blob: 632813821da6e40dd00386489d1e12081985840d [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
Stephen Smalley7efbb602017-08-17 13:32:36 -04006 * Authors: Stephen Smalley, <sds@tycho.nsa.gov>
Eric Paris828dfe12008-04-17 13:17:49 -04007 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070010 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
Eric Paris2069f452008-07-04 09:47:13 +100012 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070014 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
Eric Paris828dfe12008-04-17 13:17:49 -040015 * <dgoeddel@trustedcs.com>
Paul Mooreed6d76e2009-08-28 18:12:49 -040016 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
Paul Moore82c21bf2011-08-01 11:10:33 +000017 * Paul Moore <paul@paul-moore.com>
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +090018 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
Eric Paris828dfe12008-04-17 13:17:49 -040019 * Yuichi Nakamura <ynakam@hitachisoft.jp>
Daniel Jurgens3a976fa2017-05-19 15:48:56 +030020 * Copyright (C) 2016 Mellanox Technologies
Linus Torvalds1da177e2005-04-16 15:20:36 -070021 *
22 * This program is free software; you can redistribute it and/or modify
23 * it under the terms of the GNU General Public License version 2,
Eric Paris828dfe12008-04-17 13:17:49 -040024 * as published by the Free Software Foundation.
Linus Torvalds1da177e2005-04-16 15:20:36 -070025 */
26
Linus Torvalds1da177e2005-04-16 15:20:36 -070027#include <linux/init.h>
Eric Paris0b24dcb2011-02-25 15:39:20 -050028#include <linux/kd.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070029#include <linux/kernel.h>
Roland McGrath0d094ef2008-07-25 19:45:49 -070030#include <linux/tracehook.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070031#include <linux/errno.h>
Ingo Molnar3f07c012017-02-08 18:51:30 +010032#include <linux/sched/signal.h>
Ingo Molnar29930022017-02-08 18:51:36 +010033#include <linux/sched/task.h>
Casey Schaufler3c4ed7b2015-05-02 15:10:46 -070034#include <linux/lsm_hooks.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070035#include <linux/xattr.h>
36#include <linux/capability.h>
37#include <linux/unistd.h>
38#include <linux/mm.h>
39#include <linux/mman.h>
40#include <linux/slab.h>
41#include <linux/pagemap.h>
Eric Paris0b24dcb2011-02-25 15:39:20 -050042#include <linux/proc_fs.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070043#include <linux/swap.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070044#include <linux/spinlock.h>
45#include <linux/syscalls.h>
Eric Paris2a7dba32011-02-01 11:05:39 -050046#include <linux/dcache.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070047#include <linux/file.h>
Al Viro9f3acc32008-04-24 07:44:08 -040048#include <linux/fdtable.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070049#include <linux/namei.h>
50#include <linux/mount.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070051#include <linux/netfilter_ipv4.h>
52#include <linux/netfilter_ipv6.h>
53#include <linux/tty.h>
54#include <net/icmp.h>
Stephen Hemminger227b60f2007-10-10 17:30:46 -070055#include <net/ip.h> /* for local_port_range[] */
Linus Torvalds1da177e2005-04-16 15:20:36 -070056#include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
Paul Moore47180062013-12-04 16:10:45 -050057#include <net/inet_connection_sock.h>
Paul Moore220deb92008-01-29 08:38:23 -050058#include <net/net_namespace.h>
Paul Moored621d352008-01-29 08:43:36 -050059#include <net/netlabel.h>
Eric Parisf5269712008-05-14 11:27:45 -040060#include <linux/uaccess.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070061#include <asm/ioctls.h>
Arun Sharma600634972011-07-26 16:09:06 -070062#include <linux/atomic.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070063#include <linux/bitops.h>
64#include <linux/interrupt.h>
65#include <linux/netdevice.h> /* for network interface checks */
Hong zhi guo77954982013-03-27 06:49:35 +000066#include <net/netlink.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070067#include <linux/tcp.h>
68#include <linux/udp.h>
James Morris2ee92d42006-11-13 16:09:01 -080069#include <linux/dccp.h>
Richard Hainesd4529302018-02-13 20:57:18 +000070#include <linux/sctp.h>
71#include <net/sctp/structs.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070072#include <linux/quota.h>
73#include <linux/un.h> /* for Unix socket types */
74#include <net/af_unix.h> /* for Unix socket types */
75#include <linux/parser.h>
76#include <linux/nfs_mount.h>
77#include <net/ipv6.h>
78#include <linux/hugetlb.h>
79#include <linux/personality.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070080#include <linux/audit.h>
Eric Paris6931dfc2005-06-30 02:58:51 -070081#include <linux/string.h>
Eric Paris23970742006-09-25 23:32:01 -070082#include <linux/mutex.h>
Frank Mayharf06febc2008-09-12 09:54:39 -070083#include <linux/posix-timers.h>
Kees Cook00234592010-02-03 15:36:43 -080084#include <linux/syslog.h>
Serge E. Hallyn34867402011-03-23 16:43:17 -070085#include <linux/user_namespace.h>
Paul Gortmaker44fc7ea2011-05-26 20:52:10 -040086#include <linux/export.h>
Al Viro40401532012-02-13 03:58:52 +000087#include <linux/msg.h>
88#include <linux/shm.h>
Chenbo Fengec27c352017-10-18 13:00:25 -070089#include <linux/bpf.h>
David Howellse262e32d2018-11-01 23:07:23 +000090#include <uapi/linux/mount.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070091
92#include "avc.h"
93#include "objsec.h"
94#include "netif.h"
Paul Moore224dfbd2008-01-29 08:38:13 -050095#include "netnode.h"
Paul Moore3e1121722008-04-10 10:48:14 -040096#include "netport.h"
Daniel Jurgens409dcf32017-05-19 15:48:59 +030097#include "ibpkey.h"
Trent Jaegerd28d1e02005-12-13 23:12:40 -080098#include "xfrm.h"
Paul Moorec60475b2007-02-28 15:14:23 -050099#include "netlabel.h"
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +0200100#include "audit.h"
James Morris7b98a582011-08-30 12:52:32 +1000101#include "avc_ss.h"
Linus Torvalds1da177e2005-04-16 15:20:36 -0700102
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500103struct selinux_state selinux_state;
104
Paul Moored621d352008-01-29 08:43:36 -0500105/* SECMARK reference count */
James Morris56a4ca92011-08-17 11:08:43 +1000106static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
Paul Moored621d352008-01-29 08:43:36 -0500107
Linus Torvalds1da177e2005-04-16 15:20:36 -0700108#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500109static int selinux_enforcing_boot;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700110
111static int __init enforcing_setup(char *str)
112{
Eric Parisf5269712008-05-14 11:27:45 -0400113 unsigned long enforcing;
Jingoo Han29707b22014-02-05 15:13:14 +0900114 if (!kstrtoul(str, 0, &enforcing))
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500115 selinux_enforcing_boot = enforcing ? 1 : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700116 return 1;
117}
118__setup("enforcing=", enforcing_setup);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500119#else
120#define selinux_enforcing_boot 1
Linus Torvalds1da177e2005-04-16 15:20:36 -0700121#endif
122
Kees Cookbe6ec882018-10-01 17:08:57 -0700123int selinux_enabled __lsm_ro_after_init = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700124#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
Linus Torvalds1da177e2005-04-16 15:20:36 -0700125static int __init selinux_enabled_setup(char *str)
126{
Eric Parisf5269712008-05-14 11:27:45 -0400127 unsigned long enabled;
Jingoo Han29707b22014-02-05 15:13:14 +0900128 if (!kstrtoul(str, 0, &enabled))
Eric Parisf5269712008-05-14 11:27:45 -0400129 selinux_enabled = enabled ? 1 : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700130 return 1;
131}
132__setup("selinux=", selinux_enabled_setup);
133#endif
134
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500135static unsigned int selinux_checkreqprot_boot =
136 CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
137
138static int __init checkreqprot_setup(char *str)
139{
140 unsigned long checkreqprot;
141
142 if (!kstrtoul(str, 0, &checkreqprot))
143 selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
144 return 1;
145}
146__setup("checkreqprot=", checkreqprot_setup);
147
Christoph Lametere18b8902006-12-06 20:33:20 -0800148static struct kmem_cache *sel_inode_cache;
James Morris7cae7e22006-03-22 00:09:22 -0800149
Paul Moored621d352008-01-29 08:43:36 -0500150/**
151 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
152 *
153 * Description:
154 * This function checks the SECMARK reference counter to see if any SECMARK
155 * targets are currently configured, if the reference counter is greater than
156 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
Chris PeBenito2be4d742013-05-03 09:05:39 -0400157 * enabled, false (0) if SECMARK is disabled. If the always_check_network
158 * policy capability is enabled, SECMARK is always considered enabled.
Paul Moored621d352008-01-29 08:43:36 -0500159 *
160 */
161static int selinux_secmark_enabled(void)
162{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500163 return (selinux_policycap_alwaysnetwork() ||
164 atomic_read(&selinux_secmark_refcount));
Chris PeBenito2be4d742013-05-03 09:05:39 -0400165}
166
167/**
168 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
169 *
170 * Description:
171 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
172 * (1) if any are enabled or false (0) if neither are enabled. If the
173 * always_check_network policy capability is enabled, peer labeling
174 * is always considered enabled.
175 *
176 */
177static int selinux_peerlbl_enabled(void)
178{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500179 return (selinux_policycap_alwaysnetwork() ||
180 netlbl_enabled() || selinux_xfrm_enabled());
Paul Moored621d352008-01-29 08:43:36 -0500181}
182
Paul Moore615e51f2014-06-26 14:33:56 -0400183static int selinux_netcache_avc_callback(u32 event)
184{
185 if (event == AVC_CALLBACK_RESET) {
186 sel_netif_flush();
187 sel_netnode_flush();
188 sel_netport_flush();
189 synchronize_net();
190 }
191 return 0;
192}
193
Daniel Jurgens8f408ab2017-05-19 15:48:53 +0300194static int selinux_lsm_notifier_avc_callback(u32 event)
195{
Daniel Jurgens409dcf32017-05-19 15:48:59 +0300196 if (event == AVC_CALLBACK_RESET) {
197 sel_ib_pkey_flush();
Daniel Jurgens8f408ab2017-05-19 15:48:53 +0300198 call_lsm_notifier(LSM_POLICY_CHANGE, NULL);
Daniel Jurgens409dcf32017-05-19 15:48:59 +0300199 }
Daniel Jurgens8f408ab2017-05-19 15:48:53 +0300200
201 return 0;
202}
203
David Howellsd84f4f92008-11-14 10:39:23 +1100204/*
205 * initialise the security for the init task
206 */
207static void cred_init_security(void)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700208{
David Howells3b11a1d2008-11-14 10:39:26 +1100209 struct cred *cred = (struct cred *) current->real_cred;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700210 struct task_security_struct *tsec;
211
Casey Schauflerbbd36622018-11-12 09:30:56 -0800212 lsm_early_cred(cred);
213 tsec = selinux_cred(cred);
David Howellsd84f4f92008-11-14 10:39:23 +1100214 tsec->osid = tsec->sid = SECINITSID_KERNEL;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700215}
216
David Howells275bb412008-11-14 10:39:19 +1100217/*
David Howells88e67f32008-11-14 10:39:21 +1100218 * get the security ID of a set of credentials
219 */
220static inline u32 cred_sid(const struct cred *cred)
221{
222 const struct task_security_struct *tsec;
223
Casey Schaufler0c6cfa62018-09-21 17:17:16 -0700224 tsec = selinux_cred(cred);
David Howells88e67f32008-11-14 10:39:21 +1100225 return tsec->sid;
226}
227
228/*
David Howells3b11a1d2008-11-14 10:39:26 +1100229 * get the objective security ID of a task
David Howells275bb412008-11-14 10:39:19 +1100230 */
231static inline u32 task_sid(const struct task_struct *task)
232{
David Howells275bb412008-11-14 10:39:19 +1100233 u32 sid;
234
235 rcu_read_lock();
David Howells88e67f32008-11-14 10:39:21 +1100236 sid = cred_sid(__task_cred(task));
David Howells275bb412008-11-14 10:39:19 +1100237 rcu_read_unlock();
238 return sid;
239}
240
David Howells88e67f32008-11-14 10:39:21 +1100241/* Allocate and free functions for each kind of security blob. */
242
Linus Torvalds1da177e2005-04-16 15:20:36 -0700243static int inode_alloc_security(struct inode *inode)
244{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700245 struct inode_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +1100246 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700247
Josef Bacika02fe132008-04-04 09:35:05 +1100248 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700249 if (!isec)
250 return -ENOMEM;
251
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +0100252 spin_lock_init(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700253 INIT_LIST_HEAD(&isec->list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700254 isec->inode = inode;
255 isec->sid = SECINITSID_UNLABELED;
256 isec->sclass = SECCLASS_FILE;
David Howells275bb412008-11-14 10:39:19 +1100257 isec->task_sid = sid;
Andreas Gruenbacher42059112016-11-10 22:18:27 +0100258 isec->initialized = LABEL_INVALID;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700259 inode->i_security = isec;
260
261 return 0;
262}
263
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500264static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
265
266/*
267 * Try reloading inode security labels that have been marked as invalid. The
268 * @may_sleep parameter indicates when sleeping and thus reloading labels is
Andreas Gruenbacher42059112016-11-10 22:18:27 +0100269 * allowed; when set to false, returns -ECHILD when the label is
Al Viroe9193282018-04-24 21:31:02 -0400270 * invalid. The @dentry parameter should be set to a dentry of the inode.
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500271 */
272static int __inode_security_revalidate(struct inode *inode,
Al Viroe9193282018-04-24 21:31:02 -0400273 struct dentry *dentry,
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500274 bool may_sleep)
275{
276 struct inode_security_struct *isec = inode->i_security;
277
278 might_sleep_if(may_sleep);
279
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500280 if (selinux_state.initialized &&
281 isec->initialized != LABEL_INITIALIZED) {
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500282 if (!may_sleep)
283 return -ECHILD;
284
285 /*
286 * Try reloading the inode security label. This will fail if
287 * @opt_dentry is NULL and no dentry for this inode can be
288 * found; in that case, continue using the old label.
289 */
Al Viroe9193282018-04-24 21:31:02 -0400290 inode_doinit_with_dentry(inode, dentry);
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500291 }
292 return 0;
293}
294
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500295static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
296{
297 return inode->i_security;
298}
299
300static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
301{
302 int error;
303
304 error = __inode_security_revalidate(inode, NULL, !rcu);
305 if (error)
306 return ERR_PTR(error);
307 return inode->i_security;
308}
309
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500310/*
311 * Get the security label of an inode.
312 */
313static struct inode_security_struct *inode_security(struct inode *inode)
314{
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500315 __inode_security_revalidate(inode, NULL, true);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500316 return inode->i_security;
317}
318
Paul Moore2c971652016-04-19 16:36:28 -0400319static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
320{
321 struct inode *inode = d_backing_inode(dentry);
322
323 return inode->i_security;
324}
325
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500326/*
327 * Get the security label of a dentry's backing inode.
328 */
329static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
330{
331 struct inode *inode = d_backing_inode(dentry);
332
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500333 __inode_security_revalidate(inode, dentry, true);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500334 return inode->i_security;
335}
336
Steven Rostedt3dc91d42014-01-09 21:46:34 -0500337static void inode_free_rcu(struct rcu_head *head)
338{
339 struct inode_security_struct *isec;
340
341 isec = container_of(head, struct inode_security_struct, rcu);
342 kmem_cache_free(sel_inode_cache, isec);
343}
344
Linus Torvalds1da177e2005-04-16 15:20:36 -0700345static void inode_free_security(struct inode *inode)
346{
347 struct inode_security_struct *isec = inode->i_security;
348 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
349
Waiman Long9629d042015-07-10 17:19:56 -0400350 /*
351 * As not all inode security structures are in a list, we check for
352 * empty list outside of the lock to make sure that we won't waste
353 * time taking a lock doing nothing.
354 *
355 * The list_del_init() function can be safely called more than once.
356 * It should not be possible for this function to be called with
357 * concurrent list_add(), but for better safety against future changes
358 * in the code, we use list_empty_careful() here.
359 */
360 if (!list_empty_careful(&isec->list)) {
361 spin_lock(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700362 list_del_init(&isec->list);
Waiman Long9629d042015-07-10 17:19:56 -0400363 spin_unlock(&sbsec->isec_lock);
364 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700365
Steven Rostedt3dc91d42014-01-09 21:46:34 -0500366 /*
367 * The inode may still be referenced in a path walk and
368 * a call to selinux_inode_permission() can be made
369 * after inode_free_security() is called. Ideally, the VFS
370 * wouldn't do this, but fixing that is a much harder
371 * job. For now, simply free the i_security via RCU, and
372 * leave the current inode->i_security pointer intact.
373 * The inode will be freed after the RCU grace period too.
374 */
375 call_rcu(&isec->rcu, inode_free_rcu);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700376}
377
378static int file_alloc_security(struct file *file)
379{
Casey Schaufler33bf60c2018-11-12 12:02:49 -0800380 struct file_security_struct *fsec = selinux_file(file);
David Howells275bb412008-11-14 10:39:19 +1100381 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700382
David Howells275bb412008-11-14 10:39:19 +1100383 fsec->sid = sid;
384 fsec->fown_sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700385
386 return 0;
387}
388
Linus Torvalds1da177e2005-04-16 15:20:36 -0700389static int superblock_alloc_security(struct super_block *sb)
390{
391 struct superblock_security_struct *sbsec;
392
James Morris89d155e2005-10-30 14:59:21 -0800393 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700394 if (!sbsec)
395 return -ENOMEM;
396
Eric Parisbc7e9822006-09-25 23:32:02 -0700397 mutex_init(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700398 INIT_LIST_HEAD(&sbsec->isec_head);
399 spin_lock_init(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700400 sbsec->sb = sb;
401 sbsec->sid = SECINITSID_UNLABELED;
402 sbsec->def_sid = SECINITSID_FILE;
Eric Parisc312feb2006-07-10 04:43:53 -0700403 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700404 sb->s_security = sbsec;
405
406 return 0;
407}
408
409static void superblock_free_security(struct super_block *sb)
410{
411 struct superblock_security_struct *sbsec = sb->s_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700412 sb->s_security = NULL;
413 kfree(sbsec);
414}
415
Al Virobd323652018-12-13 15:04:59 -0500416struct selinux_mnt_opts {
417 const char *fscontext, *context, *rootcontext, *defcontext;
418};
419
Al Viro204cc0c2018-12-13 13:41:47 -0500420static void selinux_free_mnt_opts(void *mnt_opts)
421{
Al Virobd323652018-12-13 15:04:59 -0500422 struct selinux_mnt_opts *opts = mnt_opts;
423 kfree(opts->fscontext);
424 kfree(opts->context);
425 kfree(opts->rootcontext);
426 kfree(opts->defcontext);
Al Viro204cc0c2018-12-13 13:41:47 -0500427 kfree(opts);
428}
429
Linus Torvalds1da177e2005-04-16 15:20:36 -0700430static inline int inode_doinit(struct inode *inode)
431{
432 return inode_doinit_with_dentry(inode, NULL);
433}
434
435enum {
Eric Paris31e87932007-09-19 17:19:12 -0400436 Opt_error = -1,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700437 Opt_context = 1,
438 Opt_fscontext = 2,
Eric Parisc9180a52007-11-30 13:00:35 -0500439 Opt_defcontext = 3,
440 Opt_rootcontext = 4,
Al Viroda3d76a2018-12-17 10:14:16 -0500441 Opt_seclabel = 5,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700442};
443
Al Viroda3d76a2018-12-17 10:14:16 -0500444#define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg}
Al Viro169d68efb2018-12-14 22:44:50 -0500445static struct {
446 const char *name;
447 int len;
448 int opt;
449 bool has_arg;
450} tokens[] = {
Al Viroda3d76a2018-12-17 10:14:16 -0500451 A(context, true),
452 A(fscontext, true),
453 A(defcontext, true),
454 A(rootcontext, true),
455 A(seclabel, false),
Linus Torvalds1da177e2005-04-16 15:20:36 -0700456};
Al Viro169d68efb2018-12-14 22:44:50 -0500457#undef A
458
459static int match_opt_prefix(char *s, int l, char **arg)
460{
461 int i;
462
463 for (i = 0; i < ARRAY_SIZE(tokens); i++) {
464 size_t len = tokens[i].len;
465 if (len > l || memcmp(s, tokens[i].name, len))
466 continue;
467 if (tokens[i].has_arg) {
468 if (len == l || s[len] != '=')
469 continue;
470 *arg = s + len + 1;
471 } else if (len != l)
472 continue;
473 return tokens[i].opt;
474 }
475 return Opt_error;
476}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700477
478#define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
479
Eric Parisc312feb2006-07-10 04:43:53 -0700480static int may_context_mount_sb_relabel(u32 sid,
481 struct superblock_security_struct *sbsec,
David Howells275bb412008-11-14 10:39:19 +1100482 const struct cred *cred)
Eric Parisc312feb2006-07-10 04:43:53 -0700483{
Casey Schaufler0c6cfa62018-09-21 17:17:16 -0700484 const struct task_security_struct *tsec = selinux_cred(cred);
Eric Parisc312feb2006-07-10 04:43:53 -0700485 int rc;
486
Stephen Smalley6b6bc622018-03-05 11:47:56 -0500487 rc = avc_has_perm(&selinux_state,
488 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
Eric Parisc312feb2006-07-10 04:43:53 -0700489 FILESYSTEM__RELABELFROM, NULL);
490 if (rc)
491 return rc;
492
Stephen Smalley6b6bc622018-03-05 11:47:56 -0500493 rc = avc_has_perm(&selinux_state,
494 tsec->sid, sid, SECCLASS_FILESYSTEM,
Eric Parisc312feb2006-07-10 04:43:53 -0700495 FILESYSTEM__RELABELTO, NULL);
496 return rc;
497}
498
Eric Paris08089252006-07-10 04:43:55 -0700499static int may_context_mount_inode_relabel(u32 sid,
500 struct superblock_security_struct *sbsec,
David Howells275bb412008-11-14 10:39:19 +1100501 const struct cred *cred)
Eric Paris08089252006-07-10 04:43:55 -0700502{
Casey Schaufler0c6cfa62018-09-21 17:17:16 -0700503 const struct task_security_struct *tsec = selinux_cred(cred);
Eric Paris08089252006-07-10 04:43:55 -0700504 int rc;
Stephen Smalley6b6bc622018-03-05 11:47:56 -0500505 rc = avc_has_perm(&selinux_state,
506 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
Eric Paris08089252006-07-10 04:43:55 -0700507 FILESYSTEM__RELABELFROM, NULL);
508 if (rc)
509 return rc;
510
Stephen Smalley6b6bc622018-03-05 11:47:56 -0500511 rc = avc_has_perm(&selinux_state,
512 sid, sbsec->sid, SECCLASS_FILESYSTEM,
Eric Paris08089252006-07-10 04:43:55 -0700513 FILESYSTEM__ASSOCIATE, NULL);
514 return rc;
515}
516
Eric Parisb43e7252012-10-10 14:27:35 -0400517static int selinux_is_sblabel_mnt(struct super_block *sb)
518{
519 struct superblock_security_struct *sbsec = sb->s_security;
520
Mark Salyzynd5f3a5f2015-02-04 11:34:30 -0500521 return sbsec->behavior == SECURITY_FS_USE_XATTR ||
522 sbsec->behavior == SECURITY_FS_USE_TRANS ||
523 sbsec->behavior == SECURITY_FS_USE_TASK ||
J. Bruce Fields9fc2b4b2015-06-04 15:57:25 -0400524 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
Mark Salyzynd5f3a5f2015-02-04 11:34:30 -0500525 /* Special handling. Genfs but also in-core setxattr handler */
526 !strcmp(sb->s_type->name, "sysfs") ||
527 !strcmp(sb->s_type->name, "pstore") ||
528 !strcmp(sb->s_type->name, "debugfs") ||
Yongqin Liua2c7c6f2017-01-09 10:07:30 -0500529 !strcmp(sb->s_type->name, "tracefs") ||
Stephen Smalley2651225b2017-02-28 10:35:56 -0500530 !strcmp(sb->s_type->name, "rootfs") ||
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500531 (selinux_policycap_cgroupseclabel() &&
Stephen Smalley2651225b2017-02-28 10:35:56 -0500532 (!strcmp(sb->s_type->name, "cgroup") ||
533 !strcmp(sb->s_type->name, "cgroup2")));
Eric Parisb43e7252012-10-10 14:27:35 -0400534}
535
Eric Parisc9180a52007-11-30 13:00:35 -0500536static int sb_finish_set_opts(struct super_block *sb)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700537{
538 struct superblock_security_struct *sbsec = sb->s_security;
539 struct dentry *root = sb->s_root;
David Howellsc6f493d2015-03-17 22:26:22 +0000540 struct inode *root_inode = d_backing_inode(root);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700541 int rc = 0;
542
Linus Torvalds1da177e2005-04-16 15:20:36 -0700543 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
544 /* Make sure that the xattr handler exists and that no
545 error other than -ENODATA is returned by getxattr on
546 the root directory. -ENODATA is ok, as this may be
547 the first boot of the SELinux kernel before we have
548 assigned xattr values to the filesystem. */
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +0200549 if (!(root_inode->i_opflags & IOP_XATTR)) {
peter enderborgc103a912018-06-12 10:09:03 +0200550 pr_warn("SELinux: (dev %s, type %s) has no "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800551 "xattr support\n", sb->s_id, sb->s_type->name);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700552 rc = -EOPNOTSUPP;
553 goto out;
554 }
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +0200555
556 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700557 if (rc < 0 && rc != -ENODATA) {
558 if (rc == -EOPNOTSUPP)
peter enderborgc103a912018-06-12 10:09:03 +0200559 pr_warn("SELinux: (dev %s, type "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800560 "%s) has no security xattr handler\n",
561 sb->s_id, sb->s_type->name);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700562 else
peter enderborgc103a912018-06-12 10:09:03 +0200563 pr_warn("SELinux: (dev %s, type "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800564 "%s) getxattr errno %d\n", sb->s_id,
565 sb->s_type->name, -rc);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700566 goto out;
567 }
568 }
569
Eric Pariseadcabc2012-08-24 15:59:14 -0400570 sbsec->flags |= SE_SBINITIALIZED;
Scott Mayhew0b4d3452017-06-05 11:45:04 -0400571
572 /*
573 * Explicitly set or clear SBLABEL_MNT. It's not sufficient to simply
574 * leave the flag untouched because sb_clone_mnt_opts might be handing
575 * us a superblock that needs the flag to be cleared.
576 */
Eric Parisb43e7252012-10-10 14:27:35 -0400577 if (selinux_is_sblabel_mnt(sb))
Eric Paris12f348b2012-10-09 10:56:25 -0400578 sbsec->flags |= SBLABEL_MNT;
Scott Mayhew0b4d3452017-06-05 11:45:04 -0400579 else
580 sbsec->flags &= ~SBLABEL_MNT;
David P. Quigleyddd29ec2009-09-09 14:25:37 -0400581
Linus Torvalds1da177e2005-04-16 15:20:36 -0700582 /* Initialize the root inode. */
Eric Parisc9180a52007-11-30 13:00:35 -0500583 rc = inode_doinit_with_dentry(root_inode, root);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700584
585 /* Initialize any other inodes associated with the superblock, e.g.
586 inodes created prior to initial policy load or inodes created
587 during get_sb by a pseudo filesystem that directly
588 populates itself. */
589 spin_lock(&sbsec->isec_lock);
Al Viro8d641242018-12-10 15:34:12 -0500590 while (!list_empty(&sbsec->isec_head)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700591 struct inode_security_struct *isec =
Al Viro8d641242018-12-10 15:34:12 -0500592 list_first_entry(&sbsec->isec_head,
Eric Parisc9180a52007-11-30 13:00:35 -0500593 struct inode_security_struct, list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700594 struct inode *inode = isec->inode;
Stephen Smalley923190d2014-10-06 16:32:52 -0400595 list_del_init(&isec->list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700596 spin_unlock(&sbsec->isec_lock);
597 inode = igrab(inode);
598 if (inode) {
Eric Parisc9180a52007-11-30 13:00:35 -0500599 if (!IS_PRIVATE(inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700600 inode_doinit(inode);
601 iput(inode);
602 }
603 spin_lock(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700604 }
605 spin_unlock(&sbsec->isec_lock);
606out:
Eric Parisc9180a52007-11-30 13:00:35 -0500607 return rc;
608}
609
Eric Parisc9180a52007-11-30 13:00:35 -0500610static int bad_option(struct superblock_security_struct *sbsec, char flag,
611 u32 old_sid, u32 new_sid)
612{
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500613 char mnt_flags = sbsec->flags & SE_MNTMASK;
614
Eric Parisc9180a52007-11-30 13:00:35 -0500615 /* check if the old mount command had the same options */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500616 if (sbsec->flags & SE_SBINITIALIZED)
Eric Parisc9180a52007-11-30 13:00:35 -0500617 if (!(sbsec->flags & flag) ||
618 (old_sid != new_sid))
619 return 1;
620
621 /* check if we were passed the same options twice,
622 * aka someone passed context=a,context=b
623 */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500624 if (!(sbsec->flags & SE_SBINITIALIZED))
625 if (mnt_flags & flag)
Eric Parisc9180a52007-11-30 13:00:35 -0500626 return 1;
627 return 0;
628}
Eric Parise0007522008-03-05 10:31:54 -0500629
Al Virobd323652018-12-13 15:04:59 -0500630static int parse_sid(struct super_block *sb, const char *s, u32 *sid)
631{
632 int rc = security_context_str_to_sid(&selinux_state, s,
633 sid, GFP_KERNEL);
634 if (rc)
635 pr_warn("SELinux: security_context_str_to_sid"
636 "(%s) failed for (dev %s, type %s) errno=%d\n",
637 s, sb->s_id, sb->s_type->name, rc);
638 return rc;
639}
640
Eric Parisc9180a52007-11-30 13:00:35 -0500641/*
642 * Allow filesystems with binary mount data to explicitly set mount point
643 * labeling information.
