0]);
1152 if (!defcontext) {
1153 rc = -ENOMEM;
1154 goto out_err;
1155 }
1156 break;
David P. Quigley11689d42009-01-16 09:22:03 -05001157 case Opt_labelsupport:
1158 break;
Eric Parisc9180a52007-11-30 13:00:35 -05001159 default:
1160 rc = -EINVAL;
peter enderborgc103a912018-06-12 10:09:03 +02001161 pr_warn("SELinux: unknown mount option\n");
Eric Parisc9180a52007-11-30 13:00:35 -05001162 goto out_err;
1163
1164 }
1165 }
1166
Eric Parise0007522008-03-05 10:31:54 -05001167 rc = -ENOMEM;
Tetsuo Handa8931c3b2016-11-14 20:16:12 +09001168 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_KERNEL);
Eric Parise0007522008-03-05 10:31:54 -05001169 if (!opts->mnt_opts)
1170 goto out_err;
1171
Tetsuo Handa8931c3b2016-11-14 20:16:12 +09001172 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int),
1173 GFP_KERNEL);
Paul Moore023f1082017-06-07 16:48:19 -04001174 if (!opts->mnt_opts_flags)
Eric Parise0007522008-03-05 10:31:54 -05001175 goto out_err;
Eric Parisc9180a52007-11-30 13:00:35 -05001176
Eric Parise0007522008-03-05 10:31:54 -05001177 if (fscontext) {
1178 opts->mnt_opts[num_mnt_opts] = fscontext;
1179 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1180 }
1181 if (context) {
1182 opts->mnt_opts[num_mnt_opts] = context;
1183 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1184 }
1185 if (rootcontext) {
1186 opts->mnt_opts[num_mnt_opts] = rootcontext;
1187 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1188 }
1189 if (defcontext) {
1190 opts->mnt_opts[num_mnt_opts] = defcontext;
1191 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1192 }
1193
1194 opts->num_mnt_opts = num_mnt_opts;
1195 return 0;
1196
Eric Parisc9180a52007-11-30 13:00:35 -05001197out_err:
Paul Moore023f1082017-06-07 16:48:19 -04001198 security_free_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -05001199 kfree(context);
1200 kfree(defcontext);
1201 kfree(fscontext);
1202 kfree(rootcontext);
1203 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001204}
1205
Adrian Bunk3583a712008-07-22 20:21:23 +03001206static void selinux_write_opts(struct seq_file *m,
1207 struct security_mnt_opts *opts)
Eric Paris2069f452008-07-04 09:47:13 +10001208{
1209 int i;
1210 char *prefix;
1211
1212 for (i = 0; i < opts->num_mnt_opts; i++) {
David P. Quigley11689d42009-01-16 09:22:03 -05001213 char *has_comma;
1214
1215 if (opts->mnt_opts[i])
1216 has_comma = strchr(opts->mnt_opts[i], ',');
1217 else
1218 has_comma = NULL;
Eric Paris2069f452008-07-04 09:47:13 +10001219
1220 switch (opts->mnt_opts_flags[i]) {
1221 case CONTEXT_MNT:
1222 prefix = CONTEXT_STR;
1223 break;
1224 case FSCONTEXT_MNT:
1225 prefix = FSCONTEXT_STR;
1226 break;
1227 case ROOTCONTEXT_MNT:
1228 prefix = ROOTCONTEXT_STR;
1229 break;
1230 case DEFCONTEXT_MNT:
1231 prefix = DEFCONTEXT_STR;
1232 break;
Eric Paris12f348b2012-10-09 10:56:25 -04001233 case SBLABEL_MNT:
David P. Quigley11689d42009-01-16 09:22:03 -05001234 seq_putc(m, ',');
1235 seq_puts(m, LABELSUPP_STR);
1236 continue;
Eric Paris2069f452008-07-04 09:47:13 +10001237 default:
1238 BUG();
Eric Parisa35c6c832011-04-20 10:21:28 -04001239 return;
Eric Paris2069f452008-07-04 09:47:13 +10001240 };
1241 /* we need a comma before each option */
1242 seq_putc(m, ',');
1243 seq_puts(m, prefix);
1244 if (has_comma)
1245 seq_putc(m, '\"');
Kees Cooka068acf2015-09-04 15:44:57 -07001246 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
Eric Paris2069f452008-07-04 09:47:13 +10001247 if (has_comma)
1248 seq_putc(m, '\"');
1249 }
1250}
1251
1252static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1253{
1254 struct security_mnt_opts opts;
1255 int rc;
1256
1257 rc = selinux_get_mnt_opts(sb, &opts);
Eric Paris383795c2008-07-29 17:07:26 -04001258 if (rc) {
1259 /* before policy load we may get EINVAL, don't show anything */
1260 if (rc == -EINVAL)
1261 rc = 0;
Eric Paris2069f452008-07-04 09:47:13 +10001262 return rc;
Eric Paris383795c2008-07-29 17:07:26 -04001263 }
Eric Paris2069f452008-07-04 09:47:13 +10001264
1265 selinux_write_opts(m, &opts);
1266
1267 security_free_mnt_opts(&opts);
1268
1269 return rc;
1270}
1271
Linus Torvalds1da177e2005-04-16 15:20:36 -07001272static inline u16 inode_mode_to_security_class(umode_t mode)
1273{
1274 switch (mode & S_IFMT) {
1275 case S_IFSOCK:
1276 return SECCLASS_SOCK_FILE;
1277 case S_IFLNK:
1278 return SECCLASS_LNK_FILE;
1279 case S_IFREG:
1280 return SECCLASS_FILE;
1281 case S_IFBLK:
1282 return SECCLASS_BLK_FILE;
1283 case S_IFDIR:
1284 return SECCLASS_DIR;
1285 case S_IFCHR:
1286 return SECCLASS_CHR_FILE;
1287 case S_IFIFO:
1288 return SECCLASS_FIFO_FILE;
1289
1290 }
1291
1292 return SECCLASS_FILE;
1293}
1294
James Morris13402582005-09-30 14:24:34 -04001295static inline int default_protocol_stream(int protocol)
1296{
1297 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1298}
1299
1300static inline int default_protocol_dgram(int protocol)
1301{
1302 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1303}
1304
Linus Torvalds1da177e2005-04-16 15:20:36 -07001305static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1306{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001307 int extsockclass = selinux_policycap_extsockclass();
Stephen Smalleyda69a532017-01-09 10:07:30 -05001308
Linus Torvalds1da177e2005-04-16 15:20:36 -07001309 switch (family) {
1310 case PF_UNIX:
1311 switch (type) {
1312 case SOCK_STREAM:
1313 case SOCK_SEQPACKET:
1314 return SECCLASS_UNIX_STREAM_SOCKET;
1315 case SOCK_DGRAM:
Luis Ressel2a764b52017-07-25 15:13:41 -04001316 case SOCK_RAW:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001317 return SECCLASS_UNIX_DGRAM_SOCKET;
1318 }
1319 break;
1320 case PF_INET:
1321 case PF_INET6:
1322 switch (type) {
1323 case SOCK_STREAM:
Stephen Smalleyda69a532017-01-09 10:07:30 -05001324 case SOCK_SEQPACKET:
James Morris13402582005-09-30 14:24:34 -04001325 if (default_protocol_stream(protocol))
1326 return SECCLASS_TCP_SOCKET;
Stephen Smalleyda69a532017-01-09 10:07:30 -05001327 else if (extsockclass && protocol == IPPROTO_SCTP)
1328 return SECCLASS_SCTP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001329 else
1330 return SECCLASS_RAWIP_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001331 case SOCK_DGRAM:
James Morris13402582005-09-30 14:24:34 -04001332 if (default_protocol_dgram(protocol))
1333 return SECCLASS_UDP_SOCKET;
Stephen Smalleyef379792017-01-09 10:07:31 -05001334 else if (extsockclass && (protocol == IPPROTO_ICMP ||
1335 protocol == IPPROTO_ICMPV6))
Stephen Smalleyda69a532017-01-09 10:07:30 -05001336 return SECCLASS_ICMP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001337 else
1338 return SECCLASS_RAWIP_SOCKET;
James Morris2ee92d42006-11-13 16:09:01 -08001339 case SOCK_DCCP:
1340 return SECCLASS_DCCP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001341 default:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001342 return SECCLASS_RAWIP_SOCKET;
1343 }
1344 break;
1345 case PF_NETLINK:
1346 switch (protocol) {
1347 case NETLINK_ROUTE:
1348 return SECCLASS_NETLINK_ROUTE_SOCKET;
Pavel Emelyanov7f1fb602011-12-06 07:56:43 +00001349 case NETLINK_SOCK_DIAG:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001350 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1351 case NETLINK_NFLOG:
1352 return SECCLASS_NETLINK_NFLOG_SOCKET;
1353 case NETLINK_XFRM:
1354 return SECCLASS_NETLINK_XFRM_SOCKET;
1355 case NETLINK_SELINUX:
1356 return SECCLASS_NETLINK_SELINUX_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001357 case NETLINK_ISCSI:
1358 return SECCLASS_NETLINK_ISCSI_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001359 case NETLINK_AUDIT:
1360 return SECCLASS_NETLINK_AUDIT_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001361 case NETLINK_FIB_LOOKUP:
1362 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1363 case NETLINK_CONNECTOR:
1364 return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1365 case NETLINK_NETFILTER:
1366 return SECCLASS_NETLINK_NETFILTER_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001367 case NETLINK_DNRTMSG:
1368 return SECCLASS_NETLINK_DNRT_SOCKET;
James Morris0c9b7942005-04-16 15:24:13 -07001369 case NETLINK_KOBJECT_UEVENT:
1370 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001371 case NETLINK_GENERIC:
1372 return SECCLASS_NETLINK_GENERIC_SOCKET;
1373 case NETLINK_SCSITRANSPORT:
1374 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1375 case NETLINK_RDMA:
1376 return SECCLASS_NETLINK_RDMA_SOCKET;
1377 case NETLINK_CRYPTO:
1378 return SECCLASS_NETLINK_CRYPTO_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001379 default:
1380 return SECCLASS_NETLINK_SOCKET;
1381 }
1382 case PF_PACKET:
1383 return SECCLASS_PACKET_SOCKET;
1384 case PF_KEY:
1385 return SECCLASS_KEY_SOCKET;
Christopher J. PeBenito3e3ff152006-06-09 00:25:03 -07001386 case PF_APPLETALK:
1387 return SECCLASS_APPLETALK_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001388 }
1389
Stephen Smalleyda69a532017-01-09 10:07:30 -05001390 if (extsockclass) {
1391 switch (family) {
1392 case PF_AX25:
1393 return SECCLASS_AX25_SOCKET;
1394 case PF_IPX:
1395 return SECCLASS_IPX_SOCKET;
1396 case PF_NETROM:
1397 return SECCLASS_NETROM_SOCKET;
Stephen Smalleyda69a532017-01-09 10:07:30 -05001398 case PF_ATMPVC:
1399 return SECCLASS_ATMPVC_SOCKET;
1400 case PF_X25:
1401 return SECCLASS_X25_SOCKET;
1402 case PF_ROSE:
1403 return SECCLASS_ROSE_SOCKET;
1404 case PF_DECnet:
1405 return SECCLASS_DECNET_SOCKET;
1406 case PF_ATMSVC:
1407 return SECCLASS_ATMSVC_SOCKET;
1408 case PF_RDS:
1409 return SECCLASS_RDS_SOCKET;
1410 case PF_IRDA:
1411 return SECCLASS_IRDA_SOCKET;
1412 case PF_PPPOX:
1413 return SECCLASS_PPPOX_SOCKET;
1414 case PF_LLC:
1415 return SECCLASS_LLC_SOCKET;
Stephen Smalleyda69a532017-01-09 10:07:30 -05001416 case PF_CAN:
1417 return SECCLASS_CAN_SOCKET;
1418 case PF_TIPC:
1419 return SECCLASS_TIPC_SOCKET;
1420 case PF_BLUETOOTH:
1421 return SECCLASS_BLUETOOTH_SOCKET;
1422 case PF_IUCV:
1423 return SECCLASS_IUCV_SOCKET;
1424 case PF_RXRPC:
1425 return SECCLASS_RXRPC_SOCKET;
1426 case PF_ISDN:
1427 return SECCLASS_ISDN_SOCKET;
1428 case PF_PHONET:
1429 return SECCLASS_PHONET_SOCKET;
1430 case PF_IEEE802154:
1431 return SECCLASS_IEEE802154_SOCKET;
1432 case PF_CAIF:
1433 return SECCLASS_CAIF_SOCKET;
1434 case PF_ALG:
1435 return SECCLASS_ALG_SOCKET;
1436 case PF_NFC:
1437 return SECCLASS_NFC_SOCKET;
1438 case PF_VSOCK:
1439 return SECCLASS_VSOCK_SOCKET;
1440 case PF_KCM:
1441 return SECCLASS_KCM_SOCKET;
1442 case PF_QIPCRTR:
1443 return SECCLASS_QIPCRTR_SOCKET;
Linus Torvalds3051bf32017-02-22 10:15:09 -08001444 case PF_SMC:
1445 return SECCLASS_SMC_SOCKET;
Björn Töpel68e8b842018-05-02 13:01:22 +02001446 case PF_XDP:
1447 return SECCLASS_XDP_SOCKET;
1448#if PF_MAX > 45
Stephen Smalleyda69a532017-01-09 10:07:30 -05001449#error New address family defined, please update this function.
1450#endif
1451 }
1452 }
1453
Linus Torvalds1da177e2005-04-16 15:20:36 -07001454 return SECCLASS_SOCKET;
1455}
1456
Stephen Smalley134509d2015-06-04 16:22:17 -04001457static int selinux_genfs_get_sid(struct dentry *dentry,
1458 u16 tclass,
1459 u16 flags,
1460 u32 *sid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001461{
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001462 int rc;
Al Virofc640052016-04-10 01:33:30 -04001463 struct super_block *sb = dentry->d_sb;
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001464 char *buffer, *path;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001465
Eric Paris828dfe12008-04-17 13:17:49 -04001466 buffer = (char *)__get_free_page(GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001467 if (!buffer)
1468 return -ENOMEM;
1469
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001470 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1471 if (IS_ERR(path))
1472 rc = PTR_ERR(path);
1473 else {
Stephen Smalley134509d2015-06-04 16:22:17 -04001474 if (flags & SE_SBPROC) {
1475 /* each process gets a /proc/PID/ entry. Strip off the
1476 * PID part to get a valid selinux labeling.
1477 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1478 while (path[1] >= '0' && path[1] <= '9') {
1479 path[1] = '/';
1480 path++;
1481 }
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001482 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001483 rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1484 path, tclass, sid);
Stephen Smalley7bb185e2018-09-04 16:51:36 -04001485 if (rc == -ENOENT) {
1486 /* No match in policy, mark as unlabeled. */
1487 *sid = SECINITSID_UNLABELED;
1488 rc = 0;
1489 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001490 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001491 free_page((unsigned long)buffer);
1492 return rc;
1493}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001494
1495/* The inode's security attributes must be initialized before first use. */
1496static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1497{
1498 struct superblock_security_struct *sbsec = NULL;
1499 struct inode_security_struct *isec = inode->i_security;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001500 u32 task_sid, sid = 0;
1501 u16 sclass;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001502 struct dentry *dentry;
1503#define INITCONTEXTLEN 255
1504 char *context = NULL;
1505 unsigned len = 0;
1506 int rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001507
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05001508 if (isec->initialized == LABEL_INITIALIZED)
Andreas Gruenbacher13457d02016-11-10 22:18:29 +01001509 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001510
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001511 spin_lock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05001512 if (isec->initialized == LABEL_INITIALIZED)
Eric Paris23970742006-09-25 23:32:01 -07001513 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001514
Andreas Gruenbacher13457d02016-11-10 22:18:29 +01001515 if (isec->sclass == SECCLASS_FILE)
1516 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1517
Linus Torvalds1da177e2005-04-16 15:20:36 -07001518 sbsec = inode->i_sb->s_security;
David P. Quigley0d90a7e2009-01-16 09:22:02 -05001519 if (!(sbsec->flags & SE_SBINITIALIZED)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001520 /* Defer initialization until selinux_complete_init,
1521 after the initial policy is loaded and the security
1522 server is ready to handle calls. */
1523 spin_lock(&sbsec->isec_lock);
1524 if (list_empty(&isec->list))
1525 list_add(&isec->list, &sbsec->isec_head);
1526 spin_unlock(&sbsec->isec_lock);
Eric Paris23970742006-09-25 23:32:01 -07001527 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001528 }
1529
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001530 sclass = isec->sclass;
1531 task_sid = isec->task_sid;
1532 sid = isec->sid;
1533 isec->initialized = LABEL_PENDING;
1534 spin_unlock(&isec->lock);
1535
Linus Torvalds1da177e2005-04-16 15:20:36 -07001536 switch (sbsec->behavior) {
David Quigleyeb9ae682013-05-22 12:50:37 -04001537 case SECURITY_FS_USE_NATIVE:
1538 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001539 case SECURITY_FS_USE_XATTR:
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001540 if (!(inode->i_opflags & IOP_XATTR)) {
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001541 sid = sbsec->def_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001542 break;
1543 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001544 /* Need a dentry, since the xattr API requires one.
1545 Life would be simpler if we could just pass the inode. */
1546 if (opt_dentry) {
1547 /* Called from d_instantiate or d_splice_alias. */
1548 dentry = dget(opt_dentry);
1549 } else {
Al Virob1271252018-04-25 10:28:38 -04001550 /*
1551 * Called from selinux_complete_init, try to find a dentry.
1552 * Some filesystems really want a connected one, so try
1553 * that first. We could split SECURITY_FS_USE_XATTR in
1554 * two, depending upon that...
1555 */
Linus Torvalds1da177e2005-04-16 15:20:36 -07001556 dentry = d_find_alias(inode);
Al Virob1271252018-04-25 10:28:38 -04001557 if (!dentry)
1558 dentry = d_find_any_alias(inode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001559 }
1560 if (!dentry) {
Eric Parisdf7f54c2009-03-09 14:35:58 -04001561 /*
1562 * this is can be hit on boot when a file is accessed
1563 * before the policy is loaded. When we load policy we
1564 * may find inodes that have no dentry on the
1565 * sbsec->isec_head list. No reason to complain as these
1566 * will get fixed up the next time we go through
1567 * inode_doinit with a dentry, before these inodes could
1568 * be used again by userspace.
1569 */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001570 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001571 }
1572
1573 len = INITCONTEXTLEN;
Eric Paris4cb912f2009-02-12 14:50:05 -05001574 context = kmalloc(len+1, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001575 if (!context) {
1576 rc = -ENOMEM;
1577 dput(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001578 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001579 }
Eric Paris4cb912f2009-02-12 14:50:05 -05001580 context[len] = '\0';
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001581 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001582 if (rc == -ERANGE) {
James Morris314dabb2009-08-10 22:00:13 +10001583 kfree(context);
1584
Linus Torvalds1da177e2005-04-16 15:20:36 -07001585 /* Need a larger buffer. Query for the right size. */
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001586 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001587 if (rc < 0) {
1588 dput(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001589 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001590 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001591 len = rc;
Eric Paris4cb912f2009-02-12 14:50:05 -05001592 context = kmalloc(len+1, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001593 if (!context) {
1594 rc = -ENOMEM;
1595 dput(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001596 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001597 }
Eric Paris4cb912f2009-02-12 14:50:05 -05001598 context[len] = '\0';
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001599 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001600 }
1601 dput(dentry);
1602 if (rc < 0) {
1603 if (rc != -ENODATA) {
peter enderborgc103a912018-06-12 10:09:03 +02001604 pr_warn("SELinux: %s: getxattr returned "
Harvey Harrisondd6f9532008-03-06 10:03:59 +11001605 "%d for dev=%s ino=%ld\n", __func__,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001606 -rc, inode->i_sb->s_id, inode->i_ino);
1607 kfree(context);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001608 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001609 }
1610 /* Map ENODATA to the default file SID */
1611 sid = sbsec->def_sid;
1612 rc = 0;
1613 } else {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001614 rc = security_context_to_sid_default(&selinux_state,
1615 context, rc, &sid,
Stephen Smalley869ab512008-04-04 08:46:05 -04001616 sbsec->def_sid,
1617 GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001618 if (rc) {
Eric Paris4ba0a8a2009-02-12 15:01:10 -05001619 char *dev = inode->i_sb->s_id;
1620 unsigned long ino = inode->i_ino;
1621
1622 if (rc == -EINVAL) {
1623 if (printk_ratelimit())
peter enderborgc103a912018-06-12 10:09:03 +02001624 pr_notice("SELinux: inode=%lu on dev=%s was found to have an invalid "
Eric Paris4ba0a8a2009-02-12 15:01:10 -05001625 "context=%s. This indicates you may need to relabel the inode or the "
1626 "filesystem in question.\n", ino, dev, context);
1627 } else {
peter enderborgc103a912018-06-12 10:09:03 +02001628 pr_warn("SELinux: %s: context_to_sid(%s) "
Eric Paris4ba0a8a2009-02-12 15:01:10 -05001629 "returned %d for dev=%s ino=%ld\n",
1630 __func__, context, -rc, dev, ino);
1631 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001632 kfree(context);
1633 /* Leave with the unlabeled SID */
1634 rc = 0;
1635 break;
1636 }
1637 }
1638 kfree(context);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001639 break;
1640 case SECURITY_FS_USE_TASK:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001641 sid = task_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001642 break;
1643 case SECURITY_FS_USE_TRANS:
1644 /* Default to the fs SID. */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001645 sid = sbsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001646
1647 /* Try to obtain a transition SID. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001648 rc = security_transition_sid(&selinux_state, task_sid, sid,
1649 sclass, NULL, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001650 if (rc)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001651 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001652 break;
Eric Parisc312feb2006-07-10 04:43:53 -07001653 case SECURITY_FS_USE_MNTPOINT:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001654 sid = sbsec->mntpoint_sid;
Eric Parisc312feb2006-07-10 04:43:53 -07001655 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001656 default:
Eric Parisc312feb2006-07-10 04:43:53 -07001657 /* Default to the fs superblock SID. */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001658 sid = sbsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001659
Stephen Smalley134509d2015-06-04 16:22:17 -04001660 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
Paul Mooref64410e2014-03-19 16:46:18 -04001661 /* We must have a dentry to determine the label on
1662 * procfs inodes */
Al Virob1271252018-04-25 10:28:38 -04001663 if (opt_dentry) {
Paul Mooref64410e2014-03-19 16:46:18 -04001664 /* Called from d_instantiate or
1665 * d_splice_alias. */
1666 dentry = dget(opt_dentry);
Al Virob1271252018-04-25 10:28:38 -04001667 } else {
Paul Mooref64410e2014-03-19 16:46:18 -04001668 /* Called from selinux_complete_init, try to
Al Virob1271252018-04-25 10:28:38 -04001669 * find a dentry. Some filesystems really want
1670 * a connected one, so try that first.
1671 */
Paul Mooref64410e2014-03-19 16:46:18 -04001672 dentry = d_find_alias(inode);
Al Virob1271252018-04-25 10:28:38 -04001673 if (!dentry)
1674 dentry = d_find_any_alias(inode);
1675 }
Paul Mooref64410e2014-03-19 16:46:18 -04001676 /*
1677 * This can be hit on boot when a file is accessed
1678 * before the policy is loaded. When we load policy we
1679 * may find inodes that have no dentry on the
1680 * sbsec->isec_head list. No reason to complain as
1681 * these will get fixed up the next time we go through
1682 * inode_doinit() with a dentry, before these inodes
1683 * could be used again by userspace.
1684 */
1685 if (!dentry)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001686 goto out;
1687 rc = selinux_genfs_get_sid(dentry, sclass,
Stephen Smalley134509d2015-06-04 16:22:17 -04001688 sbsec->flags, &sid);
Paul Mooref64410e2014-03-19 16:46:18 -04001689 dput(dentry);
1690 if (rc)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001691 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001692 }
1693 break;
1694 }
1695
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001696out:
1697 spin_lock(&isec->lock);
1698 if (isec->initialized == LABEL_PENDING) {
1699 if (!sid || rc) {
1700 isec->initialized = LABEL_INVALID;
1701 goto out_unlock;
1702 }
1703
1704 isec->initialized = LABEL_INITIALIZED;
1705 isec->sid = sid;
1706 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001707
Eric Paris23970742006-09-25 23:32:01 -07001708out_unlock:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001709 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001710 return rc;
1711}
1712
1713/* Convert a Linux signal to an access vector. */
1714static inline u32 signal_to_av(int sig)
1715{
1716 u32 perm = 0;
1717
1718 switch (sig) {
1719 case SIGCHLD:
1720 /* Commonly granted from child to parent. */
1721 perm = PROCESS__SIGCHLD;
1722 break;
1723 case SIGKILL:
1724 /* Cannot be caught or ignored */
1725 perm = PROCESS__SIGKILL;
1726 break;
1727 case SIGSTOP:
1728 /* Cannot be caught or ignored */
1729 perm = PROCESS__SIGSTOP;
1730 break;
1731 default:
1732 /* All other signals. */
1733 perm = PROCESS__SIGNAL;
1734 break;
1735 }
1736
1737 return perm;
1738}
1739
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001740#if CAP_LAST_CAP > 63
1741#error Fix SELinux to handle capabilities > 63.
1742#endif
1743
Linus Torvalds1da177e2005-04-16 15:20:36 -07001744/* Check whether a task is allowed to use a capability. */
Eric Paris6a9de492012-01-03 12:25:14 -05001745static int cred_has_capability(const struct cred *cred,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001746 int cap, int audit, bool initns)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001747{
Thomas Liu2bf49692009-07-14 12:14:09 -04001748 struct common_audit_data ad;
Eric Paris06112162008-11-11 22:02:50 +11001749 struct av_decision avd;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001750 u16 sclass;
David Howells3699c532009-01-06 22:27:01 +00001751 u32 sid = cred_sid(cred);
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001752 u32 av = CAP_TO_MASK(cap);
Eric Paris06112162008-11-11 22:02:50 +11001753 int rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001754
Eric Paris50c205f2012-04-04 15:01:43 -04001755 ad.type = LSM_AUDIT_DATA_CAP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001756 ad.u.cap = cap;
1757
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001758 switch (CAP_TO_INDEX(cap)) {
1759 case 0:
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001760 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001761 break;
1762 case 1:
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001763 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001764 break;
1765 default:
peter enderborgc103a912018-06-12 10:09:03 +02001766 pr_err("SELinux: out of range capability %d\n", cap);
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001767 BUG();
Eric Parisa35c6c832011-04-20 10:21:28 -04001768 return -EINVAL;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001769 }
Eric Paris06112162008-11-11 22:02:50 +11001770
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001771 rc = avc_has_perm_noaudit(&selinux_state,
1772 sid, sid, sclass, av, 0, &avd);
Eric Paris9ade0cf2011-04-25 16:26:29 -04001773 if (audit == SECURITY_CAP_AUDIT) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001774 int rc2 = avc_audit(&selinux_state,
1775 sid, sid, sclass, av, &avd, rc, &ad, 0);
Eric Paris9ade0cf2011-04-25 16:26:29 -04001776 if (rc2)
1777 return rc2;
1778 }
Eric Paris06112162008-11-11 22:02:50 +11001779 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001780}
1781
Linus Torvalds1da177e2005-04-16 15:20:36 -07001782/* Check whether a task has a particular permission to an inode.
1783 The 'adp' parameter is optional and allows other audit
1784 data to be passed (e.g. the dentry). */
David Howells88e67f32008-11-14 10:39:21 +11001785static int inode_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001786 struct inode *inode,
1787 u32 perms,
Linus Torvalds19e49832013-10-04 12:54:11 -07001788 struct common_audit_data *adp)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001789{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001790 struct inode_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +11001791 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001792
David Howellse0e81732009-09-02 09:13:40 +01001793 validate_creds(cred);
1794
Eric Paris828dfe12008-04-17 13:17:49 -04001795 if (unlikely(IS_PRIVATE(inode)))
Stephen Smalleybbaca6c2007-02-14 00:34:16 -08001796 return 0;
1797
David Howells88e67f32008-11-14 10:39:21 +11001798 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001799 isec = inode->i_security;
1800
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001801 return avc_has_perm(&selinux_state,
1802 sid, isec->sid, isec->sclass, perms, adp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001803}
1804
1805/* Same as inode_has_perm, but pass explicit audit data containing
1806 the dentry to help the auditing code to more easily generate the
1807 pathname if needed. */
David Howells88e67f32008-11-14 10:39:21 +11001808static inline int dentry_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001809 struct dentry *dentry,
1810 u32 av)
1811{
David Howellsc6f493d2015-03-17 22:26:22 +00001812 struct inode *inode = d_backing_inode(dentry);
Thomas Liu2bf49692009-07-14 12:14:09 -04001813 struct common_audit_data ad;
David Howells88e67f32008-11-14 10:39:21 +11001814
Eric Paris50c205f2012-04-04 15:01:43 -04001815 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Paris2875fa02011-04-28 16:04:24 -04001816 ad.u.dentry = dentry;
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05001817 __inode_security_revalidate(inode, dentry, true);
Linus Torvalds19e49832013-10-04 12:54:11 -07001818 return inode_has_perm(cred, inode, av, &ad);
Eric Paris2875fa02011-04-28 16:04:24 -04001819}
1820
1821/* Same as inode_has_perm, but pass explicit audit data containing
1822 the path to help the auditing code to more easily generate the
1823 pathname if needed. */
1824static inline int path_has_perm(const struct cred *cred,
Al Viro3f7036a2015-03-08 19:28:30 -04001825 const struct path *path,
Eric Paris2875fa02011-04-28 16:04:24 -04001826 u32 av)
1827{
David Howellsc6f493d2015-03-17 22:26:22 +00001828 struct inode *inode = d_backing_inode(path->dentry);
Eric Paris2875fa02011-04-28 16:04:24 -04001829 struct common_audit_data ad;
1830
Eric Paris50c205f2012-04-04 15:01:43 -04001831 ad.type = LSM_AUDIT_DATA_PATH;
Eric Paris2875fa02011-04-28 16:04:24 -04001832 ad.u.path = *path;
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05001833 __inode_security_revalidate(inode, path->dentry, true);
Linus Torvalds19e49832013-10-04 12:54:11 -07001834 return inode_has_perm(cred, inode, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001835}
1836
David Howells13f8e982013-06-13 23:37:55 +01001837/* Same as path_has_perm, but uses the inode from the file struct. */
1838static inline int file_path_has_perm(const struct cred *cred,
1839 struct file *file,
1840 u32 av)
1841{
1842 struct common_audit_data ad;
1843
Vivek Goyal43af5de2016-09-09 11:37:49 -04001844 ad.type = LSM_AUDIT_DATA_FILE;
1845 ad.u.file = file;
Linus Torvalds19e49832013-10-04 12:54:11 -07001846 return inode_has_perm(cred, file_inode(file), av, &ad);
David Howells13f8e982013-06-13 23:37:55 +01001847}
1848
Chenbo Fengf66e4482017-10-18 13:00:26 -07001849#ifdef CONFIG_BPF_SYSCALL
1850static int bpf_fd_pass(struct file *file, u32 sid);
1851#endif
1852
Linus Torvalds1da177e2005-04-16 15:20:36 -07001853/* Check whether a task can use an open file descriptor to
1854 access an inode in a given way. Check access to the
1855 descriptor itself, and then use dentry_has_perm to
1856 check a particular permission to the file.
1857 Access to the descriptor is implicitly granted if it
1858 has the same SID as the process. If av is zero, then
1859 access to the file is not checked, e.g. for cases
1860 where only the descriptor is affected like seek. */
David Howells88e67f32008-11-14 10:39:21 +11001861static int file_has_perm(const struct cred *cred,
1862 struct file *file,
1863 u32 av)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001864{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001865 struct file_security_struct *fsec = file->f_security;
Al Viro496ad9a2013-01-23 17:07:38 -05001866 struct inode *inode = file_inode(file);
Thomas Liu2bf49692009-07-14 12:14:09 -04001867 struct common_audit_data ad;
David Howells88e67f32008-11-14 10:39:21 +11001868 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001869 int rc;
1870
Vivek Goyal43af5de2016-09-09 11:37:49 -04001871 ad.type = LSM_AUDIT_DATA_FILE;
1872 ad.u.file = file;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001873
David Howells275bb412008-11-14 10:39:19 +11001874 if (sid != fsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001875 rc = avc_has_perm(&selinux_state,
1876 sid, fsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001877 SECCLASS_FD,
1878 FD__USE,
1879 &ad);
1880 if (rc)
David Howells88e67f32008-11-14 10:39:21 +11001881 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001882 }
1883
Chenbo Fengf66e4482017-10-18 13:00:26 -07001884#ifdef CONFIG_BPF_SYSCALL
1885 rc = bpf_fd_pass(file, cred_sid(cred));
1886 if (rc)
1887 return rc;
1888#endif
1889
Linus Torvalds1da177e2005-04-16 15:20:36 -07001890 /* av is zero if only checking access to the descriptor. */
David Howells88e67f32008-11-14 10:39:21 +11001891 rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001892 if (av)
Linus Torvalds19e49832013-10-04 12:54:11 -07001893 rc = inode_has_perm(cred, inode, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001894
David Howells88e67f32008-11-14 10:39:21 +11001895out:
1896 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001897}
1898
David Howellsc3c188b2015-07-10 17:19:58 -04001899/*
1900 * Determine the label for an inode that might be unioned.
1901 */
Vivek Goyalc957f6d2016-07-13 10:44:51 -04001902static int
1903selinux_determine_inode_label(const struct task_security_struct *tsec,
1904 struct inode *dir,
1905 const struct qstr *name, u16 tclass,
1906 u32 *_new_isid)
David Howellsc3c188b2015-07-10 17:19:58 -04001907{
1908 const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
David Howellsc3c188b2015-07-10 17:19:58 -04001909
1910 if ((sbsec->flags & SE_SBINITIALIZED) &&
1911 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1912 *_new_isid = sbsec->mntpoint_sid;
1913 } else if ((sbsec->flags & SBLABEL_MNT) &&
1914 tsec->create_sid) {
1915 *_new_isid = tsec->create_sid;
1916 } else {
Paul Moore20cdef82016-04-04 14:14:42 -04001917 const struct inode_security_struct *dsec = inode_security(dir);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001918 return security_transition_sid(&selinux_state, tsec->sid,
1919 dsec->sid, tclass,
David Howellsc3c188b2015-07-10 17:19:58 -04001920 name, _new_isid);
1921 }
1922
1923 return 0;
1924}
1925
Linus Torvalds1da177e2005-04-16 15:20:36 -07001926/* Check whether a task can create a file. */
1927static int may_create(struct inode *dir,
1928 struct dentry *dentry,
1929 u16 tclass)
1930{
Paul Moore5fb49872010-04-22 14:46:19 -04001931 const struct task_security_struct *tsec = current_security();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001932 struct inode_security_struct *dsec;
1933 struct superblock_security_struct *sbsec;
David Howells275bb412008-11-14 10:39:19 +11001934 u32 sid, newsid;
Thomas Liu2bf49692009-07-14 12:14:09 -04001935 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001936 int rc;
1937
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001938 dsec = inode_security(dir);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001939 sbsec = dir->i_sb->s_security;
1940
David Howells275bb412008-11-14 10:39:19 +11001941 sid = tsec->sid;
David Howells275bb412008-11-14 10:39:19 +11001942
Eric Paris50c205f2012-04-04 15:01:43 -04001943 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04001944 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001945
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001946 rc = avc_has_perm(&selinux_state,
1947 sid, dsec->sid, SECCLASS_DIR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001948 DIR__ADD_NAME | DIR__SEARCH,
1949 &ad);
1950 if (rc)
1951 return rc;
1952
Vivek Goyalc957f6d2016-07-13 10:44:51 -04001953 rc = selinux_determine_inode_label(current_security(), dir,
1954 &dentry->d_name, tclass, &newsid);
David Howellsc3c188b2015-07-10 17:19:58 -04001955 if (rc)
1956 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001957
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001958 rc = avc_has_perm(&selinux_state,
1959 sid, newsid, tclass, FILE__CREATE, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001960 if (rc)
1961 return rc;
1962
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001963 return avc_has_perm(&selinux_state,
1964 newsid, sbsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001965 SECCLASS_FILESYSTEM,
1966 FILESYSTEM__ASSOCIATE, &ad);
1967}
1968
Eric Paris828dfe12008-04-17 13:17:49 -04001969#define MAY_LINK 0
1970#define MAY_UNLINK 1
1971#define MAY_RMDIR 2
Linus Torvalds1da177e2005-04-16 15:20:36 -07001972
1973/* Check whether a task can link, unlink, or rmdir a file/directory. */
1974static int may_link(struct inode *dir,
1975 struct dentry *dentry,
1976 int kind)
1977
1978{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001979 struct inode_security_struct *dsec, *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04001980 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11001981 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001982 u32 av;
1983 int rc;
1984
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001985 dsec = inode_security(dir);
1986 isec = backing_inode_security(dentry);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001987
Eric Paris50c205f2012-04-04 15:01:43 -04001988 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04001989 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001990
1991 av = DIR__SEARCH;
1992 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001993 rc = avc_has_perm(&selinux_state,
1994 sid, dsec->sid, SECCLASS_DIR, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001995 if (rc)
1996 return rc;
1997
1998 switch (kind) {
1999 case MAY_LINK:
2000 av = FILE__LINK;
2001 break;
2002 case MAY_UNLINK:
2003 av = FILE__UNLINK;
2004 break;
2005 case MAY_RMDIR:
2006 av = DIR__RMDIR;
2007 break;
2008 default:
peter enderborgc103a912018-06-12 10:09:03 +02002009 pr_warn("SELinux: %s: unrecognized kind %d\n",
Eric Paris744ba352008-04-17 11:52:44 -04002010 __func__, kind);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002011 return 0;
2012 }
2013
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002014 rc = avc_has_perm(&selinux_state,
2015 sid, isec->sid, isec->sclass, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002016 return rc;
2017}
2018
2019static inline int may_rename(struct inode *old_dir,
2020 struct dentry *old_dentry,
2021 struct inode *new_dir,
2022 struct dentry *new_dentry)
2023{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002024 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04002025 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11002026 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002027 u32 av;
2028 int old_is_dir, new_is_dir;
2029 int rc;
2030
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002031 old_dsec = inode_security(old_dir);
2032 old_isec = backing_inode_security(old_dentry);
David Howellse36cb0b2015-01-29 12:02:35 +00002033 old_is_dir = d_is_dir(old_dentry);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002034 new_dsec = inode_security(new_dir);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002035
Eric Paris50c205f2012-04-04 15:01:43 -04002036 ad.type = LSM_AUDIT_DATA_DENTRY;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002037
Eric Parisa2694342011-04-25 13:10:27 -04002038 ad.u.dentry = old_dentry;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002039 rc = avc_has_perm(&selinux_state,
2040 sid, old_dsec->sid, SECCLASS_DIR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002041 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
2042 if (rc)
2043 return rc;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002044 rc = avc_has_perm(&selinux_state,
2045 sid, old_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002046 old_isec->sclass, FILE__RENAME, &ad);
2047 if (rc)
2048 return rc;
2049 if (old_is_dir && new_dir != old_dir) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002050 rc = avc_has_perm(&selinux_state,
2051 sid, old_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002052 old_isec->sclass, DIR__REPARENT, &ad);
2053 if (rc)
2054 return rc;
2055 }
2056
Eric Parisa2694342011-04-25 13:10:27 -04002057 ad.u.dentry = new_dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002058 av = DIR__ADD_NAME | DIR__SEARCH;
David Howells2c616d42015-01-29 12:02:33 +00002059 if (d_is_positive(new_dentry))
Linus Torvalds1da177e2005-04-16 15:20:36 -07002060 av |= DIR__REMOVE_NAME;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002061 rc = avc_has_perm(&selinux_state,
2062 sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002063 if (rc)
2064 return rc;
David Howells2c616d42015-01-29 12:02:33 +00002065 if (d_is_positive(new_dentry)) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002066 new_isec = backing_inode_security(new_dentry);
David Howellse36cb0b2015-01-29 12:02:35 +00002067 new_is_dir = d_is_dir(new_dentry);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002068 rc = avc_has_perm(&selinux_state,
2069 sid, new_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002070 new_isec->sclass,
2071 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
2072 if (rc)
2073 return rc;
2074 }
2075
2076 return 0;
2077}
2078
2079/* Check whether a task can perform a filesystem operation. */
David Howells88e67f32008-11-14 10:39:21 +11002080static int superblock_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002081 struct super_block *sb,
2082 u32 perms,
Thomas Liu2bf49692009-07-14 12:14:09 -04002083 struct common_audit_data *ad)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002084{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002085 struct superblock_security_struct *sbsec;
David Howells88e67f32008-11-14 10:39:21 +11002086 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002087
Linus Torvalds1da177e2005-04-16 15:20:36 -07002088 sbsec = sb->s_security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002089 return avc_has_perm(&selinux_state,
2090 sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002091}
2092
2093/* Convert a Linux mode and permission mask to an access vector. */
2094static inline u32 file_mask_to_av(int mode, int mask)
2095{
2096 u32 av = 0;
2097
Al Virodba19c62011-07-25 20:49:29 -04002098 if (!S_ISDIR(mode)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002099 if (mask & MAY_EXEC)
2100 av |= FILE__EXECUTE;
2101 if (mask & MAY_READ)
2102 av |= FILE__READ;
2103
2104 if (mask & MAY_APPEND)
2105 av |= FILE__APPEND;
2106 else if (mask & MAY_WRITE)
2107 av |= FILE__WRITE;
2108
2109 } else {
2110 if (mask & MAY_EXEC)
2111 av |= DIR__SEARCH;
2112 if (mask & MAY_WRITE)
2113 av |= DIR__WRITE;
2114 if (mask & MAY_READ)
2115 av |= DIR__READ;
2116 }
2117
2118 return av;
2119}
2120
2121/* Convert a Linux file to an access vector. */
2122static inline u32 file_to_av(struct file *file)
2123{
2124 u32 av = 0;
2125
2126 if (file->f_mode & FMODE_READ)
2127 av |= FILE__READ;
2128 if (file->f_mode & FMODE_WRITE) {
2129 if (file->f_flags & O_APPEND)
2130 av |= FILE__APPEND;
2131 else
2132 av |= FILE__WRITE;
2133 }
Stephen Smalley0794c662008-03-17 08:55:18 -04002134 if (!av) {
2135 /*
2136 * Special file opened with flags 3 for ioctl-only use.
2137 */
2138 av = FILE__IOCTL;
2139 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002140
2141 return av;
2142}
2143
Eric Paris8b6a5a32008-10-29 17:06:46 -04002144/*
2145 * Convert a file to an access vector and include the correct open
2146 * open permission.
2147 */
2148static inline u32 open_file_to_av(struct file *file)
2149{
2150 u32 av = file_to_av(file);
Stephen Smalleyccb54472017-05-12 12:41:24 -04002151 struct inode *inode = file_inode(file);
Eric Paris8b6a5a32008-10-29 17:06:46 -04002152
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002153 if (selinux_policycap_openperm() &&
2154 inode->i_sb->s_magic != SOCKFS_MAGIC)
Eric Paris49b7b8d2010-07-23 11:44:09 -04002155 av |= FILE__OPEN;
2156
Eric Paris8b6a5a32008-10-29 17:06:46 -04002157 return av;
2158}
2159
Linus Torvalds1da177e2005-04-16 15:20:36 -07002160/* Hook functions begin here. */
2161
Stephen Smalley79af7302015-01-21 10:54:10 -05002162static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2163{
2164 u32 mysid = current_sid();
2165 u32 mgrsid = task_sid(mgr);
2166
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002167 return avc_has_perm(&selinux_state,
2168 mysid, mgrsid, SECCLASS_BINDER,
Stephen Smalley79af7302015-01-21 10:54:10 -05002169 BINDER__SET_CONTEXT_MGR, NULL);
2170}
2171
2172static int selinux_binder_transaction(struct task_struct *from,
2173 struct task_struct *to)
2174{
2175 u32 mysid = current_sid();
2176 u32 fromsid = task_sid(from);
2177 u32 tosid = task_sid(to);
2178 int rc;
2179
2180 if (mysid != fromsid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002181 rc = avc_has_perm(&selinux_state,
2182 mysid, fromsid, SECCLASS_BINDER,
Stephen Smalley79af7302015-01-21 10:54:10 -05002183 BINDER__IMPERSONATE, NULL);
2184 if (rc)
2185 return rc;
2186 }
2187
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002188 return avc_has_perm(&selinux_state,
2189 fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
Stephen Smalley79af7302015-01-21 10:54:10 -05002190 NULL);
2191}
2192
2193static int selinux_binder_transfer_binder(struct task_struct *from,
2194 struct task_struct *to)
2195{
2196 u32 fromsid = task_sid(from);
2197 u32 tosid = task_sid(to);
2198
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002199 return avc_has_perm(&selinux_state,
2200 fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
Stephen Smalley79af7302015-01-21 10:54:10 -05002201 NULL);
2202}
2203
2204static int selinux_binder_transfer_file(struct task_struct *from,
2205 struct task_struct *to,
2206 struct file *file)
2207{
2208 u32 sid = task_sid(to);
2209 struct file_security_struct *fsec = file->f_security;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002210 struct dentry *dentry = file->f_path.dentry;
Paul Moore20cdef82016-04-04 14:14:42 -04002211 struct inode_security_struct *isec;
Stephen Smalley79af7302015-01-21 10:54:10 -05002212 struct common_audit_data ad;
2213 int rc;
2214
2215 ad.type = LSM_AUDIT_DATA_PATH;
2216 ad.u.path = file->f_path;
2217
2218 if (sid != fsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002219 rc = avc_has_perm(&selinux_state,
2220 sid, fsec->sid,
Stephen Smalley79af7302015-01-21 10:54:10 -05002221 SECCLASS_FD,
2222 FD__USE,
2223 &ad);
2224 if (rc)
2225 return rc;
2226 }
2227
Chenbo Fengf66e4482017-10-18 13:00:26 -07002228#ifdef CONFIG_BPF_SYSCALL
2229 rc = bpf_fd_pass(file, sid);
2230 if (rc)
2231 return rc;
2232#endif
2233
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002234 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
Stephen Smalley79af7302015-01-21 10:54:10 -05002235 return 0;
2236
Paul Moore20cdef82016-04-04 14:14:42 -04002237 isec = backing_inode_security(dentry);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002238 return avc_has_perm(&selinux_state,
2239 sid, isec->sid, isec->sclass, file_to_av(file),
Stephen Smalley79af7302015-01-21 10:54:10 -05002240 &ad);
2241}
2242
Ingo Molnar9e488582009-05-07 19:26:19 +10002243static int selinux_ptrace_access_check(struct task_struct *child,
David Howells5cd9c582008-08-14 11:37:28 +01002244 unsigned int mode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002245{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002246 u32 sid = current_sid();
2247 u32 csid = task_sid(child);
Stephen Smalley006ebb42008-05-19 08:32:49 -04002248
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002249 if (mode & PTRACE_MODE_READ)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002250 return avc_has_perm(&selinux_state,
2251 sid, csid, SECCLASS_FILE, FILE__READ, NULL);
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002252
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002253 return avc_has_perm(&selinux_state,
2254 sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
David Howells5cd9c582008-08-14 11:37:28 +01002255}
2256
2257static int selinux_ptrace_traceme(struct task_struct *parent)
2258{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002259 return avc_has_perm(&selinux_state,
2260 task_sid(parent), current_sid(), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002261 PROCESS__PTRACE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002262}
2263
2264static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
Eric Paris828dfe12008-04-17 13:17:49 -04002265 kernel_cap_t *inheritable, kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002266{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002267 return avc_has_perm(&selinux_state,
2268 current_sid(), task_sid(target), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002269 PROCESS__GETCAP, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002270}
2271
David Howellsd84f4f92008-11-14 10:39:23 +11002272static int selinux_capset(struct cred *new, const struct cred *old,
2273 const kernel_cap_t *effective,
2274 const kernel_cap_t *inheritable,
2275 const kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002276{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002277 return avc_has_perm(&selinux_state,
2278 cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002279 PROCESS__SETCAP, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002280}
2281
James Morris5626d3e2009-01-30 10:05:06 +11002282/*
2283 * (This comment used to live with the selinux_task_setuid hook,
2284 * which was removed).
2285 *
2286 * Since setuid only affects the current process, and since the SELinux
2287 * controls are not based on the Linux identity attributes, SELinux does not
2288 * need to control this operation. However, SELinux does control the use of
2289 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2290 */
2291
Eric Paris6a9de492012-01-03 12:25:14 -05002292static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2293 int cap, int audit)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002294{
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04002295 return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002296}
2297
Linus Torvalds1da177e2005-04-16 15:20:36 -07002298static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2299{
David Howells88e67f32008-11-14 10:39:21 +11002300 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002301 int rc = 0;
2302
2303 if (!sb)
2304 return 0;
2305
2306 switch (cmds) {
Eric Paris828dfe12008-04-17 13:17:49 -04002307 case Q_SYNC:
2308 case Q_QUOTAON:
2309 case Q_QUOTAOFF:
2310 case Q_SETINFO:
2311 case Q_SETQUOTA:
David Howells88e67f32008-11-14 10:39:21 +11002312 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04002313 break;
2314 case Q_GETFMT:
2315 case Q_GETINFO:
2316 case Q_GETQUOTA:
David Howells88e67f32008-11-14 10:39:21 +11002317 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04002318 break;
2319 default:
2320 rc = 0; /* let the kernel handle invalid cmds */
2321 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002322 }
2323 return rc;
2324}
2325
2326static int selinux_quota_on(struct dentry *dentry)
2327{
David Howells88e67f32008-11-14 10:39:21 +11002328 const struct cred *cred = current_cred();
2329
Eric Paris2875fa02011-04-28 16:04:24 -04002330 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002331}
2332
Eric Paris12b30522010-11-15 18:36:29 -05002333static int selinux_syslog(int type)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002334{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002335 switch (type) {
Kees Cookd78ca3c2010-02-03 15:37:13 -08002336 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2337 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002338 return avc_has_perm(&selinux_state,
2339 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002340 SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
Kees Cookd78ca3c2010-02-03 15:37:13 -08002341 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2342 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2343 /* Set level of messages printed to console */
2344 case SYSLOG_ACTION_CONSOLE_LEVEL:
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002345 return avc_has_perm(&selinux_state,
2346 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002347 SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2348 NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002349 }
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002350 /* All other syslog types */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002351 return avc_has_perm(&selinux_state,
2352 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002353 SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002354}
2355
2356/*
2357 * Check that a process has enough memory to allocate a new virtual
2358 * mapping. 0 means there is enough memory for the allocation to
2359 * succeed and -ENOMEM implies there is not.
2360 *
Linus Torvalds1da177e2005-04-16 15:20:36 -07002361 * Do not audit the selinux permission check, as this is applied to all
2362 * processes that allocate mappings.
2363 */
Alan Cox34b4e4a2007-08-22 14:01:28 -07002364static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002365{
2366 int rc, cap_sys_admin = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002367
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07002368 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04002369 SECURITY_CAP_NOAUDIT, true);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002370 if (rc == 0)
2371 cap_sys_admin = 1;
2372
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07002373 return cap_sys_admin;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002374}
2375
2376/* binprm security operations */
2377
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002378static u32 ptrace_parent_sid(void)
Paul Moore0c6181c2016-03-30 21:41:21 -04002379{
2380 u32 sid = 0;
2381 struct task_struct *tracer;
2382
2383 rcu_read_lock();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002384 tracer = ptrace_parent(current);
Paul Moore0c6181c2016-03-30 21:41:21 -04002385 if (tracer)
2386 sid = task_sid(tracer);
2387 rcu_read_unlock();
2388
2389 return sid;
2390}
2391
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002392static int check_nnp_nosuid(const struct linux_binprm *bprm,
2393 const struct task_security_struct *old_tsec,
2394 const struct task_security_struct *new_tsec)
2395{
2396 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
Andy Lutomirski380cf5b2016-06-23 16:41:05 -05002397 int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002398 int rc;
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002399 u32 av;
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002400
2401 if (!nnp && !nosuid)
2402 return 0; /* neither NNP nor nosuid */
2403
2404 if (new_tsec->sid == old_tsec->sid)
2405 return 0; /* No change in credentials */
2406
2407 /*
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002408 * If the policy enables the nnp_nosuid_transition policy capability,
2409 * then we permit transitions under NNP or nosuid if the
2410 * policy allows the corresponding permission between
2411 * the old and new contexts.
2412 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002413 if (selinux_policycap_nnp_nosuid_transition()) {
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002414 av = 0;
2415 if (nnp)
2416 av |= PROCESS2__NNP_TRANSITION;
2417 if (nosuid)
2418 av |= PROCESS2__NOSUID_TRANSITION;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002419 rc = avc_has_perm(&selinux_state,
2420 old_tsec->sid, new_tsec->sid,
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002421 SECCLASS_PROCESS2, av, NULL);
2422 if (!rc)
2423 return 0;
2424 }
2425
2426 /*
2427 * We also permit NNP or nosuid transitions to bounded SIDs,
2428 * i.e. SIDs that are guaranteed to only be allowed a subset
2429 * of the permissions of the current SID.
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002430 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002431 rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2432 new_tsec->sid);
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002433 if (!rc)
2434 return 0;
2435
2436 /*
2437 * On failure, preserve the errno values for NNP vs nosuid.
2438 * NNP: Operation not permitted for caller.
2439 * nosuid: Permission denied to file.
2440 */
2441 if (nnp)
2442 return -EPERM;
2443 return -EACCES;
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002444}
2445
David Howellsa6f76f22008-11-14 10:39:24 +11002446static int selinux_bprm_set_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002447{
David Howellsa6f76f22008-11-14 10:39:24 +11002448 const struct task_security_struct *old_tsec;
2449 struct task_security_struct *new_tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002450 struct inode_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04002451 struct common_audit_data ad;
Al Viro496ad9a2013-01-23 17:07:38 -05002452 struct inode *inode = file_inode(bprm->file);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002453 int rc;
2454
David Howellsa6f76f22008-11-14 10:39:24 +11002455 /* SELinux context only depends on initial program or script and not
2456 * the script interpreter */
Kees Cookddb4a142017-07-18 15:25:23 -07002457 if (bprm->called_set_creds)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002458 return 0;
2459
David Howellsa6f76f22008-11-14 10:39:24 +11002460 old_tsec = current_security();
2461 new_tsec = bprm->cred->security;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002462 isec = inode_security(inode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002463
2464 /* Default to the current task SID. */
David Howellsa6f76f22008-11-14 10:39:24 +11002465 new_tsec->sid = old_tsec->sid;
2466 new_tsec->osid = old_tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002467
Michael LeMay28eba5b2006-06-27 02:53:42 -07002468 /* Reset fs, key, and sock SIDs on execve. */
David Howellsa6f76f22008-11-14 10:39:24 +11002469 new_tsec->create_sid = 0;
2470 new_tsec->keycreate_sid = 0;
2471 new_tsec->sockcreate_sid = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002472
David Howellsa6f76f22008-11-14 10:39:24 +11002473 if (old_tsec->exec_sid) {
2474 new_tsec->sid = old_tsec->exec_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002475 /* Reset exec SID on execve. */
David Howellsa6f76f22008-11-14 10:39:24 +11002476 new_tsec->exec_sid = 0;
Andy Lutomirski259e5e62012-04-12 16:47:50 -05002477
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002478 /* Fail on NNP or nosuid if not an allowed transition. */
2479 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2480 if (rc)
2481 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002482 } else {
2483 /* Check for a default transition on this program. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002484 rc = security_transition_sid(&selinux_state, old_tsec->sid,
2485 isec->sid, SECCLASS_PROCESS, NULL,
Eric Paris652bb9b2011-02-01 11:05:40 -05002486 &new_tsec->sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002487 if (rc)
2488 return rc;
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002489
2490 /*
2491 * Fallback to old SID on NNP or nosuid if not an allowed
2492 * transition.
2493 */
2494 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2495 if (rc)
2496 new_tsec->sid = old_tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002497 }
2498
Vivek Goyal43af5de2016-09-09 11:37:49 -04002499 ad.type = LSM_AUDIT_DATA_FILE;
2500 ad.u.file = bprm->file;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002501
David Howellsa6f76f22008-11-14 10:39:24 +11002502 if (new_tsec->sid == old_tsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002503 rc = avc_has_perm(&selinux_state,
2504 old_tsec->sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002505 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2506 if (rc)
2507 return rc;
2508 } else {
2509 /* Check permissions for the transition. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002510 rc = avc_has_perm(&selinux_state,
2511 old_tsec->sid, new_tsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002512 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2513 if (rc)
2514 return rc;
2515
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002516 rc = avc_has_perm(&selinux_state,
2517 new_tsec->sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002518 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2519 if (rc)
2520 return rc;
2521
David Howellsa6f76f22008-11-14 10:39:24 +11002522 /* Check for shared state */
2523 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002524 rc = avc_has_perm(&selinux_state,
2525 old_tsec->sid, new_tsec->sid,
David Howellsa6f76f22008-11-14 10:39:24 +11002526 SECCLASS_PROCESS, PROCESS__SHARE,
2527 NULL);
2528 if (rc)
2529 return -EPERM;
2530 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002531
David Howellsa6f76f22008-11-14 10:39:24 +11002532 /* Make sure that anyone attempting to ptrace over a task that
2533 * changes its SID has the appropriate permit */
Eric W. Biederman9227dd22017-01-23 17:26:31 +13002534 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002535 u32 ptsid = ptrace_parent_sid();
David Howellsa6f76f22008-11-14 10:39:24 +11002536 if (ptsid != 0) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002537 rc = avc_has_perm(&selinux_state,
2538 ptsid, new_tsec->sid,
David Howellsa6f76f22008-11-14 10:39:24 +11002539 SECCLASS_PROCESS,
2540 PROCESS__PTRACE, NULL);
2541 if (rc)
2542 return -EPERM;
2543 }
2544 }
2545
2546 /* Clear any possibly unsafe personality bits on exec: */
2547 bprm->per_clear |= PER_CLEAR_ON_SETID;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002548
Linus Torvalds1da177e2005-04-16 15:20:36 -07002549 /* Enable secure mode for SIDs transitions unless
2550 the noatsecure permission is granted between
2551 the two SIDs, i.e. ahp returns 0. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002552 rc = avc_has_perm(&selinux_state,
2553 old_tsec->sid, new_tsec->sid,
Kees Cook62874c32017-07-18 15:25:25 -07002554 SECCLASS_PROCESS, PROCESS__NOATSECURE,
2555 NULL);
2556 bprm->secureexec |= !!rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002557 }
2558
Kees Cook62874c32017-07-18 15:25:25 -07002559 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002560}
2561
Al Viroc3c073f2012-08-21 22:32:06 -04002562static int match_file(const void *p, struct file *file, unsigned fd)
2563{
2564 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2565}
2566
Linus Torvalds1da177e2005-04-16 15:20:36 -07002567/* Derived from fs/exec.c:flush_old_files. */
David Howells745ca242008-11-14 10:39:22 +11002568static inline void flush_unauthorized_files(const struct cred *cred,
2569 struct files_struct *files)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002570{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002571 struct file *file, *devnull = NULL;
Stephen Smalleyb20c8122006-09-25 23:32:03 -07002572 struct tty_struct *tty;
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002573 int drop_tty = 0;
Al Viroc3c073f2012-08-21 22:32:06 -04002574 unsigned n;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002575
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002576 tty = get_current_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002577 if (tty) {
Peter Hurley4a510962016-01-09 21:35:23 -08002578 spin_lock(&tty->files_lock);
Eric Paris37dd0bd2008-10-31 17:40:00 -04002579 if (!list_empty(&tty->tty_files)) {
Nick Piggind996b622010-08-18 04:37:36 +10002580 struct tty_file_private *file_priv;
Eric Paris37dd0bd2008-10-31 17:40:00 -04002581
Linus Torvalds1da177e2005-04-16 15:20:36 -07002582 /* Revalidate access to controlling tty.
David Howells13f8e982013-06-13 23:37:55 +01002583 Use file_path_has_perm on the tty path directly
2584 rather than using file_has_perm, as this particular
2585 open file may belong to another process and we are
2586 only interested in the inode-based check here. */
Nick Piggind996b622010-08-18 04:37:36 +10002587 file_priv = list_first_entry(&tty->tty_files,
2588 struct tty_file_private, list);
2589 file = file_priv->file;
David Howells13f8e982013-06-13 23:37:55 +01002590 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002591 drop_tty = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002592 }
Peter Hurley4a510962016-01-09 21:35:23 -08002593 spin_unlock(&tty->files_lock);
Alan Cox452a00d2008-10-13 10:39:13 +01002594 tty_kref_put(tty);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002595 }
Eric W. Biederman98a27ba2007-05-08 00:26:56 -07002596 /* Reset controlling tty. */
2597 if (drop_tty)
2598 no_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002599
2600 /* Revalidate access to inherited open files. */
Al Viroc3c073f2012-08-21 22:32:06 -04002601 n = iterate_fd(files, 0, match_file, cred);
2602 if (!n) /* none found? */
2603 return;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002604
Al Viroc3c073f2012-08-21 22:32:06 -04002605 devnull = dentry_open(&selinux_null, O_RDWR, cred);
Al Viro45525b22012-10-16 13:30:07 -04002606 if (IS_ERR(devnull))
2607 devnull = NULL;
2608 /* replace all the matching ones with this */
2609 do {
2610 replace_fd(n - 1, devnull, 0);
2611 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2612 if (devnull)
Al Viroc3c073f2012-08-21 22:32:06 -04002613 fput(devnull);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002614}
2615
Linus Torvalds1da177e2005-04-16 15:20:36 -07002616/*
David Howellsa6f76f22008-11-14 10:39:24 +11002617 * Prepare a process for imminent new credential changes due to exec
Linus Torvalds1da177e2005-04-16 15:20:36 -07002618 */
David Howellsa6f76f22008-11-14 10:39:24 +11002619static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002620{
David Howellsa6f76f22008-11-14 10:39:24 +11002621 struct task_security_struct *new_tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002622 struct rlimit *rlim, *initrlim;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002623 int rc, i;
2624
David Howellsa6f76f22008-11-14 10:39:24 +11002625 new_tsec = bprm->cred->security;
2626 if (new_tsec->sid == new_tsec->osid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002627 return;
2628
2629 /* Close files for which the new task SID is not authorized. */
David Howellsa6f76f22008-11-14 10:39:24 +11002630 flush_unauthorized_files(bprm->cred, current->files);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002631
David Howellsa6f76f22008-11-14 10:39:24 +11002632 /* Always clear parent death signal on SID transitions. */
2633 current->pdeath_signal = 0;
2634
2635 /* Check whether the new SID can inherit resource limits from the old
2636 * SID. If not, reset all soft limits to the lower of the current
2637 * task's hard limit and the init task's soft limit.