644 */
Eric Parise0007522008-03-05 10:31:54 -0500645static int selinux_set_mnt_opts(struct super_block *sb,
Al Viro204cc0c2018-12-13 13:41:47 -0500646 void *mnt_opts,
David Quigley649f6e72013-05-22 12:50:36 -0400647 unsigned long kern_flags,
648 unsigned long *set_kern_flags)
Eric Parisc9180a52007-11-30 13:00:35 -0500649{
David Howells275bb412008-11-14 10:39:19 +1100650 const struct cred *cred = current_cred();
Eric Parisc9180a52007-11-30 13:00:35 -0500651 struct superblock_security_struct *sbsec = sb->s_security;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500652 struct dentry *root = sbsec->sb->s_root;
Al Virobd323652018-12-13 15:04:59 -0500653 struct selinux_mnt_opts *opts = mnt_opts;
Paul Moore2c971652016-04-19 16:36:28 -0400654 struct inode_security_struct *root_isec;
Eric Parisc9180a52007-11-30 13:00:35 -0500655 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
656 u32 defcontext_sid = 0;
Al Virobd323652018-12-13 15:04:59 -0500657 int rc = 0;
Eric Parisc9180a52007-11-30 13:00:35 -0500658
659 mutex_lock(&sbsec->lock);
660
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500661 if (!selinux_state.initialized) {
Al Virobd323652018-12-13 15:04:59 -0500662 if (!opts) {
Eric Parisc9180a52007-11-30 13:00:35 -0500663 /* Defer initialization until selinux_complete_init,
664 after the initial policy is loaded and the security
665 server is ready to handle calls. */
Eric Parisc9180a52007-11-30 13:00:35 -0500666 goto out;
667 }
668 rc = -EINVAL;
peter enderborgc103a912018-06-12 10:09:03 +0200669 pr_warn("SELinux: Unable to set superblock options "
Eric Paris744ba352008-04-17 11:52:44 -0400670 "before the security server is initialized\n");
Eric Parisc9180a52007-11-30 13:00:35 -0500671 goto out;
672 }
David Quigley649f6e72013-05-22 12:50:36 -0400673 if (kern_flags && !set_kern_flags) {
674 /* Specifying internal flags without providing a place to
675 * place the results is not allowed */
676 rc = -EINVAL;
677 goto out;
678 }
Eric Parisc9180a52007-11-30 13:00:35 -0500679
680 /*
Eric Parise0007522008-03-05 10:31:54 -0500681 * Binary mount data FS will come through this function twice. Once
682 * from an explicit call and once from the generic calls from the vfs.
683 * Since the generic VFS calls will not contain any security mount data
684 * we need to skip the double mount verification.
685 *
686 * This does open a hole in which we will not notice if the first
687 * mount using this sb set explict options and a second mount using
688 * this sb does not set any security options. (The first options
689 * will be used for both mounts)
690 */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500691 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
Al Virobd323652018-12-13 15:04:59 -0500692 && !opts)
Eric Parisf5269712008-05-14 11:27:45 -0400693 goto out;
Eric Parise0007522008-03-05 10:31:54 -0500694
Paul Moore2c971652016-04-19 16:36:28 -0400695 root_isec = backing_inode_security_novalidate(root);
696
Eric Parise0007522008-03-05 10:31:54 -0500697 /*
Eric Parisc9180a52007-11-30 13:00:35 -0500698 * parse the mount options, check if they are valid sids.
699 * also check if someone is trying to mount the same sb more
700 * than once with different security options.
701 */
Al Virobd323652018-12-13 15:04:59 -0500702 if (opts) {
703 if (opts->fscontext) {
704 rc = parse_sid(sb, opts->fscontext, &fscontext_sid);
705 if (rc)
706 goto out;
Eric Parisc9180a52007-11-30 13:00:35 -0500707 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
708 fscontext_sid))
709 goto out_double_mount;
Eric Parisc9180a52007-11-30 13:00:35 -0500710 sbsec->flags |= FSCONTEXT_MNT;
Al Virobd323652018-12-13 15:04:59 -0500711 }
712 if (opts->context) {
713 rc = parse_sid(sb, opts->context, &context_sid);
714 if (rc)
715 goto out;
Eric Parisc9180a52007-11-30 13:00:35 -0500716 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
717 context_sid))
718 goto out_double_mount;
Eric Parisc9180a52007-11-30 13:00:35 -0500719 sbsec->flags |= CONTEXT_MNT;
Al Virobd323652018-12-13 15:04:59 -0500720 }
721 if (opts->rootcontext) {
722 rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid);
723 if (rc)
724 goto out;
Eric Parisc9180a52007-11-30 13:00:35 -0500725 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
726 rootcontext_sid))
727 goto out_double_mount;
Eric Parisc9180a52007-11-30 13:00:35 -0500728 sbsec->flags |= ROOTCONTEXT_MNT;
Al Virobd323652018-12-13 15:04:59 -0500729 }
730 if (opts->defcontext) {
731 rc = parse_sid(sb, opts->defcontext, &defcontext_sid);
732 if (rc)
733 goto out;
Eric Parisc9180a52007-11-30 13:00:35 -0500734 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
735 defcontext_sid))
736 goto out_double_mount;
Eric Parisc9180a52007-11-30 13:00:35 -0500737 sbsec->flags |= DEFCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500738 }
739 }
740
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500741 if (sbsec->flags & SE_SBINITIALIZED) {
Eric Parisc9180a52007-11-30 13:00:35 -0500742 /* previously mounted with options, but not on this attempt? */
Al Virobd323652018-12-13 15:04:59 -0500743 if ((sbsec->flags & SE_MNTMASK) && !opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500744 goto out_double_mount;
745 rc = 0;
746 goto out;
747 }
748
James Morris089be432008-07-15 18:32:49 +1000749 if (strcmp(sb->s_type->name, "proc") == 0)
Stephen Smalley134509d2015-06-04 16:22:17 -0400750 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
751
Stephen Smalley8e014722015-06-04 16:22:17 -0400752 if (!strcmp(sb->s_type->name, "debugfs") ||
Jeff Vander Stoep6a391182017-06-20 09:35:33 -0700753 !strcmp(sb->s_type->name, "tracefs") ||
Stephen Smalley8e014722015-06-04 16:22:17 -0400754 !strcmp(sb->s_type->name, "sysfs") ||
Antonio Murdaca901ef842017-02-09 17:02:42 +0100755 !strcmp(sb->s_type->name, "pstore") ||
756 !strcmp(sb->s_type->name, "cgroup") ||
757 !strcmp(sb->s_type->name, "cgroup2"))
Stephen Smalley134509d2015-06-04 16:22:17 -0400758 sbsec->flags |= SE_SBGENFS;
Eric Parisc9180a52007-11-30 13:00:35 -0500759
David Quigleyeb9ae682013-05-22 12:50:37 -0400760 if (!sbsec->behavior) {
761 /*
762 * Determine the labeling behavior to use for this
763 * filesystem type.
764 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500765 rc = security_fs_use(&selinux_state, sb);
David Quigleyeb9ae682013-05-22 12:50:37 -0400766 if (rc) {
peter enderborgc103a912018-06-12 10:09:03 +0200767 pr_warn("%s: security_fs_use(%s) returned %d\n",
David Quigleyeb9ae682013-05-22 12:50:37 -0400768 __func__, sb->s_type->name, rc);
769 goto out;
770 }
Eric Parisc9180a52007-11-30 13:00:35 -0500771 }
Seth Forsheeaad82892016-04-26 14:36:20 -0500772
773 /*
Stephen Smalley01593d32017-01-09 10:07:31 -0500774 * If this is a user namespace mount and the filesystem type is not
775 * explicitly whitelisted, then no contexts are allowed on the command
776 * line and security labels must be ignored.
Seth Forsheeaad82892016-04-26 14:36:20 -0500777 */
Stephen Smalley01593d32017-01-09 10:07:31 -0500778 if (sb->s_user_ns != &init_user_ns &&
779 strcmp(sb->s_type->name, "tmpfs") &&
780 strcmp(sb->s_type->name, "ramfs") &&
781 strcmp(sb->s_type->name, "devpts")) {
Seth Forsheeaad82892016-04-26 14:36:20 -0500782 if (context_sid || fscontext_sid || rootcontext_sid ||
783 defcontext_sid) {
784 rc = -EACCES;
785 goto out;
786 }
787 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
788 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500789 rc = security_transition_sid(&selinux_state,
790 current_sid(),
791 current_sid(),
Seth Forsheeaad82892016-04-26 14:36:20 -0500792 SECCLASS_FILE, NULL,
793 &sbsec->mntpoint_sid);
794 if (rc)
795 goto out;
796 }
797 goto out_set_opts;
798 }
799
Eric Parisc9180a52007-11-30 13:00:35 -0500800 /* sets the context of the superblock for the fs being mounted. */
801 if (fscontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100802 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500803 if (rc)
804 goto out;
805
806 sbsec->sid = fscontext_sid;
807 }
808
809 /*
810 * Switch to using mount point labeling behavior.
811 * sets the label used on all file below the mountpoint, and will set
812 * the superblock context if not already set.
813 */
David Quigleyeb9ae682013-05-22 12:50:37 -0400814 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
815 sbsec->behavior = SECURITY_FS_USE_NATIVE;
816 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
817 }
818
Eric Parisc9180a52007-11-30 13:00:35 -0500819 if (context_sid) {
820 if (!fscontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100821 rc = may_context_mount_sb_relabel(context_sid, sbsec,
822 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500823 if (rc)
824 goto out;
825 sbsec->sid = context_sid;
826 } else {
David Howells275bb412008-11-14 10:39:19 +1100827 rc = may_context_mount_inode_relabel(context_sid, sbsec,
828 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500829 if (rc)
830 goto out;
831 }
832 if (!rootcontext_sid)
833 rootcontext_sid = context_sid;
834
835 sbsec->mntpoint_sid = context_sid;
836 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
837 }
838
839 if (rootcontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100840 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
841 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500842 if (rc)
843 goto out;
844
845 root_isec->sid = rootcontext_sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -0500846 root_isec->initialized = LABEL_INITIALIZED;
Eric Parisc9180a52007-11-30 13:00:35 -0500847 }
848
849 if (defcontext_sid) {
David Quigleyeb9ae682013-05-22 12:50:37 -0400850 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
851 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
Eric Parisc9180a52007-11-30 13:00:35 -0500852 rc = -EINVAL;
peter enderborgc103a912018-06-12 10:09:03 +0200853 pr_warn("SELinux: defcontext option is "
Eric Parisc9180a52007-11-30 13:00:35 -0500854 "invalid for this filesystem type\n");
855 goto out;
856 }
857
858 if (defcontext_sid != sbsec->def_sid) {
859 rc = may_context_mount_inode_relabel(defcontext_sid,
David Howells275bb412008-11-14 10:39:19 +1100860 sbsec, cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500861 if (rc)
862 goto out;
863 }
864
865 sbsec->def_sid = defcontext_sid;
866 }
867
Seth Forsheeaad82892016-04-26 14:36:20 -0500868out_set_opts:
Eric Parisc9180a52007-11-30 13:00:35 -0500869 rc = sb_finish_set_opts(sb);
870out:
Eric Parisbc7e9822006-09-25 23:32:02 -0700871 mutex_unlock(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700872 return rc;
Eric Parisc9180a52007-11-30 13:00:35 -0500873out_double_mount:
874 rc = -EINVAL;
peter enderborgc103a912018-06-12 10:09:03 +0200875 pr_warn("SELinux: mount invalid. Same superblock, different "
Al Virobd323652018-12-13 15:04:59 -0500876 "security settings for (dev %s, type %s)\n", sb->s_id,
877 sb->s_type->name);
Eric Parisc9180a52007-11-30 13:00:35 -0500878 goto out;
879}
880
Jeff Layton094f7b62013-04-01 08:14:24 -0400881static int selinux_cmp_sb_context(const struct super_block *oldsb,
882 const struct super_block *newsb)
883{
884 struct superblock_security_struct *old = oldsb->s_security;
885 struct superblock_security_struct *new = newsb->s_security;
886 char oldflags = old->flags & SE_MNTMASK;
887 char newflags = new->flags & SE_MNTMASK;
888
889 if (oldflags != newflags)
890 goto mismatch;
891 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
892 goto mismatch;
893 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
894 goto mismatch;
895 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
896 goto mismatch;
897 if (oldflags & ROOTCONTEXT_MNT) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500898 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
899 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
Jeff Layton094f7b62013-04-01 08:14:24 -0400900 if (oldroot->sid != newroot->sid)
901 goto mismatch;
902 }
903 return 0;
904mismatch:
peter enderborgc103a912018-06-12 10:09:03 +0200905 pr_warn("SELinux: mount invalid. Same superblock, "
Jeff Layton094f7b62013-04-01 08:14:24 -0400906 "different security settings for (dev %s, "
907 "type %s)\n", newsb->s_id, newsb->s_type->name);
908 return -EBUSY;
909}
910
911static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
Scott Mayhew0b4d3452017-06-05 11:45:04 -0400912 struct super_block *newsb,
913 unsigned long kern_flags,
914 unsigned long *set_kern_flags)
Eric Parisc9180a52007-11-30 13:00:35 -0500915{
Scott Mayhew0b4d3452017-06-05 11:45:04 -0400916 int rc = 0;
Eric Parisc9180a52007-11-30 13:00:35 -0500917 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
918 struct superblock_security_struct *newsbsec = newsb->s_security;
919
920 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
921 int set_context = (oldsbsec->flags & CONTEXT_MNT);
922 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
923
Eric Paris0f5e6422008-04-21 16:24:11 -0400924 /*
925 * if the parent was able to be mounted it clearly had no special lsm
Al Viroe8c26252010-03-23 06:36:54 -0400926 * mount options. thus we can safely deal with this superblock later
Eric Paris0f5e6422008-04-21 16:24:11 -0400927 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500928 if (!selinux_state.initialized)
Jeff Layton094f7b62013-04-01 08:14:24 -0400929 return 0;
Eric Parisc9180a52007-11-30 13:00:35 -0500930
Scott Mayhew0b4d3452017-06-05 11:45:04 -0400931 /*
932 * Specifying internal flags without providing a place to
933 * place the results is not allowed.
934 */
935 if (kern_flags && !set_kern_flags)
936 return -EINVAL;
937
Eric Parisc9180a52007-11-30 13:00:35 -0500938 /* how can we clone if the old one wasn't set up?? */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500939 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
Eric Parisc9180a52007-11-30 13:00:35 -0500940
Jeff Layton094f7b62013-04-01 08:14:24 -0400941 /* if fs is reusing a sb, make sure that the contexts match */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500942 if (newsbsec->flags & SE_SBINITIALIZED)
Jeff Layton094f7b62013-04-01 08:14:24 -0400943 return selinux_cmp_sb_context(oldsb, newsb);
Eric Paris5a552612008-04-09 14:08:35 -0400944
Eric Parisc9180a52007-11-30 13:00:35 -0500945 mutex_lock(&newsbsec->lock);
946
947 newsbsec->flags = oldsbsec->flags;
948
949 newsbsec->sid = oldsbsec->sid;
950 newsbsec->def_sid = oldsbsec->def_sid;
951 newsbsec->behavior = oldsbsec->behavior;
952
Scott Mayhew0b4d3452017-06-05 11:45:04 -0400953 if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
954 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500955 rc = security_fs_use(&selinux_state, newsb);
Scott Mayhew0b4d3452017-06-05 11:45:04 -0400956 if (rc)
957 goto out;
958 }
959
960 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
961 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
962 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
963 }
964
Eric Parisc9180a52007-11-30 13:00:35 -0500965 if (set_context) {
966 u32 sid = oldsbsec->mntpoint_sid;
967
968 if (!set_fscontext)
969 newsbsec->sid = sid;
970 if (!set_rootcontext) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500971 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
Eric Parisc9180a52007-11-30 13:00:35 -0500972 newisec->sid = sid;
973 }
974 newsbsec->mntpoint_sid = sid;
975 }
976 if (set_rootcontext) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500977 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
978 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
Eric Parisc9180a52007-11-30 13:00:35 -0500979
980 newisec->sid = oldisec->sid;
981 }
982
983 sb_finish_set_opts(newsb);
Scott Mayhew0b4d3452017-06-05 11:45:04 -0400984out:
Eric Parisc9180a52007-11-30 13:00:35 -0500985 mutex_unlock(&newsbsec->lock);
Scott Mayhew0b4d3452017-06-05 11:45:04 -0400986 return rc;
Eric Parisc9180a52007-11-30 13:00:35 -0500987}
988
Al Viroba641862018-12-14 20:28:15 -0500989static int selinux_add_opt(int token, const char *s, void **mnt_opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500990{
Al Viroba641862018-12-14 20:28:15 -0500991 struct selinux_mnt_opts *opts = *mnt_opts;
Eric Parisc9180a52007-11-30 13:00:35 -0500992
Al Viroda3d76a2018-12-17 10:14:16 -0500993 if (token == Opt_seclabel) /* eaten and completely ignored */
Al Viro169d68efb2018-12-14 22:44:50 -0500994 return 0;
Eric Parisc9180a52007-11-30 13:00:35 -0500995
Al Viroba641862018-12-14 20:28:15 -0500996 if (!opts) {
997 opts = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
998 if (!opts)
999 return -ENOMEM;
1000 *mnt_opts = opts;
1001 }
1002 if (!s)
1003 return -ENOMEM;
1004 switch (token) {
1005 case Opt_context:
1006 if (opts->context || opts->defcontext)
1007 goto Einval;
1008 opts->context = s;
1009 break;
1010 case Opt_fscontext:
1011 if (opts->fscontext)
1012 goto Einval;
1013 opts->fscontext = s;
1014 break;
1015 case Opt_rootcontext:
1016 if (opts->rootcontext)
1017 goto Einval;
1018 opts->rootcontext = s;
1019 break;
1020 case Opt_defcontext:
1021 if (opts->context || opts->defcontext)
1022 goto Einval;
1023 opts->defcontext = s;
1024 break;
1025 }
1026 return 0;
1027Einval:
1028 pr_warn(SEL_MOUNT_FAIL_MSG);
Al Viroba641862018-12-14 20:28:15 -05001029 return -EINVAL;
1030}
Eric Parisc9180a52007-11-30 13:00:35 -05001031
Al Viro757cbe52018-12-14 23:42:21 -05001032static int selinux_add_mnt_opt(const char *option, const char *val, int len,
1033 void **mnt_opts)
Eric Parisc9180a52007-11-30 13:00:35 -05001034{
Al Viro757cbe52018-12-14 23:42:21 -05001035 int token = Opt_error;
1036 int rc, i;
Eric Parisc9180a52007-11-30 13:00:35 -05001037
Al Viro757cbe52018-12-14 23:42:21 -05001038 for (i = 0; i < ARRAY_SIZE(tokens); i++) {
1039 if (strcmp(option, tokens[i].name) == 0) {
1040 token = tokens[i].opt;
Eric Parisc9180a52007-11-30 13:00:35 -05001041 break;
Eric Parisc9180a52007-11-30 13:00:35 -05001042 }
1043 }
1044
Al Viro757cbe52018-12-14 23:42:21 -05001045 if (token == Opt_error)
1046 return -EINVAL;
Eric Parise0007522008-03-05 10:31:54 -05001047
Al Viro757cbe52018-12-14 23:42:21 -05001048 if (token != Opt_seclabel)
1049 val = kmemdup_nul(val, len, GFP_KERNEL);
1050 rc = selinux_add_opt(token, val, mnt_opts);
1051 if (unlikely(rc)) {
1052 kfree(val);
1053 if (*mnt_opts) {
1054 selinux_free_mnt_opts(*mnt_opts);
1055 *mnt_opts = NULL;
1056 }
1057 }
1058 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001059}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001060
Al Viroe3489f82018-12-13 00:24:36 -05001061static int show_sid(struct seq_file *m, u32 sid)
Eric Paris2069f452008-07-04 09:47:13 +10001062{
Al Viroe3489f82018-12-13 00:24:36 -05001063 char *context = NULL;
1064 u32 len;
1065 int rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001066
Al Viroe3489f82018-12-13 00:24:36 -05001067 rc = security_sid_to_context(&selinux_state, sid,
1068 &context, &len);
1069 if (!rc) {
1070 bool has_comma = context && strchr(context, ',');
Linus Torvalds1da177e2005-04-16 15:20:36 -07001071
Eric Paris2069f452008-07-04 09:47:13 +10001072 if (has_comma)
1073 seq_putc(m, '\"');
Al Viroe3489f82018-12-13 00:24:36 -05001074 seq_escape(m, context, "\"\n\\");
Eric Paris2069f452008-07-04 09:47:13 +10001075 if (has_comma)
1076 seq_putc(m, '\"');
1077 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001078 kfree(context);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001079 return rc;
1080}
Eric Paris2069f452008-07-04 09:47:13 +10001081
1082static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1083{
Al Viroe3489f82018-12-13 00:24:36 -05001084 struct superblock_security_struct *sbsec = sb->s_security;
Eric Paris2069f452008-07-04 09:47:13 +10001085 int rc;
1086
Al Viroe3489f82018-12-13 00:24:36 -05001087 if (!(sbsec->flags & SE_SBINITIALIZED))
1088 return 0;
1089
1090 if (!selinux_state.initialized)
1091 return 0;
1092
1093 if (sbsec->flags & FSCONTEXT_MNT) {
1094 seq_putc(m, ',');
1095 seq_puts(m, FSCONTEXT_STR);
1096 rc = show_sid(m, sbsec->sid);
1097 if (rc)
1098 return rc;
Eric Paris383795c2008-07-29 17:07:26 -04001099 }
Al Viroe3489f82018-12-13 00:24:36 -05001100 if (sbsec->flags & CONTEXT_MNT) {
1101 seq_putc(m, ',');
1102 seq_puts(m, CONTEXT_STR);
1103 rc = show_sid(m, sbsec->mntpoint_sid);
1104 if (rc)
1105 return rc;
1106 }
1107 if (sbsec->flags & DEFCONTEXT_MNT) {
1108 seq_putc(m, ',');
1109 seq_puts(m, DEFCONTEXT_STR);
1110 rc = show_sid(m, sbsec->def_sid);
1111 if (rc)
1112 return rc;
1113 }
1114 if (sbsec->flags & ROOTCONTEXT_MNT) {
1115 struct dentry *root = sbsec->sb->s_root;
1116 struct inode_security_struct *isec = backing_inode_security(root);
1117 seq_putc(m, ',');
1118 seq_puts(m, ROOTCONTEXT_STR);
1119 rc = show_sid(m, isec->sid);
1120 if (rc)
1121 return rc;
1122 }
1123 if (sbsec->flags & SBLABEL_MNT) {
1124 seq_putc(m, ',');
1125 seq_puts(m, LABELSUPP_STR);
1126 }
1127 return 0;
Eric Paris2069f452008-07-04 09:47:13 +10001128}
1129
Linus Torvalds1da177e2005-04-16 15:20:36 -07001130static inline u16 inode_mode_to_security_class(umode_t mode)
1131{
1132 switch (mode & S_IFMT) {
1133 case S_IFSOCK:
1134 return SECCLASS_SOCK_FILE;
1135 case S_IFLNK:
1136 return SECCLASS_LNK_FILE;
1137 case S_IFREG:
1138 return SECCLASS_FILE;
1139 case S_IFBLK:
1140 return SECCLASS_BLK_FILE;
1141 case S_IFDIR:
1142 return SECCLASS_DIR;
1143 case S_IFCHR:
1144 return SECCLASS_CHR_FILE;
1145 case S_IFIFO:
1146 return SECCLASS_FIFO_FILE;
1147
1148 }
1149
1150 return SECCLASS_FILE;
1151}
1152
James Morris13402582005-09-30 14:24:34 -04001153static inline int default_protocol_stream(int protocol)
1154{
1155 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1156}
1157
1158static inline int default_protocol_dgram(int protocol)
1159{
1160 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1161}
1162
Linus Torvalds1da177e2005-04-16 15:20:36 -07001163static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1164{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001165 int extsockclass = selinux_policycap_extsockclass();
Stephen Smalleyda69a532017-01-09 10:07:30 -05001166
Linus Torvalds1da177e2005-04-16 15:20:36 -07001167 switch (family) {
1168 case PF_UNIX:
1169 switch (type) {
1170 case SOCK_STREAM:
1171 case SOCK_SEQPACKET:
1172 return SECCLASS_UNIX_STREAM_SOCKET;
1173 case SOCK_DGRAM:
Luis Ressel2a764b52017-07-25 15:13:41 -04001174 case SOCK_RAW:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001175 return SECCLASS_UNIX_DGRAM_SOCKET;
1176 }
1177 break;
1178 case PF_INET:
1179 case PF_INET6:
1180 switch (type) {
1181 case SOCK_STREAM:
Stephen Smalleyda69a532017-01-09 10:07:30 -05001182 case SOCK_SEQPACKET:
James Morris13402582005-09-30 14:24:34 -04001183 if (default_protocol_stream(protocol))
1184 return SECCLASS_TCP_SOCKET;
Stephen Smalleyda69a532017-01-09 10:07:30 -05001185 else if (extsockclass && protocol == IPPROTO_SCTP)
1186 return SECCLASS_SCTP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001187 else
1188 return SECCLASS_RAWIP_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001189 case SOCK_DGRAM:
James Morris13402582005-09-30 14:24:34 -04001190 if (default_protocol_dgram(protocol))
1191 return SECCLASS_UDP_SOCKET;
Stephen Smalleyef379792017-01-09 10:07:31 -05001192 else if (extsockclass && (protocol == IPPROTO_ICMP ||
1193 protocol == IPPROTO_ICMPV6))
Stephen Smalleyda69a532017-01-09 10:07:30 -05001194 return SECCLASS_ICMP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001195 else
1196 return SECCLASS_RAWIP_SOCKET;
James Morris2ee92d42006-11-13 16:09:01 -08001197 case SOCK_DCCP:
1198 return SECCLASS_DCCP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001199 default:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001200 return SECCLASS_RAWIP_SOCKET;
1201 }
1202 break;
1203 case PF_NETLINK:
1204 switch (protocol) {
1205 case NETLINK_ROUTE:
1206 return SECCLASS_NETLINK_ROUTE_SOCKET;
Pavel Emelyanov7f1fb602011-12-06 07:56:43 +00001207 case NETLINK_SOCK_DIAG:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001208 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1209 case NETLINK_NFLOG:
1210 return SECCLASS_NETLINK_NFLOG_SOCKET;
1211 case NETLINK_XFRM:
1212 return SECCLASS_NETLINK_XFRM_SOCKET;
1213 case NETLINK_SELINUX:
1214 return SECCLASS_NETLINK_SELINUX_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001215 case NETLINK_ISCSI:
1216 return SECCLASS_NETLINK_ISCSI_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001217 case NETLINK_AUDIT:
1218 return SECCLASS_NETLINK_AUDIT_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001219 case NETLINK_FIB_LOOKUP:
1220 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1221 case NETLINK_CONNECTOR:
1222 return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1223 case NETLINK_NETFILTER:
1224 return SECCLASS_NETLINK_NETFILTER_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001225 case NETLINK_DNRTMSG:
1226 return SECCLASS_NETLINK_DNRT_SOCKET;
James Morris0c9b7942005-04-16 15:24:13 -07001227 case NETLINK_KOBJECT_UEVENT:
1228 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001229 case NETLINK_GENERIC:
1230 return SECCLASS_NETLINK_GENERIC_SOCKET;
1231 case NETLINK_SCSITRANSPORT:
1232 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1233 case NETLINK_RDMA:
1234 return SECCLASS_NETLINK_RDMA_SOCKET;
1235 case NETLINK_CRYPTO:
1236 return SECCLASS_NETLINK_CRYPTO_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001237 default:
1238 return SECCLASS_NETLINK_SOCKET;
1239 }
1240 case PF_PACKET:
1241 return SECCLASS_PACKET_SOCKET;
1242 case PF_KEY:
1243 return SECCLASS_KEY_SOCKET;
Christopher J. PeBenito3e3ff152006-06-09 00:25:03 -07001244 case PF_APPLETALK:
1245 return SECCLASS_APPLETALK_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001246 }
1247
Stephen Smalleyda69a532017-01-09 10:07:30 -05001248 if (extsockclass) {
1249 switch (family) {
1250 case PF_AX25:
1251 return SECCLASS_AX25_SOCKET;
1252 case PF_IPX:
1253 return SECCLASS_IPX_SOCKET;
1254 case PF_NETROM:
1255 return SECCLASS_NETROM_SOCKET;
Stephen Smalleyda69a532017-01-09 10:07:30 -05001256 case PF_ATMPVC:
1257 return SECCLASS_ATMPVC_SOCKET;
1258 case PF_X25:
1259 return SECCLASS_X25_SOCKET;
1260 case PF_ROSE:
1261 return SECCLASS_ROSE_SOCKET;
1262 case PF_DECnet:
1263 return SECCLASS_DECNET_SOCKET;
1264 case PF_ATMSVC:
1265 return SECCLASS_ATMSVC_SOCKET;
1266 case PF_RDS:
1267 return SECCLASS_RDS_SOCKET;
1268 case PF_IRDA:
1269 return SECCLASS_IRDA_SOCKET;
1270 case PF_PPPOX:
1271 return SECCLASS_PPPOX_SOCKET;
1272 case PF_LLC:
1273 return SECCLASS_LLC_SOCKET;
Stephen Smalleyda69a532017-01-09 10:07:30 -05001274 case PF_CAN:
1275 return SECCLASS_CAN_SOCKET;
1276 case PF_TIPC:
1277 return SECCLASS_TIPC_SOCKET;
1278 case PF_BLUETOOTH:
1279 return SECCLASS_BLUETOOTH_SOCKET;
1280 case PF_IUCV:
1281 return SECCLASS_IUCV_SOCKET;
1282 case PF_RXRPC:
1283 return SECCLASS_RXRPC_SOCKET;
1284 case PF_ISDN:
1285 return SECCLASS_ISDN_SOCKET;
1286 case PF_PHONET:
1287 return SECCLASS_PHONET_SOCKET;
1288 case PF_IEEE802154:
1289 return SECCLASS_IEEE802154_SOCKET;
1290 case PF_CAIF:
1291 return SECCLASS_CAIF_SOCKET;
1292 case PF_ALG:
1293 return SECCLASS_ALG_SOCKET;
1294 case PF_NFC:
1295 return SECCLASS_NFC_SOCKET;
1296 case PF_VSOCK:
1297 return SECCLASS_VSOCK_SOCKET;
1298 case PF_KCM:
1299 return SECCLASS_KCM_SOCKET;
1300 case PF_QIPCRTR:
1301 return SECCLASS_QIPCRTR_SOCKET;
Linus Torvalds3051bf32017-02-22 10:15:09 -08001302 case PF_SMC:
1303 return SECCLASS_SMC_SOCKET;
Björn Töpel68e8b842018-05-02 13:01:22 +02001304 case PF_XDP:
1305 return SECCLASS_XDP_SOCKET;
1306#if PF_MAX > 45
Stephen Smalleyda69a532017-01-09 10:07:30 -05001307#error New address family defined, please update this function.
1308#endif
1309 }
1310 }
1311
Linus Torvalds1da177e2005-04-16 15:20:36 -07001312 return SECCLASS_SOCKET;
1313}
1314
Stephen Smalley134509d2015-06-04 16:22:17 -04001315static int selinux_genfs_get_sid(struct dentry *dentry,
1316 u16 tclass,
1317 u16 flags,
1318 u32 *sid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001319{
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001320 int rc;
Al Virofc640052016-04-10 01:33:30 -04001321 struct super_block *sb = dentry->d_sb;
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001322 char *buffer, *path;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001323
Eric Paris828dfe12008-04-17 13:17:49 -04001324 buffer = (char *)__get_free_page(GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001325 if (!buffer)
1326 return -ENOMEM;
1327
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001328 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1329 if (IS_ERR(path))
1330 rc = PTR_ERR(path);
1331 else {
Stephen Smalley134509d2015-06-04 16:22:17 -04001332 if (flags & SE_SBPROC) {
1333 /* each process gets a /proc/PID/ entry. Strip off the
1334 * PID part to get a valid selinux labeling.
1335 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1336 while (path[1] >= '0' && path[1] <= '9') {
1337 path[1] = '/';
1338 path++;
1339 }
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001340 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001341 rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1342 path, tclass, sid);
Stephen Smalley7bb185e2018-09-04 16:51:36 -04001343 if (rc == -ENOENT) {
1344 /* No match in policy, mark as unlabeled. */
1345 *sid = SECINITSID_UNLABELED;
1346 rc = 0;
1347 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001348 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001349 free_page((unsigned long)buffer);
1350 return rc;
1351}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001352
1353/* The inode's security attributes must be initialized before first use. */
1354static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1355{
1356 struct superblock_security_struct *sbsec = NULL;
1357 struct inode_security_struct *isec = inode->i_security;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001358 u32 task_sid, sid = 0;
1359 u16 sclass;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001360 struct dentry *dentry;
1361#define INITCONTEXTLEN 255
1362 char *context = NULL;
1363 unsigned len = 0;
1364 int rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001365
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05001366 if (isec->initialized == LABEL_INITIALIZED)
Andreas Gruenbacher13457d02016-11-10 22:18:29 +01001367 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001368
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001369 spin_lock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05001370 if (isec->initialized == LABEL_INITIALIZED)
Eric Paris23970742006-09-25 23:32:01 -07001371 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001372
Andreas Gruenbacher13457d02016-11-10 22:18:29 +01001373 if (isec->sclass == SECCLASS_FILE)
1374 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1375
Linus Torvalds1da177e2005-04-16 15:20:36 -07001376 sbsec = inode->i_sb->s_security;
David P. Quigley0d90a7e2009-01-16 09:22:02 -05001377 if (!(sbsec->flags & SE_SBINITIALIZED)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001378 /* Defer initialization until selinux_complete_init,
1379 after the initial policy is loaded and the security
1380 server is ready to handle calls. */
1381 spin_lock(&sbsec->isec_lock);
1382 if (list_empty(&isec->list))
1383 list_add(&isec->list, &sbsec->isec_head);
1384 spin_unlock(&sbsec->isec_lock);
Eric Paris23970742006-09-25 23:32:01 -07001385 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001386 }
1387
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001388 sclass = isec->sclass;
1389 task_sid = isec->task_sid;
1390 sid = isec->sid;
1391 isec->initialized = LABEL_PENDING;
1392 spin_unlock(&isec->lock);
1393
Linus Torvalds1da177e2005-04-16 15:20:36 -07001394 switch (sbsec->behavior) {
David Quigleyeb9ae682013-05-22 12:50:37 -04001395 case SECURITY_FS_USE_NATIVE:
1396 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001397 case SECURITY_FS_USE_XATTR:
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001398 if (!(inode->i_opflags & IOP_XATTR)) {
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001399 sid = sbsec->def_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001400 break;
1401 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001402 /* Need a dentry, since the xattr API requires one.
1403 Life would be simpler if we could just pass the inode. */
1404 if (opt_dentry) {
1405 /* Called from d_instantiate or d_splice_alias. */
1406 dentry = dget(opt_dentry);
1407 } else {
Al Virob1271252018-04-25 10:28:38 -04001408 /*
1409 * Called from selinux_complete_init, try to find a dentry.
1410 * Some filesystems really want a connected one, so try
1411 * that first. We could split SECURITY_FS_USE_XATTR in
1412 * two, depending upon that...
1413 */
Linus Torvalds1da177e2005-04-16 15:20:36 -07001414 dentry = d_find_alias(inode);
Al Virob1271252018-04-25 10:28:38 -04001415 if (!dentry)
1416 dentry = d_find_any_alias(inode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001417 }
1418 if (!dentry) {
Eric Parisdf7f54c2009-03-09 14:35:58 -04001419 /*
1420 * this is can be hit on boot when a file is accessed
1421 * before the policy is loaded. When we load policy we
1422 * may find inodes that have no dentry on the
1423 * sbsec->isec_head list. No reason to complain as these
1424 * will get fixed up the next time we go through
1425 * inode_doinit with a dentry, before these inodes could
1426 * be used again by userspace.
1427 */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001428 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001429 }
1430
1431 len = INITCONTEXTLEN;
Eric Paris4cb912f2009-02-12 14:50:05 -05001432 context = kmalloc(len+1, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001433 if (!context) {
1434 rc = -ENOMEM;
1435 dput(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001436 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001437 }
Eric Paris4cb912f2009-02-12 14:50:05 -05001438 context[len] = '\0';
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001439 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001440 if (rc == -ERANGE) {
James Morris314dabb2009-08-10 22:00:13 +10001441 kfree(context);
1442
Linus Torvalds1da177e2005-04-16 15:20:36 -07001443 /* Need a larger buffer. Query for the right size. */
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001444 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001445 if (rc < 0) {
1446 dput(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001447 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001448 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001449 len = rc;
Eric Paris4cb912f2009-02-12 14:50:05 -05001450 context = kmalloc(len+1, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001451 if (!context) {
1452 rc = -ENOMEM;
1453 dput(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001454 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001455 }
Eric Paris4cb912f2009-02-12 14:50:05 -05001456 context[len] = '\0';
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001457 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001458 }
1459 dput(dentry);
1460 if (rc < 0) {
1461 if (rc != -ENODATA) {
peter enderborgc103a912018-06-12 10:09:03 +02001462 pr_warn("SELinux: %s: getxattr returned "
Harvey Harrisondd6f9532008-03-06 10:03:59 +11001463 "%d for dev=%s ino=%ld\n", __func__,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001464 -rc, inode->i_sb->s_id, inode->i_ino);
1465 kfree(context);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001466 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001467 }
1468 /* Map ENODATA to the default file SID */
1469 sid = sbsec->def_sid;
1470 rc = 0;
1471 } else {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001472 rc = security_context_to_sid_default(&selinux_state,
1473 context, rc, &sid,
Stephen Smalley869ab512008-04-04 08:46:05 -04001474 sbsec->def_sid,
1475 GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001476 if (rc) {
Eric Paris4ba0a8a2009-02-12 15:01:10 -05001477 char *dev = inode->i_sb->s_id;
1478 unsigned long ino = inode->i_ino;
1479
1480 if (rc == -EINVAL) {
1481 if (printk_ratelimit())
peter enderborgc103a912018-06-12 10:09:03 +02001482 pr_notice("SELinux: inode=%lu on dev=%s was found to have an invalid "
Eric Paris4ba0a8a2009-02-12 15:01:10 -05001483 "context=%s. This indicates you may need to relabel the inode or the "
1484 "filesystem in question.\n", ino, dev, context);
1485 } else {
peter enderborgc103a912018-06-12 10:09:03 +02001486 pr_warn("SELinux: %s: context_to_sid(%s) "
Eric Paris4ba0a8a2009-02-12 15:01:10 -05001487 "returned %d for dev=%s ino=%ld\n",
1488 __func__, context, -rc, dev, ino);
1489 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001490 kfree(context);
1491 /* Leave with the unlabeled SID */
1492 rc = 0;
1493 break;
1494 }
1495 }
1496 kfree(context);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001497 break;
1498 case SECURITY_FS_USE_TASK:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001499 sid = task_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001500 break;
1501 case SECURITY_FS_USE_TRANS:
1502 /* Default to the fs SID. */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001503 sid = sbsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001504
1505 /* Try to obtain a transition SID. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001506 rc = security_transition_sid(&selinux_state, task_sid, sid,
1507 sclass, NULL, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001508 if (rc)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001509 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001510 break;
Eric Parisc312feb2006-07-10 04:43:53 -07001511 case SECURITY_FS_USE_MNTPOINT:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001512 sid = sbsec->mntpoint_sid;
Eric Parisc312feb2006-07-10 04:43:53 -07001513 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001514 default:
Eric Parisc312feb2006-07-10 04:43:53 -07001515 /* Default to the fs superblock SID. */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001516 sid = sbsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001517
Stephen Smalley134509d2015-06-04 16:22:17 -04001518 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
Paul Mooref64410e2014-03-19 16:46:18 -04001519 /* We must have a dentry to determine the label on
1520 * procfs inodes */
Al Virob1271252018-04-25 10:28:38 -04001521 if (opt_dentry) {
Paul Mooref64410e2014-03-19 16:46:18 -04001522 /* Called from d_instantiate or
1523 * d_splice_alias. */
1524 dentry = dget(opt_dentry);
Al Virob1271252018-04-25 10:28:38 -04001525 } else {
Paul Mooref64410e2014-03-19 16:46:18 -04001526 /* Called from selinux_complete_init, try to
Al Virob1271252018-04-25 10:28:38 -04001527 * find a dentry. Some filesystems really want
1528 * a connected one, so try that first.
1529 */
Paul Mooref64410e2014-03-19 16:46:18 -04001530 dentry = d_find_alias(inode);
Al Virob1271252018-04-25 10:28:38 -04001531 if (!dentry)
1532 dentry = d_find_any_alias(inode);
1533 }
Paul Mooref64410e2014-03-19 16:46:18 -04001534 /*
1535 * This can be hit on boot when a file is accessed
1536 * before the policy is loaded. When we load policy we
1537 * may find inodes that have no dentry on the
1538 * sbsec->isec_head list. No reason to complain as
1539 * these will get fixed up the next time we go through
1540 * inode_doinit() with a dentry, before these inodes
1541 * could be used again by userspace.
1542 */
1543 if (!dentry)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001544 goto out;
1545 rc = selinux_genfs_get_sid(dentry, sclass,
Stephen Smalley134509d2015-06-04 16:22:17 -04001546 sbsec->flags, &sid);
Paul Mooref64410e2014-03-19 16:46:18 -04001547 dput(dentry);
1548 if (rc)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001549 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001550 }
1551 break;
1552 }
1553
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001554out:
1555 spin_lock(&isec->lock);
1556 if (isec->initialized == LABEL_PENDING) {
1557 if (!sid || rc) {
1558 isec->initialized = LABEL_INVALID;
1559 goto out_unlock;
1560 }
1561
1562 isec->initialized = LABEL_INITIALIZED;
1563 isec->sid = sid;
1564 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001565
Eric Paris23970742006-09-25 23:32:01 -07001566out_unlock:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001567 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001568 return rc;
1569}
1570
1571/* Convert a Linux signal to an access vector. */
1572static inline u32 signal_to_av(int sig)
1573{
1574 u32 perm = 0;
1575
1576 switch (sig) {
1577 case SIGCHLD:
1578 /* Commonly granted from child to parent. */
1579 perm = PROCESS__SIGCHLD;
1580 break;
1581 case SIGKILL:
1582 /* Cannot be caught or ignored */
1583 perm = PROCESS__SIGKILL;
1584 break;
1585 case SIGSTOP:
1586 /* Cannot be caught or ignored */
1587 perm = PROCESS__SIGSTOP;
1588 break;
1589 default:
1590 /* All other signals. */
1591 perm = PROCESS__SIGNAL;
1592 break;
1593 }
1594
1595 return perm;
1596}
1597
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001598#if CAP_LAST_CAP > 63
1599#error Fix SELinux to handle capabilities > 63.
1600#endif
1601
Linus Torvalds1da177e2005-04-16 15:20:36 -07001602/* Check whether a task is allowed to use a capability. */
Eric Paris6a9de492012-01-03 12:25:14 -05001603static int cred_has_capability(const struct cred *cred,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001604 int cap, int audit, bool initns)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001605{
Thomas Liu2bf49692009-07-14 12:14:09 -04001606 struct common_audit_data ad;
Eric Paris06112162008-11-11 22:02:50 +11001607 struct av_decision avd;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001608 u16 sclass;
David Howells3699c532009-01-06 22:27:01 +00001609 u32 sid = cred_sid(cred);
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001610 u32 av = CAP_TO_MASK(cap);
Eric Paris06112162008-11-11 22:02:50 +11001611 int rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001612
Eric Paris50c205f2012-04-04 15:01:43 -04001613 ad.type = LSM_AUDIT_DATA_CAP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001614 ad.u.cap = cap;
1615
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001616 switch (CAP_TO_INDEX(cap)) {
1617 case 0:
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001618 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001619 break;
1620 case 1:
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001621 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001622 break;
1623 default:
peter enderborgc103a912018-06-12 10:09:03 +02001624 pr_err("SELinux: out of range capability %d\n", cap);
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001625 BUG();
Eric Parisa35c6c832011-04-20 10:21:28 -04001626 return -EINVAL;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001627 }
Eric Paris06112162008-11-11 22:02:50 +11001628
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001629 rc = avc_has_perm_noaudit(&selinux_state,
1630 sid, sid, sclass, av, 0, &avd);
Eric Paris9ade0cf2011-04-25 16:26:29 -04001631 if (audit == SECURITY_CAP_AUDIT) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001632 int rc2 = avc_audit(&selinux_state,
1633 sid, sid, sclass, av, &avd, rc, &ad, 0);
Eric Paris9ade0cf2011-04-25 16:26:29 -04001634 if (rc2)
1635 return rc2;
1636 }
Eric Paris06112162008-11-11 22:02:50 +11001637 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001638}
1639
Linus Torvalds1da177e2005-04-16 15:20:36 -07001640/* Check whether a task has a particular permission to an inode.
1641 The 'adp' parameter is optional and allows other audit
1642 data to be passed (e.g. the dentry). */
David Howells88e67f32008-11-14 10:39:21 +11001643static int inode_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001644 struct inode *inode,
1645 u32 perms,
Linus Torvalds19e49832013-10-04 12:54:11 -07001646 struct common_audit_data *adp)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001647{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001648 struct inode_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +11001649 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001650
David Howellse0e81732009-09-02 09:13:40 +01001651 validate_creds(cred);
1652
Eric Paris828dfe12008-04-17 13:17:49 -04001653 if (unlikely(IS_PRIVATE(inode)))
Stephen Smalleybbaca6c2007-02-14 00:34:16 -08001654 return 0;
1655
David Howells88e67f32008-11-14 10:39:21 +11001656 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001657 isec = inode->i_security;
1658
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001659 return avc_has_perm(&selinux_state,
1660 sid, isec->sid, isec->sclass, perms, adp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001661}
1662
1663/* Same as inode_has_perm, but pass explicit audit data containing
1664 the dentry to help the auditing code to more easily generate the
1665 pathname if needed. */
David Howells88e67f32008-11-14 10:39:21 +11001666static inline int dentry_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001667 struct dentry *dentry,
1668 u32 av)
1669{
David Howellsc6f493d2015-03-17 22:26:22 +00001670 struct inode *inode = d_backing_inode(dentry);
Thomas Liu2bf49692009-07-14 12:14:09 -04001671 struct common_audit_data ad;
David Howells88e67f32008-11-14 10:39:21 +11001672
Eric Paris50c205f2012-04-04 15:01:43 -04001673 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Paris2875fa02011-04-28 16:04:24 -04001674 ad.u.dentry = dentry;
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05001675 __inode_security_revalidate(inode, dentry, true);
Linus Torvalds19e49832013-10-04 12:54:11 -07001676 return inode_has_perm(cred, inode, av, &ad);
Eric Paris2875fa02011-04-28 16:04:24 -04001677}
1678
1679/* Same as inode_has_perm, but pass explicit audit data containing
1680 the path to help the auditing code to more easily generate the
1681 pathname if needed. */
1682static inline int path_has_perm(const struct cred *cred,
Al Viro3f7036a2015-03-08 19:28:30 -04001683 const struct path *path,
Eric Paris2875fa02011-04-28 16:04:24 -04001684 u32 av)
1685{
David Howellsc6f493d2015-03-17 22:26:22 +00001686 struct inode *inode = d_backing_inode(path->dentry);
Eric Paris2875fa02011-04-28 16:04:24 -04001687 struct common_audit_data ad;
1688
Eric Paris50c205f2012-04-04 15:01:43 -04001689 ad.type = LSM_AUDIT_DATA_PATH;
Eric Paris2875fa02011-04-28 16:04:24 -04001690 ad.u.path = *path;
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05001691 __inode_security_revalidate(inode, path->dentry, true);
Linus Torvalds19e49832013-10-04 12:54:11 -07001692 return inode_has_perm(cred, inode, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001693}
1694
David Howells13f8e982013-06-13 23:37:55 +01001695/* Same as path_has_perm, but uses the inode from the file struct. */
1696static inline int file_path_has_perm(const struct cred *cred,
1697 struct file *file,
1698 u32 av)
1699{
1700 struct common_audit_data ad;
1701
Vivek Goyal43af5de2016-09-09 11:37:49 -04001702 ad.type = LSM_AUDIT_DATA_FILE;
1703 ad.u.file = file;
Linus Torvalds19e49832013-10-04 12:54:11 -07001704 return inode_has_perm(cred, file_inode(file), av, &ad);
David Howells13f8e982013-06-13 23:37:55 +01001705}
1706
Chenbo Fengf66e4482017-10-18 13:00:26 -07001707#ifdef CONFIG_BPF_SYSCALL
1708static int bpf_fd_pass(struct file *file, u32 sid);
1709#endif
1710
Linus Torvalds1da177e2005-04-16 15:20:36 -07001711/* Check whether a task can use an open file descriptor to
1712 access an inode in a given way. Check access to the
1713 descriptor itself, and then use dentry_has_perm to
1714 check a particular permission to the file.
1715 Access to the descriptor is implicitly granted if it
1716 has the same SID as the process. If av is zero, then
1717 access to the file is not checked, e.g. for cases
1718 where only the descriptor is affected like seek. */
David Howells88e67f32008-11-14 10:39:21 +11001719static int file_has_perm(const struct cred *cred,
1720 struct file *file,
1721 u32 av)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001722{
Casey Schauflerbb6c6b02018-09-21 17:22:32 -07001723 struct file_security_struct *fsec = selinux_file(file);
Al Viro496ad9a2013-01-23 17:07:38 -05001724 struct inode *inode = file_inode(file);
Thomas Liu2bf49692009-07-14 12:14:09 -04001725 struct common_audit_data ad;
David Howells88e67f32008-11-14 10:39:21 +11001726 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001727 int rc;
1728
Vivek Goyal43af5de2016-09-09 11:37:49 -04001729 ad.type = LSM_AUDIT_DATA_FILE;
1730 ad.u.file = file;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001731
David Howells275bb412008-11-14 10:39:19 +11001732 if (sid != fsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001733 rc = avc_has_perm(&selinux_state,
1734 sid, fsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001735 SECCLASS_FD,
1736 FD__USE,
1737 &ad);
1738 if (rc)
David Howells88e67f32008-11-14 10:39:21 +11001739 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001740 }
1741
Chenbo Fengf66e4482017-10-18 13:00:26 -07001742#ifdef CONFIG_BPF_SYSCALL
1743 rc = bpf_fd_pass(file, cred_sid(cred));
1744 if (rc)
1745 return rc;
1746#endif
1747
Linus Torvalds1da177e2005-04-16 15:20:36 -07001748 /* av is zero if only checking access to the descriptor. */
David Howells88e67f32008-11-14 10:39:21 +11001749 rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001750 if (av)
Linus Torvalds19e49832013-10-04 12:54:11 -07001751 rc = inode_has_perm(cred, inode, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001752
David Howells88e67f32008-11-14 10:39:21 +11001753out:
1754 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001755}
1756
David Howellsc3c188b2015-07-10 17:19:58 -04001757/*
1758 * Determine the label for an inode that might be unioned.
1759 */
Vivek Goyalc957f6d2016-07-13 10:44:51 -04001760static int
1761selinux_determine_inode_label(const struct task_security_struct *tsec,
1762 struct inode *dir,
1763 const struct qstr *name, u16 tclass,
1764 u32 *_new_isid)
David Howellsc3c188b2015-07-10 17:19:58 -04001765{
1766 const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
David Howellsc3c188b2015-07-10 17:19:58 -04001767
1768 if ((sbsec->flags & SE_SBINITIALIZED) &&
1769 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1770 *_new_isid = sbsec->mntpoint_sid;
1771 } else if ((sbsec->flags & SBLABEL_MNT) &&
1772 tsec->create_sid) {
1773 *_new_isid = tsec->create_sid;
1774 } else {
Paul Moore20cdef82016-04-04 14:14:42 -04001775 const struct inode_security_struct *dsec = inode_security(dir);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001776 return security_transition_sid(&selinux_state, tsec->sid,
1777 dsec->sid, tclass,
David Howellsc3c188b2015-07-10 17:19:58 -04001778 name, _new_isid);
1779 }
1780
1781 return 0;
1782}
1783
Linus Torvalds1da177e2005-04-16 15:20:36 -07001784/* Check whether a task can create a file. */
1785static int may_create(struct inode *dir,
1786 struct dentry *dentry,
1787 u16 tclass)
1788{
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07001789 const struct task_security_struct *tsec = selinux_cred(current_cred());
Linus Torvalds1da177e2005-04-16 15:20:36 -07001790 struct inode_security_struct *dsec;
1791 struct superblock_security_struct *sbsec;
David Howells275bb412008-11-14 10:39:19 +11001792 u32 sid, newsid;
Thomas Liu2bf49692009-07-14 12:14:09 -04001793 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001794 int rc;
1795
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001796 dsec = inode_security(dir);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001797 sbsec = dir->i_sb->s_security;
1798
David Howells275bb412008-11-14 10:39:19 +11001799 sid = tsec->sid;
David Howells275bb412008-11-14 10:39:19 +11001800
Eric Paris50c205f2012-04-04 15:01:43 -04001801 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04001802 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001803
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001804 rc = avc_has_perm(&selinux_state,
1805 sid, dsec->sid, SECCLASS_DIR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001806 DIR__ADD_NAME | DIR__SEARCH,
1807 &ad);
1808 if (rc)
1809 return rc;
1810
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07001811 rc = selinux_determine_inode_label(selinux_cred(current_cred()), dir,
Vivek Goyalc957f6d2016-07-13 10:44:51 -04001812 &dentry->d_name, tclass, &newsid);
David Howellsc3c188b2015-07-10 17:19:58 -04001813 if (rc)
1814 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001815
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001816 rc = avc_has_perm(&selinux_state,
1817 sid, newsid, tclass, FILE__CREATE, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001818 if (rc)
1819 return rc;
1820
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001821 return avc_has_perm(&selinux_state,
1822 newsid, sbsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001823 SECCLASS_FILESYSTEM,
1824 FILESYSTEM__ASSOCIATE, &ad);
1825}
1826
Eric Paris828dfe12008-04-17 13:17:49 -04001827#define MAY_LINK 0
1828#define MAY_UNLINK 1
1829#define MAY_RMDIR 2
Linus Torvalds1da177e2005-04-16 15:20:36 -07001830
1831/* Check whether a task can link, unlink, or rmdir a file/directory. */
1832static int may_link(struct inode *dir,
1833 struct dentry *dentry,
1834 int kind)
1835
1836{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001837 struct inode_security_struct *dsec, *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04001838 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11001839 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001840 u32 av;
1841 int rc;
1842
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001843 dsec = inode_security(dir);
1844 isec = backing_inode_security(dentry);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001845
Eric Paris50c205f2012-04-04 15:01:43 -04001846 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04001847 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001848
1849 av = DIR__SEARCH;
1850 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001851 rc = avc_has_perm(&selinux_state,
1852 sid, dsec->sid, SECCLASS_DIR, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001853 if (rc)
1854 return rc;
1855
1856 switch (kind) {
1857 case MAY_LINK:
1858 av = FILE__LINK;
1859 break;
1860 case MAY_UNLINK:
1861 av = FILE__UNLINK;
1862 break;
1863 case MAY_RMDIR:
1864 av = DIR__RMDIR;
1865 break;
1866 default:
peter enderborgc103a912018-06-12 10:09:03 +02001867 pr_warn("SELinux: %s: unrecognized kind %d\n",
Eric Paris744ba352008-04-17 11:52:44 -04001868 __func__, kind);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001869 return 0;
1870 }
1871
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001872 rc = avc_has_perm(&selinux_state,
1873 sid, isec->sid, isec->sclass, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001874 return rc;
1875}
1876
1877static inline int may_rename(struct inode *old_dir,
1878 struct dentry *old_dentry,
1879 struct inode *new_dir,
1880 struct dentry *new_dentry)
1881{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001882 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04001883 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11001884 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001885 u32 av;
1886 int old_is_dir, new_is_dir;
1887 int rc;
1888
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001889 old_dsec = inode_security(old_dir);
1890 old_isec = backing_inode_security(old_dentry);
David Howellse36cb0b2015-01-29 12:02:35 +00001891 old_is_dir = d_is_dir(old_dentry);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001892 new_dsec = inode_security(new_dir);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001893
Eric Paris50c205f2012-04-04 15:01:43 -04001894 ad.type = LSM_AUDIT_DATA_DENTRY;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001895
Eric Parisa2694342011-04-25 13:10:27 -04001896 ad.u.dentry = old_dentry;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001897 rc = avc_has_perm(&selinux_state,
1898 sid, old_dsec->sid, SECCLASS_DIR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001899 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1900 if (rc)
1901 return rc;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001902 rc = avc_has_perm(&selinux_state,
1903 sid, old_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001904 old_isec->sclass, FILE__RENAME, &ad);
1905 if (rc)
1906 return rc;
1907 if (old_is_dir && new_dir != old_dir) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001908 rc = avc_has_perm(&selinux_state,
1909 sid, old_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001910 old_isec->sclass, DIR__REPARENT, &ad);
1911 if (rc)
1912 return rc;
1913 }
1914
Eric Parisa2694342011-04-25 13:10:27 -04001915 ad.u.dentry = new_dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001916 av = DIR__ADD_NAME | DIR__SEARCH;
David Howells2c616d42015-01-29 12:02:33 +00001917 if (d_is_positive(new_dentry))
Linus Torvalds1da177e2005-04-16 15:20:36 -07001918 av |= DIR__REMOVE_NAME;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001919 rc = avc_has_perm(&selinux_state,
1920 sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001921 if (rc)
1922 return rc;
David Howells2c616d42015-01-29 12:02:33 +00001923 if (d_is_positive(new_dentry)) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001924 new_isec = backing_inode_security(new_dentry);
David Howellse36cb0b2015-01-29 12:02:35 +00001925 new_is_dir = d_is_dir(new_dentry);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001926 rc = avc_has_perm(&selinux_state,
1927 sid, new_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001928 new_isec->sclass,
1929 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1930 if (rc)
1931 return rc;
1932 }
1933
1934 return 0;
1935}
1936
1937/* Check whether a task can perform a filesystem operation. */
David Howells88e67f32008-11-14 10:39:21 +11001938static int superblock_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001939 struct super_block *sb,
1940 u32 perms,
Thomas Liu2bf49692009-07-14 12:14:09 -04001941 struct common_audit_data *ad)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001942{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001943 struct superblock_security_struct *sbsec;
David Howells88e67f32008-11-14 10:39:21 +11001944 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001945
Linus Torvalds1da177e2005-04-16 15:20:36 -07001946 sbsec = sb->s_security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001947 return avc_has_perm(&selinux_state,
1948 sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001949}
1950
1951/* Convert a Linux mode and permission mask to an access vector. */
1952static inline u32 file_mask_to_av(int mode, int mask)
1953{
1954 u32 av = 0;
1955
Al Virodba19c62011-07-25 20:49:29 -04001956 if (!S_ISDIR(mode)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001957 if (mask & MAY_EXEC)
1958 av |= FILE__EXECUTE;
1959 if (mask & MAY_READ)
1960 av |= FILE__READ;
1961
1962 if (mask & MAY_APPEND)
1963 av |= FILE__APPEND;
1964 else if (mask & MAY_WRITE)
1965 av |= FILE__WRITE;
1966
1967 } else {
1968 if (mask & MAY_EXEC)
1969 av |= DIR__SEARCH;
1970 if (mask & MAY_WRITE)
1971 av |= DIR__WRITE;
1972 if (mask & MAY_READ)
1973 av |= DIR__READ;
1974 }
1975
1976 return av;
1977}
1978
1979/* Convert a Linux file to an access vector. */
1980static inline u32 file_to_av(struct file *file)
1981{
1982 u32 av = 0;
1983
1984 if (file->f_mode & FMODE_READ)
1985 av |= FILE__READ;
1986 if (file->f_mode & FMODE_WRITE) {
1987 if (file->f_flags & O_APPEND)
1988 av |= FILE__APPEND;
1989 else
1990 av |= FILE__WRITE;
1991 }
Stephen Smalley0794c662008-03-17 08:55:18 -04001992 if (!av) {
1993 /*
1994 * Special file opened with flags 3 for ioctl-only use.