2638 *
2639 * Note that the setting of hard limits (even to lower them) can be
2640 * controlled by the setrlimit check. The inclusion of the init task's
2641 * soft limit into the computation is to avoid resetting soft limits
2642 * higher than the default soft limit for cases where the default is
2643 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2644 */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002645 rc = avc_has_perm(&selinux_state,
2646 new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
David Howellsa6f76f22008-11-14 10:39:24 +11002647 PROCESS__RLIMITINH, NULL);
2648 if (rc) {
Oleg Nesteroveb2d55a2010-06-23 22:43:32 +02002649 /* protect against do_prlimit() */
2650 task_lock(current);
David Howellsa6f76f22008-11-14 10:39:24 +11002651 for (i = 0; i < RLIM_NLIMITS; i++) {
2652 rlim = current->signal->rlim + i;
2653 initrlim = init_task.signal->rlim + i;
2654 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2655 }
Oleg Nesteroveb2d55a2010-06-23 22:43:32 +02002656 task_unlock(current);
Nicolas Pitrebaa73d92016-11-11 00:10:10 -05002657 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2658 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
David Howellsa6f76f22008-11-14 10:39:24 +11002659 }
2660}
2661
2662/*
2663 * Clean up the process immediately after the installation of new credentials
2664 * due to exec
2665 */
2666static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2667{
2668 const struct task_security_struct *tsec = current_security();
2669 struct itimerval itimer;
David Howellsa6f76f22008-11-14 10:39:24 +11002670 u32 osid, sid;
2671 int rc, i;
David Howellsa6f76f22008-11-14 10:39:24 +11002672
David Howellsa6f76f22008-11-14 10:39:24 +11002673 osid = tsec->osid;
2674 sid = tsec->sid;
2675
2676 if (sid == osid)
2677 return;
2678
2679 /* Check whether the new SID can inherit signal state from the old SID.
2680 * If not, clear itimers to avoid subsequent signal generation and
2681 * flush and unblock signals.
2682 *
2683 * This must occur _after_ the task SID has been updated so that any
2684 * kill done after the flush will be checked against the new SID.
2685 */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002686 rc = avc_has_perm(&selinux_state,
2687 osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002688 if (rc) {
Nicolas Pitrebaa73d92016-11-11 00:10:10 -05002689 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) {
2690 memset(&itimer, 0, sizeof itimer);
2691 for (i = 0; i < 3; i++)
2692 do_setitimer(i, &itimer, NULL);
2693 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002694 spin_lock_irq(&current->sighand->siglock);
Oleg Nesterov9e7c8f82015-06-04 16:22:16 -04002695 if (!fatal_signal_pending(current)) {
2696 flush_sigqueue(&current->pending);
2697 flush_sigqueue(&current->signal->shared_pending);
David Howells3bcac022009-04-29 13:45:05 +01002698 flush_signal_handlers(current, 1);
2699 sigemptyset(&current->blocked);
Oleg Nesterov9e7c8f82015-06-04 16:22:16 -04002700 recalc_sigpending();
David Howells3bcac022009-04-29 13:45:05 +01002701 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002702 spin_unlock_irq(&current->sighand->siglock);
2703 }
2704
David Howellsa6f76f22008-11-14 10:39:24 +11002705 /* Wake up the parent if it is waiting so that it can recheck
2706 * wait permission to the new task SID. */
Oleg Nesterovecd6de32009-04-29 16:02:24 +02002707 read_lock(&tasklist_lock);
Oleg Nesterov0b7570e2009-09-23 15:56:46 -07002708 __wake_up_parent(current, current->real_parent);
Oleg Nesterovecd6de32009-04-29 16:02:24 +02002709 read_unlock(&tasklist_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002710}
2711
2712/* superblock security operations */
2713
2714static int selinux_sb_alloc_security(struct super_block *sb)
2715{
2716 return superblock_alloc_security(sb);
2717}
2718
2719static void selinux_sb_free_security(struct super_block *sb)
2720{
2721 superblock_free_security(sb);
2722}
2723
2724static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2725{
2726 if (plen > olen)
2727 return 0;
2728
2729 return !memcmp(prefix, option, plen);
2730}
2731
2732static inline int selinux_option(char *option, int len)
2733{
Eric Paris832cbd92008-04-01 13:24:09 -04002734 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2735 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2736 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
David P. Quigley11689d42009-01-16 09:22:03 -05002737 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2738 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
Linus Torvalds1da177e2005-04-16 15:20:36 -07002739}
2740
2741static inline void take_option(char **to, char *from, int *first, int len)
2742{
2743 if (!*first) {
2744 **to = ',';
2745 *to += 1;
Cory Olmo3528a952006-09-29 01:58:44 -07002746 } else
Linus Torvalds1da177e2005-04-16 15:20:36 -07002747 *first = 0;
2748 memcpy(*to, from, len);
2749 *to += len;
2750}
2751
Eric Paris828dfe12008-04-17 13:17:49 -04002752static inline void take_selinux_option(char **to, char *from, int *first,
2753 int len)
Cory Olmo3528a952006-09-29 01:58:44 -07002754{
2755 int current_size = 0;
2756
2757 if (!*first) {
2758 **to = '|';
2759 *to += 1;
Eric Paris828dfe12008-04-17 13:17:49 -04002760 } else
Cory Olmo3528a952006-09-29 01:58:44 -07002761 *first = 0;
2762
2763 while (current_size < len) {
2764 if (*from != '"') {
2765 **to = *from;
2766 *to += 1;
2767 }
2768 from += 1;
2769 current_size += 1;
2770 }
2771}
2772
Eric Parise0007522008-03-05 10:31:54 -05002773static int selinux_sb_copy_data(char *orig, char *copy)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002774{
2775 int fnosec, fsec, rc = 0;
2776 char *in_save, *in_curr, *in_end;
2777 char *sec_curr, *nosec_save, *nosec;
Cory Olmo3528a952006-09-29 01:58:44 -07002778 int open_quote = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002779
2780 in_curr = orig;
2781 sec_curr = copy;
2782
Linus Torvalds1da177e2005-04-16 15:20:36 -07002783 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2784 if (!nosec) {
2785 rc = -ENOMEM;
2786 goto out;
2787 }
2788
2789 nosec_save = nosec;
2790 fnosec = fsec = 1;
2791 in_save = in_end = orig;
2792
2793 do {
Cory Olmo3528a952006-09-29 01:58:44 -07002794 if (*in_end == '"')
2795 open_quote = !open_quote;
2796 if ((*in_end == ',' && open_quote == 0) ||
2797 *in_end == '\0') {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002798 int len = in_end - in_curr;
2799
2800 if (selinux_option(in_curr, len))
Cory Olmo3528a952006-09-29 01:58:44 -07002801 take_selinux_option(&sec_curr, in_curr, &fsec, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002802 else
2803 take_option(&nosec, in_curr, &fnosec, len);
2804
2805 in_curr = in_end + 1;
2806 }
2807 } while (*in_end++);
2808
Eric Paris6931dfc2005-06-30 02:58:51 -07002809 strcpy(in_save, nosec_save);
Gerald Schaeferda3caa22005-06-21 17:15:18 -07002810 free_page((unsigned long)nosec_save);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002811out:
2812 return rc;
2813}
2814
Eric Paris026eb162011-03-03 16:09:14 -05002815static int selinux_sb_remount(struct super_block *sb, void *data)
2816{
2817 int rc, i, *flags;
2818 struct security_mnt_opts opts;
2819 char *secdata, **mount_options;
2820 struct superblock_security_struct *sbsec = sb->s_security;
2821
2822 if (!(sbsec->flags & SE_SBINITIALIZED))
2823 return 0;
2824
2825 if (!data)
2826 return 0;
2827
2828 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2829 return 0;
2830
2831 security_init_mnt_opts(&opts);
2832 secdata = alloc_secdata();
2833 if (!secdata)
2834 return -ENOMEM;
2835 rc = selinux_sb_copy_data(data, secdata);
2836 if (rc)
2837 goto out_free_secdata;
2838
2839 rc = selinux_parse_opts_str(secdata, &opts);
2840 if (rc)
2841 goto out_free_secdata;
2842
2843 mount_options = opts.mnt_opts;
2844 flags = opts.mnt_opts_flags;
2845
2846 for (i = 0; i < opts.num_mnt_opts; i++) {
2847 u32 sid;
Eric Paris026eb162011-03-03 16:09:14 -05002848
Eric Paris12f348b2012-10-09 10:56:25 -04002849 if (flags[i] == SBLABEL_MNT)
Eric Paris026eb162011-03-03 16:09:14 -05002850 continue;
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002851 rc = security_context_str_to_sid(&selinux_state,
2852 mount_options[i], &sid,
2853 GFP_KERNEL);
Eric Paris026eb162011-03-03 16:09:14 -05002854 if (rc) {
peter enderborgc103a912018-06-12 10:09:03 +02002855 pr_warn("SELinux: security_context_str_to_sid"
Linus Torvalds29b1deb2013-12-15 11:17:45 -08002856 "(%s) failed for (dev %s, type %s) errno=%d\n",
2857 mount_options[i], sb->s_id, sb->s_type->name, rc);
Eric Paris026eb162011-03-03 16:09:14 -05002858 goto out_free_opts;
2859 }
2860 rc = -EINVAL;
2861 switch (flags[i]) {
2862 case FSCONTEXT_MNT:
2863 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2864 goto out_bad_option;
2865 break;
2866 case CONTEXT_MNT:
2867 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2868 goto out_bad_option;
2869 break;
2870 case ROOTCONTEXT_MNT: {
2871 struct inode_security_struct *root_isec;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002872 root_isec = backing_inode_security(sb->s_root);
Eric Paris026eb162011-03-03 16:09:14 -05002873
2874 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2875 goto out_bad_option;
2876 break;
2877 }
2878 case DEFCONTEXT_MNT:
2879 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2880 goto out_bad_option;
2881 break;
2882 default:
2883 goto out_free_opts;
2884 }
2885 }
2886
2887 rc = 0;
2888out_free_opts:
2889 security_free_mnt_opts(&opts);
2890out_free_secdata:
2891 free_secdata(secdata);
2892 return rc;
2893out_bad_option:
peter enderborgc103a912018-06-12 10:09:03 +02002894 pr_warn("SELinux: unable to change security options "
Linus Torvalds29b1deb2013-12-15 11:17:45 -08002895 "during remount (dev %s, type=%s)\n", sb->s_id,
2896 sb->s_type->name);
Eric Paris026eb162011-03-03 16:09:14 -05002897 goto out_free_opts;
2898}
2899
James Morris12204e22008-12-19 10:44:42 +11002900static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002901{
Al Viro17f3b552018-11-10 23:46:07 -05002902 char *options = data;
David Howells88e67f32008-11-14 10:39:21 +11002903 const struct cred *cred = current_cred();
Thomas Liu2bf49692009-07-14 12:14:09 -04002904 struct common_audit_data ad;
Al Viro17f3b552018-11-10 23:46:07 -05002905 int rc = 0;
2906 struct security_mnt_opts opts;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002907
Al Viro17f3b552018-11-10 23:46:07 -05002908 security_init_mnt_opts(&opts);
2909
2910 if (!data)
2911 goto out;
2912
2913 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
2914
2915 rc = selinux_parse_opts_str(options, &opts);
2916 if (rc)
2917 goto out_err;
2918
2919out:
2920 rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
2921
2922out_err:
2923 security_free_mnt_opts(&opts);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002924 if (rc)
2925 return rc;
2926
James Morris74192242008-12-19 11:41:10 +11002927 /* Allow all mounts performed by the kernel */
2928 if (flags & MS_KERNMOUNT)
2929 return 0;
2930
Eric Paris50c205f2012-04-04 15:01:43 -04002931 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04002932 ad.u.dentry = sb->s_root;
David Howells88e67f32008-11-14 10:39:21 +11002933 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002934}
2935
David Howells726c3342006-06-23 02:02:58 -07002936static int selinux_sb_statfs(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002937{
David Howells88e67f32008-11-14 10:39:21 +11002938 const struct cred *cred = current_cred();
Thomas Liu2bf49692009-07-14 12:14:09 -04002939 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002940
Eric Paris50c205f2012-04-04 15:01:43 -04002941 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04002942 ad.u.dentry = dentry->d_sb->s_root;
David Howells88e67f32008-11-14 10:39:21 +11002943 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002944}
2945
Al Viro808d4e32012-10-11 11:42:01 -04002946static int selinux_mount(const char *dev_name,
Al Viro8a04c432016-03-25 14:52:53 -04002947 const struct path *path,
Al Viro808d4e32012-10-11 11:42:01 -04002948 const char *type,
Eric Paris828dfe12008-04-17 13:17:49 -04002949 unsigned long flags,
2950 void *data)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002951{
David Howells88e67f32008-11-14 10:39:21 +11002952 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002953
2954 if (flags & MS_REMOUNT)
Al Virod8c95842011-12-07 18:16:57 -05002955 return superblock_has_perm(cred, path->dentry->d_sb,
Eric Paris828dfe12008-04-17 13:17:49 -04002956 FILESYSTEM__REMOUNT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002957 else
Eric Paris2875fa02011-04-28 16:04:24 -04002958 return path_has_perm(cred, path, FILE__MOUNTON);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002959}
2960
2961static int selinux_umount(struct vfsmount *mnt, int flags)
2962{
David Howells88e67f32008-11-14 10:39:21 +11002963 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002964
David Howells88e67f32008-11-14 10:39:21 +11002965 return superblock_has_perm(cred, mnt->mnt_sb,
Eric Paris828dfe12008-04-17 13:17:49 -04002966 FILESYSTEM__UNMOUNT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002967}
2968
2969/* inode security operations */
2970
2971static int selinux_inode_alloc_security(struct inode *inode)
2972{
2973 return inode_alloc_security(inode);
2974}
2975
2976static void selinux_inode_free_security(struct inode *inode)
2977{
2978 inode_free_security(inode);
2979}
2980
David Quigleyd47be3d2013-05-22 12:50:34 -04002981static int selinux_dentry_init_security(struct dentry *dentry, int mode,
Al Viro4f3ccd72016-07-20 16:06:15 -04002982 const struct qstr *name, void **ctx,
David Quigleyd47be3d2013-05-22 12:50:34 -04002983 u32 *ctxlen)
2984{
David Quigleyd47be3d2013-05-22 12:50:34 -04002985 u32 newsid;
2986 int rc;
2987
Vivek Goyalc957f6d2016-07-13 10:44:51 -04002988 rc = selinux_determine_inode_label(current_security(),
2989 d_inode(dentry->d_parent), name,
David Howellsc3c188b2015-07-10 17:19:58 -04002990 inode_mode_to_security_class(mode),
2991 &newsid);
2992 if (rc)
2993 return rc;
David Quigleyd47be3d2013-05-22 12:50:34 -04002994
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002995 return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
2996 ctxlen);
David Quigleyd47be3d2013-05-22 12:50:34 -04002997}
2998
Vivek Goyala518b0a2016-07-13 10:44:53 -04002999static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
3000 struct qstr *name,
3001 const struct cred *old,
3002 struct cred *new)
3003{
3004 u32 newsid;
3005 int rc;
3006 struct task_security_struct *tsec;
3007
3008 rc = selinux_determine_inode_label(old->security,
3009 d_inode(dentry->d_parent), name,
3010 inode_mode_to_security_class(mode),
3011 &newsid);
3012 if (rc)
3013 return rc;
3014
3015 tsec = new->security;
3016 tsec->create_sid = newsid;
3017 return 0;
3018}
3019
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003020static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
Tetsuo Handa95489062013-07-25 05:44:02 +09003021 const struct qstr *qstr,
3022 const char **name,
Eric Paris2a7dba32011-02-01 11:05:39 -05003023 void **value, size_t *len)
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003024{
Paul Moore5fb49872010-04-22 14:46:19 -04003025 const struct task_security_struct *tsec = current_security();
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003026 struct superblock_security_struct *sbsec;
Corentin LABBEc0d4f462017-10-04 20:32:17 +02003027 u32 newsid, clen;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003028 int rc;
Tetsuo Handa95489062013-07-25 05:44:02 +09003029 char *context;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003030
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003031 sbsec = dir->i_sb->s_security;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003032
David Howells275bb412008-11-14 10:39:19 +11003033 newsid = tsec->create_sid;
3034
Vivek Goyalc957f6d2016-07-13 10:44:51 -04003035 rc = selinux_determine_inode_label(current_security(),
David Howellsc3c188b2015-07-10 17:19:58 -04003036 dir, qstr,
3037 inode_mode_to_security_class(inode->i_mode),
3038 &newsid);
3039 if (rc)
3040 return rc;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003041
Eric Paris296fddf2006-09-25 23:32:00 -07003042 /* Possibly defer initialization to selinux_complete_init. */
David P. Quigley0d90a7e2009-01-16 09:22:02 -05003043 if (sbsec->flags & SE_SBINITIALIZED) {
Eric Paris296fddf2006-09-25 23:32:00 -07003044 struct inode_security_struct *isec = inode->i_security;
3045 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3046 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05003047 isec->initialized = LABEL_INITIALIZED;
Eric Paris296fddf2006-09-25 23:32:00 -07003048 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003049
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003050 if (!selinux_state.initialized || !(sbsec->flags & SBLABEL_MNT))
Stephen Smalley25a74f32005-11-08 21:34:33 -08003051 return -EOPNOTSUPP;
3052
Tetsuo Handa95489062013-07-25 05:44:02 +09003053 if (name)
3054 *name = XATTR_SELINUX_SUFFIX;
Stephen Smalley570bc1c2005-09-09 13:01:43 -07003055
3056 if (value && len) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003057 rc = security_sid_to_context_force(&selinux_state, newsid,
3058 &context, &clen);
Tetsuo Handa95489062013-07-25 05:44:02 +09003059 if (rc)
Stephen Smalley570bc1c2005-09-09 13:01:43 -07003060 return rc;
Stephen Smalley570bc1c2005-09-09 13:01:43 -07003061 *value = context;
3062 *len = clen;
3063 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003064
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003065 return 0;
3066}
3067
Al Viro4acdaf22011-07-26 01:42:34 -04003068static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003069{
3070 return may_create(dir, dentry, SECCLASS_FILE);
3071}
3072
Linus Torvalds1da177e2005-04-16 15:20:36 -07003073static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
3074{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003075 return may_link(dir, old_dentry, MAY_LINK);
3076}
3077
Linus Torvalds1da177e2005-04-16 15:20:36 -07003078static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
3079{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003080 return may_link(dir, dentry, MAY_UNLINK);
3081}
3082
3083static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
3084{
3085 return may_create(dir, dentry, SECCLASS_LNK_FILE);
3086}
3087
Al Viro18bb1db2011-07-26 01:41:39 -04003088static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003089{
3090 return may_create(dir, dentry, SECCLASS_DIR);
3091}
3092
Linus Torvalds1da177e2005-04-16 15:20:36 -07003093static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
3094{
3095 return may_link(dir, dentry, MAY_RMDIR);
3096}
3097
Al Viro1a67aaf2011-07-26 01:52:52 -04003098static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003099{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003100 return may_create(dir, dentry, inode_mode_to_security_class(mode));
3101}
3102
Linus Torvalds1da177e2005-04-16 15:20:36 -07003103static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
Eric Paris828dfe12008-04-17 13:17:49 -04003104 struct inode *new_inode, struct dentry *new_dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003105{
3106 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
3107}
3108
Linus Torvalds1da177e2005-04-16 15:20:36 -07003109static int selinux_inode_readlink(struct dentry *dentry)
3110{
David Howells88e67f32008-11-14 10:39:21 +11003111 const struct cred *cred = current_cred();
3112
Eric Paris2875fa02011-04-28 16:04:24 -04003113 return dentry_has_perm(cred, dentry, FILE__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003114}
3115
NeilBrownbda0be72015-03-23 13:37:39 +11003116static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
3117 bool rcu)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003118{
David Howells88e67f32008-11-14 10:39:21 +11003119 const struct cred *cred = current_cred();
NeilBrownbda0be72015-03-23 13:37:39 +11003120 struct common_audit_data ad;
3121 struct inode_security_struct *isec;
3122 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003123
NeilBrownbda0be72015-03-23 13:37:39 +11003124 validate_creds(cred);
3125
3126 ad.type = LSM_AUDIT_DATA_DENTRY;
3127 ad.u.dentry = dentry;
3128 sid = cred_sid(cred);
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05003129 isec = inode_security_rcu(inode, rcu);
3130 if (IS_ERR(isec))
3131 return PTR_ERR(isec);
NeilBrownbda0be72015-03-23 13:37:39 +11003132
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003133 return avc_has_perm_flags(&selinux_state,
3134 sid, isec->sid, isec->sclass, FILE__READ, &ad,
NeilBrownbda0be72015-03-23 13:37:39 +11003135 rcu ? MAY_NOT_BLOCK : 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003136}
3137
Eric Parisd4cf970d2012-04-04 15:01:42 -04003138static noinline int audit_inode_permission(struct inode *inode,
3139 u32 perms, u32 audited, u32 denied,
Stephen Smalley626b9742014-04-29 11:29:04 -07003140 int result,
Eric Parisd4cf970d2012-04-04 15:01:42 -04003141 unsigned flags)
3142{
3143 struct common_audit_data ad;
Eric Parisd4cf970d2012-04-04 15:01:42 -04003144 struct inode_security_struct *isec = inode->i_security;
3145 int rc;
3146
Eric Paris50c205f2012-04-04 15:01:43 -04003147 ad.type = LSM_AUDIT_DATA_INODE;
Eric Parisd4cf970d2012-04-04 15:01:42 -04003148 ad.u.inode = inode;
3149
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003150 rc = slow_avc_audit(&selinux_state,
3151 current_sid(), isec->sid, isec->sclass, perms,
Stephen Smalley626b9742014-04-29 11:29:04 -07003152 audited, denied, result, &ad, flags);
Eric Parisd4cf970d2012-04-04 15:01:42 -04003153 if (rc)
3154 return rc;
3155 return 0;
3156}
3157
Al Viroe74f71e2011-06-20 19:38:15 -04003158static int selinux_inode_permission(struct inode *inode, int mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003159{
David Howells88e67f32008-11-14 10:39:21 +11003160 const struct cred *cred = current_cred();
Eric Parisb782e0a2010-07-23 11:44:03 -04003161 u32 perms;
3162 bool from_access;
Al Virocf1dd1d2011-06-20 19:44:08 -04003163 unsigned flags = mask & MAY_NOT_BLOCK;
Eric Paris2e334052012-04-04 15:01:42 -04003164 struct inode_security_struct *isec;
3165 u32 sid;
3166 struct av_decision avd;
3167 int rc, rc2;
3168 u32 audited, denied;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003169
Eric Parisb782e0a2010-07-23 11:44:03 -04003170 from_access = mask & MAY_ACCESS;
Eric Parisd09ca732010-07-23 11:43:57 -04003171 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3172
Eric Parisb782e0a2010-07-23 11:44:03 -04003173 /* No permission to check. Existence test. */
3174 if (!mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003175 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003176
Eric Paris2e334052012-04-04 15:01:42 -04003177 validate_creds(cred);
Eric Parisb782e0a2010-07-23 11:44:03 -04003178
Eric Paris2e334052012-04-04 15:01:42 -04003179 if (unlikely(IS_PRIVATE(inode)))
3180 return 0;
Eric Parisb782e0a2010-07-23 11:44:03 -04003181
3182 perms = file_mask_to_av(inode->i_mode, mask);
3183
Eric Paris2e334052012-04-04 15:01:42 -04003184 sid = cred_sid(cred);
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05003185 isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3186 if (IS_ERR(isec))
3187 return PTR_ERR(isec);
Eric Paris2e334052012-04-04 15:01:42 -04003188
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003189 rc = avc_has_perm_noaudit(&selinux_state,
3190 sid, isec->sid, isec->sclass, perms, 0, &avd);
Eric Paris2e334052012-04-04 15:01:42 -04003191 audited = avc_audit_required(perms, &avd, rc,
3192 from_access ? FILE__AUDIT_ACCESS : 0,
3193 &denied);
3194 if (likely(!audited))
3195 return rc;
3196
Stephen Smalley626b9742014-04-29 11:29:04 -07003197 rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
Eric Paris2e334052012-04-04 15:01:42 -04003198 if (rc2)
3199 return rc2;
3200 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003201}
3202
3203static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3204{
David Howells88e67f32008-11-14 10:39:21 +11003205 const struct cred *cred = current_cred();
Stephen Smalleyccb54472017-05-12 12:41:24 -04003206 struct inode *inode = d_backing_inode(dentry);
Amerigo Wangbc6a6002009-08-20 19:29:02 -07003207 unsigned int ia_valid = iattr->ia_valid;
Eric Paris95dbf732012-04-04 13:45:34 -04003208 __u32 av = FILE__WRITE;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003209
Amerigo Wangbc6a6002009-08-20 19:29:02 -07003210 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3211 if (ia_valid & ATTR_FORCE) {
3212 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3213 ATTR_FORCE);
3214 if (!ia_valid)
3215 return 0;
3216 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003217
Amerigo Wangbc6a6002009-08-20 19:29:02 -07003218 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3219 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
Eric Paris2875fa02011-04-28 16:04:24 -04003220 return dentry_has_perm(cred, dentry, FILE__SETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003221
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003222 if (selinux_policycap_openperm() &&
Stephen Smalleyccb54472017-05-12 12:41:24 -04003223 inode->i_sb->s_magic != SOCKFS_MAGIC &&
3224 (ia_valid & ATTR_SIZE) &&
3225 !(ia_valid & ATTR_FILE))
Eric Paris95dbf732012-04-04 13:45:34 -04003226 av |= FILE__OPEN;
3227
3228 return dentry_has_perm(cred, dentry, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003229}
3230
Al Viro3f7036a2015-03-08 19:28:30 -04003231static int selinux_inode_getattr(const struct path *path)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003232{
Al Viro3f7036a2015-03-08 19:28:30 -04003233 return path_has_perm(current_cred(), path, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003234}
3235
Stephen Smalleydb590002017-04-20 11:31:30 -04003236static bool has_cap_mac_admin(bool audit)
3237{
3238 const struct cred *cred = current_cred();
3239 int cap_audit = audit ? SECURITY_CAP_AUDIT : SECURITY_CAP_NOAUDIT;
3240
3241 if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, cap_audit))
3242 return false;
3243 if (cred_has_capability(cred, CAP_MAC_ADMIN, cap_audit, true))
3244 return false;
3245 return true;
3246}
3247
David Howells8f0cfa52008-04-29 00:59:41 -07003248static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3249 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003250{
David Howellsc6f493d2015-03-17 22:26:22 +00003251 struct inode *inode = d_backing_inode(dentry);
Paul Moore20cdef82016-04-04 14:14:42 -04003252 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003253 struct superblock_security_struct *sbsec;
Thomas Liu2bf49692009-07-14 12:14:09 -04003254 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11003255 u32 newsid, sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003256 int rc = 0;
3257
Eric W. Biederman6b240302017-10-02 09:38:20 -05003258 if (strcmp(name, XATTR_NAME_SELINUX)) {
3259 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3260 if (rc)
3261 return rc;
3262
3263 /* Not an attribute we recognize, so just check the
3264 ordinary setattr permission. */
3265 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3266 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003267
3268 sbsec = inode->i_sb->s_security;
Eric Paris12f348b2012-10-09 10:56:25 -04003269 if (!(sbsec->flags & SBLABEL_MNT))
Linus Torvalds1da177e2005-04-16 15:20:36 -07003270 return -EOPNOTSUPP;
3271
Serge E. Hallyn2e149672011-03-23 16:43:26 -07003272 if (!inode_owner_or_capable(inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -07003273 return -EPERM;
3274
Eric Paris50c205f2012-04-04 15:01:43 -04003275 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04003276 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003277
Paul Moore20cdef82016-04-04 14:14:42 -04003278 isec = backing_inode_security(dentry);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003279 rc = avc_has_perm(&selinux_state,
3280 sid, isec->sid, isec->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003281 FILE__RELABELFROM, &ad);
3282 if (rc)
3283 return rc;
3284
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003285 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3286 GFP_KERNEL);
Stephen Smalley12b29f32008-05-07 13:03:20 -04003287 if (rc == -EINVAL) {
Stephen Smalleydb590002017-04-20 11:31:30 -04003288 if (!has_cap_mac_admin(true)) {
Eric Parisd6ea83e2012-04-04 13:45:49 -04003289 struct audit_buffer *ab;
3290 size_t audit_size;
Eric Parisd6ea83e2012-04-04 13:45:49 -04003291
3292 /* We strip a nul only if it is at the end, otherwise the
3293 * context contains a nul and we should audit that */
Al Viroe3fea3f2012-06-09 08:15:16 +01003294 if (value) {
Colin Ian Kingadd24372017-10-14 13:46:55 +01003295 const char *str = value;
3296
Al Viroe3fea3f2012-06-09 08:15:16 +01003297 if (str[size - 1] == '\0')
3298 audit_size = size - 1;
3299 else
3300 audit_size = size;
3301 } else {
Al Viroe3fea3f2012-06-09 08:15:16 +01003302 audit_size = 0;
3303 }
Richard Guy Briggscdfb6b32018-05-12 21:58:20 -04003304 ab = audit_log_start(audit_context(),
3305 GFP_ATOMIC, AUDIT_SELINUX_ERR);
Eric Parisd6ea83e2012-04-04 13:45:49 -04003306 audit_log_format(ab, "op=setxattr invalid_context=");
3307 audit_log_n_untrustedstring(ab, value, audit_size);
3308 audit_log_end(ab);
3309
Stephen Smalley12b29f32008-05-07 13:03:20 -04003310 return rc;
Eric Parisd6ea83e2012-04-04 13:45:49 -04003311 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003312 rc = security_context_to_sid_force(&selinux_state, value,
3313 size, &newsid);
Stephen Smalley12b29f32008-05-07 13:03:20 -04003314 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003315 if (rc)
3316 return rc;
3317
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003318 rc = avc_has_perm(&selinux_state,
3319 sid, newsid, isec->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003320 FILE__RELABELTO, &ad);
3321 if (rc)
3322 return rc;
3323
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003324 rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3325 sid, isec->sclass);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003326 if (rc)
3327 return rc;
3328
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003329 return avc_has_perm(&selinux_state,
3330 newsid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003331 sbsec->sid,
3332 SECCLASS_FILESYSTEM,
3333 FILESYSTEM__ASSOCIATE,
3334 &ad);
3335}
3336
David Howells8f0cfa52008-04-29 00:59:41 -07003337static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
Eric Parisf5269712008-05-14 11:27:45 -04003338 const void *value, size_t size,
David Howells8f0cfa52008-04-29 00:59:41 -07003339 int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003340{
David Howellsc6f493d2015-03-17 22:26:22 +00003341 struct inode *inode = d_backing_inode(dentry);
Paul Moore20cdef82016-04-04 14:14:42 -04003342 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003343 u32 newsid;
3344 int rc;
3345
3346 if (strcmp(name, XATTR_NAME_SELINUX)) {
3347 /* Not an attribute we recognize, so nothing to do. */
3348 return;
3349 }
3350
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003351 rc = security_context_to_sid_force(&selinux_state, value, size,
3352 &newsid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003353 if (rc) {
peter enderborgc103a912018-06-12 10:09:03 +02003354 pr_err("SELinux: unable to map context to SID"
Stephen Smalley12b29f32008-05-07 13:03:20 -04003355 "for (%s, %lu), rc=%d\n",
3356 inode->i_sb->s_id, inode->i_ino, -rc);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003357 return;
3358 }
3359
Paul Moore20cdef82016-04-04 14:14:42 -04003360 isec = backing_inode_security(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003361 spin_lock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003362 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003363 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05003364 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003365 spin_unlock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003366
Linus Torvalds1da177e2005-04-16 15:20:36 -07003367 return;
3368}
3369
David Howells8f0cfa52008-04-29 00:59:41 -07003370static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003371{
David Howells88e67f32008-11-14 10:39:21 +11003372 const struct cred *cred = current_cred();
3373
Eric Paris2875fa02011-04-28 16:04:24 -04003374 return dentry_has_perm(cred, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003375}
3376
Eric Paris828dfe12008-04-17 13:17:49 -04003377static int selinux_inode_listxattr(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003378{
David Howells88e67f32008-11-14 10:39:21 +11003379 const struct cred *cred = current_cred();
3380
Eric Paris2875fa02011-04-28 16:04:24 -04003381 return dentry_has_perm(cred, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003382}
3383
David Howells8f0cfa52008-04-29 00:59:41 -07003384static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003385{
Eric W. Biederman6b240302017-10-02 09:38:20 -05003386 if (strcmp(name, XATTR_NAME_SELINUX)) {
3387 int rc = cap_inode_removexattr(dentry, name);
3388 if (rc)
3389 return rc;
3390
3391 /* Not an attribute we recognize, so just check the
3392 ordinary setattr permission. */
3393 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3394 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003395
3396 /* No one is allowed to remove a SELinux security label.