1995 */
1996 av = FILE__IOCTL;
1997 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001998
1999 return av;
2000}
2001
Eric Paris8b6a5a32008-10-29 17:06:46 -04002002/*
2003 * Convert a file to an access vector and include the correct open
2004 * open permission.
2005 */
2006static inline u32 open_file_to_av(struct file *file)
2007{
2008 u32 av = file_to_av(file);
Stephen Smalleyccb54472017-05-12 12:41:24 -04002009 struct inode *inode = file_inode(file);
Eric Paris8b6a5a32008-10-29 17:06:46 -04002010
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002011 if (selinux_policycap_openperm() &&
2012 inode->i_sb->s_magic != SOCKFS_MAGIC)
Eric Paris49b7b8d2010-07-23 11:44:09 -04002013 av |= FILE__OPEN;
2014
Eric Paris8b6a5a32008-10-29 17:06:46 -04002015 return av;
2016}
2017
Linus Torvalds1da177e2005-04-16 15:20:36 -07002018/* Hook functions begin here. */
2019
Stephen Smalley79af7302015-01-21 10:54:10 -05002020static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2021{
2022 u32 mysid = current_sid();
2023 u32 mgrsid = task_sid(mgr);
2024
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002025 return avc_has_perm(&selinux_state,
2026 mysid, mgrsid, SECCLASS_BINDER,
Stephen Smalley79af7302015-01-21 10:54:10 -05002027 BINDER__SET_CONTEXT_MGR, NULL);
2028}
2029
2030static int selinux_binder_transaction(struct task_struct *from,
2031 struct task_struct *to)
2032{
2033 u32 mysid = current_sid();
2034 u32 fromsid = task_sid(from);
2035 u32 tosid = task_sid(to);
2036 int rc;
2037
2038 if (mysid != fromsid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002039 rc = avc_has_perm(&selinux_state,
2040 mysid, fromsid, SECCLASS_BINDER,
Stephen Smalley79af7302015-01-21 10:54:10 -05002041 BINDER__IMPERSONATE, NULL);
2042 if (rc)
2043 return rc;
2044 }
2045
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002046 return avc_has_perm(&selinux_state,
2047 fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
Stephen Smalley79af7302015-01-21 10:54:10 -05002048 NULL);
2049}
2050
2051static int selinux_binder_transfer_binder(struct task_struct *from,
2052 struct task_struct *to)
2053{
2054 u32 fromsid = task_sid(from);
2055 u32 tosid = task_sid(to);
2056
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002057 return avc_has_perm(&selinux_state,
2058 fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
Stephen Smalley79af7302015-01-21 10:54:10 -05002059 NULL);
2060}
2061
2062static int selinux_binder_transfer_file(struct task_struct *from,
2063 struct task_struct *to,
2064 struct file *file)
2065{
2066 u32 sid = task_sid(to);
Casey Schauflerbb6c6b02018-09-21 17:22:32 -07002067 struct file_security_struct *fsec = selinux_file(file);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002068 struct dentry *dentry = file->f_path.dentry;
Paul Moore20cdef82016-04-04 14:14:42 -04002069 struct inode_security_struct *isec;
Stephen Smalley79af7302015-01-21 10:54:10 -05002070 struct common_audit_data ad;
2071 int rc;
2072
2073 ad.type = LSM_AUDIT_DATA_PATH;
2074 ad.u.path = file->f_path;
2075
2076 if (sid != fsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002077 rc = avc_has_perm(&selinux_state,
2078 sid, fsec->sid,
Stephen Smalley79af7302015-01-21 10:54:10 -05002079 SECCLASS_FD,
2080 FD__USE,
2081 &ad);
2082 if (rc)
2083 return rc;
2084 }
2085
Chenbo Fengf66e4482017-10-18 13:00:26 -07002086#ifdef CONFIG_BPF_SYSCALL
2087 rc = bpf_fd_pass(file, sid);
2088 if (rc)
2089 return rc;
2090#endif
2091
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002092 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
Stephen Smalley79af7302015-01-21 10:54:10 -05002093 return 0;
2094
Paul Moore20cdef82016-04-04 14:14:42 -04002095 isec = backing_inode_security(dentry);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002096 return avc_has_perm(&selinux_state,
2097 sid, isec->sid, isec->sclass, file_to_av(file),
Stephen Smalley79af7302015-01-21 10:54:10 -05002098 &ad);
2099}
2100
Ingo Molnar9e488582009-05-07 19:26:19 +10002101static int selinux_ptrace_access_check(struct task_struct *child,
David Howells5cd9c582008-08-14 11:37:28 +01002102 unsigned int mode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002103{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002104 u32 sid = current_sid();
2105 u32 csid = task_sid(child);
Stephen Smalley006ebb42008-05-19 08:32:49 -04002106
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002107 if (mode & PTRACE_MODE_READ)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002108 return avc_has_perm(&selinux_state,
2109 sid, csid, SECCLASS_FILE, FILE__READ, NULL);
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002110
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002111 return avc_has_perm(&selinux_state,
2112 sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
David Howells5cd9c582008-08-14 11:37:28 +01002113}
2114
2115static int selinux_ptrace_traceme(struct task_struct *parent)
2116{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002117 return avc_has_perm(&selinux_state,
2118 task_sid(parent), current_sid(), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002119 PROCESS__PTRACE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002120}
2121
2122static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
Eric Paris828dfe12008-04-17 13:17:49 -04002123 kernel_cap_t *inheritable, kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002124{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002125 return avc_has_perm(&selinux_state,
2126 current_sid(), task_sid(target), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002127 PROCESS__GETCAP, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002128}
2129
David Howellsd84f4f92008-11-14 10:39:23 +11002130static int selinux_capset(struct cred *new, const struct cred *old,
2131 const kernel_cap_t *effective,
2132 const kernel_cap_t *inheritable,
2133 const kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002134{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002135 return avc_has_perm(&selinux_state,
2136 cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002137 PROCESS__SETCAP, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002138}
2139
James Morris5626d3e2009-01-30 10:05:06 +11002140/*
2141 * (This comment used to live with the selinux_task_setuid hook,
2142 * which was removed).
2143 *
2144 * Since setuid only affects the current process, and since the SELinux
2145 * controls are not based on the Linux identity attributes, SELinux does not
2146 * need to control this operation. However, SELinux does control the use of
2147 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2148 */
2149
Eric Paris6a9de492012-01-03 12:25:14 -05002150static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2151 int cap, int audit)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002152{
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04002153 return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002154}
2155
Linus Torvalds1da177e2005-04-16 15:20:36 -07002156static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2157{
David Howells88e67f32008-11-14 10:39:21 +11002158 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002159 int rc = 0;
2160
2161 if (!sb)
2162 return 0;
2163
2164 switch (cmds) {
Eric Paris828dfe12008-04-17 13:17:49 -04002165 case Q_SYNC:
2166 case Q_QUOTAON:
2167 case Q_QUOTAOFF:
2168 case Q_SETINFO:
2169 case Q_SETQUOTA:
David Howells88e67f32008-11-14 10:39:21 +11002170 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04002171 break;
2172 case Q_GETFMT:
2173 case Q_GETINFO:
2174 case Q_GETQUOTA:
David Howells88e67f32008-11-14 10:39:21 +11002175 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04002176 break;
2177 default:
2178 rc = 0; /* let the kernel handle invalid cmds */
2179 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002180 }
2181 return rc;
2182}
2183
2184static int selinux_quota_on(struct dentry *dentry)
2185{
David Howells88e67f32008-11-14 10:39:21 +11002186 const struct cred *cred = current_cred();
2187
Eric Paris2875fa02011-04-28 16:04:24 -04002188 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002189}
2190
Eric Paris12b30522010-11-15 18:36:29 -05002191static int selinux_syslog(int type)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002192{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002193 switch (type) {
Kees Cookd78ca3c2010-02-03 15:37:13 -08002194 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2195 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002196 return avc_has_perm(&selinux_state,
2197 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002198 SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
Kees Cookd78ca3c2010-02-03 15:37:13 -08002199 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2200 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2201 /* Set level of messages printed to console */
2202 case SYSLOG_ACTION_CONSOLE_LEVEL:
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002203 return avc_has_perm(&selinux_state,
2204 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002205 SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2206 NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002207 }
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002208 /* All other syslog types */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002209 return avc_has_perm(&selinux_state,
2210 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002211 SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002212}
2213
2214/*
2215 * Check that a process has enough memory to allocate a new virtual
2216 * mapping. 0 means there is enough memory for the allocation to
2217 * succeed and -ENOMEM implies there is not.
2218 *
Linus Torvalds1da177e2005-04-16 15:20:36 -07002219 * Do not audit the selinux permission check, as this is applied to all
2220 * processes that allocate mappings.
2221 */
Alan Cox34b4e4a2007-08-22 14:01:28 -07002222static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002223{
2224 int rc, cap_sys_admin = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002225
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07002226 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04002227 SECURITY_CAP_NOAUDIT, true);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002228 if (rc == 0)
2229 cap_sys_admin = 1;
2230
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07002231 return cap_sys_admin;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002232}
2233
2234/* binprm security operations */
2235
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002236static u32 ptrace_parent_sid(void)
Paul Moore0c6181c2016-03-30 21:41:21 -04002237{
2238 u32 sid = 0;
2239 struct task_struct *tracer;
2240
2241 rcu_read_lock();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002242 tracer = ptrace_parent(current);
Paul Moore0c6181c2016-03-30 21:41:21 -04002243 if (tracer)
2244 sid = task_sid(tracer);
2245 rcu_read_unlock();
2246
2247 return sid;
2248}
2249
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002250static int check_nnp_nosuid(const struct linux_binprm *bprm,
2251 const struct task_security_struct *old_tsec,
2252 const struct task_security_struct *new_tsec)
2253{
2254 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
Andy Lutomirski380cf5b2016-06-23 16:41:05 -05002255 int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002256 int rc;
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002257 u32 av;
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002258
2259 if (!nnp && !nosuid)
2260 return 0; /* neither NNP nor nosuid */
2261
2262 if (new_tsec->sid == old_tsec->sid)
2263 return 0; /* No change in credentials */
2264
2265 /*
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002266 * If the policy enables the nnp_nosuid_transition policy capability,
2267 * then we permit transitions under NNP or nosuid if the
2268 * policy allows the corresponding permission between
2269 * the old and new contexts.
2270 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002271 if (selinux_policycap_nnp_nosuid_transition()) {
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002272 av = 0;
2273 if (nnp)
2274 av |= PROCESS2__NNP_TRANSITION;
2275 if (nosuid)
2276 av |= PROCESS2__NOSUID_TRANSITION;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002277 rc = avc_has_perm(&selinux_state,
2278 old_tsec->sid, new_tsec->sid,
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002279 SECCLASS_PROCESS2, av, NULL);
2280 if (!rc)
2281 return 0;
2282 }
2283
2284 /*
2285 * We also permit NNP or nosuid transitions to bounded SIDs,
2286 * i.e. SIDs that are guaranteed to only be allowed a subset
2287 * of the permissions of the current SID.
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002288 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002289 rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2290 new_tsec->sid);
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002291 if (!rc)
2292 return 0;
2293
2294 /*
2295 * On failure, preserve the errno values for NNP vs nosuid.
2296 * NNP: Operation not permitted for caller.
2297 * nosuid: Permission denied to file.
2298 */
2299 if (nnp)
2300 return -EPERM;
2301 return -EACCES;
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002302}
2303
David Howellsa6f76f22008-11-14 10:39:24 +11002304static int selinux_bprm_set_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002305{
David Howellsa6f76f22008-11-14 10:39:24 +11002306 const struct task_security_struct *old_tsec;
2307 struct task_security_struct *new_tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002308 struct inode_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04002309 struct common_audit_data ad;
Al Viro496ad9a2013-01-23 17:07:38 -05002310 struct inode *inode = file_inode(bprm->file);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002311 int rc;
2312
David Howellsa6f76f22008-11-14 10:39:24 +11002313 /* SELinux context only depends on initial program or script and not
2314 * the script interpreter */
Kees Cookddb4a142017-07-18 15:25:23 -07002315 if (bprm->called_set_creds)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002316 return 0;
2317
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07002318 old_tsec = selinux_cred(current_cred());
2319 new_tsec = selinux_cred(bprm->cred);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002320 isec = inode_security(inode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002321
2322 /* Default to the current task SID. */
David Howellsa6f76f22008-11-14 10:39:24 +11002323 new_tsec->sid = old_tsec->sid;
2324 new_tsec->osid = old_tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002325
Michael LeMay28eba5b2006-06-27 02:53:42 -07002326 /* Reset fs, key, and sock SIDs on execve. */
David Howellsa6f76f22008-11-14 10:39:24 +11002327 new_tsec->create_sid = 0;
2328 new_tsec->keycreate_sid = 0;
2329 new_tsec->sockcreate_sid = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002330
David Howellsa6f76f22008-11-14 10:39:24 +11002331 if (old_tsec->exec_sid) {
2332 new_tsec->sid = old_tsec->exec_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002333 /* Reset exec SID on execve. */
David Howellsa6f76f22008-11-14 10:39:24 +11002334 new_tsec->exec_sid = 0;
Andy Lutomirski259e5e62012-04-12 16:47:50 -05002335
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002336 /* Fail on NNP or nosuid if not an allowed transition. */
2337 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2338 if (rc)
2339 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002340 } else {
2341 /* Check for a default transition on this program. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002342 rc = security_transition_sid(&selinux_state, old_tsec->sid,
2343 isec->sid, SECCLASS_PROCESS, NULL,
Eric Paris652bb9b2011-02-01 11:05:40 -05002344 &new_tsec->sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002345 if (rc)
2346 return rc;
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002347
2348 /*
2349 * Fallback to old SID on NNP or nosuid if not an allowed
2350 * transition.
2351 */
2352 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2353 if (rc)
2354 new_tsec->sid = old_tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002355 }
2356
Vivek Goyal43af5de2016-09-09 11:37:49 -04002357 ad.type = LSM_AUDIT_DATA_FILE;
2358 ad.u.file = bprm->file;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002359
David Howellsa6f76f22008-11-14 10:39:24 +11002360 if (new_tsec->sid == old_tsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002361 rc = avc_has_perm(&selinux_state,
2362 old_tsec->sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002363 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2364 if (rc)
2365 return rc;
2366 } else {
2367 /* Check permissions for the transition. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002368 rc = avc_has_perm(&selinux_state,
2369 old_tsec->sid, new_tsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002370 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2371 if (rc)
2372 return rc;
2373
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002374 rc = avc_has_perm(&selinux_state,
2375 new_tsec->sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002376 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2377 if (rc)
2378 return rc;
2379
David Howellsa6f76f22008-11-14 10:39:24 +11002380 /* Check for shared state */
2381 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002382 rc = avc_has_perm(&selinux_state,
2383 old_tsec->sid, new_tsec->sid,
David Howellsa6f76f22008-11-14 10:39:24 +11002384 SECCLASS_PROCESS, PROCESS__SHARE,
2385 NULL);
2386 if (rc)
2387 return -EPERM;
2388 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002389
David Howellsa6f76f22008-11-14 10:39:24 +11002390 /* Make sure that anyone attempting to ptrace over a task that
2391 * changes its SID has the appropriate permit */
Eric W. Biederman9227dd22017-01-23 17:26:31 +13002392 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002393 u32 ptsid = ptrace_parent_sid();
David Howellsa6f76f22008-11-14 10:39:24 +11002394 if (ptsid != 0) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002395 rc = avc_has_perm(&selinux_state,
2396 ptsid, new_tsec->sid,
David Howellsa6f76f22008-11-14 10:39:24 +11002397 SECCLASS_PROCESS,
2398 PROCESS__PTRACE, NULL);
2399 if (rc)
2400 return -EPERM;
2401 }
2402 }
2403
2404 /* Clear any possibly unsafe personality bits on exec: */
2405 bprm->per_clear |= PER_CLEAR_ON_SETID;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002406
Linus Torvalds1da177e2005-04-16 15:20:36 -07002407 /* Enable secure mode for SIDs transitions unless
2408 the noatsecure permission is granted between
2409 the two SIDs, i.e. ahp returns 0. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002410 rc = avc_has_perm(&selinux_state,
2411 old_tsec->sid, new_tsec->sid,
Kees Cook62874c32017-07-18 15:25:25 -07002412 SECCLASS_PROCESS, PROCESS__NOATSECURE,
2413 NULL);
2414 bprm->secureexec |= !!rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002415 }
2416
Kees Cook62874c32017-07-18 15:25:25 -07002417 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002418}
2419
Al Viroc3c073f2012-08-21 22:32:06 -04002420static int match_file(const void *p, struct file *file, unsigned fd)
2421{
2422 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2423}
2424
Linus Torvalds1da177e2005-04-16 15:20:36 -07002425/* Derived from fs/exec.c:flush_old_files. */
David Howells745ca242008-11-14 10:39:22 +11002426static inline void flush_unauthorized_files(const struct cred *cred,
2427 struct files_struct *files)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002428{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002429 struct file *file, *devnull = NULL;
Stephen Smalleyb20c8122006-09-25 23:32:03 -07002430 struct tty_struct *tty;
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002431 int drop_tty = 0;
Al Viroc3c073f2012-08-21 22:32:06 -04002432 unsigned n;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002433
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002434 tty = get_current_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002435 if (tty) {
Peter Hurley4a510962016-01-09 21:35:23 -08002436 spin_lock(&tty->files_lock);
Eric Paris37dd0bd2008-10-31 17:40:00 -04002437 if (!list_empty(&tty->tty_files)) {
Nick Piggind996b622010-08-18 04:37:36 +10002438 struct tty_file_private *file_priv;
Eric Paris37dd0bd2008-10-31 17:40:00 -04002439
Linus Torvalds1da177e2005-04-16 15:20:36 -07002440 /* Revalidate access to controlling tty.
David Howells13f8e982013-06-13 23:37:55 +01002441 Use file_path_has_perm on the tty path directly
2442 rather than using file_has_perm, as this particular
2443 open file may belong to another process and we are
2444 only interested in the inode-based check here. */
Nick Piggind996b622010-08-18 04:37:36 +10002445 file_priv = list_first_entry(&tty->tty_files,
2446 struct tty_file_private, list);
2447 file = file_priv->file;
David Howells13f8e982013-06-13 23:37:55 +01002448 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002449 drop_tty = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002450 }
Peter Hurley4a510962016-01-09 21:35:23 -08002451 spin_unlock(&tty->files_lock);
Alan Cox452a00d2008-10-13 10:39:13 +01002452 tty_kref_put(tty);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002453 }
Eric W. Biederman98a27ba2007-05-08 00:26:56 -07002454 /* Reset controlling tty. */
2455 if (drop_tty)
2456 no_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002457
2458 /* Revalidate access to inherited open files. */
Al Viroc3c073f2012-08-21 22:32:06 -04002459 n = iterate_fd(files, 0, match_file, cred);
2460 if (!n) /* none found? */
2461 return;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002462
Al Viroc3c073f2012-08-21 22:32:06 -04002463 devnull = dentry_open(&selinux_null, O_RDWR, cred);
Al Viro45525b22012-10-16 13:30:07 -04002464 if (IS_ERR(devnull))
2465 devnull = NULL;
2466 /* replace all the matching ones with this */
2467 do {
2468 replace_fd(n - 1, devnull, 0);
2469 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2470 if (devnull)
Al Viroc3c073f2012-08-21 22:32:06 -04002471 fput(devnull);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002472}
2473
Linus Torvalds1da177e2005-04-16 15:20:36 -07002474/*
David Howellsa6f76f22008-11-14 10:39:24 +11002475 * Prepare a process for imminent new credential changes due to exec
Linus Torvalds1da177e2005-04-16 15:20:36 -07002476 */
David Howellsa6f76f22008-11-14 10:39:24 +11002477static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002478{
David Howellsa6f76f22008-11-14 10:39:24 +11002479 struct task_security_struct *new_tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002480 struct rlimit *rlim, *initrlim;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002481 int rc, i;
2482
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07002483 new_tsec = selinux_cred(bprm->cred);
David Howellsa6f76f22008-11-14 10:39:24 +11002484 if (new_tsec->sid == new_tsec->osid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002485 return;
2486
2487 /* Close files for which the new task SID is not authorized. */
David Howellsa6f76f22008-11-14 10:39:24 +11002488 flush_unauthorized_files(bprm->cred, current->files);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002489
David Howellsa6f76f22008-11-14 10:39:24 +11002490 /* Always clear parent death signal on SID transitions. */
2491 current->pdeath_signal = 0;
2492
2493 /* Check whether the new SID can inherit resource limits from the old
2494 * SID. If not, reset all soft limits to the lower of the current
2495 * task's hard limit and the init task's soft limit.
2496 *
2497 * Note that the setting of hard limits (even to lower them) can be
2498 * controlled by the setrlimit check. The inclusion of the init task's
2499 * soft limit into the computation is to avoid resetting soft limits
2500 * higher than the default soft limit for cases where the default is
2501 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2502 */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002503 rc = avc_has_perm(&selinux_state,
2504 new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
David Howellsa6f76f22008-11-14 10:39:24 +11002505 PROCESS__RLIMITINH, NULL);
2506 if (rc) {
Oleg Nesteroveb2d55a2010-06-23 22:43:32 +02002507 /* protect against do_prlimit() */
2508 task_lock(current);
David Howellsa6f76f22008-11-14 10:39:24 +11002509 for (i = 0; i < RLIM_NLIMITS; i++) {
2510 rlim = current->signal->rlim + i;
2511 initrlim = init_task.signal->rlim + i;
2512 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2513 }
Oleg Nesteroveb2d55a2010-06-23 22:43:32 +02002514 task_unlock(current);
Nicolas Pitrebaa73d92016-11-11 00:10:10 -05002515 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2516 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
David Howellsa6f76f22008-11-14 10:39:24 +11002517 }
2518}
2519
2520/*
2521 * Clean up the process immediately after the installation of new credentials
2522 * due to exec
2523 */
2524static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2525{
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07002526 const struct task_security_struct *tsec = selinux_cred(current_cred());
David Howellsa6f76f22008-11-14 10:39:24 +11002527 struct itimerval itimer;
David Howellsa6f76f22008-11-14 10:39:24 +11002528 u32 osid, sid;
2529 int rc, i;
David Howellsa6f76f22008-11-14 10:39:24 +11002530
David Howellsa6f76f22008-11-14 10:39:24 +11002531 osid = tsec->osid;
2532 sid = tsec->sid;
2533
2534 if (sid == osid)
2535 return;
2536
2537 /* Check whether the new SID can inherit signal state from the old SID.
2538 * If not, clear itimers to avoid subsequent signal generation and
2539 * flush and unblock signals.
2540 *
2541 * This must occur _after_ the task SID has been updated so that any
2542 * kill done after the flush will be checked against the new SID.