3397 You can change the label, but all data must be labeled. */
3398 return -EACCES;
3399}
3400
James Morrisd381d8a2005-10-30 14:59:22 -08003401/*
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003402 * Copy the inode security context value to the user.
James Morrisd381d8a2005-10-30 14:59:22 -08003403 *
3404 * Permission check is handled by selinux_inode_getxattr hook.
3405 */
Andreas Gruenbacherea861df2015-12-24 11:09:39 -05003406static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003407{
David P. Quigley42492592008-02-04 22:29:39 -08003408 u32 size;
3409 int error;
3410 char *context = NULL;
Paul Moore20cdef82016-04-04 14:14:42 -04003411 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003412
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00003413 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3414 return -EOPNOTSUPP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003415
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003416 /*
3417 * If the caller has CAP_MAC_ADMIN, then get the raw context
3418 * value even if it is not defined by current policy; otherwise,
3419 * use the in-core value under current policy.
3420 * Use the non-auditing forms of the permission checks since
3421 * getxattr may be called by unprivileged processes commonly
3422 * and lack of permission just means that we fall back to the
3423 * in-core context value, not a denial.
3424 */
Paul Moore20cdef82016-04-04 14:14:42 -04003425 isec = inode_security(inode);
Stephen Smalleydb590002017-04-20 11:31:30 -04003426 if (has_cap_mac_admin(false))
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003427 error = security_sid_to_context_force(&selinux_state,
3428 isec->sid, &context,
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003429 &size);
3430 else
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003431 error = security_sid_to_context(&selinux_state, isec->sid,
3432 &context, &size);
David P. Quigley42492592008-02-04 22:29:39 -08003433 if (error)
3434 return error;
3435 error = size;
3436 if (alloc) {
3437 *buffer = context;
3438 goto out_nofree;
3439 }
3440 kfree(context);
3441out_nofree:
3442 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003443}
3444
3445static int selinux_inode_setsecurity(struct inode *inode, const char *name,
Eric Paris828dfe12008-04-17 13:17:49 -04003446 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003447{
Paul Moore2c971652016-04-19 16:36:28 -04003448 struct inode_security_struct *isec = inode_security_novalidate(inode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003449 u32 newsid;
3450 int rc;
3451
3452 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3453 return -EOPNOTSUPP;
3454
3455 if (!value || !size)
3456 return -EACCES;
3457
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003458 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3459 GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003460 if (rc)
3461 return rc;
3462
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003463 spin_lock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003464 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003465 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05003466 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003467 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003468 return 0;
3469}
3470
3471static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3472{
3473 const int len = sizeof(XATTR_NAME_SELINUX);
3474 if (buffer && len <= buffer_size)
3475 memcpy(buffer, XATTR_NAME_SELINUX, len);
3476 return len;
3477}
3478
Andreas Gruenbacherd6335d72015-12-24 11:09:39 -05003479static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02003480{
Andreas Gruenbachere817c2f2016-02-18 12:04:08 +01003481 struct inode_security_struct *isec = inode_security_novalidate(inode);
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02003482 *secid = isec->sid;
3483}
3484
Vivek Goyal56909eb2016-07-13 10:44:48 -04003485static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3486{
3487 u32 sid;
3488 struct task_security_struct *tsec;
3489 struct cred *new_creds = *new;
3490
3491 if (new_creds == NULL) {
3492 new_creds = prepare_creds();
3493 if (!new_creds)
3494 return -ENOMEM;
3495 }
3496
3497 tsec = new_creds->security;
3498 /* Get label from overlay inode and set it in create_sid */
3499 selinux_inode_getsecid(d_inode(src), &sid);
3500 tsec->create_sid = sid;
3501 *new = new_creds;
3502 return 0;
3503}
3504
Vivek Goyal19472b62016-07-13 10:44:50 -04003505static int selinux_inode_copy_up_xattr(const char *name)
3506{
3507 /* The copy_up hook above sets the initial context on an inode, but we
3508 * don't then want to overwrite it by blindly copying all the lower
3509 * xattrs up. Instead, we have to filter out SELinux-related xattrs.
3510 */
3511 if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3512 return 1; /* Discard */
3513 /*
3514 * Any other attribute apart from SELINUX is not claimed, supported
3515 * by selinux.
3516 */
3517 return -EOPNOTSUPP;
3518}
3519
Linus Torvalds1da177e2005-04-16 15:20:36 -07003520/* file security operations */
3521
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003522static int selinux_revalidate_file_permission(struct file *file, int mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003523{
David Howells88e67f32008-11-14 10:39:21 +11003524 const struct cred *cred = current_cred();
Al Viro496ad9a2013-01-23 17:07:38 -05003525 struct inode *inode = file_inode(file);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003526
Linus Torvalds1da177e2005-04-16 15:20:36 -07003527 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3528 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3529 mask |= MAY_APPEND;
3530
Paul Moore389fb8002009-03-27 17:10:34 -04003531 return file_has_perm(cred, file,
3532 file_mask_to_av(inode->i_mode, mask));
Linus Torvalds1da177e2005-04-16 15:20:36 -07003533}
3534
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003535static int selinux_file_permission(struct file *file, int mask)
3536{
Al Viro496ad9a2013-01-23 17:07:38 -05003537 struct inode *inode = file_inode(file);
Stephen Smalley20dda182009-06-22 14:54:53 -04003538 struct file_security_struct *fsec = file->f_security;
Andreas Gruenbacherb1973672016-01-05 23:12:33 +01003539 struct inode_security_struct *isec;
Stephen Smalley20dda182009-06-22 14:54:53 -04003540 u32 sid = current_sid();
3541
Paul Moore389fb8002009-03-27 17:10:34 -04003542 if (!mask)
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003543 /* No permission to check. Existence test. */
3544 return 0;
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003545
Andreas Gruenbacherb1973672016-01-05 23:12:33 +01003546 isec = inode_security(inode);
Stephen Smalley20dda182009-06-22 14:54:53 -04003547 if (sid == fsec->sid && fsec->isid == isec->sid &&
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003548 fsec->pseqno == avc_policy_seqno(&selinux_state))
Eric Paris83d49852012-04-04 13:45:40 -04003549 /* No change since file_open check. */
Stephen Smalley20dda182009-06-22 14:54:53 -04003550 return 0;
3551
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003552 return selinux_revalidate_file_permission(file, mask);
3553}
3554
Linus Torvalds1da177e2005-04-16 15:20:36 -07003555static int selinux_file_alloc_security(struct file *file)
3556{
3557 return file_alloc_security(file);
3558}
3559
3560static void selinux_file_free_security(struct file *file)
3561{
3562 file_free_security(file);
3563}
3564
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003565/*
3566 * Check whether a task has the ioctl permission and cmd
3567 * operation to an inode.
3568 */
Geliang Tang1d2a1682015-10-21 17:44:27 -04003569static int ioctl_has_perm(const struct cred *cred, struct file *file,
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003570 u32 requested, u16 cmd)
3571{
3572 struct common_audit_data ad;
3573 struct file_security_struct *fsec = file->f_security;
3574 struct inode *inode = file_inode(file);
Paul Moore20cdef82016-04-04 14:14:42 -04003575 struct inode_security_struct *isec;
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003576 struct lsm_ioctlop_audit ioctl;
3577 u32 ssid = cred_sid(cred);
3578 int rc;
3579 u8 driver = cmd >> 8;
3580 u8 xperm = cmd & 0xff;
3581
3582 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3583 ad.u.op = &ioctl;
3584 ad.u.op->cmd = cmd;
3585 ad.u.op->path = file->f_path;
3586
3587 if (ssid != fsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003588 rc = avc_has_perm(&selinux_state,
3589 ssid, fsec->sid,
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003590 SECCLASS_FD,
3591 FD__USE,
3592 &ad);
3593 if (rc)
3594 goto out;
3595 }
3596
3597 if (unlikely(IS_PRIVATE(inode)))
3598 return 0;
3599
Paul Moore20cdef82016-04-04 14:14:42 -04003600 isec = inode_security(inode);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003601 rc = avc_has_extended_perms(&selinux_state,
3602 ssid, isec->sid, isec->sclass,
3603 requested, driver, xperm, &ad);
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003604out:
3605 return rc;
3606}
3607
Linus Torvalds1da177e2005-04-16 15:20:36 -07003608static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3609 unsigned long arg)
3610{
David Howells88e67f32008-11-14 10:39:21 +11003611 const struct cred *cred = current_cred();
Eric Paris0b24dcb2011-02-25 15:39:20 -05003612 int error = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003613
Eric Paris0b24dcb2011-02-25 15:39:20 -05003614 switch (cmd) {
3615 case FIONREAD:
3616 /* fall through */
3617 case FIBMAP:
3618 /* fall through */
3619 case FIGETBSZ:
3620 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003621 case FS_IOC_GETFLAGS:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003622 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003623 case FS_IOC_GETVERSION:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003624 error = file_has_perm(cred, file, FILE__GETATTR);
3625 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003626
Al Viro2f99c362012-03-23 16:04:05 -04003627 case FS_IOC_SETFLAGS:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003628 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003629 case FS_IOC_SETVERSION:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003630 error = file_has_perm(cred, file, FILE__SETATTR);
3631 break;
3632
3633 /* sys_ioctl() checks */
3634 case FIONBIO:
3635 /* fall through */
3636 case FIOASYNC:
3637 error = file_has_perm(cred, file, 0);
3638 break;
3639
3640 case KDSKBENT:
3641 case KDSKBSENT:
Eric Paris6a9de492012-01-03 12:25:14 -05003642 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04003643 SECURITY_CAP_AUDIT, true);
Eric Paris0b24dcb2011-02-25 15:39:20 -05003644 break;
3645
3646 /* default case assumes that the command will go
3647 * to the file's ioctl() function.
3648 */
3649 default:
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003650 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
Eric Paris0b24dcb2011-02-25 15:39:20 -05003651 }
3652 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003653}
3654
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003655static int default_noexec;
3656
Linus Torvalds1da177e2005-04-16 15:20:36 -07003657static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3658{
David Howells88e67f32008-11-14 10:39:21 +11003659 const struct cred *cred = current_cred();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003660 u32 sid = cred_sid(cred);
David Howellsd84f4f92008-11-14 10:39:23 +11003661 int rc = 0;
David Howells88e67f32008-11-14 10:39:21 +11003662
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003663 if (default_noexec &&
Stephen Smalley892e8ca2015-07-10 09:40:59 -04003664 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3665 (!shared && (prot & PROT_WRITE)))) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07003666 /*
3667 * We are making executable an anonymous mapping or a
3668 * private file mapping that will also be writable.
3669 * This has an additional check.
3670 */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003671 rc = avc_has_perm(&selinux_state,
3672 sid, sid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003673 PROCESS__EXECMEM, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003674 if (rc)
David Howellsd84f4f92008-11-14 10:39:23 +11003675 goto error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003676 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003677
3678 if (file) {
3679 /* read access is always possible with a mapping */
3680 u32 av = FILE__READ;
3681
3682 /* write access only matters if the mapping is shared */
3683 if (shared && (prot & PROT_WRITE))
3684 av |= FILE__WRITE;
3685
3686 if (prot & PROT_EXEC)
3687 av |= FILE__EXECUTE;
3688
David Howells88e67f32008-11-14 10:39:21 +11003689 return file_has_perm(cred, file, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003690 }
David Howellsd84f4f92008-11-14 10:39:23 +11003691
3692error:
3693 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003694}
3695
Al Viroe5467852012-05-30 13:30:51 -04003696static int selinux_mmap_addr(unsigned long addr)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003697{
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07003698 int rc = 0;
Paul Moore98883bf2014-03-19 16:46:11 -04003699
3700 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3701 u32 sid = current_sid();
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003702 rc = avc_has_perm(&selinux_state,
3703 sid, sid, SECCLASS_MEMPROTECT,
Paul Moore98883bf2014-03-19 16:46:11 -04003704 MEMPROTECT__MMAP_ZERO, NULL);
3705 }
3706
3707 return rc;
Al Viroe5467852012-05-30 13:30:51 -04003708}
Linus Torvalds1da177e2005-04-16 15:20:36 -07003709
Al Viroe5467852012-05-30 13:30:51 -04003710static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3711 unsigned long prot, unsigned long flags)
3712{
Stephen Smalley3ba4bf52017-05-05 09:14:48 -04003713 struct common_audit_data ad;
3714 int rc;
3715
3716 if (file) {
3717 ad.type = LSM_AUDIT_DATA_FILE;
3718 ad.u.file = file;
3719 rc = inode_has_perm(current_cred(), file_inode(file),
3720 FILE__MAP, &ad);
3721 if (rc)
3722 return rc;
3723 }
3724
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003725 if (selinux_state.checkreqprot)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003726 prot = reqprot;
3727
3728 return file_map_prot_check(file, prot,
3729 (flags & MAP_TYPE) == MAP_SHARED);
3730}
3731
3732static int selinux_file_mprotect(struct vm_area_struct *vma,
3733 unsigned long reqprot,
3734 unsigned long prot)
3735{
David Howells88e67f32008-11-14 10:39:21 +11003736 const struct cred *cred = current_cred();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003737 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003738
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003739 if (selinux_state.checkreqprot)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003740 prot = reqprot;
3741
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003742 if (default_noexec &&
3743 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
James Morrisd541bbe2009-01-29 12:19:51 +11003744 int rc = 0;
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003745 if (vma->vm_start >= vma->vm_mm->start_brk &&
3746 vma->vm_end <= vma->vm_mm->brk) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003747 rc = avc_has_perm(&selinux_state,
3748 sid, sid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003749 PROCESS__EXECHEAP, NULL);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003750 } else if (!vma->vm_file &&
Stephen Smalleyc2316db2016-04-08 13:55:03 -04003751 ((vma->vm_start <= vma->vm_mm->start_stack &&
3752 vma->vm_end >= vma->vm_mm->start_stack) ||
Andy Lutomirskid17af502016-09-30 10:58:58 -07003753 vma_is_stack_for_current(vma))) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003754 rc = avc_has_perm(&selinux_state,
3755 sid, sid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003756 PROCESS__EXECSTACK, NULL);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003757 } else if (vma->vm_file && vma->anon_vma) {
3758 /*
3759 * We are making executable a file mapping that has
3760 * had some COW done. Since pages might have been
3761 * written, check ability to execute the possibly
3762 * modified content. This typically should only
3763 * occur for text relocations.
3764 */
David Howellsd84f4f92008-11-14 10:39:23 +11003765 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003766 }
Lorenzo Hernandez García-Hierro6b992192005-06-25 14:54:34 -07003767 if (rc)
3768 return rc;
3769 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003770
3771 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3772}
3773
3774static int selinux_file_lock(struct file *file, unsigned int cmd)
3775{
David Howells88e67f32008-11-14 10:39:21 +11003776 const struct cred *cred = current_cred();
3777
3778 return file_has_perm(cred, file, FILE__LOCK);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003779}
3780
3781static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3782 unsigned long arg)
3783{
David Howells88e67f32008-11-14 10:39:21 +11003784 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003785 int err = 0;
3786
3787 switch (cmd) {
Eric Paris828dfe12008-04-17 13:17:49 -04003788 case F_SETFL:
Eric Paris828dfe12008-04-17 13:17:49 -04003789 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
David Howells88e67f32008-11-14 10:39:21 +11003790 err = file_has_perm(cred, file, FILE__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003791 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003792 }
3793 /* fall through */
3794 case F_SETOWN:
3795 case F_SETSIG:
3796 case F_GETFL:
3797 case F_GETOWN:
3798 case F_GETSIG:
Cyrill Gorcunov1d151c32012-07-30 14:43:00 -07003799 case F_GETOWNER_UIDS:
Eric Paris828dfe12008-04-17 13:17:49 -04003800 /* Just check FD__USE permission */
David Howells88e67f32008-11-14 10:39:21 +11003801 err = file_has_perm(cred, file, 0);
Eric Paris828dfe12008-04-17 13:17:49 -04003802 break;
3803 case F_GETLK:
3804 case F_SETLK:
3805 case F_SETLKW:
Jeff Layton0d3f7a22014-04-22 08:23:58 -04003806 case F_OFD_GETLK:
3807 case F_OFD_SETLK:
3808 case F_OFD_SETLKW:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003809#if BITS_PER_LONG == 32
Eric Paris828dfe12008-04-17 13:17:49 -04003810 case F_GETLK64:
3811 case F_SETLK64:
3812 case F_SETLKW64:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003813#endif
David Howells88e67f32008-11-14 10:39:21 +11003814 err = file_has_perm(cred, file, FILE__LOCK);
Eric Paris828dfe12008-04-17 13:17:49 -04003815 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003816 }
3817
3818 return err;
3819}
3820
Jeff Laytone0b93ed2014-08-22 11:27:32 -04003821static void selinux_file_set_fowner(struct file *file)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003822{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003823 struct file_security_struct *fsec;
3824
Linus Torvalds1da177e2005-04-16 15:20:36 -07003825 fsec = file->f_security;
David Howells275bb412008-11-14 10:39:19 +11003826 fsec->fown_sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003827}
3828
3829static int selinux_file_send_sigiotask(struct task_struct *tsk,
3830 struct fown_struct *fown, int signum)
3831{
Eric Paris828dfe12008-04-17 13:17:49 -04003832 struct file *file;
Stephen Smalley65c90bc2009-05-04 15:43:18 -04003833 u32 sid = task_sid(tsk);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003834 u32 perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003835 struct file_security_struct *fsec;
3836
3837 /* struct fown_struct is never outside the context of a struct file */
Eric Paris828dfe12008-04-17 13:17:49 -04003838 file = container_of(fown, struct file, f_owner);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003839
Linus Torvalds1da177e2005-04-16 15:20:36 -07003840 fsec = file->f_security;
3841
3842 if (!signum)
3843 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3844 else
3845 perm = signal_to_av(signum);
3846
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003847 return avc_has_perm(&selinux_state,
3848 fsec->fown_sid, sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003849 SECCLASS_PROCESS, perm, NULL);
3850}
3851
3852static int selinux_file_receive(struct file *file)
3853{
David Howells88e67f32008-11-14 10:39:21 +11003854 const struct cred *cred = current_cred();
3855
3856 return file_has_perm(cred, file, file_to_av(file));
Linus Torvalds1da177e2005-04-16 15:20:36 -07003857}
3858
Al Viro94817692018-07-10 14:13:18 -04003859static int selinux_file_open(struct file *file)
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003860{
3861 struct file_security_struct *fsec;
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003862 struct inode_security_struct *isec;
David Howellsd84f4f92008-11-14 10:39:23 +11003863
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003864 fsec = file->f_security;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05003865 isec = inode_security(file_inode(file));
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003866 /*
3867 * Save inode label and policy sequence number
3868 * at open-time so that selinux_file_permission
3869 * can determine whether revalidation is necessary.
3870 * Task label is already saved in the file security
3871 * struct as its SID.
3872 */
3873 fsec->isid = isec->sid;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003874 fsec->pseqno = avc_policy_seqno(&selinux_state);
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003875 /*
3876 * Since the inode label or policy seqno may have changed
3877 * between the selinux_inode_permission check and the saving
3878 * of state above, recheck that access is still permitted.
3879 * Otherwise, access might never be revalidated against the
3880 * new inode label or new policy.
3881 * This check is not redundant - do not remove.
3882 */
Al Viro94817692018-07-10 14:13:18 -04003883 return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003884}
3885
Linus Torvalds1da177e2005-04-16 15:20:36 -07003886/* task security operations */
3887
Tetsuo Handaa79be232017-03-28 23:08:45 +09003888static int selinux_task_alloc(struct task_struct *task,
3889 unsigned long clone_flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003890{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003891 u32 sid = current_sid();
3892
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003893 return avc_has_perm(&selinux_state,
3894 sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003895}
3896
David Howellsf1752ee2008-11-14 10:39:17 +11003897/*
David Howellsee18d642009-09-02 09:14:21 +01003898 * allocate the SELinux part of blank credentials
3899 */
3900static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3901{
3902 struct task_security_struct *tsec;
3903
3904 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3905 if (!tsec)
3906 return -ENOMEM;
3907
3908 cred->security = tsec;
3909 return 0;
3910}
3911
3912/*
David Howellsf1752ee2008-11-14 10:39:17 +11003913 * detach and free the LSM part of a set of credentials
3914 */
3915static void selinux_cred_free(struct cred *cred)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003916{
David Howellsf1752ee2008-11-14 10:39:17 +11003917 struct task_security_struct *tsec = cred->security;
David Howellse0e81732009-09-02 09:13:40 +01003918
Tetsuo Handa2edeaa32011-02-07 13:36:10 +00003919 /*
3920 * cred->security == NULL if security_cred_alloc_blank() or
3921 * security_prepare_creds() returned an error.
3922 */
3923 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
David Howellse0e81732009-09-02 09:13:40 +01003924 cred->security = (void *) 0x7UL;
David Howellsf1752ee2008-11-14 10:39:17 +11003925 kfree(tsec);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003926}
3927
David Howellsd84f4f92008-11-14 10:39:23 +11003928/*
3929 * prepare a new set of credentials for modification
3930 */
3931static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3932 gfp_t gfp)
3933{
3934 const struct task_security_struct *old_tsec;
3935 struct task_security_struct *tsec;
3936
3937 old_tsec = old->security;
3938
3939 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3940 if (!tsec)
3941 return -ENOMEM;
3942
3943 new->security = tsec;
3944 return 0;
3945}
3946
3947/*
David Howellsee18d642009-09-02 09:14:21 +01003948 * transfer the SELinux data to a blank set of creds
3949 */
3950static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3951{
3952 const struct task_security_struct *old_tsec = old->security;
3953 struct task_security_struct *tsec = new->security;
3954
3955 *tsec = *old_tsec;
3956}
3957
Matthew Garrett3ec30112018-01-08 13:36:19 -08003958static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
3959{
3960 *secid = cred_sid(c);
3961}
3962
David Howellsee18d642009-09-02 09:14:21 +01003963/*
David Howells3a3b7ce2008-11-14 10:39:28 +11003964 * set the security data for a kernel service
3965 * - all the creation contexts are set to unlabelled
3966 */
3967static int selinux_kernel_act_as(struct cred *new, u32 secid)
3968{
3969 struct task_security_struct *tsec = new->security;
3970 u32 sid = current_sid();
3971 int ret;
3972
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003973 ret = avc_has_perm(&selinux_state,
3974 sid, secid,
David Howells3a3b7ce2008-11-14 10:39:28 +11003975 SECCLASS_KERNEL_SERVICE,
3976 KERNEL_SERVICE__USE_AS_OVERRIDE,
3977 NULL);
3978 if (ret == 0) {
3979 tsec->sid = secid;
3980 tsec->create_sid = 0;
3981 tsec->keycreate_sid = 0;
3982 tsec->sockcreate_sid = 0;
3983 }
3984 return ret;
3985}
3986
3987/*
3988 * set the file creation context in a security record to the same as the
3989 * objective context of the specified inode
3990 */
3991static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3992{
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05003993 struct inode_security_struct *isec = inode_security(inode);
David Howells3a3b7ce2008-11-14 10:39:28 +11003994 struct task_security_struct *tsec = new->security;
3995 u32 sid = current_sid();
3996 int ret;
3997
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003998 ret = avc_has_perm(&selinux_state,
3999 sid, isec->sid,
David Howells3a3b7ce2008-11-14 10:39:28 +11004000 SECCLASS_KERNEL_SERVICE,
4001 KERNEL_SERVICE__CREATE_FILES_AS,
4002 NULL);
4003
4004 if (ret == 0)
4005 tsec->create_sid = isec->sid;
David Howellsef574712010-02-26 01:56:16 +00004006 return ret;
David Howells3a3b7ce2008-11-14 10:39:28 +11004007}
4008
Eric Parisdd8dbf22009-11-03 16:35:32 +11004009static int selinux_kernel_module_request(char *kmod_name)
Eric Paris25354c42009-08-13 09:45:03 -04004010{
Eric Parisdd8dbf22009-11-03 16:35:32 +11004011 struct common_audit_data ad;
4012
Eric Paris50c205f2012-04-04 15:01:43 -04004013 ad.type = LSM_AUDIT_DATA_KMOD;
Eric Parisdd8dbf22009-11-03 16:35:32 +11004014 ad.u.kmod_name = kmod_name;
4015
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004016 return avc_has_perm(&selinux_state,
4017 current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
Eric Parisdd8dbf22009-11-03 16:35:32 +11004018 SYSTEM__MODULE_REQUEST, &ad);
Eric Paris25354c42009-08-13 09:45:03 -04004019}
4020
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07004021static int selinux_kernel_module_from_file(struct file *file)
4022{
4023 struct common_audit_data ad;
4024 struct inode_security_struct *isec;
4025 struct file_security_struct *fsec;
4026 u32 sid = current_sid();
4027 int rc;
4028
4029 /* init_module */
4030 if (file == NULL)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004031 return avc_has_perm(&selinux_state,
4032 sid, sid, SECCLASS_SYSTEM,
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07004033 SYSTEM__MODULE_LOAD, NULL);
4034
4035 /* finit_module */
Paul Moore20cdef82016-04-04 14:14:42 -04004036
Vivek Goyal43af5de2016-09-09 11:37:49 -04004037 ad.type = LSM_AUDIT_DATA_FILE;
4038 ad.u.file = file;
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07004039
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07004040 fsec = file->f_security;
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07004041 if (sid != fsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004042 rc = avc_has_perm(&selinux_state,
4043 sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07004044 if (rc)
4045 return rc;
4046 }
4047
Paul Moore20cdef82016-04-04 14:14:42 -04004048 isec = inode_security(file_inode(file));
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004049 return avc_has_perm(&selinux_state,
4050 sid, isec->sid, SECCLASS_SYSTEM,
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07004051 SYSTEM__MODULE_LOAD, &ad);
4052}
4053
4054static int selinux_kernel_read_file(struct file *file,
4055 enum kernel_read_file_id id)
4056{
4057 int rc = 0;
4058
4059 switch (id) {
4060 case READING_MODULE:
4061 rc = selinux_kernel_module_from_file(file);
4062 break;
4063 default:
4064 break;
4065 }
4066
4067 return rc;
4068}
4069
Mimi Zoharc77b8cd2018-07-13 14:06:02 -04004070static int selinux_kernel_load_data(enum kernel_load_data_id id)
4071{
4072 int rc = 0;
4073
4074 switch (id) {
4075 case LOADING_MODULE:
4076 rc = selinux_kernel_module_from_file(NULL);
4077 default:
4078 break;
4079 }
4080
4081 return rc;
4082}
4083
Linus Torvalds1da177e2005-04-16 15:20:36 -07004084static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
4085{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004086 return avc_has_perm(&selinux_state,
4087 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004088 PROCESS__SETPGID, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004089}
4090
4091static int selinux_task_getpgid(struct task_struct *p)
4092{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004093 return avc_has_perm(&selinux_state,
4094 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004095 PROCESS__GETPGID, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004096}
4097
4098static int selinux_task_getsid(struct task_struct *p)
4099{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004100 return avc_has_perm(&selinux_state,
4101 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004102 PROCESS__GETSESSION, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004103}
4104
David Quigleyf9008e4c2006-06-30 01:55:46 -07004105static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
4106{
David Howells275bb412008-11-14 10:39:19 +11004107 *secid = task_sid(p);
David Quigleyf9008e4c2006-06-30 01:55:46 -07004108}
4109
Linus Torvalds1da177e2005-04-16 15:20:36 -07004110static int selinux_task_setnice(struct task_struct *p, int nice)
4111{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004112 return avc_has_perm(&selinux_state,
4113 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004114 PROCESS__SETSCHED, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004115}
4116
James Morris03e68062006-06-23 02:03:58 -07004117static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4118{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004119 return avc_has_perm(&selinux_state,
4120 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004121 PROCESS__SETSCHED, NULL);
James Morris03e68062006-06-23 02:03:58 -07004122}
4123
David Quigleya1836a42006-06-30 01:55:49 -07004124static int selinux_task_getioprio(struct task_struct *p)
4125{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004126 return avc_has_perm(&selinux_state,
4127 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004128 PROCESS__GETSCHED, NULL);
David Quigleya1836a42006-06-30 01:55:49 -07004129}
4130
Corentin LABBE42985552017-10-04 20:32:18 +02004131static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4132 unsigned int flags)
Stephen Smalley791ec492017-02-17 07:57:00 -05004133{
4134 u32 av = 0;
4135
Stephen Smalley84e68852017-02-28 09:35:08 -05004136 if (!flags)
4137 return 0;
Stephen Smalley791ec492017-02-17 07:57:00 -05004138 if (flags & LSM_PRLIMIT_WRITE)
4139 av |= PROCESS__SETRLIMIT;
4140 if (flags & LSM_PRLIMIT_READ)
4141 av |= PROCESS__GETRLIMIT;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004142 return avc_has_perm(&selinux_state,
4143 cred_sid(cred), cred_sid(tcred),
Stephen Smalley791ec492017-02-17 07:57:00 -05004144 SECCLASS_PROCESS, av, NULL);
4145}
4146
Jiri Slaby8fd00b42009-08-26 18:41:16 +02004147static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4148 struct rlimit *new_rlim)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004149{
Jiri Slaby8fd00b42009-08-26 18:41:16 +02004150 struct rlimit *old_rlim = p->signal->rlim + resource;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004151
4152 /* Control the ability to change the hard limit (whether
4153 lowering or raising it), so that the hard limit can
4154 later be used as a safe reset point for the soft limit
David Howellsd84f4f92008-11-14 10:39:23 +11004155 upon context transitions. See selinux_bprm_committing_creds. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07004156 if (old_rlim->rlim_max != new_rlim->rlim_max)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004157 return avc_has_perm(&selinux_state,
4158 current_sid(), task_sid(p),
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004159 SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004160
4161 return 0;
4162}
4163
KOSAKI Motohirob0ae1982010-10-15 04:21:18 +09004164static int selinux_task_setscheduler(struct task_struct *p)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004165{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004166 return avc_has_perm(&selinux_state,
4167 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004168 PROCESS__SETSCHED, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004169}
4170
4171static int selinux_task_getscheduler(struct task_struct *p)
4172{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004173 return avc_has_perm(&selinux_state,
4174 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004175 PROCESS__GETSCHED, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004176}
4177
David Quigley35601542006-06-23 02:04:01 -07004178static int selinux_task_movememory(struct task_struct *p)
4179{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004180 return avc_has_perm(&selinux_state,
4181 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004182 PROCESS__SETSCHED, NULL);
David Quigley35601542006-06-23 02:04:01 -07004183}
4184
Eric W. Biedermanae7795b2018-09-25 11:27:20 +02004185static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
Stephen Smalley6b4f3d02017-09-08 12:40:01 -04004186 int sig, const struct cred *cred)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004187{
Stephen Smalley6b4f3d02017-09-08 12:40:01 -04004188 u32 secid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004189 u32 perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004190
Linus Torvalds1da177e2005-04-16 15:20:36 -07004191 if (!sig)
4192 perm = PROCESS__SIGNULL; /* null signal; existence test */
4193 else
4194 perm = signal_to_av(sig);
Stephen Smalley6b4f3d02017-09-08 12:40:01 -04004195 if (!cred)
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004196 secid = current_sid();
Stephen Smalley6b4f3d02017-09-08 12:40:01 -04004197 else
4198 secid = cred_sid(cred);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004199 return avc_has_perm(&selinux_state,
4200 secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004201}
4202
Linus Torvalds1da177e2005-04-16 15:20:36 -07004203static void selinux_task_to_inode(struct task_struct *p,
4204 struct inode *inode)
4205{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004206 struct inode_security_struct *isec = inode->i_security;
David Howells275bb412008-11-14 10:39:19 +11004207 u32 sid = task_sid(p);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004208
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004209 spin_lock(&isec->lock);
Andreas Gruenbacherdb978da2016-11-10 22:18:28 +01004210 isec->sclass = inode_mode_to_security_class(inode->i_mode);
David Howells275bb412008-11-14 10:39:19 +11004211 isec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05004212 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004213 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004214}
4215
Linus Torvalds1da177e2005-04-16 15:20:36 -07004216/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004217static int selinux_parse_skb_ipv4(struct sk_buff *skb,
Thomas Liu2bf49692009-07-14 12:14:09 -04004218 struct common_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004219{
4220 int offset, ihlen, ret = -EINVAL;
4221 struct iphdr _iph, *ih;
4222
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03004223 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004224 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4225 if (ih == NULL)
4226 goto out;
4227
4228 ihlen = ih->ihl * 4;
4229 if (ihlen < sizeof(_iph))
4230 goto out;
4231
Eric Paris48c62af2012-04-02 13:15:44 -04004232 ad->u.net->v4info.saddr = ih->saddr;
4233 ad->u.net->v4info.daddr = ih->daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004234 ret = 0;
4235
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004236 if (proto)
4237 *proto = ih->protocol;
4238
Linus Torvalds1da177e2005-04-16 15:20:36 -07004239 switch (ih->protocol) {
Eric Paris828dfe12008-04-17 13:17:49 -04004240 case IPPROTO_TCP: {
4241 struct tcphdr _tcph, *th;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004242
Eric Paris828dfe12008-04-17 13:17:49 -04004243 if (ntohs(ih->frag_off) & IP_OFFSET)
4244 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004245
4246 offset += ihlen;
4247 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4248 if (th == NULL)
4249 break;
4250
Eric Paris48c62af2012-04-02 13:15:44 -04004251 ad->u.net->sport = th->source;
4252 ad->u.net->dport = th->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004253 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004254 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004255
Eric Paris828dfe12008-04-17 13:17:49 -04004256 case IPPROTO_UDP: {
4257 struct udphdr _udph, *uh;
4258
4259 if (ntohs(ih->frag_off) & IP_OFFSET)
4260 break;
4261
4262 offset += ihlen;
4263 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4264 if (uh == NULL)
4265 break;
4266
Eric Paris48c62af2012-04-02 13:15:44 -04004267 ad->u.net->sport = uh->source;
4268 ad->u.net->dport = uh->dest;
Eric Paris828dfe12008-04-17 13:17:49 -04004269 break;
4270 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004271
James Morris2ee92d42006-11-13 16:09:01 -08004272 case IPPROTO_DCCP: {
4273 struct dccp_hdr _dccph, *dh;
4274
4275 if (ntohs(ih->frag_off) & IP_OFFSET)
4276 break;
4277
4278 offset += ihlen;
4279 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4280 if (dh == NULL)
4281 break;
4282
Eric Paris48c62af2012-04-02 13:15:44 -04004283 ad->u.net->sport = dh->dccph_sport;
4284 ad->u.net->dport = dh->dccph_dport;
James Morris2ee92d42006-11-13 16:09:01 -08004285 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004286 }
James Morris2ee92d42006-11-13 16:09:01 -08004287
Richard Hainesd4529302018-02-13 20:57:18 +00004288#if IS_ENABLED(CONFIG_IP_SCTP)
4289 case IPPROTO_SCTP: {
4290 struct sctphdr _sctph, *sh;
4291
4292 if (ntohs(ih->frag_off) & IP_OFFSET)
4293 break;
4294
4295 offset += ihlen;
4296 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4297 if (sh == NULL)
4298 break;
4299
4300 ad->u.net->sport = sh->source;
4301 ad->u.net->dport = sh->dest;
4302 break;
4303 }
4304#endif
Eric Paris828dfe12008-04-17 13:17:49 -04004305 default:
4306 break;
4307 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004308out:
4309 return ret;
4310}
4311
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04004312#if IS_ENABLED(CONFIG_IPV6)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004313
4314/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004315static int selinux_parse_skb_ipv6(struct sk_buff *skb,
Thomas Liu2bf49692009-07-14 12:14:09 -04004316 struct common_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004317{
4318 u8 nexthdr;
4319 int ret = -EINVAL, offset;
4320 struct ipv6hdr _ipv6h, *ip6;
Jesse Gross75f28112011-11-30 17:05:51 -08004321 __be16 frag_off;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004322
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03004323 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004324 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4325 if (ip6 == NULL)
4326 goto out;
4327
Eric Paris48c62af2012-04-02 13:15:44 -04004328 ad->u.net->v6info.saddr = ip6->saddr;
4329 ad->u.net->v6info.daddr = ip6->daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004330 ret = 0;
4331
4332 nexthdr = ip6->nexthdr;
4333 offset += sizeof(_ipv6h);
Jesse Gross75f28112011-11-30 17:05:51 -08004334 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004335 if (offset < 0)
4336 goto out;
4337
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004338 if (proto)
4339 *proto = nexthdr;
4340
Linus Torvalds1da177e2005-04-16 15:20:36 -07004341 switch (nexthdr) {
4342 case IPPROTO_TCP: {
Eric Paris828dfe12008-04-17 13:17:49 -04004343 struct tcphdr _tcph, *th;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004344
4345 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4346 if (th == NULL)
4347 break;
4348
Eric Paris48c62af2012-04-02 13:15:44 -04004349 ad->u.net->sport = th->source;
4350 ad->u.net->dport = th->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004351 break;
4352 }
4353
4354 case IPPROTO_UDP: {
4355 struct udphdr _udph, *uh;
4356
4357 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4358 if (uh == NULL)
4359 break;
4360
Eric Paris48c62af2012-04-02 13:15:44 -04004361 ad->u.net->sport = uh->source;
4362 ad->u.net->dport = uh->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004363 break;
4364 }
4365
James Morris2ee92d42006-11-13 16:09:01 -08004366 case IPPROTO_DCCP: {
4367 struct dccp_hdr _dccph, *dh;
4368
4369 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4370 if (dh == NULL)
4371 break;
4372
Eric Paris48c62af2012-04-02 13:15:44 -04004373 ad->u.net->sport = dh->dccph_sport;
4374 ad->u.net->dport = dh->dccph_dport;
James Morris2ee92d42006-11-13 16:09:01 -08004375 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004376 }
James Morris2ee92d42006-11-13 16:09:01 -08004377
Richard Hainesd4529302018-02-13 20:57:18 +00004378#if IS_ENABLED(CONFIG_IP_SCTP)
4379 case IPPROTO_SCTP: {
4380 struct sctphdr _sctph, *sh;
4381
4382 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4383 if (sh == NULL)
4384 break;
4385
4386 ad->u.net->sport = sh->source;
4387 ad->u.net->dport = sh->dest;
4388 break;
4389 }
4390#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07004391 /* includes fragments */
4392 default:
4393 break;
4394 }
4395out:
4396 return ret;
4397}
4398
4399#endif /* IPV6 */
4400
Thomas Liu2bf49692009-07-14 12:14:09 -04004401static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
David Howellscf9481e2008-07-27 21:31:07 +10004402 char **_addrp, int src, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004403{
David Howellscf9481e2008-07-27 21:31:07 +10004404 char *addrp;
4405 int ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004406
Eric Paris48c62af2012-04-02 13:15:44 -04004407 switch (ad->u.net->family) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07004408 case PF_INET:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004409 ret = selinux_parse_skb_ipv4(skb, ad, proto);
David Howellscf9481e2008-07-27 21:31:07 +10004410 if (ret)
4411 goto parse_error;
Eric Paris48c62af2012-04-02 13:15:44 -04004412 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4413 &ad->u.net->v4info.daddr);
David Howellscf9481e2008-07-27 21:31:07 +10004414 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004415
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04004416#if IS_ENABLED(CONFIG_IPV6)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004417 case PF_INET6:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004418 ret = selinux_parse_skb_ipv6(skb, ad, proto);
David Howellscf9481e2008-07-27 21:31:07 +10004419 if (ret)
4420 goto parse_error;
Eric Paris48c62af2012-04-02 13:15:44 -04004421 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4422 &ad->u.net->v6info.daddr);
David Howellscf9481e2008-07-27 21:31:07 +10004423 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004424#endif /* IPV6 */
4425 default:
David Howellscf9481e2008-07-27 21:31:07 +10004426 addrp = NULL;
4427 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004428 }
4429
David Howellscf9481e2008-07-27 21:31:07 +10004430parse_error:
peter enderborgc103a912018-06-12 10:09:03 +02004431 pr_warn(
David Howellscf9481e2008-07-27 21:31:07 +10004432 "SELinux: failure in selinux_parse_skb(),"
4433 " unable to parse packet\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07004434 return ret;
David Howellscf9481e2008-07-27 21:31:07 +10004435
4436okay:
4437 if (_addrp)
4438 *_addrp = addrp;
4439 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004440}
4441
Paul Moore4f6a9932007-03-01 14:35:22 -05004442/**
Paul Moore220deb92008-01-29 08:38:23 -05004443 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
Paul Moore4f6a9932007-03-01 14:35:22 -05004444 * @skb: the packet
Paul Moore75e22912008-01-29 08:38:04 -05004445 * @family: protocol family
Paul Moore220deb92008-01-29 08:38:23 -05004446 * @sid: the packet's peer label SID
Paul Moore4f6a9932007-03-01 14:35:22 -05004447 *
4448 * Description:
Paul Moore220deb92008-01-29 08:38:23 -05004449 * Check the various different forms of network peer labeling and determine
4450 * the peer label/SID for the packet; most of the magic actually occurs in
4451 * the security server function security_net_peersid_cmp(). The function
4452 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4453 * or -EACCES if @sid is invalid due to inconsistencies with the different
4454 * peer labels.