2543 */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002544 rc = avc_has_perm(&selinux_state,
2545 osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002546 if (rc) {
Nicolas Pitrebaa73d92016-11-11 00:10:10 -05002547 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) {
2548 memset(&itimer, 0, sizeof itimer);
2549 for (i = 0; i < 3; i++)
2550 do_setitimer(i, &itimer, NULL);
2551 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002552 spin_lock_irq(&current->sighand->siglock);
Oleg Nesterov9e7c8f82015-06-04 16:22:16 -04002553 if (!fatal_signal_pending(current)) {
2554 flush_sigqueue(&current->pending);
2555 flush_sigqueue(&current->signal->shared_pending);
David Howells3bcac022009-04-29 13:45:05 +01002556 flush_signal_handlers(current, 1);
2557 sigemptyset(&current->blocked);
Oleg Nesterov9e7c8f82015-06-04 16:22:16 -04002558 recalc_sigpending();
David Howells3bcac022009-04-29 13:45:05 +01002559 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002560 spin_unlock_irq(&current->sighand->siglock);
2561 }
2562
David Howellsa6f76f22008-11-14 10:39:24 +11002563 /* Wake up the parent if it is waiting so that it can recheck
2564 * wait permission to the new task SID. */
Oleg Nesterovecd6de32009-04-29 16:02:24 +02002565 read_lock(&tasklist_lock);
Oleg Nesterov0b7570e2009-09-23 15:56:46 -07002566 __wake_up_parent(current, current->real_parent);
Oleg Nesterovecd6de32009-04-29 16:02:24 +02002567 read_unlock(&tasklist_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002568}
2569
2570/* superblock security operations */
2571
2572static int selinux_sb_alloc_security(struct super_block *sb)
2573{
2574 return superblock_alloc_security(sb);
2575}
2576
2577static void selinux_sb_free_security(struct super_block *sb)
2578{
2579 superblock_free_security(sb);
2580}
2581
Al Viro99dbbb52018-12-14 21:56:23 -05002582static inline int opt_len(const char *s)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002583{
Al Viro99dbbb52018-12-14 21:56:23 -05002584 bool open_quote = false;
2585 int len;
2586 char c;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002587
Al Viro99dbbb52018-12-14 21:56:23 -05002588 for (len = 0; (c = s[len]) != '\0'; len++) {
2589 if (c == '"')
Cory Olmo3528a952006-09-29 01:58:44 -07002590 open_quote = !open_quote;
Al Viro99dbbb52018-12-14 21:56:23 -05002591 if (c == ',' && !open_quote)
2592 break;
2593 }
2594 return len;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002595}
2596
Al Viro204cc0c2018-12-13 13:41:47 -05002597static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
Eric Paris026eb162011-03-03 16:09:14 -05002598{
Al Viro99dbbb52018-12-14 21:56:23 -05002599 char *from = options;
2600 char *to = options;
2601 bool first = true;
Al Viro5b400232018-12-12 20:13:29 -05002602
Al Viro99dbbb52018-12-14 21:56:23 -05002603 while (1) {
2604 int len = opt_len(from);
2605 int token, rc;
2606 char *arg = NULL;
2607
2608 token = match_opt_prefix(from, len, &arg);
2609
2610 if (token != Opt_error) {
2611 char *p, *q;
2612
2613 /* strip quotes */
2614 if (arg) {
2615 for (p = q = arg; p < from + len; p++) {
2616 char c = *p;
2617 if (c != '"')
2618 *q++ = c;
2619 }
2620 arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);
2621 }
2622 rc = selinux_add_opt(token, arg, mnt_opts);
2623 if (unlikely(rc)) {
2624 kfree(arg);
2625 if (*mnt_opts) {
2626 selinux_free_mnt_opts(*mnt_opts);
2627 *mnt_opts = NULL;
2628 }
2629 return rc;
2630 }
2631 } else {
2632 if (!first) { // copy with preceding comma
2633 from--;
2634 len++;
2635 }
2636 if (to != from)
2637 memmove(to, from, len);
2638 to += len;
2639 first = false;
2640 }
2641 if (!from[len])
2642 break;
2643 from += len + 1;
2644 }
2645 *to = '\0';
2646 return 0;
Al Viro5b400232018-12-12 20:13:29 -05002647}
2648
Al Viro204cc0c2018-12-13 13:41:47 -05002649static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
Eric Paris026eb162011-03-03 16:09:14 -05002650{
Al Virobd323652018-12-13 15:04:59 -05002651 struct selinux_mnt_opts *opts = mnt_opts;
Eric Paris026eb162011-03-03 16:09:14 -05002652 struct superblock_security_struct *sbsec = sb->s_security;
Al Virobd323652018-12-13 15:04:59 -05002653 u32 sid;
2654 int rc;
Eric Paris026eb162011-03-03 16:09:14 -05002655
2656 if (!(sbsec->flags & SE_SBINITIALIZED))
2657 return 0;
2658
Al Viro204cc0c2018-12-13 13:41:47 -05002659 if (!opts)
Eric Paris026eb162011-03-03 16:09:14 -05002660 return 0;
2661
Al Virobd323652018-12-13 15:04:59 -05002662 if (opts->fscontext) {
2663 rc = parse_sid(sb, opts->fscontext, &sid);
2664 if (rc)
Al Viroc039bc32018-12-01 23:06:57 -05002665 return rc;
Al Virobd323652018-12-13 15:04:59 -05002666 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2667 goto out_bad_option;
Eric Paris026eb162011-03-03 16:09:14 -05002668 }
Al Virobd323652018-12-13 15:04:59 -05002669 if (opts->context) {
2670 rc = parse_sid(sb, opts->context, &sid);
2671 if (rc)
2672 return rc;
2673 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2674 goto out_bad_option;
2675 }
2676 if (opts->rootcontext) {
2677 struct inode_security_struct *root_isec;
2678 root_isec = backing_inode_security(sb->s_root);
2679 rc = parse_sid(sb, opts->rootcontext, &sid);
2680 if (rc)
2681 return rc;
2682 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2683 goto out_bad_option;
2684 }
2685 if (opts->defcontext) {
2686 rc = parse_sid(sb, opts->defcontext, &sid);
2687 if (rc)
2688 return rc;
2689 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2690 goto out_bad_option;
Eric Paris026eb162011-03-03 16:09:14 -05002691 }
Al Viroc039bc32018-12-01 23:06:57 -05002692 return 0;
Eric Paris026eb162011-03-03 16:09:14 -05002693
Eric Paris026eb162011-03-03 16:09:14 -05002694out_bad_option:
peter enderborgc103a912018-06-12 10:09:03 +02002695 pr_warn("SELinux: unable to change security options "
Linus Torvalds29b1deb2013-12-15 11:17:45 -08002696 "during remount (dev %s, type=%s)\n", sb->s_id,
2697 sb->s_type->name);
Al Viroc039bc32018-12-01 23:06:57 -05002698 return -EINVAL;
Eric Paris026eb162011-03-03 16:09:14 -05002699}
2700
Al Viroa10d7c22018-12-05 11:58:35 -05002701static int selinux_sb_kern_mount(struct super_block *sb)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002702{
David Howells88e67f32008-11-14 10:39:21 +11002703 const struct cred *cred = current_cred();
Thomas Liu2bf49692009-07-14 12:14:09 -04002704 struct common_audit_data ad;
James Morris74192242008-12-19 11:41:10 +11002705
Eric Paris50c205f2012-04-04 15:01:43 -04002706 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04002707 ad.u.dentry = sb->s_root;
David Howells88e67f32008-11-14 10:39:21 +11002708 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002709}
2710
David Howells726c3342006-06-23 02:02:58 -07002711static int selinux_sb_statfs(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002712{
David Howells88e67f32008-11-14 10:39:21 +11002713 const struct cred *cred = current_cred();
Thomas Liu2bf49692009-07-14 12:14:09 -04002714 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002715
Eric Paris50c205f2012-04-04 15:01:43 -04002716 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04002717 ad.u.dentry = dentry->d_sb->s_root;
David Howells88e67f32008-11-14 10:39:21 +11002718 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002719}
2720
Al Viro808d4e32012-10-11 11:42:01 -04002721static int selinux_mount(const char *dev_name,
Al Viro8a04c432016-03-25 14:52:53 -04002722 const struct path *path,
Al Viro808d4e32012-10-11 11:42:01 -04002723 const char *type,
Eric Paris828dfe12008-04-17 13:17:49 -04002724 unsigned long flags,
2725 void *data)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002726{
David Howells88e67f32008-11-14 10:39:21 +11002727 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002728
2729 if (flags & MS_REMOUNT)
Al Virod8c95842011-12-07 18:16:57 -05002730 return superblock_has_perm(cred, path->dentry->d_sb,
Eric Paris828dfe12008-04-17 13:17:49 -04002731 FILESYSTEM__REMOUNT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002732 else
Eric Paris2875fa02011-04-28 16:04:24 -04002733 return path_has_perm(cred, path, FILE__MOUNTON);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002734}
2735
2736static int selinux_umount(struct vfsmount *mnt, int flags)
2737{
David Howells88e67f32008-11-14 10:39:21 +11002738 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002739
David Howells88e67f32008-11-14 10:39:21 +11002740 return superblock_has_perm(cred, mnt->mnt_sb,
Eric Paris828dfe12008-04-17 13:17:49 -04002741 FILESYSTEM__UNMOUNT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002742}
2743
2744/* inode security operations */
2745
2746static int selinux_inode_alloc_security(struct inode *inode)
2747{
2748 return inode_alloc_security(inode);
2749}
2750
2751static void selinux_inode_free_security(struct inode *inode)
2752{
2753 inode_free_security(inode);
2754}
2755
David Quigleyd47be3d2013-05-22 12:50:34 -04002756static int selinux_dentry_init_security(struct dentry *dentry, int mode,
Al Viro4f3ccd72016-07-20 16:06:15 -04002757 const struct qstr *name, void **ctx,
David Quigleyd47be3d2013-05-22 12:50:34 -04002758 u32 *ctxlen)
2759{
David Quigleyd47be3d2013-05-22 12:50:34 -04002760 u32 newsid;
2761 int rc;
2762
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07002763 rc = selinux_determine_inode_label(selinux_cred(current_cred()),
Vivek Goyalc957f6d2016-07-13 10:44:51 -04002764 d_inode(dentry->d_parent), name,
David Howellsc3c188b2015-07-10 17:19:58 -04002765 inode_mode_to_security_class(mode),
2766 &newsid);
2767 if (rc)
2768 return rc;
David Quigleyd47be3d2013-05-22 12:50:34 -04002769
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002770 return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
2771 ctxlen);
David Quigleyd47be3d2013-05-22 12:50:34 -04002772}
2773
Vivek Goyala518b0a2016-07-13 10:44:53 -04002774static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2775 struct qstr *name,
2776 const struct cred *old,
2777 struct cred *new)
2778{
2779 u32 newsid;
2780 int rc;
2781 struct task_security_struct *tsec;
2782
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07002783 rc = selinux_determine_inode_label(selinux_cred(old),
Vivek Goyala518b0a2016-07-13 10:44:53 -04002784 d_inode(dentry->d_parent), name,
2785 inode_mode_to_security_class(mode),
2786 &newsid);
2787 if (rc)
2788 return rc;
2789
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07002790 tsec = selinux_cred(new);
Vivek Goyala518b0a2016-07-13 10:44:53 -04002791 tsec->create_sid = newsid;
2792 return 0;
2793}
2794
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002795static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
Tetsuo Handa95489062013-07-25 05:44:02 +09002796 const struct qstr *qstr,
2797 const char **name,
Eric Paris2a7dba32011-02-01 11:05:39 -05002798 void **value, size_t *len)
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002799{
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07002800 const struct task_security_struct *tsec = selinux_cred(current_cred());
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002801 struct superblock_security_struct *sbsec;
Corentin LABBEc0d4f462017-10-04 20:32:17 +02002802 u32 newsid, clen;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002803 int rc;
Tetsuo Handa95489062013-07-25 05:44:02 +09002804 char *context;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002805
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002806 sbsec = dir->i_sb->s_security;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002807
David Howells275bb412008-11-14 10:39:19 +11002808 newsid = tsec->create_sid;
2809
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07002810 rc = selinux_determine_inode_label(selinux_cred(current_cred()),
David Howellsc3c188b2015-07-10 17:19:58 -04002811 dir, qstr,
2812 inode_mode_to_security_class(inode->i_mode),
2813 &newsid);
2814 if (rc)
2815 return rc;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002816
Eric Paris296fddf2006-09-25 23:32:00 -07002817 /* Possibly defer initialization to selinux_complete_init. */
David P. Quigley0d90a7e2009-01-16 09:22:02 -05002818 if (sbsec->flags & SE_SBINITIALIZED) {
Eric Paris296fddf2006-09-25 23:32:00 -07002819 struct inode_security_struct *isec = inode->i_security;
2820 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2821 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05002822 isec->initialized = LABEL_INITIALIZED;
Eric Paris296fddf2006-09-25 23:32:00 -07002823 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002824
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002825 if (!selinux_state.initialized || !(sbsec->flags & SBLABEL_MNT))
Stephen Smalley25a74f32005-11-08 21:34:33 -08002826 return -EOPNOTSUPP;
2827
Tetsuo Handa95489062013-07-25 05:44:02 +09002828 if (name)
2829 *name = XATTR_SELINUX_SUFFIX;
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002830
2831 if (value && len) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002832 rc = security_sid_to_context_force(&selinux_state, newsid,
2833 &context, &clen);
Tetsuo Handa95489062013-07-25 05:44:02 +09002834 if (rc)
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002835 return rc;
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002836 *value = context;
2837 *len = clen;
2838 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002839
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002840 return 0;
2841}
2842
Al Viro4acdaf22011-07-26 01:42:34 -04002843static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002844{
2845 return may_create(dir, dentry, SECCLASS_FILE);
2846}
2847
Linus Torvalds1da177e2005-04-16 15:20:36 -07002848static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2849{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002850 return may_link(dir, old_dentry, MAY_LINK);
2851}
2852
Linus Torvalds1da177e2005-04-16 15:20:36 -07002853static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2854{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002855 return may_link(dir, dentry, MAY_UNLINK);
2856}
2857
2858static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2859{
2860 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2861}
2862
Al Viro18bb1db2011-07-26 01:41:39 -04002863static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002864{
2865 return may_create(dir, dentry, SECCLASS_DIR);
2866}
2867
Linus Torvalds1da177e2005-04-16 15:20:36 -07002868static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2869{
2870 return may_link(dir, dentry, MAY_RMDIR);
2871}
2872
Al Viro1a67aaf2011-07-26 01:52:52 -04002873static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002874{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002875 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2876}
2877
Linus Torvalds1da177e2005-04-16 15:20:36 -07002878static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
Eric Paris828dfe12008-04-17 13:17:49 -04002879 struct inode *new_inode, struct dentry *new_dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002880{
2881 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2882}
2883
Linus Torvalds1da177e2005-04-16 15:20:36 -07002884static int selinux_inode_readlink(struct dentry *dentry)
2885{
David Howells88e67f32008-11-14 10:39:21 +11002886 const struct cred *cred = current_cred();
2887
Eric Paris2875fa02011-04-28 16:04:24 -04002888 return dentry_has_perm(cred, dentry, FILE__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002889}
2890
NeilBrownbda0be72015-03-23 13:37:39 +11002891static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2892 bool rcu)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002893{
David Howells88e67f32008-11-14 10:39:21 +11002894 const struct cred *cred = current_cred();
NeilBrownbda0be72015-03-23 13:37:39 +11002895 struct common_audit_data ad;
2896 struct inode_security_struct *isec;
2897 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002898
NeilBrownbda0be72015-03-23 13:37:39 +11002899 validate_creds(cred);
2900
2901 ad.type = LSM_AUDIT_DATA_DENTRY;
2902 ad.u.dentry = dentry;
2903 sid = cred_sid(cred);
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05002904 isec = inode_security_rcu(inode, rcu);
2905 if (IS_ERR(isec))
2906 return PTR_ERR(isec);
NeilBrownbda0be72015-03-23 13:37:39 +11002907
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002908 return avc_has_perm_flags(&selinux_state,
2909 sid, isec->sid, isec->sclass, FILE__READ, &ad,
NeilBrownbda0be72015-03-23 13:37:39 +11002910 rcu ? MAY_NOT_BLOCK : 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002911}
2912
Eric Parisd4cf970d2012-04-04 15:01:42 -04002913static noinline int audit_inode_permission(struct inode *inode,
2914 u32 perms, u32 audited, u32 denied,
Stephen Smalley626b9742014-04-29 11:29:04 -07002915 int result,
Eric Parisd4cf970d2012-04-04 15:01:42 -04002916 unsigned flags)
2917{
2918 struct common_audit_data ad;
Eric Parisd4cf970d2012-04-04 15:01:42 -04002919 struct inode_security_struct *isec = inode->i_security;
2920 int rc;
2921
Eric Paris50c205f2012-04-04 15:01:43 -04002922 ad.type = LSM_AUDIT_DATA_INODE;
Eric Parisd4cf970d2012-04-04 15:01:42 -04002923 ad.u.inode = inode;
2924
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002925 rc = slow_avc_audit(&selinux_state,
2926 current_sid(), isec->sid, isec->sclass, perms,
Stephen Smalley626b9742014-04-29 11:29:04 -07002927 audited, denied, result, &ad, flags);
Eric Parisd4cf970d2012-04-04 15:01:42 -04002928 if (rc)
2929 return rc;
2930 return 0;
2931}
2932
Al Viroe74f71e2011-06-20 19:38:15 -04002933static int selinux_inode_permission(struct inode *inode, int mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002934{
David Howells88e67f32008-11-14 10:39:21 +11002935 const struct cred *cred = current_cred();
Eric Parisb782e0a2010-07-23 11:44:03 -04002936 u32 perms;
2937 bool from_access;
Al Virocf1dd1d2011-06-20 19:44:08 -04002938 unsigned flags = mask & MAY_NOT_BLOCK;
Eric Paris2e334052012-04-04 15:01:42 -04002939 struct inode_security_struct *isec;
2940 u32 sid;
2941 struct av_decision avd;
2942 int rc, rc2;
2943 u32 audited, denied;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002944
Eric Parisb782e0a2010-07-23 11:44:03 -04002945 from_access = mask & MAY_ACCESS;
Eric Parisd09ca732010-07-23 11:43:57 -04002946 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2947
Eric Parisb782e0a2010-07-23 11:44:03 -04002948 /* No permission to check. Existence test. */
2949 if (!mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002950 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002951
Eric Paris2e334052012-04-04 15:01:42 -04002952 validate_creds(cred);
Eric Parisb782e0a2010-07-23 11:44:03 -04002953
Eric Paris2e334052012-04-04 15:01:42 -04002954 if (unlikely(IS_PRIVATE(inode)))
2955 return 0;
Eric Parisb782e0a2010-07-23 11:44:03 -04002956
2957 perms = file_mask_to_av(inode->i_mode, mask);
2958
Eric Paris2e334052012-04-04 15:01:42 -04002959 sid = cred_sid(cred);
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05002960 isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
2961 if (IS_ERR(isec))
2962 return PTR_ERR(isec);
Eric Paris2e334052012-04-04 15:01:42 -04002963
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002964 rc = avc_has_perm_noaudit(&selinux_state,
2965 sid, isec->sid, isec->sclass, perms, 0, &avd);
Eric Paris2e334052012-04-04 15:01:42 -04002966 audited = avc_audit_required(perms, &avd, rc,
2967 from_access ? FILE__AUDIT_ACCESS : 0,
2968 &denied);
2969 if (likely(!audited))
2970 return rc;
2971
Stephen Smalley626b9742014-04-29 11:29:04 -07002972 rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
Eric Paris2e334052012-04-04 15:01:42 -04002973 if (rc2)
2974 return rc2;
2975 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002976}
2977
2978static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2979{
David Howells88e67f32008-11-14 10:39:21 +11002980 const struct cred *cred = current_cred();
Stephen Smalleyccb54472017-05-12 12:41:24 -04002981 struct inode *inode = d_backing_inode(dentry);
Amerigo Wangbc6a6002009-08-20 19:29:02 -07002982 unsigned int ia_valid = iattr->ia_valid;
Eric Paris95dbf732012-04-04 13:45:34 -04002983 __u32 av = FILE__WRITE;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002984
Amerigo Wangbc6a6002009-08-20 19:29:02 -07002985 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2986 if (ia_valid & ATTR_FORCE) {
2987 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2988 ATTR_FORCE);
2989 if (!ia_valid)
2990 return 0;
2991 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002992
Amerigo Wangbc6a6002009-08-20 19:29:02 -07002993 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2994 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
Eric Paris2875fa02011-04-28 16:04:24 -04002995 return dentry_has_perm(cred, dentry, FILE__SETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002996
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002997 if (selinux_policycap_openperm() &&
Stephen Smalleyccb54472017-05-12 12:41:24 -04002998 inode->i_sb->s_magic != SOCKFS_MAGIC &&
2999 (ia_valid & ATTR_SIZE) &&
3000 !(ia_valid & ATTR_FILE))
Eric Paris95dbf732012-04-04 13:45:34 -04003001 av |= FILE__OPEN;
3002
3003 return dentry_has_perm(cred, dentry, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003004}
3005
Al Viro3f7036a2015-03-08 19:28:30 -04003006static int selinux_inode_getattr(const struct path *path)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003007{
Al Viro3f7036a2015-03-08 19:28:30 -04003008 return path_has_perm(current_cred(), path, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003009}
3010
Stephen Smalleydb590002017-04-20 11:31:30 -04003011static bool has_cap_mac_admin(bool audit)
3012{
3013 const struct cred *cred = current_cred();
3014 int cap_audit = audit ? SECURITY_CAP_AUDIT : SECURITY_CAP_NOAUDIT;
3015
3016 if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, cap_audit))
3017 return false;
3018 if (cred_has_capability(cred, CAP_MAC_ADMIN, cap_audit, true))
3019 return false;
3020 return true;
3021}
3022
David Howells8f0cfa52008-04-29 00:59:41 -07003023static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3024 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003025{
David Howellsc6f493d2015-03-17 22:26:22 +00003026 struct inode *inode = d_backing_inode(dentry);
Paul Moore20cdef82016-04-04 14:14:42 -04003027 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003028 struct superblock_security_struct *sbsec;
Thomas Liu2bf49692009-07-14 12:14:09 -04003029 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11003030 u32 newsid, sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003031 int rc = 0;
3032
Eric W. Biederman6b240302017-10-02 09:38:20 -05003033 if (strcmp(name, XATTR_NAME_SELINUX)) {
3034 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3035 if (rc)
3036 return rc;
3037
3038 /* Not an attribute we recognize, so just check the
3039 ordinary setattr permission. */
3040 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3041 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003042
3043 sbsec = inode->i_sb->s_security;
Eric Paris12f348b2012-10-09 10:56:25 -04003044 if (!(sbsec->flags & SBLABEL_MNT))
Linus Torvalds1da177e2005-04-16 15:20:36 -07003045 return -EOPNOTSUPP;
3046
Serge E. Hallyn2e149672011-03-23 16:43:26 -07003047 if (!inode_owner_or_capable(inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -07003048 return -EPERM;
3049
Eric Paris50c205f2012-04-04 15:01:43 -04003050 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04003051 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003052
Paul Moore20cdef82016-04-04 14:14:42 -04003053 isec = backing_inode_security(dentry);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003054 rc = avc_has_perm(&selinux_state,
3055 sid, isec->sid, isec->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003056 FILE__RELABELFROM, &ad);
3057 if (rc)
3058 return rc;
3059
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003060 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3061 GFP_KERNEL);
Stephen Smalley12b29f32008-05-07 13:03:20 -04003062 if (rc == -EINVAL) {
Stephen Smalleydb590002017-04-20 11:31:30 -04003063 if (!has_cap_mac_admin(true)) {
Eric Parisd6ea83e2012-04-04 13:45:49 -04003064 struct audit_buffer *ab;
3065 size_t audit_size;
Eric Parisd6ea83e2012-04-04 13:45:49 -04003066
3067 /* We strip a nul only if it is at the end, otherwise the
3068 * context contains a nul and we should audit that */
Al Viroe3fea3f2012-06-09 08:15:16 +01003069 if (value) {
Colin Ian Kingadd24372017-10-14 13:46:55 +01003070 const char *str = value;
3071
Al Viroe3fea3f2012-06-09 08:15:16 +01003072 if (str[size - 1] == '\0')
3073 audit_size = size - 1;
3074 else
3075 audit_size = size;
3076 } else {
Al Viroe3fea3f2012-06-09 08:15:16 +01003077 audit_size = 0;
3078 }
Richard Guy Briggscdfb6b32018-05-12 21:58:20 -04003079 ab = audit_log_start(audit_context(),
3080 GFP_ATOMIC, AUDIT_SELINUX_ERR);
Eric Parisd6ea83e2012-04-04 13:45:49 -04003081 audit_log_format(ab, "op=setxattr invalid_context=");
3082 audit_log_n_untrustedstring(ab, value, audit_size);
3083 audit_log_end(ab);
3084
Stephen Smalley12b29f32008-05-07 13:03:20 -04003085 return rc;
Eric Parisd6ea83e2012-04-04 13:45:49 -04003086 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003087 rc = security_context_to_sid_force(&selinux_state, value,
3088 size, &newsid);
Stephen Smalley12b29f32008-05-07 13:03:20 -04003089 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003090 if (rc)
3091 return rc;
3092
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003093 rc = avc_has_perm(&selinux_state,
3094 sid, newsid, isec->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003095 FILE__RELABELTO, &ad);
3096 if (rc)
3097 return rc;
3098
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003099 rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3100 sid, isec->sclass);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003101 if (rc)
3102 return rc;
3103
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003104 return avc_has_perm(&selinux_state,
3105 newsid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003106 sbsec->sid,
3107 SECCLASS_FILESYSTEM,
3108 FILESYSTEM__ASSOCIATE,
3109 &ad);
3110}
3111
David Howells8f0cfa52008-04-29 00:59:41 -07003112static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
Eric Parisf5269712008-05-14 11:27:45 -04003113 const void *value, size_t size,
David Howells8f0cfa52008-04-29 00:59:41 -07003114 int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003115{
David Howellsc6f493d2015-03-17 22:26:22 +00003116 struct inode *inode = d_backing_inode(dentry);
Paul Moore20cdef82016-04-04 14:14:42 -04003117 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003118 u32 newsid;
3119 int rc;
3120
3121 if (strcmp(name, XATTR_NAME_SELINUX)) {
3122 /* Not an attribute we recognize, so nothing to do. */
3123 return;
3124 }
3125
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003126 rc = security_context_to_sid_force(&selinux_state, value, size,
3127 &newsid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003128 if (rc) {
peter enderborgc103a912018-06-12 10:09:03 +02003129 pr_err("SELinux: unable to map context to SID"
Stephen Smalley12b29f32008-05-07 13:03:20 -04003130 "for (%s, %lu), rc=%d\n",
3131 inode->i_sb->s_id, inode->i_ino, -rc);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003132 return;
3133 }
3134
Paul Moore20cdef82016-04-04 14:14:42 -04003135 isec = backing_inode_security(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003136 spin_lock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003137 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003138 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05003139 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003140 spin_unlock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003141
Linus Torvalds1da177e2005-04-16 15:20:36 -07003142 return;
3143}
3144
David Howells8f0cfa52008-04-29 00:59:41 -07003145static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003146{
David Howells88e67f32008-11-14 10:39:21 +11003147 const struct cred *cred = current_cred();
3148
Eric Paris2875fa02011-04-28 16:04:24 -04003149 return dentry_has_perm(cred, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003150}
3151
Eric Paris828dfe12008-04-17 13:17:49 -04003152static int selinux_inode_listxattr(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003153{
David Howells88e67f32008-11-14 10:39:21 +11003154 const struct cred *cred = current_cred();
3155
Eric Paris2875fa02011-04-28 16:04:24 -04003156 return dentry_has_perm(cred, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003157}
3158
David Howells8f0cfa52008-04-29 00:59:41 -07003159static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003160{
Eric W. Biederman6b240302017-10-02 09:38:20 -05003161 if (strcmp(name, XATTR_NAME_SELINUX)) {
3162 int rc = cap_inode_removexattr(dentry, name);
3163 if (rc)
3164 return rc;
3165
3166 /* Not an attribute we recognize, so just check the
3167 ordinary setattr permission. */
3168 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3169 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003170
3171 /* No one is allowed to remove a SELinux security label.
3172 You can change the label, but all data must be labeled. */
3173 return -EACCES;
3174}
3175
James Morrisd381d8a2005-10-30 14:59:22 -08003176/*
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003177 * Copy the inode security context value to the user.
James Morrisd381d8a2005-10-30 14:59:22 -08003178 *
3179 * Permission check is handled by selinux_inode_getxattr hook.
3180 */
Andreas Gruenbacherea861df2015-12-24 11:09:39 -05003181static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003182{
David P. Quigley42492592008-02-04 22:29:39 -08003183 u32 size;
3184 int error;
3185 char *context = NULL;
Paul Moore20cdef82016-04-04 14:14:42 -04003186 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003187
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00003188 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3189 return -EOPNOTSUPP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003190
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003191 /*
3192 * If the caller has CAP_MAC_ADMIN, then get the raw context
3193 * value even if it is not defined by current policy; otherwise,
3194 * use the in-core value under current policy.
3195 * Use the non-auditing forms of the permission checks since
3196 * getxattr may be called by unprivileged processes commonly
3197 * and lack of permission just means that we fall back to the
3198 * in-core context value, not a denial.
3199 */
Paul Moore20cdef82016-04-04 14:14:42 -04003200 isec = inode_security(inode);
Stephen Smalleydb590002017-04-20 11:31:30 -04003201 if (has_cap_mac_admin(false))
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003202 error = security_sid_to_context_force(&selinux_state,
3203 isec->sid, &context,
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003204 &size);
3205 else
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003206 error = security_sid_to_context(&selinux_state, isec->sid,
3207 &context, &size);
David P. Quigley42492592008-02-04 22:29:39 -08003208 if (error)
3209 return error;
3210 error = size;
3211 if (alloc) {
3212 *buffer = context;
3213 goto out_nofree;
3214 }
3215 kfree(context);
3216out_nofree:
3217 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003218}
3219
3220static int selinux_inode_setsecurity(struct inode *inode, const char *name,
Eric Paris828dfe12008-04-17 13:17:49 -04003221 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003222{
Paul Moore2c971652016-04-19 16:36:28 -04003223 struct inode_security_struct *isec = inode_security_novalidate(inode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003224 u32 newsid;
3225 int rc;
3226
3227 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3228 return -EOPNOTSUPP;
3229
3230 if (!value || !size)
3231 return -EACCES;
3232
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003233 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3234 GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003235 if (rc)
3236 return rc;
3237
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003238 spin_lock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003239 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003240 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05003241 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003242 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003243 return 0;
3244}
3245
3246static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3247{
3248 const int len = sizeof(XATTR_NAME_SELINUX);
3249 if (buffer && len <= buffer_size)
3250 memcpy(buffer, XATTR_NAME_SELINUX, len);
3251 return len;
3252}
3253
Andreas Gruenbacherd6335d72015-12-24 11:09:39 -05003254static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02003255{
Andreas Gruenbachere817c2f2016-02-18 12:04:08 +01003256 struct inode_security_struct *isec = inode_security_novalidate(inode);
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02003257 *secid = isec->sid;
3258}
3259
Vivek Goyal56909eb2016-07-13 10:44:48 -04003260static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3261{
3262 u32 sid;
3263 struct task_security_struct *tsec;
3264 struct cred *new_creds = *new;
3265
3266 if (new_creds == NULL) {
3267 new_creds = prepare_creds();
3268 if (!new_creds)
3269 return -ENOMEM;
3270 }
3271
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07003272 tsec = selinux_cred(new_creds);
Vivek Goyal56909eb2016-07-13 10:44:48 -04003273 /* Get label from overlay inode and set it in create_sid */
3274 selinux_inode_getsecid(d_inode(src), &sid);
3275 tsec->create_sid = sid;
3276 *new = new_creds;
3277 return 0;
3278}
3279
Vivek Goyal19472b62016-07-13 10:44:50 -04003280static int selinux_inode_copy_up_xattr(const char *name)
3281{
3282 /* The copy_up hook above sets the initial context on an inode, but we
3283 * don't then want to overwrite it by blindly copying all the lower
3284 * xattrs up. Instead, we have to filter out SELinux-related xattrs.
3285 */
3286 if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3287 return 1; /* Discard */
3288 /*
3289 * Any other attribute apart from SELINUX is not claimed, supported
3290 * by selinux.
3291 */
3292 return -EOPNOTSUPP;
3293}
3294
Linus Torvalds1da177e2005-04-16 15:20:36 -07003295/* file security operations */
3296
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003297static int selinux_revalidate_file_permission(struct file *file, int mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003298{
David Howells88e67f32008-11-14 10:39:21 +11003299 const struct cred *cred = current_cred();
Al Viro496ad9a2013-01-23 17:07:38 -05003300 struct inode *inode = file_inode(file);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003301
Linus Torvalds1da177e2005-04-16 15:20:36 -07003302 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3303 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3304 mask |= MAY_APPEND;
3305
Paul Moore389fb8002009-03-27 17:10:34 -04003306 return file_has_perm(cred, file,
3307 file_mask_to_av(inode->i_mode, mask));
Linus Torvalds1da177e2005-04-16 15:20:36 -07003308}
3309
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003310static int selinux_file_permission(struct file *file, int mask)
3311{
Al Viro496ad9a2013-01-23 17:07:38 -05003312 struct inode *inode = file_inode(file);
Casey Schauflerbb6c6b02018-09-21 17:22:32 -07003313 struct file_security_struct *fsec = selinux_file(file);
Andreas Gruenbacherb1973672016-01-05 23:12:33 +01003314 struct inode_security_struct *isec;
Stephen Smalley20dda182009-06-22 14:54:53 -04003315 u32 sid = current_sid();
3316
Paul Moore389fb8002009-03-27 17:10:34 -04003317 if (!mask)
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003318 /* No permission to check. Existence test. */
3319 return 0;
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003320
Andreas Gruenbacherb1973672016-01-05 23:12:33 +01003321 isec = inode_security(inode);
Stephen Smalley20dda182009-06-22 14:54:53 -04003322 if (sid == fsec->sid && fsec->isid == isec->sid &&
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003323 fsec->pseqno == avc_policy_seqno(&selinux_state))
Eric Paris83d49852012-04-04 13:45:40 -04003324 /* No change since file_open check. */
Stephen Smalley20dda182009-06-22 14:54:53 -04003325 return 0;
3326
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003327 return selinux_revalidate_file_permission(file, mask);
3328}
3329
Linus Torvalds1da177e2005-04-16 15:20:36 -07003330static int selinux_file_alloc_security(struct file *file)
3331{
3332 return file_alloc_security(file);
3333}
3334
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003335/*
3336 * Check whether a task has the ioctl permission and cmd
3337 * operation to an inode.