Paul Moore4f6a9932007-03-01 14:35:22 -05004455 *
4456 */
Paul Moore220deb92008-01-29 08:38:23 -05004457static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
Paul Moore4f6a9932007-03-01 14:35:22 -05004458{
Paul Moore71f1cb02008-01-29 08:51:16 -05004459 int err;
Paul Moore4f6a9932007-03-01 14:35:22 -05004460 u32 xfrm_sid;
4461 u32 nlbl_sid;
Paul Moore220deb92008-01-29 08:38:23 -05004462 u32 nlbl_type;
Paul Moore4f6a9932007-03-01 14:35:22 -05004463
Paul Moore817eff72013-12-10 14:57:54 -05004464 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
Paul Moorebed4d7e2013-07-23 17:38:40 -04004465 if (unlikely(err))
4466 return -EACCES;
4467 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4468 if (unlikely(err))
4469 return -EACCES;
Paul Moore220deb92008-01-29 08:38:23 -05004470
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004471 err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4472 nlbl_type, xfrm_sid, sid);
Paul Moore71f1cb02008-01-29 08:51:16 -05004473 if (unlikely(err)) {
peter enderborgc103a912018-06-12 10:09:03 +02004474 pr_warn(
Paul Moore71f1cb02008-01-29 08:51:16 -05004475 "SELinux: failure in selinux_skb_peerlbl_sid(),"
4476 " unable to determine packet's peer label\n");
Paul Moore220deb92008-01-29 08:38:23 -05004477 return -EACCES;
Paul Moore71f1cb02008-01-29 08:51:16 -05004478 }
Paul Moore220deb92008-01-29 08:38:23 -05004479
4480 return 0;
Paul Moore4f6a9932007-03-01 14:35:22 -05004481}
4482
Paul Moore446b8022013-12-04 16:10:51 -05004483/**
4484 * selinux_conn_sid - Determine the child socket label for a connection
4485 * @sk_sid: the parent socket's SID
4486 * @skb_sid: the packet's SID
4487 * @conn_sid: the resulting connection SID
4488 *
4489 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4490 * combined with the MLS information from @skb_sid in order to create
4491 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
4492 * of @sk_sid. Returns zero on success, negative values on failure.
4493 *
4494 */
4495static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4496{
4497 int err = 0;
4498
4499 if (skb_sid != SECSID_NULL)
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004500 err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4501 conn_sid);
Paul Moore446b8022013-12-04 16:10:51 -05004502 else
4503 *conn_sid = sk_sid;
4504
4505 return err;
4506}
4507
Linus Torvalds1da177e2005-04-16 15:20:36 -07004508/* socket security operations */
Paul Moored4f2d972010-04-22 14:46:18 -04004509
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004510static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4511 u16 secclass, u32 *socksid)
Paul Moored4f2d972010-04-22 14:46:18 -04004512{
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004513 if (tsec->sockcreate_sid > SECSID_NULL) {
4514 *socksid = tsec->sockcreate_sid;
4515 return 0;
4516 }
4517
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004518 return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4519 secclass, NULL, socksid);
Paul Moored4f2d972010-04-22 14:46:18 -04004520}
4521
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004522static int sock_has_perm(struct sock *sk, u32 perms)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004523{
Paul Moore253bfae2010-04-22 14:46:19 -04004524 struct sk_security_struct *sksec = sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004525 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004526 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004527
Paul Moore253bfae2010-04-22 14:46:19 -04004528 if (sksec->sid == SECINITSID_KERNEL)
4529 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004530
Eric Paris50c205f2012-04-04 15:01:43 -04004531 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004532 ad.u.net = &net;
4533 ad.u.net->sk = sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004534
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004535 return avc_has_perm(&selinux_state,
4536 current_sid(), sksec->sid, sksec->sclass, perms,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004537 &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004538}
4539
4540static int selinux_socket_create(int family, int type,
4541 int protocol, int kern)
4542{
Paul Moore5fb49872010-04-22 14:46:19 -04004543 const struct task_security_struct *tsec = current_security();
Paul Moored4f2d972010-04-22 14:46:18 -04004544 u32 newsid;
David Howells275bb412008-11-14 10:39:19 +11004545 u16 secclass;
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004546 int rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004547
4548 if (kern)
Paul Moored4f2d972010-04-22 14:46:18 -04004549 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004550
David Howells275bb412008-11-14 10:39:19 +11004551 secclass = socket_type_to_security_class(family, type, protocol);
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004552 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4553 if (rc)
4554 return rc;
4555
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004556 return avc_has_perm(&selinux_state,
4557 tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004558}
4559
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07004560static int selinux_socket_post_create(struct socket *sock, int family,
4561 int type, int protocol, int kern)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004562{
Paul Moore5fb49872010-04-22 14:46:19 -04004563 const struct task_security_struct *tsec = current_security();
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05004564 struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004565 struct sk_security_struct *sksec;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004566 u16 sclass = socket_type_to_security_class(family, type, protocol);
4567 u32 sid = SECINITSID_KERNEL;
David Howells275bb412008-11-14 10:39:19 +11004568 int err = 0;
4569
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004570 if (!kern) {
4571 err = socket_sockcreate_sid(tsec, sclass, &sid);
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004572 if (err)
4573 return err;
4574 }
David Howells275bb412008-11-14 10:39:19 +11004575
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004576 isec->sclass = sclass;
4577 isec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05004578 isec->initialized = LABEL_INITIALIZED;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004579
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004580 if (sock->sk) {
4581 sksec = sock->sk->sk_security;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004582 sksec->sclass = sclass;
4583 sksec->sid = sid;
Richard Hainesd4529302018-02-13 20:57:18 +00004584 /* Allows detection of the first association on this socket */
4585 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4586 sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4587
Paul Moore389fb8002009-03-27 17:10:34 -04004588 err = selinux_netlbl_socket_post_create(sock->sk, family);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004589 }
4590
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07004591 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004592}
4593
David Herrmann0b811db2018-05-04 16:28:21 +02004594static int selinux_socket_socketpair(struct socket *socka,
4595 struct socket *sockb)
4596{
4597 struct sk_security_struct *sksec_a = socka->sk->sk_security;
4598 struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4599
4600 sksec_a->peer_sid = sksec_b->sid;
4601 sksec_b->peer_sid = sksec_a->sid;
4602
4603 return 0;
4604}
4605
Linus Torvalds1da177e2005-04-16 15:20:36 -07004606/* Range of port numbers used to automatically bind.
4607 Need to determine whether we should perform a name_bind
4608 permission check between the socket and the port number. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07004609
4610static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4611{
Paul Moore253bfae2010-04-22 14:46:19 -04004612 struct sock *sk = sock->sk;
Alexey Kodanev0f8db8c2018-05-11 20:15:11 +03004613 struct sk_security_struct *sksec = sk->sk_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004614 u16 family;
4615 int err;
4616
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004617 err = sock_has_perm(sk, SOCKET__BIND);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004618 if (err)
4619 goto out;
4620
Richard Hainesd4529302018-02-13 20:57:18 +00004621 /* If PF_INET or PF_INET6, check name_bind permission for the port. */
Paul Moore253bfae2010-04-22 14:46:19 -04004622 family = sk->sk_family;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004623 if (family == PF_INET || family == PF_INET6) {
4624 char *addrp;
Thomas Liu2bf49692009-07-14 12:14:09 -04004625 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004626 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004627 struct sockaddr_in *addr4 = NULL;
4628 struct sockaddr_in6 *addr6 = NULL;
Alexey Kodanev0f8db8c2018-05-11 20:15:11 +03004629 u16 family_sa = address->sa_family;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004630 unsigned short snum;
James Morrise399f982008-06-12 01:39:58 +10004631 u32 sid, node_perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004632
Richard Hainesd4529302018-02-13 20:57:18 +00004633 /*
4634 * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4635 * that validates multiple binding addresses. Because of this
4636 * need to check address->sa_family as it is possible to have
4637 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4638 */
Alexey Kodanev0f8db8c2018-05-11 20:15:11 +03004639 switch (family_sa) {
4640 case AF_UNSPEC:
Richard Haines68741a8a2018-03-02 19:54:34 +00004641 case AF_INET:
4642 if (addrlen < sizeof(struct sockaddr_in))
4643 return -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004644 addr4 = (struct sockaddr_in *)address;
Alexey Kodanev0f8db8c2018-05-11 20:15:11 +03004645 if (family_sa == AF_UNSPEC) {
4646 /* see __inet_bind(), we only want to allow
4647 * AF_UNSPEC if the address is INADDR_ANY
4648 */
4649 if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4650 goto err_af;
4651 family_sa = AF_INET;
4652 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004653 snum = ntohs(addr4->sin_port);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004654 addrp = (char *)&addr4->sin_addr.s_addr;
Richard Haines68741a8a2018-03-02 19:54:34 +00004655 break;
4656 case AF_INET6:
4657 if (addrlen < SIN6_LEN_RFC2133)
4658 return -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004659 addr6 = (struct sockaddr_in6 *)address;
4660 snum = ntohs(addr6->sin6_port);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004661 addrp = (char *)&addr6->sin6_addr.s6_addr;
Richard Haines68741a8a2018-03-02 19:54:34 +00004662 break;
4663 default:
Alexey Kodanev0f8db8c2018-05-11 20:15:11 +03004664 goto err_af;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004665 }
4666
Alexey Kodanev88b7d372018-05-11 20:15:12 +03004667 ad.type = LSM_AUDIT_DATA_NET;
4668 ad.u.net = &net;
4669 ad.u.net->sport = htons(snum);
4670 ad.u.net->family = family_sa;
4671
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004672 if (snum) {
4673 int low, high;
4674
Eric W. Biederman0bbf87d2013-09-28 14:10:59 -07004675 inet_get_local_port_range(sock_net(sk), &low, &high);
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004676
Krister Johansen4548b682017-01-20 17:49:11 -08004677 if (snum < max(inet_prot_sock(sock_net(sk)), low) ||
4678 snum > high) {
Paul Moore3e1121722008-04-10 10:48:14 -04004679 err = sel_netport_sid(sk->sk_protocol,
4680 snum, &sid);
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004681 if (err)
4682 goto out;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004683 err = avc_has_perm(&selinux_state,
4684 sksec->sid, sid,
Paul Moore253bfae2010-04-22 14:46:19 -04004685 sksec->sclass,
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004686 SOCKET__NAME_BIND, &ad);
4687 if (err)
4688 goto out;
4689 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004690 }
Eric Paris828dfe12008-04-17 13:17:49 -04004691
Paul Moore253bfae2010-04-22 14:46:19 -04004692 switch (sksec->sclass) {
James Morris13402582005-09-30 14:24:34 -04004693 case SECCLASS_TCP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004694 node_perm = TCP_SOCKET__NODE_BIND;
4695 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004696
James Morris13402582005-09-30 14:24:34 -04004697 case SECCLASS_UDP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004698 node_perm = UDP_SOCKET__NODE_BIND;
4699 break;
James Morris2ee92d42006-11-13 16:09:01 -08004700
4701 case SECCLASS_DCCP_SOCKET:
4702 node_perm = DCCP_SOCKET__NODE_BIND;
4703 break;
4704
Richard Hainesd4529302018-02-13 20:57:18 +00004705 case SECCLASS_SCTP_SOCKET:
4706 node_perm = SCTP_SOCKET__NODE_BIND;
4707 break;
4708
Linus Torvalds1da177e2005-04-16 15:20:36 -07004709 default:
4710 node_perm = RAWIP_SOCKET__NODE_BIND;
4711 break;
4712 }
Eric Paris828dfe12008-04-17 13:17:49 -04004713
Alexey Kodanev88b7d372018-05-11 20:15:12 +03004714 err = sel_netnode_sid(addrp, family_sa, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004715 if (err)
4716 goto out;
Eric Paris828dfe12008-04-17 13:17:49 -04004717
Alexey Kodanev0f8db8c2018-05-11 20:15:11 +03004718 if (family_sa == AF_INET)
Eric Paris48c62af2012-04-02 13:15:44 -04004719 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004720 else
Eric Paris48c62af2012-04-02 13:15:44 -04004721 ad.u.net->v6info.saddr = addr6->sin6_addr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004722
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004723 err = avc_has_perm(&selinux_state,
4724 sksec->sid, sid,
Paul Moore253bfae2010-04-22 14:46:19 -04004725 sksec->sclass, node_perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004726 if (err)
4727 goto out;
4728 }
4729out:
4730 return err;
Alexey Kodanev0f8db8c2018-05-11 20:15:11 +03004731err_af:
4732 /* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4733 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4734 return -EINVAL;
4735 return -EAFNOSUPPORT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004736}
4737
Richard Hainesd4529302018-02-13 20:57:18 +00004738/* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
Mauro Carvalho Chehab5fb94e92018-05-08 15:14:57 -03004739 * and sctp_sendmsg(3) as described in Documentation/security/LSM-sctp.rst
Richard Hainesd4529302018-02-13 20:57:18 +00004740 */
4741static int selinux_socket_connect_helper(struct socket *sock,
4742 struct sockaddr *address, int addrlen)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004743{
Paul Moore014ab192008-10-10 10:16:33 -04004744 struct sock *sk = sock->sk;
Paul Moore253bfae2010-04-22 14:46:19 -04004745 struct sk_security_struct *sksec = sk->sk_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004746 int err;
4747
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004748 err = sock_has_perm(sk, SOCKET__CONNECT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004749 if (err)
4750 return err;
4751
4752 /*
Richard Hainesd4529302018-02-13 20:57:18 +00004753 * If a TCP, DCCP or SCTP socket, check name_connect permission
4754 * for the port.
Linus Torvalds1da177e2005-04-16 15:20:36 -07004755 */
Paul Moore253bfae2010-04-22 14:46:19 -04004756 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
Richard Hainesd4529302018-02-13 20:57:18 +00004757 sksec->sclass == SECCLASS_DCCP_SOCKET ||
4758 sksec->sclass == SECCLASS_SCTP_SOCKET) {
Thomas Liu2bf49692009-07-14 12:14:09 -04004759 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004760 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004761 struct sockaddr_in *addr4 = NULL;
4762 struct sockaddr_in6 *addr6 = NULL;
4763 unsigned short snum;
James Morris2ee92d42006-11-13 16:09:01 -08004764 u32 sid, perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004765
Richard Hainesd4529302018-02-13 20:57:18 +00004766 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4767 * that validates multiple connect addresses. Because of this
4768 * need to check address->sa_family as it is possible to have
4769 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4770 */
Richard Haines68741a8a2018-03-02 19:54:34 +00004771 switch (address->sa_family) {
4772 case AF_INET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004773 addr4 = (struct sockaddr_in *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07004774 if (addrlen < sizeof(struct sockaddr_in))
Linus Torvalds1da177e2005-04-16 15:20:36 -07004775 return -EINVAL;
4776 snum = ntohs(addr4->sin_port);
Richard Haines68741a8a2018-03-02 19:54:34 +00004777 break;
4778 case AF_INET6:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004779 addr6 = (struct sockaddr_in6 *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07004780 if (addrlen < SIN6_LEN_RFC2133)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004781 return -EINVAL;
4782 snum = ntohs(addr6->sin6_port);
Richard Haines68741a8a2018-03-02 19:54:34 +00004783 break;
4784 default:
4785 /* Note that SCTP services expect -EINVAL, whereas
4786 * others expect -EAFNOSUPPORT.
4787 */
4788 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4789 return -EINVAL;
4790 else
4791 return -EAFNOSUPPORT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004792 }
4793
Paul Moore3e1121722008-04-10 10:48:14 -04004794 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004795 if (err)
Richard Hainesd4529302018-02-13 20:57:18 +00004796 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004797
Richard Hainesd4529302018-02-13 20:57:18 +00004798 switch (sksec->sclass) {
4799 case SECCLASS_TCP_SOCKET:
4800 perm = TCP_SOCKET__NAME_CONNECT;
4801 break;
4802 case SECCLASS_DCCP_SOCKET:
4803 perm = DCCP_SOCKET__NAME_CONNECT;
4804 break;
4805 case SECCLASS_SCTP_SOCKET:
4806 perm = SCTP_SOCKET__NAME_CONNECT;
4807 break;
4808 }
James Morris2ee92d42006-11-13 16:09:01 -08004809
Eric Paris50c205f2012-04-04 15:01:43 -04004810 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004811 ad.u.net = &net;
4812 ad.u.net->dport = htons(snum);
Alexey Kodanev88b7d372018-05-11 20:15:12 +03004813 ad.u.net->family = address->sa_family;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004814 err = avc_has_perm(&selinux_state,
4815 sksec->sid, sid, sksec->sclass, perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004816 if (err)
Richard Hainesd4529302018-02-13 20:57:18 +00004817 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004818 }
4819
Richard Hainesd4529302018-02-13 20:57:18 +00004820 return 0;
4821}
Paul Moore014ab192008-10-10 10:16:33 -04004822
Richard Hainesd4529302018-02-13 20:57:18 +00004823/* Supports connect(2), see comments in selinux_socket_connect_helper() */
4824static int selinux_socket_connect(struct socket *sock,
4825 struct sockaddr *address, int addrlen)
4826{
4827 int err;
4828 struct sock *sk = sock->sk;
4829
4830 err = selinux_socket_connect_helper(sock, address, addrlen);
4831 if (err)
4832 return err;
4833
4834 return selinux_netlbl_socket_connect(sk, address);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004835}
4836
4837static int selinux_socket_listen(struct socket *sock, int backlog)
4838{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004839 return sock_has_perm(sock->sk, SOCKET__LISTEN);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004840}
4841
4842static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4843{
4844 int err;
4845 struct inode_security_struct *isec;
4846 struct inode_security_struct *newisec;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004847 u16 sclass;
4848 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004849
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004850 err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004851 if (err)
4852 return err;
4853
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05004854 isec = inode_security_novalidate(SOCK_INODE(sock));
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004855 spin_lock(&isec->lock);
4856 sclass = isec->sclass;
4857 sid = isec->sid;
4858 spin_unlock(&isec->lock);
4859
4860 newisec = inode_security_novalidate(SOCK_INODE(newsock));
4861 newisec->sclass = sclass;
4862 newisec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05004863 newisec->initialized = LABEL_INITIALIZED;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004864
4865 return 0;
4866}
4867
4868static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
Eric Paris828dfe12008-04-17 13:17:49 -04004869 int size)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004870{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004871 return sock_has_perm(sock->sk, SOCKET__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004872}
4873
4874static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4875 int size, int flags)
4876{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004877 return sock_has_perm(sock->sk, SOCKET__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004878}
4879
4880static int selinux_socket_getsockname(struct socket *sock)
4881{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004882 return sock_has_perm(sock->sk, SOCKET__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004883}
4884
4885static int selinux_socket_getpeername(struct socket *sock)
4886{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004887 return sock_has_perm(sock->sk, SOCKET__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004888}
4889
Eric Paris828dfe12008-04-17 13:17:49 -04004890static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004891{
Paul Mooref8687af2006-10-30 15:22:15 -08004892 int err;
4893
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004894 err = sock_has_perm(sock->sk, SOCKET__SETOPT);
Paul Mooref8687af2006-10-30 15:22:15 -08004895 if (err)
4896 return err;
4897
4898 return selinux_netlbl_socket_setsockopt(sock, level, optname);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004899}
4900
4901static int selinux_socket_getsockopt(struct socket *sock, int level,
4902 int optname)
4903{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004904 return sock_has_perm(sock->sk, SOCKET__GETOPT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004905}
4906
4907static int selinux_socket_shutdown(struct socket *sock, int how)
4908{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004909 return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004910}
4911
David S. Miller3610cda2011-01-05 15:38:53 -08004912static int selinux_socket_unix_stream_connect(struct sock *sock,
4913 struct sock *other,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004914 struct sock *newsk)
4915{
David S. Miller3610cda2011-01-05 15:38:53 -08004916 struct sk_security_struct *sksec_sock = sock->sk_security;
4917 struct sk_security_struct *sksec_other = other->sk_security;
Paul Moore4d1e2452010-04-22 14:46:18 -04004918 struct sk_security_struct *sksec_new = newsk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004919 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004920 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004921 int err;
4922
Eric Paris50c205f2012-04-04 15:01:43 -04004923 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004924 ad.u.net = &net;
4925 ad.u.net->sk = other;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004926
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004927 err = avc_has_perm(&selinux_state,
4928 sksec_sock->sid, sksec_other->sid,
Paul Moore4d1e2452010-04-22 14:46:18 -04004929 sksec_other->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004930 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4931 if (err)
4932 return err;
4933
Linus Torvalds1da177e2005-04-16 15:20:36 -07004934 /* server child socket */
Paul Moore4d1e2452010-04-22 14:46:18 -04004935 sksec_new->peer_sid = sksec_sock->sid;
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004936 err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
4937 sksec_sock->sid, &sksec_new->sid);
Paul Moore4d1e2452010-04-22 14:46:18 -04004938 if (err)
4939 return err;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004940
Paul Moore4d1e2452010-04-22 14:46:18 -04004941 /* connecting socket */
4942 sksec_sock->peer_sid = sksec_new->sid;
4943
4944 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004945}
4946
4947static int selinux_socket_unix_may_send(struct socket *sock,
4948 struct socket *other)
4949{
Paul Moore253bfae2010-04-22 14:46:19 -04004950 struct sk_security_struct *ssec = sock->sk->sk_security;
4951 struct sk_security_struct *osec = other->sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004952 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004953 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004954
Eric Paris50c205f2012-04-04 15:01:43 -04004955 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004956 ad.u.net = &net;
4957 ad.u.net->sk = other->sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004958
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004959 return avc_has_perm(&selinux_state,
4960 ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
Paul Moore253bfae2010-04-22 14:46:19 -04004961 &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004962}
4963
Paul Moorecbe0d6e2014-09-10 17:09:57 -04004964static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4965 char *addrp, u16 family, u32 peer_sid,
Thomas Liu2bf49692009-07-14 12:14:09 -04004966 struct common_audit_data *ad)
Paul Mooreeffad8d2008-01-29 08:49:27 -05004967{
4968 int err;
4969 u32 if_sid;
4970 u32 node_sid;
4971
Paul Moorecbe0d6e2014-09-10 17:09:57 -04004972 err = sel_netif_sid(ns, ifindex, &if_sid);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004973 if (err)
4974 return err;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004975 err = avc_has_perm(&selinux_state,
4976 peer_sid, if_sid,
Paul Mooreeffad8d2008-01-29 08:49:27 -05004977 SECCLASS_NETIF, NETIF__INGRESS, ad);
4978 if (err)
4979 return err;
4980
4981 err = sel_netnode_sid(addrp, family, &node_sid);
4982 if (err)
4983 return err;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004984 return avc_has_perm(&selinux_state,
4985 peer_sid, node_sid,
Paul Mooreeffad8d2008-01-29 08:49:27 -05004986 SECCLASS_NODE, NODE__RECVFROM, ad);
4987}
4988
Paul Moore220deb92008-01-29 08:38:23 -05004989static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
Paul Moored8395c82008-10-10 10:16:30 -04004990 u16 family)
Paul Moore220deb92008-01-29 08:38:23 -05004991{
Paul Moore277d3422008-12-31 12:54:11 -05004992 int err = 0;
Paul Moore220deb92008-01-29 08:38:23 -05004993 struct sk_security_struct *sksec = sk->sk_security;
Paul Moore220deb92008-01-29 08:38:23 -05004994 u32 sk_sid = sksec->sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04004995 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004996 struct lsm_network_audit net = {0,};
Paul Moored8395c82008-10-10 10:16:30 -04004997 char *addrp;
4998
Eric Paris50c205f2012-04-04 15:01:43 -04004999 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005000 ad.u.net = &net;
5001 ad.u.net->netif = skb->skb_iif;
5002 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04005003 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5004 if (err)
5005 return err;
Paul Moore220deb92008-01-29 08:38:23 -05005006
Paul Moore58bfbb52009-03-27 17:10:41 -04005007 if (selinux_secmark_enabled()) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005008 err = avc_has_perm(&selinux_state,
5009 sk_sid, skb->secmark, SECCLASS_PACKET,
Paul Moored8395c82008-10-10 10:16:30 -04005010 PACKET__RECV, &ad);
Paul Moore58bfbb52009-03-27 17:10:41 -04005011 if (err)
5012 return err;
5013 }
Paul Moore220deb92008-01-29 08:38:23 -05005014
Steffen Klassertb9679a72011-02-23 12:55:21 +01005015 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
5016 if (err)
5017 return err;
5018 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005019
James Morris4e5ab4c2006-06-09 00:33:33 -07005020 return err;
5021}
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005022
James Morris4e5ab4c2006-06-09 00:33:33 -07005023static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
5024{
Paul Moore220deb92008-01-29 08:38:23 -05005025 int err;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005026 struct sk_security_struct *sksec = sk->sk_security;
Paul Moore220deb92008-01-29 08:38:23 -05005027 u16 family = sk->sk_family;
5028 u32 sk_sid = sksec->sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04005029 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005030 struct lsm_network_audit net = {0,};
Paul Moore220deb92008-01-29 08:38:23 -05005031 char *addrp;
Paul Moored8395c82008-10-10 10:16:30 -04005032 u8 secmark_active;
5033 u8 peerlbl_active;
James Morris4e5ab4c2006-06-09 00:33:33 -07005034
James Morris4e5ab4c2006-06-09 00:33:33 -07005035 if (family != PF_INET && family != PF_INET6)
Paul Moore220deb92008-01-29 08:38:23 -05005036 return 0;
James Morris4e5ab4c2006-06-09 00:33:33 -07005037
5038 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
Al Viro87fcd702006-12-04 22:00:55 +00005039 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
James Morris4e5ab4c2006-06-09 00:33:33 -07005040 family = PF_INET;
5041
Paul Moored8395c82008-10-10 10:16:30 -04005042 /* If any sort of compatibility mode is enabled then handoff processing
5043 * to the selinux_sock_rcv_skb_compat() function to deal with the
5044 * special handling. We do this in an attempt to keep this function
5045 * as fast and as clean as possible. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005046 if (!selinux_policycap_netpeer())
Paul Moored8395c82008-10-10 10:16:30 -04005047 return selinux_sock_rcv_skb_compat(sk, skb, family);
5048
5049 secmark_active = selinux_secmark_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04005050 peerlbl_active = selinux_peerlbl_enabled();
Paul Moored8395c82008-10-10 10:16:30 -04005051 if (!secmark_active && !peerlbl_active)
5052 return 0;
5053
Eric Paris50c205f2012-04-04 15:01:43 -04005054 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005055 ad.u.net = &net;
5056 ad.u.net->netif = skb->skb_iif;
5057 ad.u.net->family = family;
Paul Moore224dfbd2008-01-29 08:38:13 -05005058 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
James Morris4e5ab4c2006-06-09 00:33:33 -07005059 if (err)
Paul Moore220deb92008-01-29 08:38:23 -05005060 return err;
James Morris4e5ab4c2006-06-09 00:33:33 -07005061
Paul Moored8395c82008-10-10 10:16:30 -04005062 if (peerlbl_active) {
Paul Moored621d352008-01-29 08:43:36 -05005063 u32 peer_sid;
5064
5065 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
5066 if (err)
5067 return err;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005068 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
5069 addrp, family, peer_sid, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04005070 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04005071 selinux_netlbl_err(skb, family, err, 0);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005072 return err;
Paul Mooredfaebe92008-10-10 10:16:31 -04005073 }
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005074 err = avc_has_perm(&selinux_state,
5075 sk_sid, peer_sid, SECCLASS_PEER,
Paul Moored621d352008-01-29 08:43:36 -05005076 PEER__RECV, &ad);
Chad Hanson46d01d62013-12-23 17:45:01 -05005077 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04005078 selinux_netlbl_err(skb, family, err, 0);
Chad Hanson46d01d62013-12-23 17:45:01 -05005079 return err;
5080 }
Paul Moored621d352008-01-29 08:43:36 -05005081 }
5082
Paul Moored8395c82008-10-10 10:16:30 -04005083 if (secmark_active) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005084 err = avc_has_perm(&selinux_state,
5085 sk_sid, skb->secmark, SECCLASS_PACKET,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005086 PACKET__RECV, &ad);
5087 if (err)
5088 return err;
5089 }
5090
Paul Moored621d352008-01-29 08:43:36 -05005091 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005092}
5093
Catherine Zhang2c7946a2006-03-20 22:41:23 -08005094static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
5095 int __user *optlen, unsigned len)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005096{
5097 int err = 0;
5098 char *scontext;
5099 u32 scontext_len;
Paul Moore253bfae2010-04-22 14:46:19 -04005100 struct sk_security_struct *sksec = sock->sk->sk_security;
Paul Moore3de4bab2006-11-17 17:38:54 -05005101 u32 peer_sid = SECSID_NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005102
Paul Moore253bfae2010-04-22 14:46:19 -04005103 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
Richard Hainesd4529302018-02-13 20:57:18 +00005104 sksec->sclass == SECCLASS_TCP_SOCKET ||
5105 sksec->sclass == SECCLASS_SCTP_SOCKET)
Eric Parisdd3e7832010-04-07 15:08:46 -04005106 peer_sid = sksec->peer_sid;
Paul Moore253bfae2010-04-22 14:46:19 -04005107 if (peer_sid == SECSID_NULL)
5108 return -ENOPROTOOPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005109
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005110 err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
5111 &scontext_len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005112 if (err)
Paul Moore253bfae2010-04-22 14:46:19 -04005113 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005114
5115 if (scontext_len > len) {
5116 err = -ERANGE;
5117 goto out_len;
5118 }
5119
5120 if (copy_to_user(optval, scontext, scontext_len))
5121 err = -EFAULT;
5122
5123out_len:
5124 if (put_user(scontext_len, optlen))
5125 err = -EFAULT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005126 kfree(scontext);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005127 return err;
5128}
5129
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005130static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
Catherine Zhang2c7946a2006-03-20 22:41:23 -08005131{
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005132 u32 peer_secid = SECSID_NULL;
Paul Moore75e22912008-01-29 08:38:04 -05005133 u16 family;
Paul Moore899134f2016-03-28 15:19:10 -04005134 struct inode_security_struct *isec;
Catherine Zhang877ce7c2006-06-29 12:27:47 -07005135
Paul Mooreaa862902008-10-10 10:16:29 -04005136 if (skb && skb->protocol == htons(ETH_P_IP))
5137 family = PF_INET;
5138 else if (skb && skb->protocol == htons(ETH_P_IPV6))
5139 family = PF_INET6;
5140 else if (sock)
Paul Moore75e22912008-01-29 08:38:04 -05005141 family = sock->sk->sk_family;
Paul Moore75e22912008-01-29 08:38:04 -05005142 else
5143 goto out;
5144
Paul Moore899134f2016-03-28 15:19:10 -04005145 if (sock && family == PF_UNIX) {
5146 isec = inode_security_novalidate(SOCK_INODE(sock));
5147 peer_secid = isec->sid;
5148 } else if (skb)
Paul Moore220deb92008-01-29 08:38:23 -05005149 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
Catherine Zhang2c7946a2006-03-20 22:41:23 -08005150
Paul Moore75e22912008-01-29 08:38:04 -05005151out:
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005152 *secid = peer_secid;
Paul Moore75e22912008-01-29 08:38:04 -05005153 if (peer_secid == SECSID_NULL)
5154 return -EINVAL;
5155 return 0;
Catherine Zhang2c7946a2006-03-20 22:41:23 -08005156}
5157
Al Viro7d877f32005-10-21 03:20:43 -04005158static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005159{
Paul Moore84914b72010-04-22 14:46:18 -04005160 struct sk_security_struct *sksec;
5161
5162 sksec = kzalloc(sizeof(*sksec), priority);
5163 if (!sksec)
5164 return -ENOMEM;
5165
5166 sksec->peer_sid = SECINITSID_UNLABELED;
5167 sksec->sid = SECINITSID_UNLABELED;
Stephen Smalley5dee25d2015-07-10 17:19:57 -04005168 sksec->sclass = SECCLASS_SOCKET;
Paul Moore84914b72010-04-22 14:46:18 -04005169 selinux_netlbl_sk_security_reset(sksec);
5170 sk->sk_security = sksec;
5171
5172 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005173}
5174
5175static void selinux_sk_free_security(struct sock *sk)
5176{
Paul Moore84914b72010-04-22 14:46:18 -04005177 struct sk_security_struct *sksec = sk->sk_security;
5178
5179 sk->sk_security = NULL;
5180 selinux_netlbl_sk_security_free(sksec);
5181 kfree(sksec);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005182}
5183
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005184static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5185{
Eric Parisdd3e7832010-04-07 15:08:46 -04005186 struct sk_security_struct *sksec = sk->sk_security;
5187 struct sk_security_struct *newsksec = newsk->sk_security;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005188
Eric Parisdd3e7832010-04-07 15:08:46 -04005189 newsksec->sid = sksec->sid;
5190 newsksec->peer_sid = sksec->peer_sid;
5191 newsksec->sclass = sksec->sclass;
Paul Moore99f59ed2006-08-29 17:53:48 -07005192
Eric Parisdd3e7832010-04-07 15:08:46 -04005193 selinux_netlbl_sk_security_reset(newsksec);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005194}
5195
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07005196static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005197{
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005198 if (!sk)
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07005199 *secid = SECINITSID_ANY_SOCKET;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005200 else {
5201 struct sk_security_struct *sksec = sk->sk_security;
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005202
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07005203 *secid = sksec->sid;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005204 }
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005205}
5206
Eric Paris828dfe12008-04-17 13:17:49 -04005207static void selinux_sock_graft(struct sock *sk, struct socket *parent)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005208{
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05005209 struct inode_security_struct *isec =
5210 inode_security_novalidate(SOCK_INODE(parent));
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005211 struct sk_security_struct *sksec = sk->sk_security;
5212
Paul Moore2873ead2014-07-28 10:42:48 -04005213 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5214 sk->sk_family == PF_UNIX)
David Woodhouse2148ccc2006-09-29 15:50:25 -07005215 isec->sid = sksec->sid;
Paul Moore220deb92008-01-29 08:38:23 -05005216 sksec->sclass = isec->sclass;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005217}
5218
Richard Hainesd4529302018-02-13 20:57:18 +00005219/* Called whenever SCTP receives an INIT chunk. This happens when an incoming
5220 * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
5221 * already present).
5222 */
5223static int selinux_sctp_assoc_request(struct sctp_endpoint *ep,
5224 struct sk_buff *skb)
5225{
5226 struct sk_security_struct *sksec = ep->base.sk->sk_security;
5227 struct common_audit_data ad;
5228 struct lsm_network_audit net = {0,};
5229 u8 peerlbl_active;
5230 u32 peer_sid = SECINITSID_UNLABELED;
5231 u32 conn_sid;
5232 int err = 0;
5233
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005234 if (!selinux_policycap_extsockclass())
Richard Hainesd4529302018-02-13 20:57:18 +00005235 return 0;
5236
5237 peerlbl_active = selinux_peerlbl_enabled();
5238
5239 if (peerlbl_active) {
5240 /* This will return peer_sid = SECSID_NULL if there are
5241 * no peer labels, see security_net_peersid_resolve().
5242 */
5243 err = selinux_skb_peerlbl_sid(skb, ep->base.sk->sk_family,
5244 &peer_sid);
5245 if (err)
5246 return err;
5247
5248 if (peer_sid == SECSID_NULL)
5249 peer_sid = SECINITSID_UNLABELED;
5250 }
5251
5252 if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5253 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5254
5255 /* Here as first association on socket. As the peer SID
5256 * was allowed by peer recv (and the netif/node checks),
5257 * then it is approved by policy and used as the primary
5258 * peer SID for getpeercon(3).
5259 */
5260 sksec->peer_sid = peer_sid;
5261 } else if (sksec->peer_sid != peer_sid) {
5262 /* Other association peer SIDs are checked to enforce
5263 * consistency among the peer SIDs.
5264 */
5265 ad.type = LSM_AUDIT_DATA_NET;
5266 ad.u.net = &net;
5267 ad.u.net->sk = ep->base.sk;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005268 err = avc_has_perm(&selinux_state,
5269 sksec->peer_sid, peer_sid, sksec->sclass,
Richard Hainesd4529302018-02-13 20:57:18 +00005270 SCTP_SOCKET__ASSOCIATION, &ad);
5271 if (err)
5272 return err;
5273 }
5274
5275 /* Compute the MLS component for the connection and store
5276 * the information in ep. This will be used by SCTP TCP type
5277 * sockets and peeled off connections as they cause a new
5278 * socket to be generated. selinux_sctp_sk_clone() will then
5279 * plug this into the new socket.
5280 */
5281 err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
5282 if (err)
5283 return err;
5284
5285 ep->secid = conn_sid;
5286 ep->peer_secid = peer_sid;
5287
5288 /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5289 return selinux_netlbl_sctp_assoc_request(ep, skb);
5290}
5291
5292/* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5293 * based on their @optname.
5294 */
5295static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5296 struct sockaddr *address,
5297 int addrlen)
5298{
5299 int len, err = 0, walk_size = 0;
5300 void *addr_buf;
5301 struct sockaddr *addr;
5302 struct socket *sock;
5303
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005304 if (!selinux_policycap_extsockclass())
Richard Hainesd4529302018-02-13 20:57:18 +00005305 return 0;
5306
5307 /* Process one or more addresses that may be IPv4 or IPv6 */
5308 sock = sk->sk_socket;
5309 addr_buf = address;
5310
5311 while (walk_size < addrlen) {
5312 addr = addr_buf;
5313 switch (addr->sa_family) {
Alexey Kodanev4152dc92018-05-11 20:15:13 +03005314 case AF_UNSPEC:
Richard Hainesd4529302018-02-13 20:57:18 +00005315 case AF_INET:
5316 len = sizeof(struct sockaddr_in);
5317 break;
5318 case AF_INET6:
5319 len = sizeof(struct sockaddr_in6);
5320 break;
5321 default:
Alexey Kodanev4152dc92018-05-11 20:15:13 +03005322 return -EINVAL;
Richard Hainesd4529302018-02-13 20:57:18 +00005323 }
5324
5325 err = -EINVAL;
5326 switch (optname) {
5327 /* Bind checks */
5328 case SCTP_PRIMARY_ADDR:
5329 case SCTP_SET_PEER_PRIMARY_ADDR:
5330 case SCTP_SOCKOPT_BINDX_ADD:
5331 err = selinux_socket_bind(sock, addr, len);
5332 break;
5333 /* Connect checks */
5334 case SCTP_SOCKOPT_CONNECTX:
5335 case SCTP_PARAM_SET_PRIMARY:
5336 case SCTP_PARAM_ADD_IP:
5337 case SCTP_SENDMSG_CONNECT:
5338 err = selinux_socket_connect_helper(sock, addr, len);
5339 if (err)
5340 return err;
5341
5342 /* As selinux_sctp_bind_connect() is called by the
5343 * SCTP protocol layer, the socket is already locked,
5344 * therefore selinux_netlbl_socket_connect_locked() is
5345 * is called here. The situations handled are:
5346 * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5347 * whenever a new IP address is added or when a new
5348 * primary address is selected.
5349 * Note that an SCTP connect(2) call happens before
5350 * the SCTP protocol layer and is handled via
5351 * selinux_socket_connect().
5352 */
5353 err = selinux_netlbl_socket_connect_locked(sk, addr);
5354 break;
5355 }
5356
5357 if (err)
5358 return err;
5359
5360 addr_buf += len;
5361 walk_size += len;
5362 }
5363
5364 return 0;
5365}
5366
5367/* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5368static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
5369 struct sock *newsk)
5370{
5371 struct sk_security_struct *sksec = sk->sk_security;
5372 struct sk_security_struct *newsksec = newsk->sk_security;
5373
5374 /* If policy does not support SECCLASS_SCTP_SOCKET then call
5375 * the non-sctp clone version.
5376 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005377 if (!selinux_policycap_extsockclass())
Richard Hainesd4529302018-02-13 20:57:18 +00005378 return selinux_sk_clone_security(sk, newsk);
5379
5380 newsksec->sid = ep->secid;
5381 newsksec->peer_sid = ep->peer_secid;
5382 newsksec->sclass = sksec->sclass;
5383 selinux_netlbl_sctp_sk_clone(sk, newsk);
5384}
5385
Adrian Bunk9a673e52006-08-15 00:03:53 -07005386static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
5387 struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005388{
5389 struct sk_security_struct *sksec = sk->sk_security;
5390 int err;
Paul Moore0b1f24e2013-12-03 11:39:13 -05005391 u16 family = req->rsk_ops->family;
Paul Moore446b8022013-12-04 16:10:51 -05005392 u32 connsid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005393 u32 peersid;
5394
Paul Mooreaa862902008-10-10 10:16:29 -04005395 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
Paul Moore220deb92008-01-29 08:38:23 -05005396 if (err)
5397 return err;
Paul Moore446b8022013-12-04 16:10:51 -05005398 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5399 if (err)
5400 return err;
5401 req->secid = connsid;
5402 req->peer_secid = peersid;
Venkat Yekkiralaa51c64f2006-07-27 22:01:34 -07005403
Paul Moore389fb8002009-03-27 17:10:34 -04005404 return selinux_netlbl_inet_conn_request(req, family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005405}
5406
Adrian Bunk9a673e52006-08-15 00:03:53 -07005407static void selinux_inet_csk_clone(struct sock *newsk,
5408 const struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005409{
5410 struct sk_security_struct *newsksec = newsk->sk_security;
5411
5412 newsksec->sid = req->secid;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005413 newsksec->peer_sid = req->peer_secid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005414 /* NOTE: Ideally, we should also get the isec->sid for the
5415 new socket in sync, but we don't have the isec available yet.
5416 So we will wait until sock_graft to do it, by which
5417 time it will have been created and available. */
Paul Moore99f59ed2006-08-29 17:53:48 -07005418
Paul Moore9f2ad662006-11-17 17:38:53 -05005419 /* We don't need to take any sort of lock here as we are the only
5420 * thread with access to newsksec */
Paul Moore389fb8002009-03-27 17:10:34 -04005421 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005422}
5423
Paul Moore014ab192008-10-10 10:16:33 -04005424static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005425{
Paul Mooreaa862902008-10-10 10:16:29 -04005426 u16 family = sk->sk_family;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005427 struct sk_security_struct *sksec = sk->sk_security;
5428
Paul Mooreaa862902008-10-10 10:16:29 -04005429 /* handle mapped IPv4 packets arriving via IPv6 sockets */
5430 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5431 family = PF_INET;
5432
5433 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005434}
5435
Eric Paris2606fd12010-10-13 16:24:41 -04005436static int selinux_secmark_relabel_packet(u32 sid)
5437{
5438 const struct task_security_struct *__tsec;
5439 u32 tsid;
5440
5441 __tsec = current_security();
5442 tsid = __tsec->sid;
5443
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005444 return avc_has_perm(&selinux_state,
5445 tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5446 NULL);
Eric Paris2606fd12010-10-13 16:24:41 -04005447}
5448
5449static void selinux_secmark_refcount_inc(void)
5450{
5451 atomic_inc(&selinux_secmark_refcount);
5452}
5453
5454static void selinux_secmark_refcount_dec(void)
5455{
5456 atomic_dec(&selinux_secmark_refcount);
5457}
5458
Adrian Bunk9a673e52006-08-15 00:03:53 -07005459static void selinux_req_classify_flow(const struct request_sock *req,
5460 struct flowi *fl)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005461{
David S. Miller1d28f422011-03-12 00:29:39 -05005462 fl->flowi_secid = req->secid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005463}
5464
Paul Moore5dbbaf22013-01-14 07:12:19 +00005465static int selinux_tun_dev_alloc_security(void **security)
5466{
5467 struct tun_security_struct *tunsec;
5468
5469 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5470 if (!tunsec)
5471 return -ENOMEM;
5472 tunsec->sid = current_sid();
5473
5474 *security = tunsec;
5475 return 0;
5476}
5477
5478static void selinux_tun_dev_free_security(void *security)
5479{
5480 kfree(security);
5481}
5482
Paul Mooreed6d76e2009-08-28 18:12:49 -04005483static int selinux_tun_dev_create(void)
5484{
5485 u32 sid = current_sid();
5486
5487 /* we aren't taking into account the "sockcreate" SID since the socket
5488 * that is being created here is not a socket in the traditional sense,
5489 * instead it is a private sock, accessible only to the kernel, and
5490 * representing a wide range of network traffic spanning multiple
5491 * connections unlike traditional sockets - check the TUN driver to
5492 * get a better understanding of why this socket is special */
5493
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005494 return avc_has_perm(&selinux_state,
5495 sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
Paul Mooreed6d76e2009-08-28 18:12:49 -04005496 NULL);
5497}
5498
Paul Moore5dbbaf22013-01-14 07:12:19 +00005499static int selinux_tun_dev_attach_queue(void *security)
Paul Mooreed6d76e2009-08-28 18:12:49 -04005500{
Paul Moore5dbbaf22013-01-14 07:12:19 +00005501 struct tun_security_struct *tunsec = security;
5502
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005503 return avc_has_perm(&selinux_state,
5504 current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
Paul Moore5dbbaf22013-01-14 07:12:19 +00005505 TUN_SOCKET__ATTACH_QUEUE, NULL);
5506}
5507
5508static int selinux_tun_dev_attach(struct sock *sk, void *security)
5509{
5510 struct tun_security_struct *tunsec = security;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005511 struct sk_security_struct *sksec = sk->sk_security;
5512
5513 /* we don't currently perform any NetLabel based labeling here and it
5514 * isn't clear that we would want to do so anyway; while we could apply
5515 * labeling without the support of the TUN user the resulting labeled
5516 * traffic from the other end of the connection would almost certainly
5517 * cause confusion to the TUN user that had no idea network labeling
5518 * protocols were being used */
5519
Paul Moore5dbbaf22013-01-14 07:12:19 +00005520 sksec->sid = tunsec->sid;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005521 sksec->sclass = SECCLASS_TUN_SOCKET;
Paul Moore5dbbaf22013-01-14 07:12:19 +00005522
5523 return 0;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005524}
5525
Paul Moore5dbbaf22013-01-14 07:12:19 +00005526static int selinux_tun_dev_open(void *security)
Paul Mooreed6d76e2009-08-28 18:12:49 -04005527{
Paul Moore5dbbaf22013-01-14 07:12:19 +00005528 struct tun_security_struct *tunsec = security;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005529 u32 sid = current_sid();
5530 int err;
5531
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005532 err = avc_has_perm(&selinux_state,
5533 sid, tunsec->sid, SECCLASS_TUN_SOCKET,
Paul Mooreed6d76e2009-08-28 18:12:49 -04005534 TUN_SOCKET__RELABELFROM, NULL);
5535 if (err)
5536 return err;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005537 err = avc_has_perm(&selinux_state,
5538 sid, sid, SECCLASS_TUN_SOCKET,
Paul Mooreed6d76e2009-08-28 18:12:49 -04005539 TUN_SOCKET__RELABELTO, NULL);
5540 if (err)
5541 return err;
Paul Moore5dbbaf22013-01-14 07:12:19 +00005542 tunsec->sid = sid;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005543
5544 return 0;
5545}
5546
Linus Torvalds1da177e2005-04-16 15:20:36 -07005547static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5548{
5549 int err = 0;
5550 u32 perm;
5551 struct nlmsghdr *nlh;
Paul Moore253bfae2010-04-22 14:46:19 -04005552 struct sk_security_struct *sksec = sk->sk_security;
Eric Paris828dfe12008-04-17 13:17:49 -04005553
Hong zhi guo77954982013-03-27 06:49:35 +00005554 if (skb->len < NLMSG_HDRLEN) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005555 err = -EINVAL;
5556 goto out;
5557 }
Arnaldo Carvalho de Melob529ccf2007-04-25 19:08:35 -07005558 nlh = nlmsg_hdr(skb);
Eric Paris828dfe12008-04-17 13:17:49 -04005559
Paul Moore253bfae2010-04-22 14:46:19 -04005560 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005561 if (err) {
5562 if (err == -EINVAL) {
Vladis Dronov76319942015-12-24 11:09:41 -05005563 pr_warn_ratelimited("SELinux: unrecognized netlink"
5564 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5565 " pig=%d comm=%s\n",
Marek Milkoviccded3ff2015-06-04 16:22:16 -04005566 sk->sk_protocol, nlh->nlmsg_type,
Vladis Dronov76319942015-12-24 11:09:41 -05005567 secclass_map[sksec->sclass - 1].name,
5568 task_pid_nr(current), current->comm);
Paul Mooree5a5ca92018-03-01 17:38:30 -05005569 if (!enforcing_enabled(&selinux_state) ||
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005570 security_get_allow_unknown(&selinux_state))
Linus Torvalds1da177e2005-04-16 15:20:36 -07005571 err = 0;
5572 }
5573
5574 /* Ignore */
5575 if (err == -ENOENT)
5576 err = 0;
5577 goto out;
5578 }
5579
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005580 err = sock_has_perm(sk, perm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005581out:
5582 return err;
5583}
5584
5585#ifdef CONFIG_NETFILTER
5586
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005587static unsigned int selinux_ip_forward(struct sk_buff *skb,
5588 const struct net_device *indev,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005589 u16 family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005590{
Paul Mooredfaebe92008-10-10 10:16:31 -04005591 int err;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005592 char *addrp;
5593 u32 peer_sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04005594 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005595 struct lsm_network_audit net = {0,};
Paul Mooreeffad8d2008-01-29 08:49:27 -05005596 u8 secmark_active;
Paul Moore948bf852008-10-10 10:16:32 -04005597 u8 netlbl_active;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005598 u8 peerlbl_active;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005599
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005600 if (!selinux_policycap_netpeer())
Paul Mooreeffad8d2008-01-29 08:49:27 -05005601 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005602
Paul Mooreeffad8d2008-01-29 08:49:27 -05005603 secmark_active = selinux_secmark_enabled();
Paul Moore948bf852008-10-10 10:16:32 -04005604 netlbl_active = netlbl_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04005605 peerlbl_active = selinux_peerlbl_enabled();
Paul Mooreeffad8d2008-01-29 08:49:27 -05005606 if (!secmark_active && !peerlbl_active)
5607 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005608
Paul Moored8395c82008-10-10 10:16:30 -04005609 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5610 return NF_DROP;
5611
Eric Paris50c205f2012-04-04 15:01:43 -04005612 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005613 ad.u.net = &net;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005614 ad.u.net->netif = indev->ifindex;
Eric Paris48c62af2012-04-02 13:15:44 -04005615 ad.u.net->family = family;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005616 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5617 return NF_DROP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005618
Paul Mooredfaebe92008-10-10 10:16:31 -04005619 if (peerlbl_active) {
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005620 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5621 addrp, family, peer_sid, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04005622 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04005623 selinux_netlbl_err(skb, family, err, 1);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005624 return NF_DROP;
Paul Mooredfaebe92008-10-10 10:16:31 -04005625 }
5626 }
Paul Mooreeffad8d2008-01-29 08:49:27 -05005627
5628 if (secmark_active)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005629 if (avc_has_perm(&selinux_state,
5630 peer_sid, skb->secmark,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005631 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5632 return NF_DROP;
5633
Paul Moore948bf852008-10-10 10:16:32 -04005634 if (netlbl_active)
5635 /* we do this in the FORWARD path and not the POST_ROUTING
5636 * path because we want to make sure we apply the necessary
5637 * labeling before IPsec is applied so we can leverage AH
5638 * protection */
5639 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5640 return NF_DROP;
5641
Paul Mooreeffad8d2008-01-29 08:49:27 -05005642 return NF_ACCEPT;
5643}
5644
Eric W. Biederman06198b32015-09-18 14:33:06 -05005645static unsigned int selinux_ipv4_forward(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005646 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005647 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005648{
David S. Miller238e54c2015-04-03 20:32:56 -04005649 return selinux_ip_forward(skb, state->in, PF_INET);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005650}
5651
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005652#if IS_ENABLED(CONFIG_IPV6)
Eric W. Biederman06198b32015-09-18 14:33:06 -05005653static unsigned int selinux_ipv6_forward(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005654 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005655 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005656{
David S. Miller238e54c2015-04-03 20:32:56 -04005657 return selinux_ip_forward(skb, state->in, PF_INET6);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005658}
5659#endif /* IPV6 */
5660
Paul Moore948bf852008-10-10 10:16:32 -04005661static unsigned int selinux_ip_output(struct sk_buff *skb,
5662 u16 family)
5663{
Paul Moore47180062013-12-04 16:10:45 -05005664 struct sock *sk;
Paul Moore948bf852008-10-10 10:16:32 -04005665 u32 sid;
5666
5667 if (!netlbl_enabled())
5668 return NF_ACCEPT;
5669
5670 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5671 * because we want to make sure we apply the necessary labeling
5672 * before IPsec is applied so we can leverage AH protection */
Paul Moore47180062013-12-04 16:10:45 -05005673 sk = skb->sk;
5674 if (sk) {
5675 struct sk_security_struct *sksec;
5676
Eric Dumazete446f9d2015-10-08 05:01:55 -07005677 if (sk_listener(sk))
Paul Moore47180062013-12-04 16:10:45 -05005678 /* if the socket is the listening state then this
5679 * packet is a SYN-ACK packet which means it needs to
5680 * be labeled based on the connection/request_sock and
5681 * not the parent socket. unfortunately, we can't
5682 * lookup the request_sock yet as it isn't queued on
5683 * the parent socket until after the SYN-ACK is sent.