3338 */
Geliang Tang1d2a1682015-10-21 17:44:27 -04003339static int ioctl_has_perm(const struct cred *cred, struct file *file,
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003340 u32 requested, u16 cmd)
3341{
3342 struct common_audit_data ad;
Casey Schauflerbb6c6b02018-09-21 17:22:32 -07003343 struct file_security_struct *fsec = selinux_file(file);
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003344 struct inode *inode = file_inode(file);
Paul Moore20cdef82016-04-04 14:14:42 -04003345 struct inode_security_struct *isec;
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003346 struct lsm_ioctlop_audit ioctl;
3347 u32 ssid = cred_sid(cred);
3348 int rc;
3349 u8 driver = cmd >> 8;
3350 u8 xperm = cmd & 0xff;
3351
3352 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3353 ad.u.op = &ioctl;
3354 ad.u.op->cmd = cmd;
3355 ad.u.op->path = file->f_path;
3356
3357 if (ssid != fsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003358 rc = avc_has_perm(&selinux_state,
3359 ssid, fsec->sid,
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003360 SECCLASS_FD,
3361 FD__USE,
3362 &ad);
3363 if (rc)
3364 goto out;
3365 }
3366
3367 if (unlikely(IS_PRIVATE(inode)))
3368 return 0;
3369
Paul Moore20cdef82016-04-04 14:14:42 -04003370 isec = inode_security(inode);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003371 rc = avc_has_extended_perms(&selinux_state,
3372 ssid, isec->sid, isec->sclass,
3373 requested, driver, xperm, &ad);
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003374out:
3375 return rc;
3376}
3377
Linus Torvalds1da177e2005-04-16 15:20:36 -07003378static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3379 unsigned long arg)
3380{
David Howells88e67f32008-11-14 10:39:21 +11003381 const struct cred *cred = current_cred();
Eric Paris0b24dcb2011-02-25 15:39:20 -05003382 int error = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003383
Eric Paris0b24dcb2011-02-25 15:39:20 -05003384 switch (cmd) {
3385 case FIONREAD:
3386 /* fall through */
3387 case FIBMAP:
3388 /* fall through */
3389 case FIGETBSZ:
3390 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003391 case FS_IOC_GETFLAGS:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003392 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003393 case FS_IOC_GETVERSION:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003394 error = file_has_perm(cred, file, FILE__GETATTR);
3395 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003396
Al Viro2f99c362012-03-23 16:04:05 -04003397 case FS_IOC_SETFLAGS:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003398 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003399 case FS_IOC_SETVERSION:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003400 error = file_has_perm(cred, file, FILE__SETATTR);
3401 break;
3402
3403 /* sys_ioctl() checks */
3404 case FIONBIO:
3405 /* fall through */
3406 case FIOASYNC:
3407 error = file_has_perm(cred, file, 0);
3408 break;
3409
3410 case KDSKBENT:
3411 case KDSKBSENT:
Eric Paris6a9de492012-01-03 12:25:14 -05003412 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04003413 SECURITY_CAP_AUDIT, true);
Eric Paris0b24dcb2011-02-25 15:39:20 -05003414 break;
3415
3416 /* default case assumes that the command will go
3417 * to the file's ioctl() function.
3418 */
3419 default:
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003420 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
Eric Paris0b24dcb2011-02-25 15:39:20 -05003421 }
3422 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003423}
3424
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003425static int default_noexec;
3426
Linus Torvalds1da177e2005-04-16 15:20:36 -07003427static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3428{
David Howells88e67f32008-11-14 10:39:21 +11003429 const struct cred *cred = current_cred();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003430 u32 sid = cred_sid(cred);
David Howellsd84f4f92008-11-14 10:39:23 +11003431 int rc = 0;
David Howells88e67f32008-11-14 10:39:21 +11003432
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003433 if (default_noexec &&
Stephen Smalley892e8ca2015-07-10 09:40:59 -04003434 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3435 (!shared && (prot & PROT_WRITE)))) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07003436 /*
3437 * We are making executable an anonymous mapping or a
3438 * private file mapping that will also be writable.
3439 * This has an additional check.
3440 */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003441 rc = avc_has_perm(&selinux_state,
3442 sid, sid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003443 PROCESS__EXECMEM, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003444 if (rc)
David Howellsd84f4f92008-11-14 10:39:23 +11003445 goto error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003446 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003447
3448 if (file) {
3449 /* read access is always possible with a mapping */
3450 u32 av = FILE__READ;
3451
3452 /* write access only matters if the mapping is shared */
3453 if (shared && (prot & PROT_WRITE))
3454 av |= FILE__WRITE;
3455
3456 if (prot & PROT_EXEC)
3457 av |= FILE__EXECUTE;
3458
David Howells88e67f32008-11-14 10:39:21 +11003459 return file_has_perm(cred, file, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003460 }
David Howellsd84f4f92008-11-14 10:39:23 +11003461
3462error:
3463 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003464}
3465
Al Viroe5467852012-05-30 13:30:51 -04003466static int selinux_mmap_addr(unsigned long addr)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003467{
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07003468 int rc = 0;
Paul Moore98883bf2014-03-19 16:46:11 -04003469
3470 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3471 u32 sid = current_sid();
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003472 rc = avc_has_perm(&selinux_state,
3473 sid, sid, SECCLASS_MEMPROTECT,
Paul Moore98883bf2014-03-19 16:46:11 -04003474 MEMPROTECT__MMAP_ZERO, NULL);
3475 }
3476
3477 return rc;
Al Viroe5467852012-05-30 13:30:51 -04003478}
Linus Torvalds1da177e2005-04-16 15:20:36 -07003479
Al Viroe5467852012-05-30 13:30:51 -04003480static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3481 unsigned long prot, unsigned long flags)
3482{
Stephen Smalley3ba4bf52017-05-05 09:14:48 -04003483 struct common_audit_data ad;
3484 int rc;
3485
3486 if (file) {
3487 ad.type = LSM_AUDIT_DATA_FILE;
3488 ad.u.file = file;
3489 rc = inode_has_perm(current_cred(), file_inode(file),
3490 FILE__MAP, &ad);
3491 if (rc)
3492 return rc;
3493 }
3494
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003495 if (selinux_state.checkreqprot)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003496 prot = reqprot;
3497
3498 return file_map_prot_check(file, prot,
3499 (flags & MAP_TYPE) == MAP_SHARED);
3500}
3501
3502static int selinux_file_mprotect(struct vm_area_struct *vma,
3503 unsigned long reqprot,
3504 unsigned long prot)
3505{
David Howells88e67f32008-11-14 10:39:21 +11003506 const struct cred *cred = current_cred();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003507 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003508
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003509 if (selinux_state.checkreqprot)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003510 prot = reqprot;
3511
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003512 if (default_noexec &&
3513 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
James Morrisd541bbe2009-01-29 12:19:51 +11003514 int rc = 0;
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003515 if (vma->vm_start >= vma->vm_mm->start_brk &&
3516 vma->vm_end <= vma->vm_mm->brk) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003517 rc = avc_has_perm(&selinux_state,
3518 sid, sid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003519 PROCESS__EXECHEAP, NULL);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003520 } else if (!vma->vm_file &&
Stephen Smalleyc2316db2016-04-08 13:55:03 -04003521 ((vma->vm_start <= vma->vm_mm->start_stack &&
3522 vma->vm_end >= vma->vm_mm->start_stack) ||
Andy Lutomirskid17af502016-09-30 10:58:58 -07003523 vma_is_stack_for_current(vma))) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003524 rc = avc_has_perm(&selinux_state,
3525 sid, sid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003526 PROCESS__EXECSTACK, NULL);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003527 } else if (vma->vm_file && vma->anon_vma) {
3528 /*
3529 * We are making executable a file mapping that has
3530 * had some COW done. Since pages might have been
3531 * written, check ability to execute the possibly
3532 * modified content. This typically should only
3533 * occur for text relocations.
3534 */
David Howellsd84f4f92008-11-14 10:39:23 +11003535 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003536 }
Lorenzo Hernandez García-Hierro6b992192005-06-25 14:54:34 -07003537 if (rc)
3538 return rc;
3539 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003540
3541 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3542}
3543
3544static int selinux_file_lock(struct file *file, unsigned int cmd)
3545{
David Howells88e67f32008-11-14 10:39:21 +11003546 const struct cred *cred = current_cred();
3547
3548 return file_has_perm(cred, file, FILE__LOCK);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003549}
3550
3551static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3552 unsigned long arg)
3553{
David Howells88e67f32008-11-14 10:39:21 +11003554 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003555 int err = 0;
3556
3557 switch (cmd) {
Eric Paris828dfe12008-04-17 13:17:49 -04003558 case F_SETFL:
Eric Paris828dfe12008-04-17 13:17:49 -04003559 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
David Howells88e67f32008-11-14 10:39:21 +11003560 err = file_has_perm(cred, file, FILE__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003561 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003562 }
3563 /* fall through */
3564 case F_SETOWN:
3565 case F_SETSIG:
3566 case F_GETFL:
3567 case F_GETOWN:
3568 case F_GETSIG:
Cyrill Gorcunov1d151c32012-07-30 14:43:00 -07003569 case F_GETOWNER_UIDS:
Eric Paris828dfe12008-04-17 13:17:49 -04003570 /* Just check FD__USE permission */
David Howells88e67f32008-11-14 10:39:21 +11003571 err = file_has_perm(cred, file, 0);
Eric Paris828dfe12008-04-17 13:17:49 -04003572 break;
3573 case F_GETLK:
3574 case F_SETLK:
3575 case F_SETLKW:
Jeff Layton0d3f7a22014-04-22 08:23:58 -04003576 case F_OFD_GETLK:
3577 case F_OFD_SETLK:
3578 case F_OFD_SETLKW:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003579#if BITS_PER_LONG == 32
Eric Paris828dfe12008-04-17 13:17:49 -04003580 case F_GETLK64:
3581 case F_SETLK64:
3582 case F_SETLKW64:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003583#endif
David Howells88e67f32008-11-14 10:39:21 +11003584 err = file_has_perm(cred, file, FILE__LOCK);
Eric Paris828dfe12008-04-17 13:17:49 -04003585 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003586 }
3587
3588 return err;
3589}
3590
Jeff Laytone0b93ed2014-08-22 11:27:32 -04003591static void selinux_file_set_fowner(struct file *file)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003592{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003593 struct file_security_struct *fsec;
3594
Casey Schauflerbb6c6b02018-09-21 17:22:32 -07003595 fsec = selinux_file(file);
David Howells275bb412008-11-14 10:39:19 +11003596 fsec->fown_sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003597}
3598
3599static int selinux_file_send_sigiotask(struct task_struct *tsk,
3600 struct fown_struct *fown, int signum)
3601{
Eric Paris828dfe12008-04-17 13:17:49 -04003602 struct file *file;
Stephen Smalley65c90bc2009-05-04 15:43:18 -04003603 u32 sid = task_sid(tsk);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003604 u32 perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003605 struct file_security_struct *fsec;
3606
3607 /* struct fown_struct is never outside the context of a struct file */
Eric Paris828dfe12008-04-17 13:17:49 -04003608 file = container_of(fown, struct file, f_owner);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003609
Casey Schauflerbb6c6b02018-09-21 17:22:32 -07003610 fsec = selinux_file(file);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003611
3612 if (!signum)
3613 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3614 else
3615 perm = signal_to_av(signum);
3616
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003617 return avc_has_perm(&selinux_state,
3618 fsec->fown_sid, sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003619 SECCLASS_PROCESS, perm, NULL);
3620}
3621
3622static int selinux_file_receive(struct file *file)
3623{
David Howells88e67f32008-11-14 10:39:21 +11003624 const struct cred *cred = current_cred();
3625
3626 return file_has_perm(cred, file, file_to_av(file));
Linus Torvalds1da177e2005-04-16 15:20:36 -07003627}
3628
Al Viro94817692018-07-10 14:13:18 -04003629static int selinux_file_open(struct file *file)
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003630{
3631 struct file_security_struct *fsec;
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003632 struct inode_security_struct *isec;
David Howellsd84f4f92008-11-14 10:39:23 +11003633
Casey Schauflerbb6c6b02018-09-21 17:22:32 -07003634 fsec = selinux_file(file);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05003635 isec = inode_security(file_inode(file));
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003636 /*
3637 * Save inode label and policy sequence number
3638 * at open-time so that selinux_file_permission
3639 * can determine whether revalidation is necessary.
3640 * Task label is already saved in the file security
3641 * struct as its SID.
3642 */
3643 fsec->isid = isec->sid;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003644 fsec->pseqno = avc_policy_seqno(&selinux_state);
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003645 /*
3646 * Since the inode label or policy seqno may have changed
3647 * between the selinux_inode_permission check and the saving
3648 * of state above, recheck that access is still permitted.
3649 * Otherwise, access might never be revalidated against the
3650 * new inode label or new policy.
3651 * This check is not redundant - do not remove.
3652 */
Al Viro94817692018-07-10 14:13:18 -04003653 return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003654}
3655
Linus Torvalds1da177e2005-04-16 15:20:36 -07003656/* task security operations */
3657
Tetsuo Handaa79be232017-03-28 23:08:45 +09003658static int selinux_task_alloc(struct task_struct *task,
3659 unsigned long clone_flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003660{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003661 u32 sid = current_sid();
3662
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003663 return avc_has_perm(&selinux_state,
3664 sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003665}
3666
David Howellsf1752ee2008-11-14 10:39:17 +11003667/*
David Howellsd84f4f92008-11-14 10:39:23 +11003668 * prepare a new set of credentials for modification
3669 */
3670static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3671 gfp_t gfp)
3672{
Casey Schauflerbbd36622018-11-12 09:30:56 -08003673 const struct task_security_struct *old_tsec = selinux_cred(old);
3674 struct task_security_struct *tsec = selinux_cred(new);
David Howellsd84f4f92008-11-14 10:39:23 +11003675
Casey Schauflerbbd36622018-11-12 09:30:56 -08003676 *tsec = *old_tsec;
David Howellsd84f4f92008-11-14 10:39:23 +11003677 return 0;
3678}
3679
3680/*
David Howellsee18d642009-09-02 09:14:21 +01003681 * transfer the SELinux data to a blank set of creds
3682 */
3683static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3684{
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07003685 const struct task_security_struct *old_tsec = selinux_cred(old);
3686 struct task_security_struct *tsec = selinux_cred(new);
David Howellsee18d642009-09-02 09:14:21 +01003687
3688 *tsec = *old_tsec;
3689}
3690
Matthew Garrett3ec30112018-01-08 13:36:19 -08003691static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
3692{
3693 *secid = cred_sid(c);
3694}
3695
David Howellsee18d642009-09-02 09:14:21 +01003696/*
David Howells3a3b7ce2008-11-14 10:39:28 +11003697 * set the security data for a kernel service
3698 * - all the creation contexts are set to unlabelled
3699 */
3700static int selinux_kernel_act_as(struct cred *new, u32 secid)
3701{
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07003702 struct task_security_struct *tsec = selinux_cred(new);
David Howells3a3b7ce2008-11-14 10:39:28 +11003703 u32 sid = current_sid();
3704 int ret;
3705
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003706 ret = avc_has_perm(&selinux_state,
3707 sid, secid,
David Howells3a3b7ce2008-11-14 10:39:28 +11003708 SECCLASS_KERNEL_SERVICE,
3709 KERNEL_SERVICE__USE_AS_OVERRIDE,
3710 NULL);
3711 if (ret == 0) {
3712 tsec->sid = secid;
3713 tsec->create_sid = 0;
3714 tsec->keycreate_sid = 0;
3715 tsec->sockcreate_sid = 0;
3716 }
3717 return ret;
3718}
3719
3720/*
3721 * set the file creation context in a security record to the same as the
3722 * objective context of the specified inode
3723 */
3724static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3725{
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05003726 struct inode_security_struct *isec = inode_security(inode);
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07003727 struct task_security_struct *tsec = selinux_cred(new);
David Howells3a3b7ce2008-11-14 10:39:28 +11003728 u32 sid = current_sid();
3729 int ret;
3730
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003731 ret = avc_has_perm(&selinux_state,
3732 sid, isec->sid,
David Howells3a3b7ce2008-11-14 10:39:28 +11003733 SECCLASS_KERNEL_SERVICE,
3734 KERNEL_SERVICE__CREATE_FILES_AS,
3735 NULL);
3736
3737 if (ret == 0)
3738 tsec->create_sid = isec->sid;
David Howellsef574712010-02-26 01:56:16 +00003739 return ret;
David Howells3a3b7ce2008-11-14 10:39:28 +11003740}
3741
Eric Parisdd8dbf22009-11-03 16:35:32 +11003742static int selinux_kernel_module_request(char *kmod_name)
Eric Paris25354c42009-08-13 09:45:03 -04003743{
Eric Parisdd8dbf22009-11-03 16:35:32 +11003744 struct common_audit_data ad;
3745
Eric Paris50c205f2012-04-04 15:01:43 -04003746 ad.type = LSM_AUDIT_DATA_KMOD;
Eric Parisdd8dbf22009-11-03 16:35:32 +11003747 ad.u.kmod_name = kmod_name;
3748
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003749 return avc_has_perm(&selinux_state,
3750 current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
Eric Parisdd8dbf22009-11-03 16:35:32 +11003751 SYSTEM__MODULE_REQUEST, &ad);
Eric Paris25354c42009-08-13 09:45:03 -04003752}
3753
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003754static int selinux_kernel_module_from_file(struct file *file)
3755{
3756 struct common_audit_data ad;
3757 struct inode_security_struct *isec;
3758 struct file_security_struct *fsec;
3759 u32 sid = current_sid();
3760 int rc;
3761
3762 /* init_module */
3763 if (file == NULL)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003764 return avc_has_perm(&selinux_state,
3765 sid, sid, SECCLASS_SYSTEM,
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003766 SYSTEM__MODULE_LOAD, NULL);
3767
3768 /* finit_module */
Paul Moore20cdef82016-04-04 14:14:42 -04003769
Vivek Goyal43af5de2016-09-09 11:37:49 -04003770 ad.type = LSM_AUDIT_DATA_FILE;
3771 ad.u.file = file;
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003772
Casey Schauflerbb6c6b02018-09-21 17:22:32 -07003773 fsec = selinux_file(file);
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003774 if (sid != fsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003775 rc = avc_has_perm(&selinux_state,
3776 sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003777 if (rc)
3778 return rc;
3779 }
3780
Paul Moore20cdef82016-04-04 14:14:42 -04003781 isec = inode_security(file_inode(file));
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003782 return avc_has_perm(&selinux_state,
3783 sid, isec->sid, SECCLASS_SYSTEM,
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003784 SYSTEM__MODULE_LOAD, &ad);
3785}
3786
3787static int selinux_kernel_read_file(struct file *file,
3788 enum kernel_read_file_id id)
3789{
3790 int rc = 0;
3791
3792 switch (id) {
3793 case READING_MODULE:
3794 rc = selinux_kernel_module_from_file(file);
3795 break;
3796 default:
3797 break;
3798 }
3799
3800 return rc;
3801}
3802
Mimi Zoharc77b8cd2018-07-13 14:06:02 -04003803static int selinux_kernel_load_data(enum kernel_load_data_id id)
3804{
3805 int rc = 0;
3806
3807 switch (id) {
3808 case LOADING_MODULE:
3809 rc = selinux_kernel_module_from_file(NULL);
3810 default:
3811 break;
3812 }
3813
3814 return rc;
3815}
3816
Linus Torvalds1da177e2005-04-16 15:20:36 -07003817static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3818{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003819 return avc_has_perm(&selinux_state,
3820 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003821 PROCESS__SETPGID, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003822}
3823
3824static int selinux_task_getpgid(struct task_struct *p)
3825{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003826 return avc_has_perm(&selinux_state,
3827 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003828 PROCESS__GETPGID, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003829}
3830
3831static int selinux_task_getsid(struct task_struct *p)
3832{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003833 return avc_has_perm(&selinux_state,
3834 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003835 PROCESS__GETSESSION, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003836}
3837
David Quigleyf9008e4c2006-06-30 01:55:46 -07003838static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3839{
David Howells275bb412008-11-14 10:39:19 +11003840 *secid = task_sid(p);
David Quigleyf9008e4c2006-06-30 01:55:46 -07003841}
3842
Linus Torvalds1da177e2005-04-16 15:20:36 -07003843static int selinux_task_setnice(struct task_struct *p, int nice)
3844{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003845 return avc_has_perm(&selinux_state,
3846 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003847 PROCESS__SETSCHED, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003848}
3849
James Morris03e68062006-06-23 02:03:58 -07003850static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3851{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003852 return avc_has_perm(&selinux_state,
3853 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003854 PROCESS__SETSCHED, NULL);
James Morris03e68062006-06-23 02:03:58 -07003855}
3856
David Quigleya1836a42006-06-30 01:55:49 -07003857static int selinux_task_getioprio(struct task_struct *p)
3858{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003859 return avc_has_perm(&selinux_state,
3860 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003861 PROCESS__GETSCHED, NULL);
David Quigleya1836a42006-06-30 01:55:49 -07003862}
3863
Corentin LABBE42985552017-10-04 20:32:18 +02003864static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
3865 unsigned int flags)
Stephen Smalley791ec492017-02-17 07:57:00 -05003866{
3867 u32 av = 0;
3868
Stephen Smalley84e68852017-02-28 09:35:08 -05003869 if (!flags)
3870 return 0;
Stephen Smalley791ec492017-02-17 07:57:00 -05003871 if (flags & LSM_PRLIMIT_WRITE)
3872 av |= PROCESS__SETRLIMIT;
3873 if (flags & LSM_PRLIMIT_READ)
3874 av |= PROCESS__GETRLIMIT;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003875 return avc_has_perm(&selinux_state,
3876 cred_sid(cred), cred_sid(tcred),
Stephen Smalley791ec492017-02-17 07:57:00 -05003877 SECCLASS_PROCESS, av, NULL);
3878}
3879
Jiri Slaby8fd00b42009-08-26 18:41:16 +02003880static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3881 struct rlimit *new_rlim)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003882{
Jiri Slaby8fd00b42009-08-26 18:41:16 +02003883 struct rlimit *old_rlim = p->signal->rlim + resource;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003884
3885 /* Control the ability to change the hard limit (whether
3886 lowering or raising it), so that the hard limit can
3887 later be used as a safe reset point for the soft limit
David Howellsd84f4f92008-11-14 10:39:23 +11003888 upon context transitions. See selinux_bprm_committing_creds. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07003889 if (old_rlim->rlim_max != new_rlim->rlim_max)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003890 return avc_has_perm(&selinux_state,
3891 current_sid(), task_sid(p),
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003892 SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003893
3894 return 0;
3895}
3896
KOSAKI Motohirob0ae1982010-10-15 04:21:18 +09003897static int selinux_task_setscheduler(struct task_struct *p)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003898{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003899 return avc_has_perm(&selinux_state,
3900 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003901 PROCESS__SETSCHED, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003902}
3903
3904static int selinux_task_getscheduler(struct task_struct *p)
3905{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003906 return avc_has_perm(&selinux_state,
3907 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003908 PROCESS__GETSCHED, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003909}
3910
David Quigley35601542006-06-23 02:04:01 -07003911static int selinux_task_movememory(struct task_struct *p)
3912{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003913 return avc_has_perm(&selinux_state,
3914 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003915 PROCESS__SETSCHED, NULL);
David Quigley35601542006-06-23 02:04:01 -07003916}
3917
Eric W. Biedermanae7795b2018-09-25 11:27:20 +02003918static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
Stephen Smalley6b4f3d02017-09-08 12:40:01 -04003919 int sig, const struct cred *cred)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003920{
Stephen Smalley6b4f3d02017-09-08 12:40:01 -04003921 u32 secid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003922 u32 perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003923
Linus Torvalds1da177e2005-04-16 15:20:36 -07003924 if (!sig)
3925 perm = PROCESS__SIGNULL; /* null signal; existence test */
3926 else
3927 perm = signal_to_av(sig);
Stephen Smalley6b4f3d02017-09-08 12:40:01 -04003928 if (!cred)
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003929 secid = current_sid();
Stephen Smalley6b4f3d02017-09-08 12:40:01 -04003930 else
3931 secid = cred_sid(cred);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003932 return avc_has_perm(&selinux_state,
3933 secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003934}
3935
Linus Torvalds1da177e2005-04-16 15:20:36 -07003936static void selinux_task_to_inode(struct task_struct *p,
3937 struct inode *inode)
3938{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003939 struct inode_security_struct *isec = inode->i_security;
David Howells275bb412008-11-14 10:39:19 +11003940 u32 sid = task_sid(p);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003941
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003942 spin_lock(&isec->lock);
Andreas Gruenbacherdb978da2016-11-10 22:18:28 +01003943 isec->sclass = inode_mode_to_security_class(inode->i_mode);
David Howells275bb412008-11-14 10:39:19 +11003944 isec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05003945 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003946 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003947}
3948
Linus Torvalds1da177e2005-04-16 15:20:36 -07003949/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003950static int selinux_parse_skb_ipv4(struct sk_buff *skb,
Thomas Liu2bf49692009-07-14 12:14:09 -04003951 struct common_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003952{
3953 int offset, ihlen, ret = -EINVAL;
3954 struct iphdr _iph, *ih;
3955
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03003956 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003957 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3958 if (ih == NULL)
3959 goto out;
3960
3961 ihlen = ih->ihl * 4;
3962 if (ihlen < sizeof(_iph))
3963 goto out;
3964
Eric Paris48c62af2012-04-02 13:15:44 -04003965 ad->u.net->v4info.saddr = ih->saddr;
3966 ad->u.net->v4info.daddr = ih->daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003967 ret = 0;
3968
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003969 if (proto)
3970 *proto = ih->protocol;
3971
Linus Torvalds1da177e2005-04-16 15:20:36 -07003972 switch (ih->protocol) {
Eric Paris828dfe12008-04-17 13:17:49 -04003973 case IPPROTO_TCP: {
3974 struct tcphdr _tcph, *th;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003975
Eric Paris828dfe12008-04-17 13:17:49 -04003976 if (ntohs(ih->frag_off) & IP_OFFSET)
3977 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003978
3979 offset += ihlen;
3980 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3981 if (th == NULL)
3982 break;
3983
Eric Paris48c62af2012-04-02 13:15:44 -04003984 ad->u.net->sport = th->source;
3985 ad->u.net->dport = th->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003986 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003987 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003988
Eric Paris828dfe12008-04-17 13:17:49 -04003989 case IPPROTO_UDP: {
3990 struct udphdr _udph, *uh;
3991
3992 if (ntohs(ih->frag_off) & IP_OFFSET)
3993 break;
3994
3995 offset += ihlen;
3996 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3997 if (uh == NULL)
3998 break;
3999
Eric Paris48c62af2012-04-02 13:15:44 -04004000 ad->u.net->sport = uh->source;
4001 ad->u.net->dport = uh->dest;
Eric Paris828dfe12008-04-17 13:17:49 -04004002 break;
4003 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004004
James Morris2ee92d42006-11-13 16:09:01 -08004005 case IPPROTO_DCCP: {
4006 struct dccp_hdr _dccph, *dh;
4007
4008 if (ntohs(ih->frag_off) & IP_OFFSET)
4009 break;
4010
4011 offset += ihlen;
4012 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4013 if (dh == NULL)
4014 break;
4015
Eric Paris48c62af2012-04-02 13:15:44 -04004016 ad->u.net->sport = dh->dccph_sport;
4017 ad->u.net->dport = dh->dccph_dport;
James Morris2ee92d42006-11-13 16:09:01 -08004018 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004019 }
James Morris2ee92d42006-11-13 16:09:01 -08004020
Richard Hainesd4529302018-02-13 20:57:18 +00004021#if IS_ENABLED(CONFIG_IP_SCTP)
4022 case IPPROTO_SCTP: {
4023 struct sctphdr _sctph, *sh;
4024
4025 if (ntohs(ih->frag_off) & IP_OFFSET)
4026 break;
4027
4028 offset += ihlen;
4029 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4030 if (sh == NULL)
4031 break;
4032
4033 ad->u.net->sport = sh->source;
4034 ad->u.net->dport = sh->dest;
4035 break;
4036 }
4037#endif
Eric Paris828dfe12008-04-17 13:17:49 -04004038 default:
4039 break;
4040 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004041out:
4042 return ret;
4043}
4044
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04004045#if IS_ENABLED(CONFIG_IPV6)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004046
4047/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004048static int selinux_parse_skb_ipv6(struct sk_buff *skb,
Thomas Liu2bf49692009-07-14 12:14:09 -04004049 struct common_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004050{
4051 u8 nexthdr;
4052 int ret = -EINVAL, offset;
4053 struct ipv6hdr _ipv6h, *ip6;
Jesse Gross75f28112011-11-30 17:05:51 -08004054 __be16 frag_off;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004055
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03004056 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004057 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4058 if (ip6 == NULL)
4059 goto out;
4060
Eric Paris48c62af2012-04-02 13:15:44 -04004061 ad->u.net->v6info.saddr = ip6->saddr;
4062 ad->u.net->v6info.daddr = ip6->daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004063 ret = 0;
4064
4065 nexthdr = ip6->nexthdr;
4066 offset += sizeof(_ipv6h);
Jesse Gross75f28112011-11-30 17:05:51 -08004067 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004068 if (offset < 0)
4069 goto out;
4070
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004071 if (proto)
4072 *proto = nexthdr;
4073
Linus Torvalds1da177e2005-04-16 15:20:36 -07004074 switch (nexthdr) {
4075 case IPPROTO_TCP: {
Eric Paris828dfe12008-04-17 13:17:49 -04004076 struct tcphdr _tcph, *th;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004077
4078 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4079 if (th == NULL)
4080 break;
4081
Eric Paris48c62af2012-04-02 13:15:44 -04004082 ad->u.net->sport = th->source;
4083 ad->u.net->dport = th->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004084 break;
4085 }
4086
4087 case IPPROTO_UDP: {
4088 struct udphdr _udph, *uh;
4089
4090 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4091 if (uh == NULL)
4092 break;
4093
Eric Paris48c62af2012-04-02 13:15:44 -04004094 ad->u.net->sport = uh->source;
4095 ad->u.net->dport = uh->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004096 break;
4097 }
4098
James Morris2ee92d42006-11-13 16:09:01 -08004099 case IPPROTO_DCCP: {
4100 struct dccp_hdr _dccph, *dh;
4101
4102 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4103 if (dh == NULL)
4104 break;
4105
Eric Paris48c62af2012-04-02 13:15:44 -04004106 ad->u.net->sport = dh->dccph_sport;
4107 ad->u.net->dport = dh->dccph_dport;
James Morris2ee92d42006-11-13 16:09:01 -08004108 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004109 }
James Morris2ee92d42006-11-13 16:09:01 -08004110
Richard Hainesd4529302018-02-13 20:57:18 +00004111#if IS_ENABLED(CONFIG_IP_SCTP)
4112 case IPPROTO_SCTP: {
4113 struct sctphdr _sctph, *sh;
4114
4115 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4116 if (sh == NULL)
4117 break;
4118
4119 ad->u.net->sport = sh->source;
4120 ad->u.net->dport = sh->dest;
4121 break;
4122 }
4123#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07004124 /* includes fragments */
4125 default:
4126 break;
4127 }
4128out:
4129 return ret;
4130}
4131
4132#endif /* IPV6 */
4133
Thomas Liu2bf49692009-07-14 12:14:09 -04004134static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
David Howellscf9481e2008-07-27 21:31:07 +10004135 char **_addrp, int src, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004136{
David Howellscf9481e2008-07-27 21:31:07 +10004137 char *addrp;
4138 int ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004139
Eric Paris48c62af2012-04-02 13:15:44 -04004140 switch (ad->u.net->family) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07004141 case PF_INET:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004142 ret = selinux_parse_skb_ipv4(skb, ad, proto);
David Howellscf9481e2008-07-27 21:31:07 +10004143 if (ret)
4144 goto parse_error;
Eric Paris48c62af2012-04-02 13:15:44 -04004145 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4146 &ad->u.net->v4info.daddr);
David Howellscf9481e2008-07-27 21:31:07 +10004147 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004148
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04004149#if IS_ENABLED(CONFIG_IPV6)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004150 case PF_INET6:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004151 ret = selinux_parse_skb_ipv6(skb, ad, proto);
David Howellscf9481e2008-07-27 21:31:07 +10004152 if (ret)
4153 goto parse_error;
Eric Paris48c62af2012-04-02 13:15:44 -04004154 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4155 &ad->u.net->v6info.daddr);
David Howellscf9481e2008-07-27 21:31:07 +10004156 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004157#endif /* IPV6 */
4158 default:
David Howellscf9481e2008-07-27 21:31:07 +10004159 addrp = NULL;
4160 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004161 }
4162
David Howellscf9481e2008-07-27 21:31:07 +10004163parse_error:
peter enderborgc103a912018-06-12 10:09:03 +02004164 pr_warn(
David Howellscf9481e2008-07-27 21:31:07 +10004165 "SELinux: failure in selinux_parse_skb(),"
4166 " unable to parse packet\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07004167 return ret;
David Howellscf9481e2008-07-27 21:31:07 +10004168
4169okay:
4170 if (_addrp)
4171 *_addrp = addrp;
4172 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004173}
4174
Paul Moore4f6a9932007-03-01 14:35:22 -05004175/**
Paul Moore220deb92008-01-29 08:38:23 -05004176 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
Paul Moore4f6a9932007-03-01 14:35:22 -05004177 * @skb: the packet
Paul Moore75e22912008-01-29 08:38:04 -05004178 * @family: protocol family
Paul Moore220deb92008-01-29 08:38:23 -05004179 * @sid: the packet's peer label SID
Paul Moore4f6a9932007-03-01 14:35:22 -05004180 *
4181 * Description:
Paul Moore220deb92008-01-29 08:38:23 -05004182 * Check the various different forms of network peer labeling and determine
4183 * the peer label/SID for the packet; most of the magic actually occurs in
4184 * the security server function security_net_peersid_cmp(). The function
4185 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4186 * or -EACCES if @sid is invalid due to inconsistencies with the different
4187 * peer labels.