5684 * the "solution" is to simply pass the packet as-is
5685 * as any IP option based labeling should be copied
5686 * from the initial connection request (in the IP
5687 * layer). it is far from ideal, but until we get a
5688 * security label in the packet itself this is the
5689 * best we can do. */
5690 return NF_ACCEPT;
5691
5692 /* standard practice, label using the parent socket */
5693 sksec = sk->sk_security;
Paul Moore948bf852008-10-10 10:16:32 -04005694 sid = sksec->sid;
5695 } else
5696 sid = SECINITSID_KERNEL;
5697 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5698 return NF_DROP;
5699
5700 return NF_ACCEPT;
5701}
5702
Eric W. Biederman06198b32015-09-18 14:33:06 -05005703static unsigned int selinux_ipv4_output(void *priv,
Paul Moore948bf852008-10-10 10:16:32 -04005704 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005705 const struct nf_hook_state *state)
Paul Moore948bf852008-10-10 10:16:32 -04005706{
5707 return selinux_ip_output(skb, PF_INET);
5708}
5709
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005710#if IS_ENABLED(CONFIG_IPV6)
Huw Davies2917f572016-06-27 15:06:15 -04005711static unsigned int selinux_ipv6_output(void *priv,
5712 struct sk_buff *skb,
5713 const struct nf_hook_state *state)
5714{
5715 return selinux_ip_output(skb, PF_INET6);
5716}
5717#endif /* IPV6 */
5718
Paul Mooreeffad8d2008-01-29 08:49:27 -05005719static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5720 int ifindex,
Paul Moored8395c82008-10-10 10:16:30 -04005721 u16 family)
James Morris4e5ab4c2006-06-09 00:33:33 -07005722{
Eric Dumazet54abc682015-11-08 10:54:07 -08005723 struct sock *sk = skb_to_full_sk(skb);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005724 struct sk_security_struct *sksec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005725 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005726 struct lsm_network_audit net = {0,};
Paul Moored8395c82008-10-10 10:16:30 -04005727 char *addrp;
5728 u8 proto;
James Morris4e5ab4c2006-06-09 00:33:33 -07005729
Paul Mooreeffad8d2008-01-29 08:49:27 -05005730 if (sk == NULL)
5731 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005732 sksec = sk->sk_security;
James Morris4e5ab4c2006-06-09 00:33:33 -07005733
Eric Paris50c205f2012-04-04 15:01:43 -04005734 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005735 ad.u.net = &net;
5736 ad.u.net->netif = ifindex;
5737 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04005738 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5739 return NF_DROP;
5740
Paul Moore58bfbb52009-03-27 17:10:41 -04005741 if (selinux_secmark_enabled())
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005742 if (avc_has_perm(&selinux_state,
5743 sksec->sid, skb->secmark,
Paul Moored8395c82008-10-10 10:16:30 -04005744 SECCLASS_PACKET, PACKET__SEND, &ad))
Eric Paris2fe66ec2010-11-23 06:28:08 +00005745 return NF_DROP_ERR(-ECONNREFUSED);
James Morris4e5ab4c2006-06-09 00:33:33 -07005746
Steffen Klassertb9679a72011-02-23 12:55:21 +01005747 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5748 return NF_DROP_ERR(-ECONNREFUSED);
James Morris4e5ab4c2006-06-09 00:33:33 -07005749
Paul Mooreeffad8d2008-01-29 08:49:27 -05005750 return NF_ACCEPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005751}
5752
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005753static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5754 const struct net_device *outdev,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005755 u16 family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005756{
Paul Mooreeffad8d2008-01-29 08:49:27 -05005757 u32 secmark_perm;
5758 u32 peer_sid;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005759 int ifindex = outdev->ifindex;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005760 struct sock *sk;
Thomas Liu2bf49692009-07-14 12:14:09 -04005761 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005762 struct lsm_network_audit net = {0,};
Paul Mooreeffad8d2008-01-29 08:49:27 -05005763 char *addrp;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005764 u8 secmark_active;
5765 u8 peerlbl_active;
5766
Paul Mooreeffad8d2008-01-29 08:49:27 -05005767 /* If any sort of compatibility mode is enabled then handoff processing
5768 * to the selinux_ip_postroute_compat() function to deal with the
5769 * special handling. We do this in an attempt to keep this function
5770 * as fast and as clean as possible. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005771 if (!selinux_policycap_netpeer())
Paul Moored8395c82008-10-10 10:16:30 -04005772 return selinux_ip_postroute_compat(skb, ifindex, family);
Paul Moorec0828e52013-12-10 14:58:01 -05005773
Paul Mooreeffad8d2008-01-29 08:49:27 -05005774 secmark_active = selinux_secmark_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04005775 peerlbl_active = selinux_peerlbl_enabled();
Paul Mooreeffad8d2008-01-29 08:49:27 -05005776 if (!secmark_active && !peerlbl_active)
5777 return NF_ACCEPT;
5778
Eric Dumazet54abc682015-11-08 10:54:07 -08005779 sk = skb_to_full_sk(skb);
Paul Moorec0828e52013-12-10 14:58:01 -05005780
Paul Mooreeffad8d2008-01-29 08:49:27 -05005781#ifdef CONFIG_XFRM
5782 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5783 * packet transformation so allow the packet to pass without any checks
5784 * since we'll have another chance to perform access control checks
5785 * when the packet is on it's final way out.
5786 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
Paul Moorec0828e52013-12-10 14:58:01 -05005787 * is NULL, in this case go ahead and apply access control.
5788 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5789 * TCP listening state we cannot wait until the XFRM processing
5790 * is done as we will miss out on the SA label if we do;
5791 * unfortunately, this means more work, but it is only once per
5792 * connection. */
5793 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
Eric Dumazete446f9d2015-10-08 05:01:55 -07005794 !(sk && sk_listener(sk)))
Paul Mooreeffad8d2008-01-29 08:49:27 -05005795 return NF_ACCEPT;
5796#endif
Paul Mooreeffad8d2008-01-29 08:49:27 -05005797
Paul Moored8395c82008-10-10 10:16:30 -04005798 if (sk == NULL) {
Paul Moore446b8022013-12-04 16:10:51 -05005799 /* Without an associated socket the packet is either coming
5800 * from the kernel or it is being forwarded; check the packet
5801 * to determine which and if the packet is being forwarded
5802 * query the packet directly to determine the security label. */
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005803 if (skb->skb_iif) {
5804 secmark_perm = PACKET__FORWARD_OUT;
Paul Moored8395c82008-10-10 10:16:30 -04005805 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005806 return NF_DROP;
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005807 } else {
5808 secmark_perm = PACKET__SEND;
Paul Moored8395c82008-10-10 10:16:30 -04005809 peer_sid = SECINITSID_KERNEL;
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005810 }
Eric Dumazete446f9d2015-10-08 05:01:55 -07005811 } else if (sk_listener(sk)) {
Paul Moore446b8022013-12-04 16:10:51 -05005812 /* Locally generated packet but the associated socket is in the
5813 * listening state which means this is a SYN-ACK packet. In
5814 * this particular case the correct security label is assigned
5815 * to the connection/request_sock but unfortunately we can't
5816 * query the request_sock as it isn't queued on the parent
5817 * socket until after the SYN-ACK packet is sent; the only
5818 * viable choice is to regenerate the label like we do in
5819 * selinux_inet_conn_request(). See also selinux_ip_output()
5820 * for similar problems. */
5821 u32 skb_sid;
Eric Dumazete446f9d2015-10-08 05:01:55 -07005822 struct sk_security_struct *sksec;
5823
Eric Dumazete446f9d2015-10-08 05:01:55 -07005824 sksec = sk->sk_security;
Paul Moore446b8022013-12-04 16:10:51 -05005825 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5826 return NF_DROP;
Paul Moorec0828e52013-12-10 14:58:01 -05005827 /* At this point, if the returned skb peerlbl is SECSID_NULL
5828 * and the packet has been through at least one XFRM
5829 * transformation then we must be dealing with the "final"
5830 * form of labeled IPsec packet; since we've already applied
5831 * all of our access controls on this packet we can safely
5832 * pass the packet. */
5833 if (skb_sid == SECSID_NULL) {
5834 switch (family) {
5835 case PF_INET:
5836 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5837 return NF_ACCEPT;
5838 break;
5839 case PF_INET6:
5840 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5841 return NF_ACCEPT;
Paul Moorea7a91a12014-09-03 10:51:59 -04005842 break;
Paul Moorec0828e52013-12-10 14:58:01 -05005843 default:
5844 return NF_DROP_ERR(-ECONNREFUSED);
5845 }
5846 }
Paul Moore446b8022013-12-04 16:10:51 -05005847 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5848 return NF_DROP;
5849 secmark_perm = PACKET__SEND;
Paul Moored8395c82008-10-10 10:16:30 -04005850 } else {
Paul Moore446b8022013-12-04 16:10:51 -05005851 /* Locally generated packet, fetch the security label from the
5852 * associated socket. */
Paul Mooreeffad8d2008-01-29 08:49:27 -05005853 struct sk_security_struct *sksec = sk->sk_security;
5854 peer_sid = sksec->sid;
5855 secmark_perm = PACKET__SEND;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005856 }
5857
Eric Paris50c205f2012-04-04 15:01:43 -04005858 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005859 ad.u.net = &net;
5860 ad.u.net->netif = ifindex;
5861 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04005862 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
Eric Paris04f6d702010-11-23 06:28:02 +00005863 return NF_DROP;
Paul Moored8395c82008-10-10 10:16:30 -04005864
Paul Mooreeffad8d2008-01-29 08:49:27 -05005865 if (secmark_active)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005866 if (avc_has_perm(&selinux_state,
5867 peer_sid, skb->secmark,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005868 SECCLASS_PACKET, secmark_perm, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005869 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005870
5871 if (peerlbl_active) {
5872 u32 if_sid;
5873 u32 node_sid;
5874
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005875 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005876 return NF_DROP;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005877 if (avc_has_perm(&selinux_state,
5878 peer_sid, if_sid,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005879 SECCLASS_NETIF, NETIF__EGRESS, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005880 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005881
5882 if (sel_netnode_sid(addrp, family, &node_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005883 return NF_DROP;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005884 if (avc_has_perm(&selinux_state,
5885 peer_sid, node_sid,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005886 SECCLASS_NODE, NODE__SENDTO, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005887 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005888 }
5889
5890 return NF_ACCEPT;
5891}
5892
Eric W. Biederman06198b32015-09-18 14:33:06 -05005893static unsigned int selinux_ipv4_postroute(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005894 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005895 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005896{
David S. Miller238e54c2015-04-03 20:32:56 -04005897 return selinux_ip_postroute(skb, state->out, PF_INET);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005898}
5899
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005900#if IS_ENABLED(CONFIG_IPV6)
Eric W. Biederman06198b32015-09-18 14:33:06 -05005901static unsigned int selinux_ipv6_postroute(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005902 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005903 const struct nf_hook_state *state)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005904{
David S. Miller238e54c2015-04-03 20:32:56 -04005905 return selinux_ip_postroute(skb, state->out, PF_INET6);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005906}
Linus Torvalds1da177e2005-04-16 15:20:36 -07005907#endif /* IPV6 */
5908
5909#endif /* CONFIG_NETFILTER */
5910
Linus Torvalds1da177e2005-04-16 15:20:36 -07005911static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5912{
Stephen Smalley941fc5b2009-10-01 14:48:23 -04005913 return selinux_nlmsg_perm(sk, skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005914}
5915
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005916static int ipc_alloc_security(struct kern_ipc_perm *perm,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005917 u16 sclass)
5918{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005919 struct ipc_security_struct *isec;
5920
James Morris89d155e2005-10-30 14:59:21 -08005921 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005922 if (!isec)
5923 return -ENOMEM;
5924
Linus Torvalds1da177e2005-04-16 15:20:36 -07005925 isec->sclass = sclass;
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005926 isec->sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005927 perm->security = isec;
5928
5929 return 0;
5930}
5931
5932static void ipc_free_security(struct kern_ipc_perm *perm)
5933{
5934 struct ipc_security_struct *isec = perm->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005935 perm->security = NULL;
5936 kfree(isec);
5937}
5938
5939static int msg_msg_alloc_security(struct msg_msg *msg)
5940{
5941 struct msg_security_struct *msec;
5942
James Morris89d155e2005-10-30 14:59:21 -08005943 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005944 if (!msec)
5945 return -ENOMEM;
5946
Linus Torvalds1da177e2005-04-16 15:20:36 -07005947 msec->sid = SECINITSID_UNLABELED;
5948 msg->security = msec;
5949
5950 return 0;
5951}
5952
5953static void msg_msg_free_security(struct msg_msg *msg)
5954{
5955 struct msg_security_struct *msec = msg->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005956
5957 msg->security = NULL;
5958 kfree(msec);
5959}
5960
5961static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
Stephen Smalley6af963f2005-05-01 08:58:39 -07005962 u32 perms)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005963{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005964 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005965 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005966 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005967
Linus Torvalds1da177e2005-04-16 15:20:36 -07005968 isec = ipc_perms->security;
5969
Eric Paris50c205f2012-04-04 15:01:43 -04005970 ad.type = LSM_AUDIT_DATA_IPC;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005971 ad.u.ipc_id = ipc_perms->key;
5972
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005973 return avc_has_perm(&selinux_state,
5974 sid, isec->sid, isec->sclass, perms, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005975}
5976
5977static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5978{
5979 return msg_msg_alloc_security(msg);
5980}
5981
5982static void selinux_msg_msg_free_security(struct msg_msg *msg)
5983{
5984 msg_msg_free_security(msg);
5985}
5986
5987/* message queue security operations */
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005988static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005989{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005990 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005991 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005992 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005993 int rc;
5994
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005995 rc = ipc_alloc_security(msq, SECCLASS_MSGQ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005996 if (rc)
5997 return rc;
5998
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005999 isec = msq->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006000
Eric Paris50c205f2012-04-04 15:01:43 -04006001 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006002 ad.u.ipc_id = msq->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006003
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006004 rc = avc_has_perm(&selinux_state,
6005 sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006006 MSGQ__CREATE, &ad);
6007 if (rc) {
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006008 ipc_free_security(msq);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006009 return rc;
6010 }
6011 return 0;
6012}
6013
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006014static void selinux_msg_queue_free_security(struct kern_ipc_perm *msq)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006015{
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006016 ipc_free_security(msq);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006017}
6018
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006019static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006020{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006021 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006022 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006023 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006024
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006025 isec = msq->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006026
Eric Paris50c205f2012-04-04 15:01:43 -04006027 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006028 ad.u.ipc_id = msq->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006029
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006030 return avc_has_perm(&selinux_state,
6031 sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006032 MSGQ__ASSOCIATE, &ad);
6033}
6034
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006035static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006036{
6037 int err;
6038 int perms;
6039
Eric Paris828dfe12008-04-17 13:17:49 -04006040 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006041 case IPC_INFO:
6042 case MSG_INFO:
6043 /* No specific object, just general system-wide information. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006044 return avc_has_perm(&selinux_state,
6045 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006046 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006047 case IPC_STAT:
6048 case MSG_STAT:
Davidlohr Bueso23c8cec2018-04-10 16:35:30 -07006049 case MSG_STAT_ANY:
Linus Torvalds1da177e2005-04-16 15:20:36 -07006050 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
6051 break;
6052 case IPC_SET:
6053 perms = MSGQ__SETATTR;
6054 break;
6055 case IPC_RMID:
6056 perms = MSGQ__DESTROY;
6057 break;
6058 default:
6059 return 0;
6060 }
6061
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006062 err = ipc_has_perm(msq, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006063 return err;
6064}
6065
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006066static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006067{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006068 struct ipc_security_struct *isec;
6069 struct msg_security_struct *msec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006070 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006071 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006072 int rc;
6073
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006074 isec = msq->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006075 msec = msg->security;
6076
6077 /*
6078 * First time through, need to assign label to the message
6079 */
6080 if (msec->sid == SECINITSID_UNLABELED) {
6081 /*
6082 * Compute new sid based on current process and
6083 * message queue this message will be stored in
6084 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006085 rc = security_transition_sid(&selinux_state, sid, isec->sid,
6086 SECCLASS_MSG, NULL, &msec->sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006087 if (rc)
6088 return rc;
6089 }
6090
Eric Paris50c205f2012-04-04 15:01:43 -04006091 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006092 ad.u.ipc_id = msq->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006093
6094 /* Can this process write to the queue? */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006095 rc = avc_has_perm(&selinux_state,
6096 sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006097 MSGQ__WRITE, &ad);
6098 if (!rc)
6099 /* Can this process send the message */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006100 rc = avc_has_perm(&selinux_state,
6101 sid, msec->sid, SECCLASS_MSG,
David Howells275bb412008-11-14 10:39:19 +11006102 MSG__SEND, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006103 if (!rc)
6104 /* Can the message be put in the queue? */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006105 rc = avc_has_perm(&selinux_state,
6106 msec->sid, isec->sid, SECCLASS_MSGQ,
David Howells275bb412008-11-14 10:39:19 +11006107 MSGQ__ENQUEUE, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006108
6109 return rc;
6110}
6111
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006112static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006113 struct task_struct *target,
6114 long type, int mode)
6115{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006116 struct ipc_security_struct *isec;
6117 struct msg_security_struct *msec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006118 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006119 u32 sid = task_sid(target);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006120 int rc;
6121
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006122 isec = msq->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006123 msec = msg->security;
6124
Eric Paris50c205f2012-04-04 15:01:43 -04006125 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006126 ad.u.ipc_id = msq->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006127
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006128 rc = avc_has_perm(&selinux_state,
6129 sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006130 SECCLASS_MSGQ, MSGQ__READ, &ad);
6131 if (!rc)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006132 rc = avc_has_perm(&selinux_state,
6133 sid, msec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006134 SECCLASS_MSG, MSG__RECEIVE, &ad);
6135 return rc;
6136}
6137
6138/* Shared Memory security operations */
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006139static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006140{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006141 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006142 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006143 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006144 int rc;
6145
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006146 rc = ipc_alloc_security(shp, SECCLASS_SHM);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006147 if (rc)
6148 return rc;
6149
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006150 isec = shp->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006151
Eric Paris50c205f2012-04-04 15:01:43 -04006152 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006153 ad.u.ipc_id = shp->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006154
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006155 rc = avc_has_perm(&selinux_state,
6156 sid, isec->sid, SECCLASS_SHM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006157 SHM__CREATE, &ad);
6158 if (rc) {
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006159 ipc_free_security(shp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006160 return rc;
6161 }
6162 return 0;
6163}
6164
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006165static void selinux_shm_free_security(struct kern_ipc_perm *shp)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006166{
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006167 ipc_free_security(shp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006168}
6169
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006170static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006171{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006172 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006173 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006174 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006175
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006176 isec = shp->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006177
Eric Paris50c205f2012-04-04 15:01:43 -04006178 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006179 ad.u.ipc_id = shp->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006180
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006181 return avc_has_perm(&selinux_state,
6182 sid, isec->sid, SECCLASS_SHM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006183 SHM__ASSOCIATE, &ad);
6184}
6185
6186/* Note, at this point, shp is locked down */
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006187static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006188{
6189 int perms;
6190 int err;
6191
Eric Paris828dfe12008-04-17 13:17:49 -04006192 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006193 case IPC_INFO:
6194 case SHM_INFO:
6195 /* No specific object, just general system-wide information. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006196 return avc_has_perm(&selinux_state,
6197 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006198 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006199 case IPC_STAT:
6200 case SHM_STAT:
Davidlohr Buesoc21a6972018-04-10 16:35:23 -07006201 case SHM_STAT_ANY:
Linus Torvalds1da177e2005-04-16 15:20:36 -07006202 perms = SHM__GETATTR | SHM__ASSOCIATE;
6203 break;
6204 case IPC_SET:
6205 perms = SHM__SETATTR;
6206 break;
6207 case SHM_LOCK:
6208 case SHM_UNLOCK:
6209 perms = SHM__LOCK;
6210 break;
6211 case IPC_RMID:
6212 perms = SHM__DESTROY;
6213 break;
6214 default:
6215 return 0;
6216 }
6217
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006218 err = ipc_has_perm(shp, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006219 return err;
6220}
6221
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006222static int selinux_shm_shmat(struct kern_ipc_perm *shp,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006223 char __user *shmaddr, int shmflg)
6224{
6225 u32 perms;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006226
6227 if (shmflg & SHM_RDONLY)
6228 perms = SHM__READ;
6229 else
6230 perms = SHM__READ | SHM__WRITE;
6231
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006232 return ipc_has_perm(shp, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006233}
6234
6235/* Semaphore security operations */
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006236static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006237{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006238 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006239 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006240 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006241 int rc;
6242
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006243 rc = ipc_alloc_security(sma, SECCLASS_SEM);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006244 if (rc)
6245 return rc;
6246
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006247 isec = sma->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006248
Eric Paris50c205f2012-04-04 15:01:43 -04006249 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006250 ad.u.ipc_id = sma->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006251
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006252 rc = avc_has_perm(&selinux_state,
6253 sid, isec->sid, SECCLASS_SEM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006254 SEM__CREATE, &ad);
6255 if (rc) {
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006256 ipc_free_security(sma);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006257 return rc;
6258 }
6259 return 0;
6260}
6261
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006262static void selinux_sem_free_security(struct kern_ipc_perm *sma)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006263{
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006264 ipc_free_security(sma);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006265}
6266
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006267static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006268{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006269 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006270 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006271 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006272
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006273 isec = sma->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006274
Eric Paris50c205f2012-04-04 15:01:43 -04006275 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006276 ad.u.ipc_id = sma->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006277
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006278 return avc_has_perm(&selinux_state,
6279 sid, isec->sid, SECCLASS_SEM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006280 SEM__ASSOCIATE, &ad);
6281}
6282
6283/* Note, at this point, sma is locked down */
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006284static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006285{
6286 int err;
6287 u32 perms;
6288
Eric Paris828dfe12008-04-17 13:17:49 -04006289 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006290 case IPC_INFO:
6291 case SEM_INFO:
6292 /* No specific object, just general system-wide information. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006293 return avc_has_perm(&selinux_state,
6294 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006295 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006296 case GETPID:
6297 case GETNCNT:
6298 case GETZCNT:
6299 perms = SEM__GETATTR;
6300 break;
6301 case GETVAL:
6302 case GETALL:
6303 perms = SEM__READ;
6304 break;
6305 case SETVAL:
6306 case SETALL:
6307 perms = SEM__WRITE;
6308 break;
6309 case IPC_RMID:
6310 perms = SEM__DESTROY;
6311 break;
6312 case IPC_SET:
6313 perms = SEM__SETATTR;
6314 break;
6315 case IPC_STAT:
6316 case SEM_STAT:
Davidlohr Buesoa280d6d2018-04-10 16:35:26 -07006317 case SEM_STAT_ANY:
Linus Torvalds1da177e2005-04-16 15:20:36 -07006318 perms = SEM__GETATTR | SEM__ASSOCIATE;
6319 break;
6320 default:
6321 return 0;
6322 }
6323
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006324 err = ipc_has_perm(sma, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006325 return err;
6326}
6327
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006328static int selinux_sem_semop(struct kern_ipc_perm *sma,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006329 struct sembuf *sops, unsigned nsops, int alter)
6330{
6331 u32 perms;
6332
6333 if (alter)
6334 perms = SEM__READ | SEM__WRITE;
6335 else
6336 perms = SEM__READ;
6337
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006338 return ipc_has_perm(sma, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006339}
6340
6341static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6342{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006343 u32 av = 0;
6344
Linus Torvalds1da177e2005-04-16 15:20:36 -07006345 av = 0;
6346 if (flag & S_IRUGO)
6347 av |= IPC__UNIX_READ;
6348 if (flag & S_IWUGO)
6349 av |= IPC__UNIX_WRITE;
6350
6351 if (av == 0)
6352 return 0;
6353
Stephen Smalley6af963f2005-05-01 08:58:39 -07006354 return ipc_has_perm(ipcp, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006355}
6356
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02006357static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6358{
6359 struct ipc_security_struct *isec = ipcp->security;
6360 *secid = isec->sid;
6361}
6362
Eric Paris828dfe12008-04-17 13:17:49 -04006363static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006364{
6365 if (inode)
6366 inode_doinit_with_dentry(inode, dentry);
6367}
6368
6369static int selinux_getprocattr(struct task_struct *p,
Al Viro04ff9702007-03-12 16:17:58 +00006370 char *name, char **value)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006371{
David Howells275bb412008-11-14 10:39:19 +11006372 const struct task_security_struct *__tsec;
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00006373 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006374 int error;
Al Viro04ff9702007-03-12 16:17:58 +00006375 unsigned len;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006376
David Howells275bb412008-11-14 10:39:19 +11006377 rcu_read_lock();
6378 __tsec = __task_cred(p)->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006379
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006380 if (current != p) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006381 error = avc_has_perm(&selinux_state,
6382 current_sid(), __tsec->sid,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006383 SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6384 if (error)
6385 goto bad;
6386 }
6387
Linus Torvalds1da177e2005-04-16 15:20:36 -07006388 if (!strcmp(name, "current"))
David Howells275bb412008-11-14 10:39:19 +11006389 sid = __tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006390 else if (!strcmp(name, "prev"))
David Howells275bb412008-11-14 10:39:19 +11006391 sid = __tsec->osid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006392 else if (!strcmp(name, "exec"))
David Howells275bb412008-11-14 10:39:19 +11006393 sid = __tsec->exec_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006394 else if (!strcmp(name, "fscreate"))
David Howells275bb412008-11-14 10:39:19 +11006395 sid = __tsec->create_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07006396 else if (!strcmp(name, "keycreate"))
David Howells275bb412008-11-14 10:39:19 +11006397 sid = __tsec->keycreate_sid;
Eric Paris42c3e032006-06-26 00:26:03 -07006398 else if (!strcmp(name, "sockcreate"))
David Howells275bb412008-11-14 10:39:19 +11006399 sid = __tsec->sockcreate_sid;
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006400 else {
6401 error = -EINVAL;
6402 goto bad;
6403 }
David Howells275bb412008-11-14 10:39:19 +11006404 rcu_read_unlock();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006405
6406 if (!sid)
6407 return 0;
6408
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006409 error = security_sid_to_context(&selinux_state, sid, value, &len);
Al Viro04ff9702007-03-12 16:17:58 +00006410 if (error)
6411 return error;
6412 return len;
David Howells275bb412008-11-14 10:39:19 +11006413
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006414bad:
David Howells275bb412008-11-14 10:39:19 +11006415 rcu_read_unlock();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006416 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006417}
6418
Stephen Smalleyb21507e2017-01-09 10:07:31 -05006419static int selinux_setprocattr(const char *name, void *value, size_t size)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006420{
6421 struct task_security_struct *tsec;
David Howellsd84f4f92008-11-14 10:39:23 +11006422 struct cred *new;
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006423 u32 mysid = current_sid(), sid = 0, ptsid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006424 int error;
6425 char *str = value;
6426
Linus Torvalds1da177e2005-04-16 15:20:36 -07006427 /*
6428 * Basic control over ability to set these attributes at all.
Linus Torvalds1da177e2005-04-16 15:20:36 -07006429 */
6430 if (!strcmp(name, "exec"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006431 error = avc_has_perm(&selinux_state,
6432 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006433 PROCESS__SETEXEC, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006434 else if (!strcmp(name, "fscreate"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006435 error = avc_has_perm(&selinux_state,
6436 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006437 PROCESS__SETFSCREATE, NULL);
Michael LeMay4eb582c2006-06-26 00:24:57 -07006438 else if (!strcmp(name, "keycreate"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006439 error = avc_has_perm(&selinux_state,
6440 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006441 PROCESS__SETKEYCREATE, NULL);
Eric Paris42c3e032006-06-26 00:26:03 -07006442 else if (!strcmp(name, "sockcreate"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006443 error = avc_has_perm(&selinux_state,
6444 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006445 PROCESS__SETSOCKCREATE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006446 else if (!strcmp(name, "current"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006447 error = avc_has_perm(&selinux_state,
6448 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006449 PROCESS__SETCURRENT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006450 else
6451 error = -EINVAL;
6452 if (error)
6453 return error;
6454
6455 /* Obtain a SID for the context, if one was specified. */
Stephen Smalleya050a572017-01-31 11:54:04 -05006456 if (size && str[0] && str[0] != '\n') {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006457 if (str[size-1] == '\n') {
6458 str[size-1] = 0;
6459 size--;
6460 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006461 error = security_context_to_sid(&selinux_state, value, size,
6462 &sid, GFP_KERNEL);
Stephen Smalley12b29f32008-05-07 13:03:20 -04006463 if (error == -EINVAL && !strcmp(name, "fscreate")) {
Stephen Smalleydb590002017-04-20 11:31:30 -04006464 if (!has_cap_mac_admin(true)) {
Eric Parisd6ea83e2012-04-04 13:45:49 -04006465 struct audit_buffer *ab;
6466 size_t audit_size;
6467
6468 /* We strip a nul only if it is at the end, otherwise the
6469 * context contains a nul and we should audit that */
6470 if (str[size - 1] == '\0')
6471 audit_size = size - 1;
6472 else
6473 audit_size = size;
Richard Guy Briggscdfb6b32018-05-12 21:58:20 -04006474 ab = audit_log_start(audit_context(),
6475 GFP_ATOMIC,
6476 AUDIT_SELINUX_ERR);
Eric Parisd6ea83e2012-04-04 13:45:49 -04006477 audit_log_format(ab, "op=fscreate invalid_context=");
6478 audit_log_n_untrustedstring(ab, value, audit_size);
6479 audit_log_end(ab);
6480
Stephen Smalley12b29f32008-05-07 13:03:20 -04006481 return error;
Eric Parisd6ea83e2012-04-04 13:45:49 -04006482 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006483 error = security_context_to_sid_force(
6484 &selinux_state,
6485 value, size, &sid);
Stephen Smalley12b29f32008-05-07 13:03:20 -04006486 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07006487 if (error)
6488 return error;
6489 }
6490
David Howellsd84f4f92008-11-14 10:39:23 +11006491 new = prepare_creds();
6492 if (!new)
6493 return -ENOMEM;
6494
Linus Torvalds1da177e2005-04-16 15:20:36 -07006495 /* Permission checking based on the specified context is
6496 performed during the actual operation (execve,
6497 open/mkdir/...), when we know the full context of the
David Howellsd84f4f92008-11-14 10:39:23 +11006498 operation. See selinux_bprm_set_creds for the execve
Linus Torvalds1da177e2005-04-16 15:20:36 -07006499 checks and may_create for the file creation checks. The
6500 operation will then fail if the context is not permitted. */
David Howellsd84f4f92008-11-14 10:39:23 +11006501 tsec = new->security;
6502 if (!strcmp(name, "exec")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006503 tsec->exec_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006504 } else if (!strcmp(name, "fscreate")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006505 tsec->create_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006506 } else if (!strcmp(name, "keycreate")) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006507 error = avc_has_perm(&selinux_state,
6508 mysid, sid, SECCLASS_KEY, KEY__CREATE,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006509 NULL);
Michael LeMay4eb582c2006-06-26 00:24:57 -07006510 if (error)
David Howellsd84f4f92008-11-14 10:39:23 +11006511 goto abort_change;
Michael LeMay4eb582c2006-06-26 00:24:57 -07006512 tsec->keycreate_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006513 } else if (!strcmp(name, "sockcreate")) {
Eric Paris42c3e032006-06-26 00:26:03 -07006514 tsec->sockcreate_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006515 } else if (!strcmp(name, "current")) {
6516 error = -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006517 if (sid == 0)
David Howellsd84f4f92008-11-14 10:39:23 +11006518 goto abort_change;
KaiGai Koheid9250de2008-08-28 16:35:57 +09006519
David Howellsd84f4f92008-11-14 10:39:23 +11006520 /* Only allow single threaded processes to change context */
6521 error = -EPERM;
Oleg Nesterov5bb459b2009-07-10 03:48:23 +02006522 if (!current_is_single_threaded()) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006523 error = security_bounded_transition(&selinux_state,
6524 tsec->sid, sid);
David Howellsd84f4f92008-11-14 10:39:23 +11006525 if (error)
6526 goto abort_change;
Eric Paris828dfe12008-04-17 13:17:49 -04006527 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07006528
6529 /* Check permissions for the transition. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006530 error = avc_has_perm(&selinux_state,
6531 tsec->sid, sid, SECCLASS_PROCESS,
Eric Paris828dfe12008-04-17 13:17:49 -04006532 PROCESS__DYNTRANSITION, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006533 if (error)
David Howellsd84f4f92008-11-14 10:39:23 +11006534 goto abort_change;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006535
6536 /* Check for ptracing, and update the task SID if ok.