Paul Moore4f6a9932007-03-01 14:35:22 -05004188 *
4189 */
Paul Moore220deb92008-01-29 08:38:23 -05004190static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
Paul Moore4f6a9932007-03-01 14:35:22 -05004191{
Paul Moore71f1cb02008-01-29 08:51:16 -05004192 int err;
Paul Moore4f6a9932007-03-01 14:35:22 -05004193 u32 xfrm_sid;
4194 u32 nlbl_sid;
Paul Moore220deb92008-01-29 08:38:23 -05004195 u32 nlbl_type;
Paul Moore4f6a9932007-03-01 14:35:22 -05004196
Paul Moore817eff72013-12-10 14:57:54 -05004197 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
Paul Moorebed4d7e2013-07-23 17:38:40 -04004198 if (unlikely(err))
4199 return -EACCES;
4200 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4201 if (unlikely(err))
4202 return -EACCES;
Paul Moore220deb92008-01-29 08:38:23 -05004203
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004204 err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4205 nlbl_type, xfrm_sid, sid);
Paul Moore71f1cb02008-01-29 08:51:16 -05004206 if (unlikely(err)) {
peter enderborgc103a912018-06-12 10:09:03 +02004207 pr_warn(
Paul Moore71f1cb02008-01-29 08:51:16 -05004208 "SELinux: failure in selinux_skb_peerlbl_sid(),"
4209 " unable to determine packet's peer label\n");
Paul Moore220deb92008-01-29 08:38:23 -05004210 return -EACCES;
Paul Moore71f1cb02008-01-29 08:51:16 -05004211 }
Paul Moore220deb92008-01-29 08:38:23 -05004212
4213 return 0;
Paul Moore4f6a9932007-03-01 14:35:22 -05004214}
4215
Paul Moore446b8022013-12-04 16:10:51 -05004216/**
4217 * selinux_conn_sid - Determine the child socket label for a connection
4218 * @sk_sid: the parent socket's SID
4219 * @skb_sid: the packet's SID
4220 * @conn_sid: the resulting connection SID
4221 *
4222 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4223 * combined with the MLS information from @skb_sid in order to create
4224 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
4225 * of @sk_sid. Returns zero on success, negative values on failure.
4226 *
4227 */
4228static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4229{
4230 int err = 0;
4231
4232 if (skb_sid != SECSID_NULL)
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004233 err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4234 conn_sid);
Paul Moore446b8022013-12-04 16:10:51 -05004235 else
4236 *conn_sid = sk_sid;
4237
4238 return err;
4239}
4240
Linus Torvalds1da177e2005-04-16 15:20:36 -07004241/* socket security operations */
Paul Moored4f2d972010-04-22 14:46:18 -04004242
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004243static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4244 u16 secclass, u32 *socksid)
Paul Moored4f2d972010-04-22 14:46:18 -04004245{
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004246 if (tsec->sockcreate_sid > SECSID_NULL) {
4247 *socksid = tsec->sockcreate_sid;
4248 return 0;
4249 }
4250
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004251 return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4252 secclass, NULL, socksid);
Paul Moored4f2d972010-04-22 14:46:18 -04004253}
4254
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004255static int sock_has_perm(struct sock *sk, u32 perms)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004256{
Paul Moore253bfae2010-04-22 14:46:19 -04004257 struct sk_security_struct *sksec = sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004258 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004259 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004260
Paul Moore253bfae2010-04-22 14:46:19 -04004261 if (sksec->sid == SECINITSID_KERNEL)
4262 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004263
Eric Paris50c205f2012-04-04 15:01:43 -04004264 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004265 ad.u.net = &net;
4266 ad.u.net->sk = sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004267
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004268 return avc_has_perm(&selinux_state,
4269 current_sid(), sksec->sid, sksec->sclass, perms,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004270 &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004271}
4272
4273static int selinux_socket_create(int family, int type,
4274 int protocol, int kern)
4275{
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07004276 const struct task_security_struct *tsec = selinux_cred(current_cred());
Paul Moored4f2d972010-04-22 14:46:18 -04004277 u32 newsid;
David Howells275bb412008-11-14 10:39:19 +11004278 u16 secclass;
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004279 int rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004280
4281 if (kern)
Paul Moored4f2d972010-04-22 14:46:18 -04004282 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004283
David Howells275bb412008-11-14 10:39:19 +11004284 secclass = socket_type_to_security_class(family, type, protocol);
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004285 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4286 if (rc)
4287 return rc;
4288
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004289 return avc_has_perm(&selinux_state,
4290 tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004291}
4292
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07004293static int selinux_socket_post_create(struct socket *sock, int family,
4294 int type, int protocol, int kern)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004295{
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07004296 const struct task_security_struct *tsec = selinux_cred(current_cred());
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05004297 struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004298 struct sk_security_struct *sksec;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004299 u16 sclass = socket_type_to_security_class(family, type, protocol);
4300 u32 sid = SECINITSID_KERNEL;
David Howells275bb412008-11-14 10:39:19 +11004301 int err = 0;
4302
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004303 if (!kern) {
4304 err = socket_sockcreate_sid(tsec, sclass, &sid);
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004305 if (err)
4306 return err;
4307 }
David Howells275bb412008-11-14 10:39:19 +11004308
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004309 isec->sclass = sclass;
4310 isec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05004311 isec->initialized = LABEL_INITIALIZED;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004312
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004313 if (sock->sk) {
4314 sksec = sock->sk->sk_security;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004315 sksec->sclass = sclass;
4316 sksec->sid = sid;
Richard Hainesd4529302018-02-13 20:57:18 +00004317 /* Allows detection of the first association on this socket */
4318 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4319 sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4320
Paul Moore389fb8002009-03-27 17:10:34 -04004321 err = selinux_netlbl_socket_post_create(sock->sk, family);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004322 }
4323
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07004324 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004325}
4326
David Herrmann0b811db2018-05-04 16:28:21 +02004327static int selinux_socket_socketpair(struct socket *socka,
4328 struct socket *sockb)
4329{
4330 struct sk_security_struct *sksec_a = socka->sk->sk_security;
4331 struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4332
4333 sksec_a->peer_sid = sksec_b->sid;
4334 sksec_b->peer_sid = sksec_a->sid;
4335
4336 return 0;
4337}
4338
Linus Torvalds1da177e2005-04-16 15:20:36 -07004339/* Range of port numbers used to automatically bind.
4340 Need to determine whether we should perform a name_bind
4341 permission check between the socket and the port number. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07004342
4343static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4344{
Paul Moore253bfae2010-04-22 14:46:19 -04004345 struct sock *sk = sock->sk;
Alexey Kodanev0f8db8c2018-05-11 20:15:11 +03004346 struct sk_security_struct *sksec = sk->sk_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004347 u16 family;
4348 int err;
4349
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004350 err = sock_has_perm(sk, SOCKET__BIND);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004351 if (err)
4352 goto out;
4353
Richard Hainesd4529302018-02-13 20:57:18 +00004354 /* If PF_INET or PF_INET6, check name_bind permission for the port. */
Paul Moore253bfae2010-04-22 14:46:19 -04004355 family = sk->sk_family;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004356 if (family == PF_INET || family == PF_INET6) {
4357 char *addrp;
Thomas Liu2bf49692009-07-14 12:14:09 -04004358 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004359 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004360 struct sockaddr_in *addr4 = NULL;
4361 struct sockaddr_in6 *addr6 = NULL;
Alexey Kodanev0f8db8c2018-05-11 20:15:11 +03004362 u16 family_sa = address->sa_family;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004363 unsigned short snum;
James Morrise399f982008-06-12 01:39:58 +10004364 u32 sid, node_perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004365
Richard Hainesd4529302018-02-13 20:57:18 +00004366 /*
4367 * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4368 * that validates multiple binding addresses. Because of this
4369 * need to check address->sa_family as it is possible to have
4370 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4371 */
Alexey Kodanev0f8db8c2018-05-11 20:15:11 +03004372 switch (family_sa) {
4373 case AF_UNSPEC:
Richard Haines68741a8a2018-03-02 19:54:34 +00004374 case AF_INET:
4375 if (addrlen < sizeof(struct sockaddr_in))
4376 return -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004377 addr4 = (struct sockaddr_in *)address;
Alexey Kodanev0f8db8c2018-05-11 20:15:11 +03004378 if (family_sa == AF_UNSPEC) {
4379 /* see __inet_bind(), we only want to allow
4380 * AF_UNSPEC if the address is INADDR_ANY
4381 */
4382 if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4383 goto err_af;
4384 family_sa = AF_INET;
4385 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004386 snum = ntohs(addr4->sin_port);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004387 addrp = (char *)&addr4->sin_addr.s_addr;
Richard Haines68741a8a2018-03-02 19:54:34 +00004388 break;
4389 case AF_INET6:
4390 if (addrlen < SIN6_LEN_RFC2133)
4391 return -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004392 addr6 = (struct sockaddr_in6 *)address;
4393 snum = ntohs(addr6->sin6_port);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004394 addrp = (char *)&addr6->sin6_addr.s6_addr;
Richard Haines68741a8a2018-03-02 19:54:34 +00004395 break;
4396 default:
Alexey Kodanev0f8db8c2018-05-11 20:15:11 +03004397 goto err_af;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004398 }
4399
Alexey Kodanev88b7d372018-05-11 20:15:12 +03004400 ad.type = LSM_AUDIT_DATA_NET;
4401 ad.u.net = &net;
4402 ad.u.net->sport = htons(snum);
4403 ad.u.net->family = family_sa;
4404
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004405 if (snum) {
4406 int low, high;
4407
Eric W. Biederman0bbf87d2013-09-28 14:10:59 -07004408 inet_get_local_port_range(sock_net(sk), &low, &high);
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004409
Krister Johansen4548b682017-01-20 17:49:11 -08004410 if (snum < max(inet_prot_sock(sock_net(sk)), low) ||
4411 snum > high) {
Paul Moore3e1121722008-04-10 10:48:14 -04004412 err = sel_netport_sid(sk->sk_protocol,
4413 snum, &sid);
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004414 if (err)
4415 goto out;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004416 err = avc_has_perm(&selinux_state,
4417 sksec->sid, sid,
Paul Moore253bfae2010-04-22 14:46:19 -04004418 sksec->sclass,
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004419 SOCKET__NAME_BIND, &ad);
4420 if (err)
4421 goto out;
4422 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004423 }
Eric Paris828dfe12008-04-17 13:17:49 -04004424
Paul Moore253bfae2010-04-22 14:46:19 -04004425 switch (sksec->sclass) {
James Morris13402582005-09-30 14:24:34 -04004426 case SECCLASS_TCP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004427 node_perm = TCP_SOCKET__NODE_BIND;
4428 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004429
James Morris13402582005-09-30 14:24:34 -04004430 case SECCLASS_UDP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004431 node_perm = UDP_SOCKET__NODE_BIND;
4432 break;
James Morris2ee92d42006-11-13 16:09:01 -08004433
4434 case SECCLASS_DCCP_SOCKET:
4435 node_perm = DCCP_SOCKET__NODE_BIND;
4436 break;
4437
Richard Hainesd4529302018-02-13 20:57:18 +00004438 case SECCLASS_SCTP_SOCKET:
4439 node_perm = SCTP_SOCKET__NODE_BIND;
4440 break;
4441
Linus Torvalds1da177e2005-04-16 15:20:36 -07004442 default:
4443 node_perm = RAWIP_SOCKET__NODE_BIND;
4444 break;
4445 }
Eric Paris828dfe12008-04-17 13:17:49 -04004446
Alexey Kodanev88b7d372018-05-11 20:15:12 +03004447 err = sel_netnode_sid(addrp, family_sa, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004448 if (err)
4449 goto out;
Eric Paris828dfe12008-04-17 13:17:49 -04004450
Alexey Kodanev0f8db8c2018-05-11 20:15:11 +03004451 if (family_sa == AF_INET)
Eric Paris48c62af2012-04-02 13:15:44 -04004452 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004453 else
Eric Paris48c62af2012-04-02 13:15:44 -04004454 ad.u.net->v6info.saddr = addr6->sin6_addr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004455
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004456 err = avc_has_perm(&selinux_state,
4457 sksec->sid, sid,
Paul Moore253bfae2010-04-22 14:46:19 -04004458 sksec->sclass, node_perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004459 if (err)
4460 goto out;
4461 }
4462out:
4463 return err;
Alexey Kodanev0f8db8c2018-05-11 20:15:11 +03004464err_af:
4465 /* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4466 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4467 return -EINVAL;
4468 return -EAFNOSUPPORT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004469}
4470
Richard Hainesd4529302018-02-13 20:57:18 +00004471/* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
Mauro Carvalho Chehab5fb94e92018-05-08 15:14:57 -03004472 * and sctp_sendmsg(3) as described in Documentation/security/LSM-sctp.rst
Richard Hainesd4529302018-02-13 20:57:18 +00004473 */
4474static int selinux_socket_connect_helper(struct socket *sock,
4475 struct sockaddr *address, int addrlen)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004476{
Paul Moore014ab192008-10-10 10:16:33 -04004477 struct sock *sk = sock->sk;
Paul Moore253bfae2010-04-22 14:46:19 -04004478 struct sk_security_struct *sksec = sk->sk_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004479 int err;
4480
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004481 err = sock_has_perm(sk, SOCKET__CONNECT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004482 if (err)
4483 return err;
4484
4485 /*
Richard Hainesd4529302018-02-13 20:57:18 +00004486 * If a TCP, DCCP or SCTP socket, check name_connect permission
4487 * for the port.
Linus Torvalds1da177e2005-04-16 15:20:36 -07004488 */
Paul Moore253bfae2010-04-22 14:46:19 -04004489 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
Richard Hainesd4529302018-02-13 20:57:18 +00004490 sksec->sclass == SECCLASS_DCCP_SOCKET ||
4491 sksec->sclass == SECCLASS_SCTP_SOCKET) {
Thomas Liu2bf49692009-07-14 12:14:09 -04004492 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004493 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004494 struct sockaddr_in *addr4 = NULL;
4495 struct sockaddr_in6 *addr6 = NULL;
4496 unsigned short snum;
James Morris2ee92d42006-11-13 16:09:01 -08004497 u32 sid, perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004498
Richard Hainesd4529302018-02-13 20:57:18 +00004499 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4500 * that validates multiple connect addresses. Because of this
4501 * need to check address->sa_family as it is possible to have
4502 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4503 */
Richard Haines68741a8a2018-03-02 19:54:34 +00004504 switch (address->sa_family) {
4505 case AF_INET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004506 addr4 = (struct sockaddr_in *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07004507 if (addrlen < sizeof(struct sockaddr_in))
Linus Torvalds1da177e2005-04-16 15:20:36 -07004508 return -EINVAL;
4509 snum = ntohs(addr4->sin_port);
Richard Haines68741a8a2018-03-02 19:54:34 +00004510 break;
4511 case AF_INET6:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004512 addr6 = (struct sockaddr_in6 *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07004513 if (addrlen < SIN6_LEN_RFC2133)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004514 return -EINVAL;
4515 snum = ntohs(addr6->sin6_port);
Richard Haines68741a8a2018-03-02 19:54:34 +00004516 break;
4517 default:
4518 /* Note that SCTP services expect -EINVAL, whereas
4519 * others expect -EAFNOSUPPORT.
4520 */
4521 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4522 return -EINVAL;
4523 else
4524 return -EAFNOSUPPORT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004525 }
4526
Paul Moore3e1121722008-04-10 10:48:14 -04004527 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004528 if (err)
Richard Hainesd4529302018-02-13 20:57:18 +00004529 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004530
Richard Hainesd4529302018-02-13 20:57:18 +00004531 switch (sksec->sclass) {
4532 case SECCLASS_TCP_SOCKET:
4533 perm = TCP_SOCKET__NAME_CONNECT;
4534 break;
4535 case SECCLASS_DCCP_SOCKET:
4536 perm = DCCP_SOCKET__NAME_CONNECT;
4537 break;
4538 case SECCLASS_SCTP_SOCKET:
4539 perm = SCTP_SOCKET__NAME_CONNECT;
4540 break;
4541 }
James Morris2ee92d42006-11-13 16:09:01 -08004542
Eric Paris50c205f2012-04-04 15:01:43 -04004543 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004544 ad.u.net = &net;
4545 ad.u.net->dport = htons(snum);
Alexey Kodanev88b7d372018-05-11 20:15:12 +03004546 ad.u.net->family = address->sa_family;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004547 err = avc_has_perm(&selinux_state,
4548 sksec->sid, sid, sksec->sclass, perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004549 if (err)
Richard Hainesd4529302018-02-13 20:57:18 +00004550 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004551 }
4552
Richard Hainesd4529302018-02-13 20:57:18 +00004553 return 0;
4554}
Paul Moore014ab192008-10-10 10:16:33 -04004555
Richard Hainesd4529302018-02-13 20:57:18 +00004556/* Supports connect(2), see comments in selinux_socket_connect_helper() */
4557static int selinux_socket_connect(struct socket *sock,
4558 struct sockaddr *address, int addrlen)
4559{
4560 int err;
4561 struct sock *sk = sock->sk;
4562
4563 err = selinux_socket_connect_helper(sock, address, addrlen);
4564 if (err)
4565 return err;
4566
4567 return selinux_netlbl_socket_connect(sk, address);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004568}
4569
4570static int selinux_socket_listen(struct socket *sock, int backlog)
4571{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004572 return sock_has_perm(sock->sk, SOCKET__LISTEN);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004573}
4574
4575static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4576{
4577 int err;
4578 struct inode_security_struct *isec;
4579 struct inode_security_struct *newisec;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004580 u16 sclass;
4581 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004582
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004583 err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004584 if (err)
4585 return err;
4586
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05004587 isec = inode_security_novalidate(SOCK_INODE(sock));
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004588 spin_lock(&isec->lock);
4589 sclass = isec->sclass;
4590 sid = isec->sid;
4591 spin_unlock(&isec->lock);
4592
4593 newisec = inode_security_novalidate(SOCK_INODE(newsock));
4594 newisec->sclass = sclass;
4595 newisec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05004596 newisec->initialized = LABEL_INITIALIZED;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004597
4598 return 0;
4599}
4600
4601static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
Eric Paris828dfe12008-04-17 13:17:49 -04004602 int size)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004603{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004604 return sock_has_perm(sock->sk, SOCKET__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004605}
4606
4607static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4608 int size, int flags)
4609{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004610 return sock_has_perm(sock->sk, SOCKET__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004611}
4612
4613static int selinux_socket_getsockname(struct socket *sock)
4614{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004615 return sock_has_perm(sock->sk, SOCKET__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004616}
4617
4618static int selinux_socket_getpeername(struct socket *sock)
4619{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004620 return sock_has_perm(sock->sk, SOCKET__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004621}
4622
Eric Paris828dfe12008-04-17 13:17:49 -04004623static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004624{
Paul Mooref8687af2006-10-30 15:22:15 -08004625 int err;
4626
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004627 err = sock_has_perm(sock->sk, SOCKET__SETOPT);
Paul Mooref8687af2006-10-30 15:22:15 -08004628 if (err)
4629 return err;
4630
4631 return selinux_netlbl_socket_setsockopt(sock, level, optname);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004632}
4633
4634static int selinux_socket_getsockopt(struct socket *sock, int level,
4635 int optname)
4636{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004637 return sock_has_perm(sock->sk, SOCKET__GETOPT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004638}
4639
4640static int selinux_socket_shutdown(struct socket *sock, int how)
4641{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004642 return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004643}
4644
David S. Miller3610cda2011-01-05 15:38:53 -08004645static int selinux_socket_unix_stream_connect(struct sock *sock,
4646 struct sock *other,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004647 struct sock *newsk)
4648{
David S. Miller3610cda2011-01-05 15:38:53 -08004649 struct sk_security_struct *sksec_sock = sock->sk_security;
4650 struct sk_security_struct *sksec_other = other->sk_security;
Paul Moore4d1e2452010-04-22 14:46:18 -04004651 struct sk_security_struct *sksec_new = newsk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004652 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004653 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004654 int err;
4655
Eric Paris50c205f2012-04-04 15:01:43 -04004656 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004657 ad.u.net = &net;
4658 ad.u.net->sk = other;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004659
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004660 err = avc_has_perm(&selinux_state,
4661 sksec_sock->sid, sksec_other->sid,
Paul Moore4d1e2452010-04-22 14:46:18 -04004662 sksec_other->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004663 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4664 if (err)
4665 return err;
4666
Linus Torvalds1da177e2005-04-16 15:20:36 -07004667 /* server child socket */
Paul Moore4d1e2452010-04-22 14:46:18 -04004668 sksec_new->peer_sid = sksec_sock->sid;
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004669 err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
4670 sksec_sock->sid, &sksec_new->sid);
Paul Moore4d1e2452010-04-22 14:46:18 -04004671 if (err)
4672 return err;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004673
Paul Moore4d1e2452010-04-22 14:46:18 -04004674 /* connecting socket */
4675 sksec_sock->peer_sid = sksec_new->sid;
4676
4677 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004678}
4679
4680static int selinux_socket_unix_may_send(struct socket *sock,
4681 struct socket *other)
4682{
Paul Moore253bfae2010-04-22 14:46:19 -04004683 struct sk_security_struct *ssec = sock->sk->sk_security;
4684 struct sk_security_struct *osec = other->sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004685 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004686 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004687
Eric Paris50c205f2012-04-04 15:01:43 -04004688 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004689 ad.u.net = &net;
4690 ad.u.net->sk = other->sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004691
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004692 return avc_has_perm(&selinux_state,
4693 ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
Paul Moore253bfae2010-04-22 14:46:19 -04004694 &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004695}
4696
Paul Moorecbe0d6e2014-09-10 17:09:57 -04004697static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4698 char *addrp, u16 family, u32 peer_sid,
Thomas Liu2bf49692009-07-14 12:14:09 -04004699 struct common_audit_data *ad)
Paul Mooreeffad8d2008-01-29 08:49:27 -05004700{
4701 int err;
4702 u32 if_sid;
4703 u32 node_sid;
4704
Paul Moorecbe0d6e2014-09-10 17:09:57 -04004705 err = sel_netif_sid(ns, ifindex, &if_sid);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004706 if (err)
4707 return err;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004708 err = avc_has_perm(&selinux_state,
4709 peer_sid, if_sid,
Paul Mooreeffad8d2008-01-29 08:49:27 -05004710 SECCLASS_NETIF, NETIF__INGRESS, ad);
4711 if (err)
4712 return err;
4713
4714 err = sel_netnode_sid(addrp, family, &node_sid);
4715 if (err)
4716 return err;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004717 return avc_has_perm(&selinux_state,
4718 peer_sid, node_sid,
Paul Mooreeffad8d2008-01-29 08:49:27 -05004719 SECCLASS_NODE, NODE__RECVFROM, ad);
4720}
4721
Paul Moore220deb92008-01-29 08:38:23 -05004722static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
Paul Moored8395c82008-10-10 10:16:30 -04004723 u16 family)
Paul Moore220deb92008-01-29 08:38:23 -05004724{
Paul Moore277d3422008-12-31 12:54:11 -05004725 int err = 0;
Paul Moore220deb92008-01-29 08:38:23 -05004726 struct sk_security_struct *sksec = sk->sk_security;
Paul Moore220deb92008-01-29 08:38:23 -05004727 u32 sk_sid = sksec->sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04004728 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004729 struct lsm_network_audit net = {0,};
Paul Moored8395c82008-10-10 10:16:30 -04004730 char *addrp;
4731
Eric Paris50c205f2012-04-04 15:01:43 -04004732 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004733 ad.u.net = &net;
4734 ad.u.net->netif = skb->skb_iif;
4735 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04004736 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4737 if (err)
4738 return err;
Paul Moore220deb92008-01-29 08:38:23 -05004739
Paul Moore58bfbb52009-03-27 17:10:41 -04004740 if (selinux_secmark_enabled()) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004741 err = avc_has_perm(&selinux_state,
4742 sk_sid, skb->secmark, SECCLASS_PACKET,
Paul Moored8395c82008-10-10 10:16:30 -04004743 PACKET__RECV, &ad);
Paul Moore58bfbb52009-03-27 17:10:41 -04004744 if (err)
4745 return err;
4746 }
Paul Moore220deb92008-01-29 08:38:23 -05004747
Steffen Klassertb9679a72011-02-23 12:55:21 +01004748 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4749 if (err)
4750 return err;
4751 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004752
James Morris4e5ab4c2006-06-09 00:33:33 -07004753 return err;
4754}
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004755
James Morris4e5ab4c2006-06-09 00:33:33 -07004756static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4757{
Paul Moore220deb92008-01-29 08:38:23 -05004758 int err;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004759 struct sk_security_struct *sksec = sk->sk_security;
Paul Moore220deb92008-01-29 08:38:23 -05004760 u16 family = sk->sk_family;
4761 u32 sk_sid = sksec->sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04004762 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004763 struct lsm_network_audit net = {0,};
Paul Moore220deb92008-01-29 08:38:23 -05004764 char *addrp;
Paul Moored8395c82008-10-10 10:16:30 -04004765 u8 secmark_active;
4766 u8 peerlbl_active;
James Morris4e5ab4c2006-06-09 00:33:33 -07004767
James Morris4e5ab4c2006-06-09 00:33:33 -07004768 if (family != PF_INET && family != PF_INET6)
Paul Moore220deb92008-01-29 08:38:23 -05004769 return 0;
James Morris4e5ab4c2006-06-09 00:33:33 -07004770
4771 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
Al Viro87fcd702006-12-04 22:00:55 +00004772 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
James Morris4e5ab4c2006-06-09 00:33:33 -07004773 family = PF_INET;
4774
Paul Moored8395c82008-10-10 10:16:30 -04004775 /* If any sort of compatibility mode is enabled then handoff processing
4776 * to the selinux_sock_rcv_skb_compat() function to deal with the
4777 * special handling. We do this in an attempt to keep this function
4778 * as fast and as clean as possible. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004779 if (!selinux_policycap_netpeer())
Paul Moored8395c82008-10-10 10:16:30 -04004780 return selinux_sock_rcv_skb_compat(sk, skb, family);
4781
4782 secmark_active = selinux_secmark_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04004783 peerlbl_active = selinux_peerlbl_enabled();
Paul Moored8395c82008-10-10 10:16:30 -04004784 if (!secmark_active && !peerlbl_active)
4785 return 0;
4786
Eric Paris50c205f2012-04-04 15:01:43 -04004787 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004788 ad.u.net = &net;
4789 ad.u.net->netif = skb->skb_iif;
4790 ad.u.net->family = family;
Paul Moore224dfbd2008-01-29 08:38:13 -05004791 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
James Morris4e5ab4c2006-06-09 00:33:33 -07004792 if (err)
Paul Moore220deb92008-01-29 08:38:23 -05004793 return err;
James Morris4e5ab4c2006-06-09 00:33:33 -07004794
Paul Moored8395c82008-10-10 10:16:30 -04004795 if (peerlbl_active) {
Paul Moored621d352008-01-29 08:43:36 -05004796 u32 peer_sid;
4797
4798 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4799 if (err)
4800 return err;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04004801 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4802 addrp, family, peer_sid, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04004803 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04004804 selinux_netlbl_err(skb, family, err, 0);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004805 return err;
Paul Mooredfaebe92008-10-10 10:16:31 -04004806 }
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004807 err = avc_has_perm(&selinux_state,
4808 sk_sid, peer_sid, SECCLASS_PEER,
Paul Moored621d352008-01-29 08:43:36 -05004809 PEER__RECV, &ad);
Chad Hanson46d01d62013-12-23 17:45:01 -05004810 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04004811 selinux_netlbl_err(skb, family, err, 0);
Chad Hanson46d01d62013-12-23 17:45:01 -05004812 return err;
4813 }
Paul Moored621d352008-01-29 08:43:36 -05004814 }
4815
Paul Moored8395c82008-10-10 10:16:30 -04004816 if (secmark_active) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004817 err = avc_has_perm(&selinux_state,
4818 sk_sid, skb->secmark, SECCLASS_PACKET,
Paul Mooreeffad8d2008-01-29 08:49:27 -05004819 PACKET__RECV, &ad);
4820 if (err)
4821 return err;
4822 }
4823
Paul Moored621d352008-01-29 08:43:36 -05004824 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004825}
4826
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004827static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4828 int __user *optlen, unsigned len)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004829{
4830 int err = 0;
4831 char *scontext;
4832 u32 scontext_len;
Paul Moore253bfae2010-04-22 14:46:19 -04004833 struct sk_security_struct *sksec = sock->sk->sk_security;
Paul Moore3de4bab2006-11-17 17:38:54 -05004834 u32 peer_sid = SECSID_NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004835
Paul Moore253bfae2010-04-22 14:46:19 -04004836 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
Richard Hainesd4529302018-02-13 20:57:18 +00004837 sksec->sclass == SECCLASS_TCP_SOCKET ||
4838 sksec->sclass == SECCLASS_SCTP_SOCKET)
Eric Parisdd3e7832010-04-07 15:08:46 -04004839 peer_sid = sksec->peer_sid;
Paul Moore253bfae2010-04-22 14:46:19 -04004840 if (peer_sid == SECSID_NULL)
4841 return -ENOPROTOOPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004842
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004843 err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
4844 &scontext_len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004845 if (err)
Paul Moore253bfae2010-04-22 14:46:19 -04004846 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004847
4848 if (scontext_len > len) {
4849 err = -ERANGE;
4850 goto out_len;
4851 }
4852
4853 if (copy_to_user(optval, scontext, scontext_len))
4854 err = -EFAULT;
4855
4856out_len:
4857 if (put_user(scontext_len, optlen))
4858 err = -EFAULT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004859 kfree(scontext);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004860 return err;
4861}
4862
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07004863static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004864{
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07004865 u32 peer_secid = SECSID_NULL;
Paul Moore75e22912008-01-29 08:38:04 -05004866 u16 family;
Paul Moore899134f2016-03-28 15:19:10 -04004867 struct inode_security_struct *isec;
Catherine Zhang877ce7c2006-06-29 12:27:47 -07004868
Paul Mooreaa862902008-10-10 10:16:29 -04004869 if (skb && skb->protocol == htons(ETH_P_IP))
4870 family = PF_INET;
4871 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4872 family = PF_INET6;
4873 else if (sock)
Paul Moore75e22912008-01-29 08:38:04 -05004874 family = sock->sk->sk_family;
Paul Moore75e22912008-01-29 08:38:04 -05004875 else
4876 goto out;
4877
Paul Moore899134f2016-03-28 15:19:10 -04004878 if (sock && family == PF_UNIX) {
4879 isec = inode_security_novalidate(SOCK_INODE(sock));
4880 peer_secid = isec->sid;
4881 } else if (skb)
Paul Moore220deb92008-01-29 08:38:23 -05004882 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004883
Paul Moore75e22912008-01-29 08:38:04 -05004884out:
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07004885 *secid = peer_secid;
Paul Moore75e22912008-01-29 08:38:04 -05004886 if (peer_secid == SECSID_NULL)
4887 return -EINVAL;
4888 return 0;
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004889}
4890
Al Viro7d877f32005-10-21 03:20:43 -04004891static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004892{
Paul Moore84914b72010-04-22 14:46:18 -04004893 struct sk_security_struct *sksec;
4894
4895 sksec = kzalloc(sizeof(*sksec), priority);
4896 if (!sksec)
4897 return -ENOMEM;
4898
4899 sksec->peer_sid = SECINITSID_UNLABELED;
4900 sksec->sid = SECINITSID_UNLABELED;
Stephen Smalley5dee25d2015-07-10 17:19:57 -04004901 sksec->sclass = SECCLASS_SOCKET;
Paul Moore84914b72010-04-22 14:46:18 -04004902 selinux_netlbl_sk_security_reset(sksec);
4903 sk->sk_security = sksec;
4904
4905 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004906}
4907
4908static void selinux_sk_free_security(struct sock *sk)
4909{
Paul Moore84914b72010-04-22 14:46:18 -04004910 struct sk_security_struct *sksec = sk->sk_security;
4911
4912 sk->sk_security = NULL;
4913 selinux_netlbl_sk_security_free(sksec);
4914 kfree(sksec);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004915}
4916
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004917static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4918{
Eric Parisdd3e7832010-04-07 15:08:46 -04004919 struct sk_security_struct *sksec = sk->sk_security;
4920 struct sk_security_struct *newsksec = newsk->sk_security;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004921
Eric Parisdd3e7832010-04-07 15:08:46 -04004922 newsksec->sid = sksec->sid;
4923 newsksec->peer_sid = sksec->peer_sid;
4924 newsksec->sclass = sksec->sclass;
Paul Moore99f59ed2006-08-29 17:53:48 -07004925
Eric Parisdd3e7832010-04-07 15:08:46 -04004926 selinux_netlbl_sk_security_reset(newsksec);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004927}
4928
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07004929static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004930{
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004931 if (!sk)
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07004932 *secid = SECINITSID_ANY_SOCKET;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004933 else {
4934 struct sk_security_struct *sksec = sk->sk_security;
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004935
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07004936 *secid = sksec->sid;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004937 }
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004938}
4939
Eric Paris828dfe12008-04-17 13:17:49 -04004940static void selinux_sock_graft(struct sock *sk, struct socket *parent)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004941{
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05004942 struct inode_security_struct *isec =
4943 inode_security_novalidate(SOCK_INODE(parent));
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004944 struct sk_security_struct *sksec = sk->sk_security;
4945
Paul Moore2873ead2014-07-28 10:42:48 -04004946 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4947 sk->sk_family == PF_UNIX)
David Woodhouse2148ccc2006-09-29 15:50:25 -07004948 isec->sid = sksec->sid;
Paul Moore220deb92008-01-29 08:38:23 -05004949 sksec->sclass = isec->sclass;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004950}
4951
Richard Hainesd4529302018-02-13 20:57:18 +00004952/* Called whenever SCTP receives an INIT chunk. This happens when an incoming
4953 * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
4954 * already present).