6537 Otherwise, leave SID unchanged and fail. */
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006538 ptsid = ptrace_parent_sid();
Paul Moore0c6181c2016-03-30 21:41:21 -04006539 if (ptsid != 0) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006540 error = avc_has_perm(&selinux_state,
6541 ptsid, sid, SECCLASS_PROCESS,
David Howellsd84f4f92008-11-14 10:39:23 +11006542 PROCESS__PTRACE, NULL);
6543 if (error)
6544 goto abort_change;
6545 }
6546
6547 tsec->sid = sid;
6548 } else {
6549 error = -EINVAL;
6550 goto abort_change;
6551 }
6552
6553 commit_creds(new);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006554 return size;
David Howellsd84f4f92008-11-14 10:39:23 +11006555
6556abort_change:
6557 abort_creds(new);
6558 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006559}
6560
David Quigley746df9b2013-05-22 12:50:35 -04006561static int selinux_ismaclabel(const char *name)
6562{
6563 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6564}
6565
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006566static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6567{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006568 return security_sid_to_context(&selinux_state, secid,
6569 secdata, seclen);
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006570}
6571
David Howells7bf570d2008-04-29 20:52:51 +01006572static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
David Howells63cb3442008-01-15 23:47:35 +00006573{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006574 return security_context_to_sid(&selinux_state, secdata, seclen,
6575 secid, GFP_KERNEL);
David Howells63cb3442008-01-15 23:47:35 +00006576}
6577
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006578static void selinux_release_secctx(char *secdata, u32 seclen)
6579{
Paul Moore088999e2007-08-01 11:12:58 -04006580 kfree(secdata);
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006581}
6582
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006583static void selinux_inode_invalidate_secctx(struct inode *inode)
6584{
6585 struct inode_security_struct *isec = inode->i_security;
6586
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01006587 spin_lock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006588 isec->initialized = LABEL_INVALID;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01006589 spin_unlock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006590}
6591
David P. Quigley1ee65e32009-09-03 14:25:57 -04006592/*
6593 * called with inode->i_mutex locked
6594 */
6595static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6596{
6597 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
6598}
6599
6600/*
6601 * called with inode->i_mutex locked
6602 */
6603static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6604{
6605 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6606}
6607
6608static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6609{
6610 int len = 0;
6611 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6612 ctx, true);
6613 if (len < 0)
6614 return len;
6615 *ctxlen = len;
6616 return 0;
6617}
Michael LeMayd7200242006-06-22 14:47:17 -07006618#ifdef CONFIG_KEYS
6619
David Howellsd84f4f92008-11-14 10:39:23 +11006620static int selinux_key_alloc(struct key *k, const struct cred *cred,
David Howells7e047ef2006-06-26 00:24:50 -07006621 unsigned long flags)
Michael LeMayd7200242006-06-22 14:47:17 -07006622{
David Howellsd84f4f92008-11-14 10:39:23 +11006623 const struct task_security_struct *tsec;
Michael LeMayd7200242006-06-22 14:47:17 -07006624 struct key_security_struct *ksec;
6625
6626 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6627 if (!ksec)
6628 return -ENOMEM;
6629
David Howellsd84f4f92008-11-14 10:39:23 +11006630 tsec = cred->security;
6631 if (tsec->keycreate_sid)
6632 ksec->sid = tsec->keycreate_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07006633 else
David Howellsd84f4f92008-11-14 10:39:23 +11006634 ksec->sid = tsec->sid;
Michael LeMayd7200242006-06-22 14:47:17 -07006635
David Howells275bb412008-11-14 10:39:19 +11006636 k->security = ksec;
Michael LeMayd7200242006-06-22 14:47:17 -07006637 return 0;
6638}
6639
6640static void selinux_key_free(struct key *k)
6641{
6642 struct key_security_struct *ksec = k->security;
6643
6644 k->security = NULL;
6645 kfree(ksec);
6646}
6647
6648static int selinux_key_permission(key_ref_t key_ref,
David Howellsd84f4f92008-11-14 10:39:23 +11006649 const struct cred *cred,
David Howellsf5895942014-03-14 17:44:49 +00006650 unsigned perm)
Michael LeMayd7200242006-06-22 14:47:17 -07006651{
6652 struct key *key;
Michael LeMayd7200242006-06-22 14:47:17 -07006653 struct key_security_struct *ksec;
David Howells275bb412008-11-14 10:39:19 +11006654 u32 sid;
Michael LeMayd7200242006-06-22 14:47:17 -07006655
6656 /* if no specific permissions are requested, we skip the
6657 permission check. No serious, additional covert channels
6658 appear to be created. */
6659 if (perm == 0)
6660 return 0;
6661
David Howellsd84f4f92008-11-14 10:39:23 +11006662 sid = cred_sid(cred);
David Howells275bb412008-11-14 10:39:19 +11006663
6664 key = key_ref_to_ptr(key_ref);
6665 ksec = key->security;
6666
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006667 return avc_has_perm(&selinux_state,
6668 sid, ksec->sid, SECCLASS_KEY, perm, NULL);
Michael LeMayd7200242006-06-22 14:47:17 -07006669}
6670
David Howells70a5bb72008-04-29 01:01:26 -07006671static int selinux_key_getsecurity(struct key *key, char **_buffer)
6672{
6673 struct key_security_struct *ksec = key->security;
6674 char *context = NULL;
6675 unsigned len;
6676 int rc;
6677
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006678 rc = security_sid_to_context(&selinux_state, ksec->sid,
6679 &context, &len);
David Howells70a5bb72008-04-29 01:01:26 -07006680 if (!rc)
6681 rc = len;
6682 *_buffer = context;
6683 return rc;
6684}
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03006685#endif
David Howells70a5bb72008-04-29 01:01:26 -07006686
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03006687#ifdef CONFIG_SECURITY_INFINIBAND
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03006688static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6689{
6690 struct common_audit_data ad;
6691 int err;
6692 u32 sid = 0;
6693 struct ib_security_struct *sec = ib_sec;
6694 struct lsm_ibpkey_audit ibpkey;
6695
Daniel Jurgens409dcf32017-05-19 15:48:59 +03006696 err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03006697 if (err)
6698 return err;
6699
6700 ad.type = LSM_AUDIT_DATA_IBPKEY;
6701 ibpkey.subnet_prefix = subnet_prefix;
6702 ibpkey.pkey = pkey_val;
6703 ad.u.ibpkey = &ibpkey;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006704 return avc_has_perm(&selinux_state,
6705 sec->sid, sid,
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03006706 SECCLASS_INFINIBAND_PKEY,
6707 INFINIBAND_PKEY__ACCESS, &ad);
6708}
6709
Daniel Jurgensab861df2017-05-19 15:48:58 +03006710static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6711 u8 port_num)
6712{
6713 struct common_audit_data ad;
6714 int err;
6715 u32 sid = 0;
6716 struct ib_security_struct *sec = ib_sec;
6717 struct lsm_ibendport_audit ibendport;
6718
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006719 err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6720 &sid);
Daniel Jurgensab861df2017-05-19 15:48:58 +03006721
6722 if (err)
6723 return err;
6724
6725 ad.type = LSM_AUDIT_DATA_IBENDPORT;
6726 strncpy(ibendport.dev_name, dev_name, sizeof(ibendport.dev_name));
6727 ibendport.port = port_num;
6728 ad.u.ibendport = &ibendport;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006729 return avc_has_perm(&selinux_state,
6730 sec->sid, sid,
Daniel Jurgensab861df2017-05-19 15:48:58 +03006731 SECCLASS_INFINIBAND_ENDPORT,
6732 INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6733}
6734
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03006735static int selinux_ib_alloc_security(void **ib_sec)
6736{
6737 struct ib_security_struct *sec;
6738
6739 sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6740 if (!sec)
6741 return -ENOMEM;
6742 sec->sid = current_sid();
6743
6744 *ib_sec = sec;
6745 return 0;
6746}
6747
6748static void selinux_ib_free_security(void *ib_sec)
6749{
6750 kfree(ib_sec);
6751}
Michael LeMayd7200242006-06-22 14:47:17 -07006752#endif
6753
Chenbo Fengec27c352017-10-18 13:00:25 -07006754#ifdef CONFIG_BPF_SYSCALL
6755static int selinux_bpf(int cmd, union bpf_attr *attr,
6756 unsigned int size)
6757{
6758 u32 sid = current_sid();
6759 int ret;
6760
6761 switch (cmd) {
6762 case BPF_MAP_CREATE:
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006763 ret = avc_has_perm(&selinux_state,
6764 sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
Chenbo Fengec27c352017-10-18 13:00:25 -07006765 NULL);
6766 break;
6767 case BPF_PROG_LOAD:
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006768 ret = avc_has_perm(&selinux_state,
6769 sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
Chenbo Fengec27c352017-10-18 13:00:25 -07006770 NULL);
6771 break;
6772 default:
6773 ret = 0;
6774 break;
6775 }
6776
6777 return ret;
6778}
6779
6780static u32 bpf_map_fmode_to_av(fmode_t fmode)
6781{
6782 u32 av = 0;
6783
6784 if (fmode & FMODE_READ)
6785 av |= BPF__MAP_READ;
6786 if (fmode & FMODE_WRITE)
6787 av |= BPF__MAP_WRITE;
6788 return av;
6789}
6790
Chenbo Fengf66e4482017-10-18 13:00:26 -07006791/* This function will check the file pass through unix socket or binder to see
6792 * if it is a bpf related object. And apply correspinding checks on the bpf
6793 * object based on the type. The bpf maps and programs, not like other files and
6794 * socket, are using a shared anonymous inode inside the kernel as their inode.
6795 * So checking that inode cannot identify if the process have privilege to
6796 * access the bpf object and that's why we have to add this additional check in
6797 * selinux_file_receive and selinux_binder_transfer_files.
6798 */
6799static int bpf_fd_pass(struct file *file, u32 sid)
6800{
6801 struct bpf_security_struct *bpfsec;
6802 struct bpf_prog *prog;
6803 struct bpf_map *map;
6804 int ret;
6805
6806 if (file->f_op == &bpf_map_fops) {
6807 map = file->private_data;
6808 bpfsec = map->security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006809 ret = avc_has_perm(&selinux_state,
6810 sid, bpfsec->sid, SECCLASS_BPF,
Chenbo Fengf66e4482017-10-18 13:00:26 -07006811 bpf_map_fmode_to_av(file->f_mode), NULL);
6812 if (ret)
6813 return ret;
6814 } else if (file->f_op == &bpf_prog_fops) {
6815 prog = file->private_data;
6816 bpfsec = prog->aux->security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006817 ret = avc_has_perm(&selinux_state,
6818 sid, bpfsec->sid, SECCLASS_BPF,
Chenbo Fengf66e4482017-10-18 13:00:26 -07006819 BPF__PROG_RUN, NULL);
6820 if (ret)
6821 return ret;
6822 }
6823 return 0;
6824}
6825
Chenbo Fengec27c352017-10-18 13:00:25 -07006826static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6827{
6828 u32 sid = current_sid();
6829 struct bpf_security_struct *bpfsec;
6830
6831 bpfsec = map->security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006832 return avc_has_perm(&selinux_state,
6833 sid, bpfsec->sid, SECCLASS_BPF,
Chenbo Fengec27c352017-10-18 13:00:25 -07006834 bpf_map_fmode_to_av(fmode), NULL);
6835}
6836
6837static int selinux_bpf_prog(struct bpf_prog *prog)
6838{
6839 u32 sid = current_sid();
6840 struct bpf_security_struct *bpfsec;
6841
6842 bpfsec = prog->aux->security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006843 return avc_has_perm(&selinux_state,
6844 sid, bpfsec->sid, SECCLASS_BPF,
Chenbo Fengec27c352017-10-18 13:00:25 -07006845 BPF__PROG_RUN, NULL);
6846}
6847
6848static int selinux_bpf_map_alloc(struct bpf_map *map)
6849{
6850 struct bpf_security_struct *bpfsec;
6851
6852 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6853 if (!bpfsec)
6854 return -ENOMEM;
6855
6856 bpfsec->sid = current_sid();
6857 map->security = bpfsec;
6858
6859 return 0;
6860}
6861
6862static void selinux_bpf_map_free(struct bpf_map *map)
6863{
6864 struct bpf_security_struct *bpfsec = map->security;
6865
6866 map->security = NULL;
6867 kfree(bpfsec);
6868}
6869
6870static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6871{
6872 struct bpf_security_struct *bpfsec;
6873
6874 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6875 if (!bpfsec)
6876 return -ENOMEM;
6877
6878 bpfsec->sid = current_sid();
6879 aux->security = bpfsec;
6880
6881 return 0;
6882}
6883
6884static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
6885{
6886 struct bpf_security_struct *bpfsec = aux->security;
6887
6888 aux->security = NULL;
6889 kfree(bpfsec);
6890}
6891#endif
6892
James Morrisca97d932017-02-15 00:18:51 +11006893static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
Casey Schauflere20b0432015-05-02 15:11:36 -07006894 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6895 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6896 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6897 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02006898
Casey Schauflere20b0432015-05-02 15:11:36 -07006899 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6900 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6901 LSM_HOOK_INIT(capget, selinux_capget),
6902 LSM_HOOK_INIT(capset, selinux_capset),
6903 LSM_HOOK_INIT(capable, selinux_capable),
6904 LSM_HOOK_INIT(quotactl, selinux_quotactl),
6905 LSM_HOOK_INIT(quota_on, selinux_quota_on),
6906 LSM_HOOK_INIT(syslog, selinux_syslog),
6907 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
Stephen Smalley79af7302015-01-21 10:54:10 -05006908
Casey Schauflere20b0432015-05-02 15:11:36 -07006909 LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006910
Casey Schauflere20b0432015-05-02 15:11:36 -07006911 LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6912 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6913 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006914
Casey Schauflere20b0432015-05-02 15:11:36 -07006915 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6916 LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6917 LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
6918 LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6919 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6920 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6921 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6922 LSM_HOOK_INIT(sb_mount, selinux_mount),
6923 LSM_HOOK_INIT(sb_umount, selinux_umount),
6924 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6925 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6926 LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006927
Casey Schauflere20b0432015-05-02 15:11:36 -07006928 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
Vivek Goyala518b0a2016-07-13 10:44:53 -04006929 LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
Eric Parise0007522008-03-05 10:31:54 -05006930
Casey Schauflere20b0432015-05-02 15:11:36 -07006931 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6932 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6933 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6934 LSM_HOOK_INIT(inode_create, selinux_inode_create),
6935 LSM_HOOK_INIT(inode_link, selinux_inode_link),
6936 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6937 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6938 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6939 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6940 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6941 LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6942 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6943 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6944 LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6945 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6946 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6947 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6948 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6949 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6950 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6951 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6952 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6953 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6954 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6955 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
Vivek Goyal56909eb2016-07-13 10:44:48 -04006956 LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
Vivek Goyal19472b62016-07-13 10:44:50 -04006957 LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006958
Casey Schauflere20b0432015-05-02 15:11:36 -07006959 LSM_HOOK_INIT(file_permission, selinux_file_permission),
6960 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6961 LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
6962 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6963 LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6964 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6965 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6966 LSM_HOOK_INIT(file_lock, selinux_file_lock),
6967 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6968 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6969 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6970 LSM_HOOK_INIT(file_receive, selinux_file_receive),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006971
Casey Schauflere20b0432015-05-02 15:11:36 -07006972 LSM_HOOK_INIT(file_open, selinux_file_open),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006973
Tetsuo Handaa79be232017-03-28 23:08:45 +09006974 LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
Casey Schauflere20b0432015-05-02 15:11:36 -07006975 LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
6976 LSM_HOOK_INIT(cred_free, selinux_cred_free),
6977 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6978 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
Matthew Garrett3ec30112018-01-08 13:36:19 -08006979 LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
Casey Schauflere20b0432015-05-02 15:11:36 -07006980 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6981 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6982 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
Mimi Zoharc77b8cd2018-07-13 14:06:02 -04006983 LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07006984 LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
Casey Schauflere20b0432015-05-02 15:11:36 -07006985 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6986 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6987 LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6988 LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6989 LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6990 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6991 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
Stephen Smalley791ec492017-02-17 07:57:00 -05006992 LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
Casey Schauflere20b0432015-05-02 15:11:36 -07006993 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6994 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6995 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6996 LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6997 LSM_HOOK_INIT(task_kill, selinux_task_kill),
Casey Schauflere20b0432015-05-02 15:11:36 -07006998 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09006999
Casey Schauflere20b0432015-05-02 15:11:36 -07007000 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
7001 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
Linus Torvalds1da177e2005-04-16 15:20:36 -07007002
Casey Schauflere20b0432015-05-02 15:11:36 -07007003 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
7004 LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
Linus Torvalds1da177e2005-04-16 15:20:36 -07007005
Casey Schauflere20b0432015-05-02 15:11:36 -07007006 LSM_HOOK_INIT(msg_queue_alloc_security,
7007 selinux_msg_queue_alloc_security),
7008 LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
7009 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
7010 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
7011 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
7012 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
Linus Torvalds1da177e2005-04-16 15:20:36 -07007013
Casey Schauflere20b0432015-05-02 15:11:36 -07007014 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
7015 LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
7016 LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
7017 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
7018 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
Linus Torvalds1da177e2005-04-16 15:20:36 -07007019
Casey Schauflere20b0432015-05-02 15:11:36 -07007020 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
7021 LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
7022 LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
7023 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
7024 LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
Linus Torvalds1da177e2005-04-16 15:20:36 -07007025
Casey Schauflere20b0432015-05-02 15:11:36 -07007026 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
Linus Torvalds1da177e2005-04-16 15:20:36 -07007027
Casey Schauflere20b0432015-05-02 15:11:36 -07007028 LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
7029 LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
Linus Torvalds1da177e2005-04-16 15:20:36 -07007030
Casey Schauflere20b0432015-05-02 15:11:36 -07007031 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
7032 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
7033 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
7034 LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05007035 LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
Casey Schauflere20b0432015-05-02 15:11:36 -07007036 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
7037 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
7038 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
Linus Torvalds1da177e2005-04-16 15:20:36 -07007039
Casey Schauflere20b0432015-05-02 15:11:36 -07007040 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
7041 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07007042
Casey Schauflere20b0432015-05-02 15:11:36 -07007043 LSM_HOOK_INIT(socket_create, selinux_socket_create),
7044 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
David Herrmann0b811db2018-05-04 16:28:21 +02007045 LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
Casey Schauflere20b0432015-05-02 15:11:36 -07007046 LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
7047 LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
7048 LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
7049 LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
7050 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
7051 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
7052 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
7053 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
7054 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
7055 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
7056 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
7057 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
7058 LSM_HOOK_INIT(socket_getpeersec_stream,
7059 selinux_socket_getpeersec_stream),
7060 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
7061 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
7062 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
7063 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
7064 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
7065 LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
Richard Hainesd4529302018-02-13 20:57:18 +00007066 LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
7067 LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
7068 LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
Casey Schauflere20b0432015-05-02 15:11:36 -07007069 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
7070 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
7071 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
7072 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
7073 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
7074 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
7075 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
7076 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
7077 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
7078 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
7079 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
7080 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
7081 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03007082#ifdef CONFIG_SECURITY_INFINIBAND
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03007083 LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
Daniel Jurgensab861df2017-05-19 15:48:58 +03007084 LSM_HOOK_INIT(ib_endport_manage_subnet,
7085 selinux_ib_endport_manage_subnet),
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03007086 LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
7087 LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
7088#endif
Trent Jaegerd28d1e02005-12-13 23:12:40 -08007089#ifdef CONFIG_SECURITY_NETWORK_XFRM
Casey Schauflere20b0432015-05-02 15:11:36 -07007090 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
7091 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
7092 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
7093 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
7094 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
7095 LSM_HOOK_INIT(xfrm_state_alloc_acquire,
7096 selinux_xfrm_state_alloc_acquire),
7097 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
7098 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
7099 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
7100 LSM_HOOK_INIT(xfrm_state_pol_flow_match,
7101 selinux_xfrm_state_pol_flow_match),
7102 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
Linus Torvalds1da177e2005-04-16 15:20:36 -07007103#endif
Michael LeMayd7200242006-06-22 14:47:17 -07007104
7105#ifdef CONFIG_KEYS
Casey Schauflere20b0432015-05-02 15:11:36 -07007106 LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
7107 LSM_HOOK_INIT(key_free, selinux_key_free),
7108 LSM_HOOK_INIT(key_permission, selinux_key_permission),
7109 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
Michael LeMayd7200242006-06-22 14:47:17 -07007110#endif
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +02007111
7112#ifdef CONFIG_AUDIT
Casey Schauflere20b0432015-05-02 15:11:36 -07007113 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
7114 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
7115 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
7116 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +02007117#endif
Chenbo Fengec27c352017-10-18 13:00:25 -07007118
7119#ifdef CONFIG_BPF_SYSCALL
7120 LSM_HOOK_INIT(bpf, selinux_bpf),
7121 LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
7122 LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
7123 LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
7124 LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
7125 LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
7126 LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
7127#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07007128};
7129
7130static __init int selinux_init(void)
7131{
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07007132 if (!security_module_enable("selinux")) {
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02007133 selinux_enabled = 0;
7134 return 0;
7135 }
7136
Linus Torvalds1da177e2005-04-16 15:20:36 -07007137 if (!selinux_enabled) {
peter enderborgc103a912018-06-12 10:09:03 +02007138 pr_info("SELinux: Disabled at boot.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07007139 return 0;
7140 }
7141
peter enderborgc103a912018-06-12 10:09:03 +02007142 pr_info("SELinux: Initializing.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07007143
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007144 memset(&selinux_state, 0, sizeof(selinux_state));
Paul Mooree5a5ca92018-03-01 17:38:30 -05007145 enforcing_set(&selinux_state, selinux_enforcing_boot);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007146 selinux_state.checkreqprot = selinux_checkreqprot_boot;
7147 selinux_ss_init(&selinux_state.ss);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05007148 selinux_avc_init(&selinux_state.avc);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007149
Linus Torvalds1da177e2005-04-16 15:20:36 -07007150 /* Set the security state for the initial task. */
David Howellsd84f4f92008-11-14 10:39:23 +11007151 cred_init_security();
Linus Torvalds1da177e2005-04-16 15:20:36 -07007152
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04007153 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
7154
James Morris7cae7e22006-03-22 00:09:22 -08007155 sel_inode_cache = kmem_cache_create("selinux_inode_security",
7156 sizeof(struct inode_security_struct),
Paul Mundt20c2df82007-07-20 10:11:58 +09007157 0, SLAB_PANIC, NULL);
Sangwoo63205652015-10-21 17:44:30 -04007158 file_security_cache = kmem_cache_create("selinux_file_security",
7159 sizeof(struct file_security_struct),
7160 0, SLAB_PANIC, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07007161 avc_init();
7162
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007163 avtab_cache_init();
7164
7165 ebitmap_cache_init();
7166
7167 hashtab_cache_init();
7168
Casey Schauflerd69dece52017-01-18 17:09:05 -08007169 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
Linus Torvalds1da177e2005-04-16 15:20:36 -07007170
Paul Moore615e51f2014-06-26 14:33:56 -04007171 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
7172 panic("SELinux: Unable to register AVC netcache callback\n");
7173
Daniel Jurgens8f408ab2017-05-19 15:48:53 +03007174 if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7175 panic("SELinux: Unable to register AVC LSM notifier callback\n");
7176
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007177 if (selinux_enforcing_boot)
peter enderborgc103a912018-06-12 10:09:03 +02007178 pr_debug("SELinux: Starting in enforcing mode\n");
Eric Paris828dfe12008-04-17 13:17:49 -04007179 else
peter enderborgc103a912018-06-12 10:09:03 +02007180 pr_debug("SELinux: Starting in permissive mode\n");
Michael LeMayd7200242006-06-22 14:47:17 -07007181
Linus Torvalds1da177e2005-04-16 15:20:36 -07007182 return 0;
7183}
7184
Al Viroe8c26252010-03-23 06:36:54 -04007185static void delayed_superblock_init(struct super_block *sb, void *unused)
7186{
Al Viro17f3b552018-11-10 23:46:07 -05007187 struct security_mnt_opts opts;
7188
7189 security_init_mnt_opts(&opts);
7190 selinux_set_mnt_opts(sb, &opts, 0, NULL);
7191 security_free_mnt_opts(&opts);
Al Viroe8c26252010-03-23 06:36:54 -04007192}
7193
Linus Torvalds1da177e2005-04-16 15:20:36 -07007194void selinux_complete_init(void)
7195{
peter enderborgc103a912018-06-12 10:09:03 +02007196 pr_debug("SELinux: Completing initialization.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07007197
7198 /* Set up any superblocks initialized prior to the policy load. */
peter enderborgc103a912018-06-12 10:09:03 +02007199 pr_debug("SELinux: Setting up existing superblocks.\n");
Al Viroe8c26252010-03-23 06:36:54 -04007200 iterate_supers(delayed_superblock_init, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07007201}
7202
7203/* SELinux requires early initialization in order to label
7204 all processes and objects when they are created. */
Kees Cook3d6e5f62018-10-10 17:18:23 -07007205DEFINE_LSM(selinux) = {
Kees Cook07aed2f2018-10-10 17:18:24 -07007206 .name = "selinux",
Kees Cook3d6e5f62018-10-10 17:18:23 -07007207 .init = selinux_init,
7208};
Linus Torvalds1da177e2005-04-16 15:20:36 -07007209
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08007210#if defined(CONFIG_NETFILTER)
Linus Torvalds1da177e2005-04-16 15:20:36 -07007211
Florian Westphal591bb2782017-07-26 11:40:52 +02007212static const struct nf_hook_ops selinux_nf_ops[] = {
Paul Mooreeffad8d2008-01-29 08:49:27 -05007213 {
7214 .hook = selinux_ipv4_postroute,
Alban Crequy2597a832012-05-14 03:56:39 +00007215 .pf = NFPROTO_IPV4,
Paul Mooreeffad8d2008-01-29 08:49:27 -05007216 .hooknum = NF_INET_POST_ROUTING,
7217 .priority = NF_IP_PRI_SELINUX_LAST,
7218 },
7219 {
7220 .hook = selinux_ipv4_forward,
Alban Crequy2597a832012-05-14 03:56:39 +00007221 .pf = NFPROTO_IPV4,
Paul Mooreeffad8d2008-01-29 08:49:27 -05007222 .hooknum = NF_INET_FORWARD,
7223 .priority = NF_IP_PRI_SELINUX_FIRST,
Paul Moore948bf852008-10-10 10:16:32 -04007224 },
7225 {
7226 .hook = selinux_ipv4_output,
Alban Crequy2597a832012-05-14 03:56:39 +00007227 .pf = NFPROTO_IPV4,
Paul Moore948bf852008-10-10 10:16:32 -04007228 .hooknum = NF_INET_LOCAL_OUT,
7229 .priority = NF_IP_PRI_SELINUX_FIRST,
Jiri Pirko25db6be2014-09-03 17:42:13 +02007230 },
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04007231#if IS_ENABLED(CONFIG_IPV6)
Paul Mooreeffad8d2008-01-29 08:49:27 -05007232 {
7233 .hook = selinux_ipv6_postroute,
Alban Crequy2597a832012-05-14 03:56:39 +00007234 .pf = NFPROTO_IPV6,
Paul Mooreeffad8d2008-01-29 08:49:27 -05007235 .hooknum = NF_INET_POST_ROUTING,
7236 .priority = NF_IP6_PRI_SELINUX_LAST,
7237 },
7238 {
7239 .hook = selinux_ipv6_forward,
Alban Crequy2597a832012-05-14 03:56:39 +00007240 .pf = NFPROTO_IPV6,
Paul Mooreeffad8d2008-01-29 08:49:27 -05007241 .hooknum = NF_INET_FORWARD,
7242 .priority = NF_IP6_PRI_SELINUX_FIRST,
Jiri Pirko25db6be2014-09-03 17:42:13 +02007243 },
Huw Davies2917f572016-06-27 15:06:15 -04007244 {
7245 .hook = selinux_ipv6_output,
7246 .pf = NFPROTO_IPV6,
7247 .hooknum = NF_INET_LOCAL_OUT,
7248 .priority = NF_IP6_PRI_SELINUX_FIRST,
7249 },
Linus Torvalds1da177e2005-04-16 15:20:36 -07007250#endif /* IPV6 */
Jiri Pirko25db6be2014-09-03 17:42:13 +02007251};
Linus Torvalds1da177e2005-04-16 15:20:36 -07007252
Florian Westphal8e71bf72017-04-21 11:49:09 +02007253static int __net_init selinux_nf_register(struct net *net)
7254{
7255 return nf_register_net_hooks(net, selinux_nf_ops,
7256 ARRAY_SIZE(selinux_nf_ops));
7257}
7258
7259static void __net_exit selinux_nf_unregister(struct net *net)
7260{
7261 nf_unregister_net_hooks(net, selinux_nf_ops,
7262 ARRAY_SIZE(selinux_nf_ops));
7263}
7264
7265static struct pernet_operations selinux_net_ops = {
7266 .init = selinux_nf_register,
7267 .exit = selinux_nf_unregister,
7268};
7269
Linus Torvalds1da177e2005-04-16 15:20:36 -07007270static int __init selinux_nf_ip_init(void)
7271{
Jiri Pirko25db6be2014-09-03 17:42:13 +02007272 int err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07007273
7274 if (!selinux_enabled)
Jiri Pirko25db6be2014-09-03 17:42:13 +02007275 return 0;
Eric Parisfadcdb42007-02-22 18:11:31 -05007276
peter enderborgc103a912018-06-12 10:09:03 +02007277 pr_debug("SELinux: Registering netfilter hooks\n");
Eric Parisfadcdb42007-02-22 18:11:31 -05007278
Florian Westphal8e71bf72017-04-21 11:49:09 +02007279 err = register_pernet_subsys(&selinux_net_ops);
Alexey Dobriyan6c5a9d22008-07-26 17:48:15 -07007280 if (err)
Florian Westphal8e71bf72017-04-21 11:49:09 +02007281 panic("SELinux: register_pernet_subsys: error %d\n", err);
Linus Torvalds1da177e2005-04-16 15:20:36 -07007282
Jiri Pirko25db6be2014-09-03 17:42:13 +02007283 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07007284}
Linus Torvalds1da177e2005-04-16 15:20:36 -07007285__initcall(selinux_nf_ip_init);
7286
7287#ifdef CONFIG_SECURITY_SELINUX_DISABLE
7288static void selinux_nf_ip_exit(void)
7289{
peter enderborgc103a912018-06-12 10:09:03 +02007290 pr_debug("SELinux: Unregistering netfilter hooks\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07007291
Florian Westphal8e71bf72017-04-21 11:49:09 +02007292 unregister_pernet_subsys(&selinux_net_ops);
Linus Torvalds1da177e2005-04-16 15:20:36 -07007293}
7294#endif
7295
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08007296#else /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07007297
7298#ifdef CONFIG_SECURITY_SELINUX_DISABLE
7299#define selinux_nf_ip_exit()
7300#endif
7301
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08007302#endif /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07007303
7304#ifdef CONFIG_SECURITY_SELINUX_DISABLE
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007305int selinux_disable(struct selinux_state *state)
Linus Torvalds1da177e2005-04-16 15:20:36 -07007306{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007307 if (state->initialized) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07007308 /* Not permitted after initial policy load. */
7309 return -EINVAL;
7310 }
7311
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007312 if (state->disabled) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07007313 /* Only do this once. */
7314 return -EINVAL;
7315 }
7316
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007317 state->disabled = 1;
7318
peter enderborgc103a912018-06-12 10:09:03 +02007319 pr_info("SELinux: Disabled at runtime.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07007320
Stephen Smalley30d55282006-05-03 10:52:36 -04007321 selinux_enabled = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07007322
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07007323 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
Linus Torvalds1da177e2005-04-16 15:20:36 -07007324
Eric Parisaf8ff042009-09-20 21:23:01 -04007325 /* Try to destroy the avc node cache */
7326 avc_disable();
7327
Linus Torvalds1da177e2005-04-16 15:20:36 -07007328 /* Unregister netfilter hooks. */
7329 selinux_nf_ip_exit();
7330
7331 /* Unregister selinuxfs. */
7332 exit_sel_fs();
7333
7334 return 0;
7335}
7336#endif