4955 */
4956static int selinux_sctp_assoc_request(struct sctp_endpoint *ep,
4957 struct sk_buff *skb)
4958{
4959 struct sk_security_struct *sksec = ep->base.sk->sk_security;
4960 struct common_audit_data ad;
4961 struct lsm_network_audit net = {0,};
4962 u8 peerlbl_active;
4963 u32 peer_sid = SECINITSID_UNLABELED;
4964 u32 conn_sid;
4965 int err = 0;
4966
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004967 if (!selinux_policycap_extsockclass())
Richard Hainesd4529302018-02-13 20:57:18 +00004968 return 0;
4969
4970 peerlbl_active = selinux_peerlbl_enabled();
4971
4972 if (peerlbl_active) {
4973 /* This will return peer_sid = SECSID_NULL if there are
4974 * no peer labels, see security_net_peersid_resolve().
4975 */
4976 err = selinux_skb_peerlbl_sid(skb, ep->base.sk->sk_family,
4977 &peer_sid);
4978 if (err)
4979 return err;
4980
4981 if (peer_sid == SECSID_NULL)
4982 peer_sid = SECINITSID_UNLABELED;
4983 }
4984
4985 if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
4986 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
4987
4988 /* Here as first association on socket. As the peer SID
4989 * was allowed by peer recv (and the netif/node checks),
4990 * then it is approved by policy and used as the primary
4991 * peer SID for getpeercon(3).
4992 */
4993 sksec->peer_sid = peer_sid;
4994 } else if (sksec->peer_sid != peer_sid) {
4995 /* Other association peer SIDs are checked to enforce
4996 * consistency among the peer SIDs.
4997 */
4998 ad.type = LSM_AUDIT_DATA_NET;
4999 ad.u.net = &net;
5000 ad.u.net->sk = ep->base.sk;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005001 err = avc_has_perm(&selinux_state,
5002 sksec->peer_sid, peer_sid, sksec->sclass,
Richard Hainesd4529302018-02-13 20:57:18 +00005003 SCTP_SOCKET__ASSOCIATION, &ad);
5004 if (err)
5005 return err;
5006 }
5007
5008 /* Compute the MLS component for the connection and store
5009 * the information in ep. This will be used by SCTP TCP type
5010 * sockets and peeled off connections as they cause a new
5011 * socket to be generated. selinux_sctp_sk_clone() will then
5012 * plug this into the new socket.
5013 */
5014 err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
5015 if (err)
5016 return err;
5017
5018 ep->secid = conn_sid;
5019 ep->peer_secid = peer_sid;
5020
5021 /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5022 return selinux_netlbl_sctp_assoc_request(ep, skb);
5023}
5024
5025/* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5026 * based on their @optname.
5027 */
5028static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5029 struct sockaddr *address,
5030 int addrlen)
5031{
5032 int len, err = 0, walk_size = 0;
5033 void *addr_buf;
5034 struct sockaddr *addr;
5035 struct socket *sock;
5036
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005037 if (!selinux_policycap_extsockclass())
Richard Hainesd4529302018-02-13 20:57:18 +00005038 return 0;
5039
5040 /* Process one or more addresses that may be IPv4 or IPv6 */
5041 sock = sk->sk_socket;
5042 addr_buf = address;
5043
5044 while (walk_size < addrlen) {
Ondrej Mosnacekc1383252018-11-13 16:16:08 +01005045 if (walk_size + sizeof(sa_family_t) > addrlen)
5046 return -EINVAL;
5047
Richard Hainesd4529302018-02-13 20:57:18 +00005048 addr = addr_buf;
5049 switch (addr->sa_family) {
Alexey Kodanev4152dc92018-05-11 20:15:13 +03005050 case AF_UNSPEC:
Richard Hainesd4529302018-02-13 20:57:18 +00005051 case AF_INET:
5052 len = sizeof(struct sockaddr_in);
5053 break;
5054 case AF_INET6:
5055 len = sizeof(struct sockaddr_in6);
5056 break;
5057 default:
Alexey Kodanev4152dc92018-05-11 20:15:13 +03005058 return -EINVAL;
Richard Hainesd4529302018-02-13 20:57:18 +00005059 }
5060
5061 err = -EINVAL;
5062 switch (optname) {
5063 /* Bind checks */
5064 case SCTP_PRIMARY_ADDR:
5065 case SCTP_SET_PEER_PRIMARY_ADDR:
5066 case SCTP_SOCKOPT_BINDX_ADD:
5067 err = selinux_socket_bind(sock, addr, len);
5068 break;
5069 /* Connect checks */
5070 case SCTP_SOCKOPT_CONNECTX:
5071 case SCTP_PARAM_SET_PRIMARY:
5072 case SCTP_PARAM_ADD_IP:
5073 case SCTP_SENDMSG_CONNECT:
5074 err = selinux_socket_connect_helper(sock, addr, len);
5075 if (err)
5076 return err;
5077
5078 /* As selinux_sctp_bind_connect() is called by the
5079 * SCTP protocol layer, the socket is already locked,
5080 * therefore selinux_netlbl_socket_connect_locked() is
5081 * is called here. The situations handled are:
5082 * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5083 * whenever a new IP address is added or when a new
5084 * primary address is selected.
5085 * Note that an SCTP connect(2) call happens before
5086 * the SCTP protocol layer and is handled via
5087 * selinux_socket_connect().
5088 */
5089 err = selinux_netlbl_socket_connect_locked(sk, addr);
5090 break;
5091 }
5092
5093 if (err)
5094 return err;
5095
5096 addr_buf += len;
5097 walk_size += len;
5098 }
5099
5100 return 0;
5101}
5102
5103/* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5104static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
5105 struct sock *newsk)
5106{
5107 struct sk_security_struct *sksec = sk->sk_security;
5108 struct sk_security_struct *newsksec = newsk->sk_security;
5109
5110 /* If policy does not support SECCLASS_SCTP_SOCKET then call
5111 * the non-sctp clone version.
5112 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005113 if (!selinux_policycap_extsockclass())
Richard Hainesd4529302018-02-13 20:57:18 +00005114 return selinux_sk_clone_security(sk, newsk);
5115
5116 newsksec->sid = ep->secid;
5117 newsksec->peer_sid = ep->peer_secid;
5118 newsksec->sclass = sksec->sclass;
5119 selinux_netlbl_sctp_sk_clone(sk, newsk);
5120}
5121
Adrian Bunk9a673e52006-08-15 00:03:53 -07005122static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
5123 struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005124{
5125 struct sk_security_struct *sksec = sk->sk_security;
5126 int err;
Paul Moore0b1f24e2013-12-03 11:39:13 -05005127 u16 family = req->rsk_ops->family;
Paul Moore446b8022013-12-04 16:10:51 -05005128 u32 connsid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005129 u32 peersid;
5130
Paul Mooreaa862902008-10-10 10:16:29 -04005131 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
Paul Moore220deb92008-01-29 08:38:23 -05005132 if (err)
5133 return err;
Paul Moore446b8022013-12-04 16:10:51 -05005134 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5135 if (err)
5136 return err;
5137 req->secid = connsid;
5138 req->peer_secid = peersid;
Venkat Yekkiralaa51c64f2006-07-27 22:01:34 -07005139
Paul Moore389fb8002009-03-27 17:10:34 -04005140 return selinux_netlbl_inet_conn_request(req, family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005141}
5142
Adrian Bunk9a673e52006-08-15 00:03:53 -07005143static void selinux_inet_csk_clone(struct sock *newsk,
5144 const struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005145{
5146 struct sk_security_struct *newsksec = newsk->sk_security;
5147
5148 newsksec->sid = req->secid;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005149 newsksec->peer_sid = req->peer_secid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005150 /* NOTE: Ideally, we should also get the isec->sid for the
5151 new socket in sync, but we don't have the isec available yet.
5152 So we will wait until sock_graft to do it, by which
5153 time it will have been created and available. */
Paul Moore99f59ed2006-08-29 17:53:48 -07005154
Paul Moore9f2ad662006-11-17 17:38:53 -05005155 /* We don't need to take any sort of lock here as we are the only
5156 * thread with access to newsksec */
Paul Moore389fb8002009-03-27 17:10:34 -04005157 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005158}
5159
Paul Moore014ab192008-10-10 10:16:33 -04005160static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005161{
Paul Mooreaa862902008-10-10 10:16:29 -04005162 u16 family = sk->sk_family;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005163 struct sk_security_struct *sksec = sk->sk_security;
5164
Paul Mooreaa862902008-10-10 10:16:29 -04005165 /* handle mapped IPv4 packets arriving via IPv6 sockets */
5166 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5167 family = PF_INET;
5168
5169 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005170}
5171
Eric Paris2606fd12010-10-13 16:24:41 -04005172static int selinux_secmark_relabel_packet(u32 sid)
5173{
5174 const struct task_security_struct *__tsec;
5175 u32 tsid;
5176
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07005177 __tsec = selinux_cred(current_cred());
Eric Paris2606fd12010-10-13 16:24:41 -04005178 tsid = __tsec->sid;
5179
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005180 return avc_has_perm(&selinux_state,
5181 tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5182 NULL);
Eric Paris2606fd12010-10-13 16:24:41 -04005183}
5184
5185static void selinux_secmark_refcount_inc(void)
5186{
5187 atomic_inc(&selinux_secmark_refcount);
5188}
5189
5190static void selinux_secmark_refcount_dec(void)
5191{
5192 atomic_dec(&selinux_secmark_refcount);
5193}
5194
Adrian Bunk9a673e52006-08-15 00:03:53 -07005195static void selinux_req_classify_flow(const struct request_sock *req,
5196 struct flowi *fl)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005197{
David S. Miller1d28f422011-03-12 00:29:39 -05005198 fl->flowi_secid = req->secid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005199}
5200
Paul Moore5dbbaf22013-01-14 07:12:19 +00005201static int selinux_tun_dev_alloc_security(void **security)
5202{
5203 struct tun_security_struct *tunsec;
5204
5205 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5206 if (!tunsec)
5207 return -ENOMEM;
5208 tunsec->sid = current_sid();
5209
5210 *security = tunsec;
5211 return 0;
5212}
5213
5214static void selinux_tun_dev_free_security(void *security)
5215{
5216 kfree(security);
5217}
5218
Paul Mooreed6d76e2009-08-28 18:12:49 -04005219static int selinux_tun_dev_create(void)
5220{
5221 u32 sid = current_sid();
5222
5223 /* we aren't taking into account the "sockcreate" SID since the socket
5224 * that is being created here is not a socket in the traditional sense,
5225 * instead it is a private sock, accessible only to the kernel, and
5226 * representing a wide range of network traffic spanning multiple
5227 * connections unlike traditional sockets - check the TUN driver to
5228 * get a better understanding of why this socket is special */
5229
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005230 return avc_has_perm(&selinux_state,
5231 sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
Paul Mooreed6d76e2009-08-28 18:12:49 -04005232 NULL);
5233}
5234
Paul Moore5dbbaf22013-01-14 07:12:19 +00005235static int selinux_tun_dev_attach_queue(void *security)
Paul Mooreed6d76e2009-08-28 18:12:49 -04005236{
Paul Moore5dbbaf22013-01-14 07:12:19 +00005237 struct tun_security_struct *tunsec = security;
5238
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005239 return avc_has_perm(&selinux_state,
5240 current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
Paul Moore5dbbaf22013-01-14 07:12:19 +00005241 TUN_SOCKET__ATTACH_QUEUE, NULL);
5242}
5243
5244static int selinux_tun_dev_attach(struct sock *sk, void *security)
5245{
5246 struct tun_security_struct *tunsec = security;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005247 struct sk_security_struct *sksec = sk->sk_security;
5248
5249 /* we don't currently perform any NetLabel based labeling here and it
5250 * isn't clear that we would want to do so anyway; while we could apply
5251 * labeling without the support of the TUN user the resulting labeled
5252 * traffic from the other end of the connection would almost certainly
5253 * cause confusion to the TUN user that had no idea network labeling
5254 * protocols were being used */
5255
Paul Moore5dbbaf22013-01-14 07:12:19 +00005256 sksec->sid = tunsec->sid;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005257 sksec->sclass = SECCLASS_TUN_SOCKET;
Paul Moore5dbbaf22013-01-14 07:12:19 +00005258
5259 return 0;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005260}
5261
Paul Moore5dbbaf22013-01-14 07:12:19 +00005262static int selinux_tun_dev_open(void *security)
Paul Mooreed6d76e2009-08-28 18:12:49 -04005263{
Paul Moore5dbbaf22013-01-14 07:12:19 +00005264 struct tun_security_struct *tunsec = security;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005265 u32 sid = current_sid();
5266 int err;
5267
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005268 err = avc_has_perm(&selinux_state,
5269 sid, tunsec->sid, SECCLASS_TUN_SOCKET,
Paul Mooreed6d76e2009-08-28 18:12:49 -04005270 TUN_SOCKET__RELABELFROM, NULL);
5271 if (err)
5272 return err;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005273 err = avc_has_perm(&selinux_state,
5274 sid, sid, SECCLASS_TUN_SOCKET,
Paul Mooreed6d76e2009-08-28 18:12:49 -04005275 TUN_SOCKET__RELABELTO, NULL);
5276 if (err)
5277 return err;
Paul Moore5dbbaf22013-01-14 07:12:19 +00005278 tunsec->sid = sid;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005279
5280 return 0;
5281}
5282
Linus Torvalds1da177e2005-04-16 15:20:36 -07005283static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5284{
5285 int err = 0;
5286 u32 perm;
5287 struct nlmsghdr *nlh;
Paul Moore253bfae2010-04-22 14:46:19 -04005288 struct sk_security_struct *sksec = sk->sk_security;
Eric Paris828dfe12008-04-17 13:17:49 -04005289
Hong zhi guo77954982013-03-27 06:49:35 +00005290 if (skb->len < NLMSG_HDRLEN) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005291 err = -EINVAL;
5292 goto out;
5293 }
Arnaldo Carvalho de Melob529ccf2007-04-25 19:08:35 -07005294 nlh = nlmsg_hdr(skb);
Eric Paris828dfe12008-04-17 13:17:49 -04005295
Paul Moore253bfae2010-04-22 14:46:19 -04005296 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005297 if (err) {
5298 if (err == -EINVAL) {
Vladis Dronov76319942015-12-24 11:09:41 -05005299 pr_warn_ratelimited("SELinux: unrecognized netlink"
5300 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5301 " pig=%d comm=%s\n",
Marek Milkoviccded3ff2015-06-04 16:22:16 -04005302 sk->sk_protocol, nlh->nlmsg_type,
Vladis Dronov76319942015-12-24 11:09:41 -05005303 secclass_map[sksec->sclass - 1].name,
5304 task_pid_nr(current), current->comm);
Paul Mooree5a5ca92018-03-01 17:38:30 -05005305 if (!enforcing_enabled(&selinux_state) ||
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005306 security_get_allow_unknown(&selinux_state))
Linus Torvalds1da177e2005-04-16 15:20:36 -07005307 err = 0;
5308 }
5309
5310 /* Ignore */
5311 if (err == -ENOENT)
5312 err = 0;
5313 goto out;
5314 }
5315
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005316 err = sock_has_perm(sk, perm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005317out:
5318 return err;
5319}
5320
5321#ifdef CONFIG_NETFILTER
5322
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005323static unsigned int selinux_ip_forward(struct sk_buff *skb,
5324 const struct net_device *indev,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005325 u16 family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005326{
Paul Mooredfaebe92008-10-10 10:16:31 -04005327 int err;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005328 char *addrp;
5329 u32 peer_sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04005330 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005331 struct lsm_network_audit net = {0,};
Paul Mooreeffad8d2008-01-29 08:49:27 -05005332 u8 secmark_active;
Paul Moore948bf852008-10-10 10:16:32 -04005333 u8 netlbl_active;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005334 u8 peerlbl_active;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005335
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005336 if (!selinux_policycap_netpeer())
Paul Mooreeffad8d2008-01-29 08:49:27 -05005337 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005338
Paul Mooreeffad8d2008-01-29 08:49:27 -05005339 secmark_active = selinux_secmark_enabled();
Paul Moore948bf852008-10-10 10:16:32 -04005340 netlbl_active = netlbl_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04005341 peerlbl_active = selinux_peerlbl_enabled();
Paul Mooreeffad8d2008-01-29 08:49:27 -05005342 if (!secmark_active && !peerlbl_active)
5343 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005344
Paul Moored8395c82008-10-10 10:16:30 -04005345 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5346 return NF_DROP;
5347
Eric Paris50c205f2012-04-04 15:01:43 -04005348 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005349 ad.u.net = &net;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005350 ad.u.net->netif = indev->ifindex;
Eric Paris48c62af2012-04-02 13:15:44 -04005351 ad.u.net->family = family;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005352 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5353 return NF_DROP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005354
Paul Mooredfaebe92008-10-10 10:16:31 -04005355 if (peerlbl_active) {
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005356 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5357 addrp, family, peer_sid, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04005358 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04005359 selinux_netlbl_err(skb, family, err, 1);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005360 return NF_DROP;
Paul Mooredfaebe92008-10-10 10:16:31 -04005361 }
5362 }
Paul Mooreeffad8d2008-01-29 08:49:27 -05005363
5364 if (secmark_active)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005365 if (avc_has_perm(&selinux_state,
5366 peer_sid, skb->secmark,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005367 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5368 return NF_DROP;
5369
Paul Moore948bf852008-10-10 10:16:32 -04005370 if (netlbl_active)
5371 /* we do this in the FORWARD path and not the POST_ROUTING
5372 * path because we want to make sure we apply the necessary
5373 * labeling before IPsec is applied so we can leverage AH
5374 * protection */
5375 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5376 return NF_DROP;
5377
Paul Mooreeffad8d2008-01-29 08:49:27 -05005378 return NF_ACCEPT;
5379}
5380
Eric W. Biederman06198b32015-09-18 14:33:06 -05005381static unsigned int selinux_ipv4_forward(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005382 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005383 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005384{
David S. Miller238e54c2015-04-03 20:32:56 -04005385 return selinux_ip_forward(skb, state->in, PF_INET);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005386}
5387
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005388#if IS_ENABLED(CONFIG_IPV6)
Eric W. Biederman06198b32015-09-18 14:33:06 -05005389static unsigned int selinux_ipv6_forward(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005390 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005391 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005392{
David S. Miller238e54c2015-04-03 20:32:56 -04005393 return selinux_ip_forward(skb, state->in, PF_INET6);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005394}
5395#endif /* IPV6 */
5396
Paul Moore948bf852008-10-10 10:16:32 -04005397static unsigned int selinux_ip_output(struct sk_buff *skb,
5398 u16 family)
5399{
Paul Moore47180062013-12-04 16:10:45 -05005400 struct sock *sk;
Paul Moore948bf852008-10-10 10:16:32 -04005401 u32 sid;
5402
5403 if (!netlbl_enabled())
5404 return NF_ACCEPT;
5405
5406 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5407 * because we want to make sure we apply the necessary labeling
5408 * before IPsec is applied so we can leverage AH protection */
Paul Moore47180062013-12-04 16:10:45 -05005409 sk = skb->sk;
5410 if (sk) {
5411 struct sk_security_struct *sksec;
5412
Eric Dumazete446f9d2015-10-08 05:01:55 -07005413 if (sk_listener(sk))
Paul Moore47180062013-12-04 16:10:45 -05005414 /* if the socket is the listening state then this
5415 * packet is a SYN-ACK packet which means it needs to
5416 * be labeled based on the connection/request_sock and
5417 * not the parent socket. unfortunately, we can't
5418 * lookup the request_sock yet as it isn't queued on
5419 * the parent socket until after the SYN-ACK is sent.
5420 * the "solution" is to simply pass the packet as-is
5421 * as any IP option based labeling should be copied
5422 * from the initial connection request (in the IP
5423 * layer). it is far from ideal, but until we get a
5424 * security label in the packet itself this is the
5425 * best we can do. */
5426 return NF_ACCEPT;
5427
5428 /* standard practice, label using the parent socket */
5429 sksec = sk->sk_security;
Paul Moore948bf852008-10-10 10:16:32 -04005430 sid = sksec->sid;
5431 } else
5432 sid = SECINITSID_KERNEL;
5433 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5434 return NF_DROP;
5435
5436 return NF_ACCEPT;
5437}
5438
Eric W. Biederman06198b32015-09-18 14:33:06 -05005439static unsigned int selinux_ipv4_output(void *priv,
Paul Moore948bf852008-10-10 10:16:32 -04005440 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005441 const struct nf_hook_state *state)
Paul Moore948bf852008-10-10 10:16:32 -04005442{
5443 return selinux_ip_output(skb, PF_INET);
5444}
5445
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005446#if IS_ENABLED(CONFIG_IPV6)
Huw Davies2917f572016-06-27 15:06:15 -04005447static unsigned int selinux_ipv6_output(void *priv,
5448 struct sk_buff *skb,
5449 const struct nf_hook_state *state)
5450{
5451 return selinux_ip_output(skb, PF_INET6);
5452}
5453#endif /* IPV6 */
5454
Paul Mooreeffad8d2008-01-29 08:49:27 -05005455static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5456 int ifindex,
Paul Moored8395c82008-10-10 10:16:30 -04005457 u16 family)
James Morris4e5ab4c2006-06-09 00:33:33 -07005458{
Eric Dumazet54abc682015-11-08 10:54:07 -08005459 struct sock *sk = skb_to_full_sk(skb);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005460 struct sk_security_struct *sksec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005461 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005462 struct lsm_network_audit net = {0,};
Paul Moored8395c82008-10-10 10:16:30 -04005463 char *addrp;
5464 u8 proto;
James Morris4e5ab4c2006-06-09 00:33:33 -07005465
Paul Mooreeffad8d2008-01-29 08:49:27 -05005466 if (sk == NULL)
5467 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005468 sksec = sk->sk_security;
James Morris4e5ab4c2006-06-09 00:33:33 -07005469
Eric Paris50c205f2012-04-04 15:01:43 -04005470 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005471 ad.u.net = &net;
5472 ad.u.net->netif = ifindex;
5473 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04005474 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5475 return NF_DROP;
5476
Paul Moore58bfbb52009-03-27 17:10:41 -04005477 if (selinux_secmark_enabled())
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005478 if (avc_has_perm(&selinux_state,
5479 sksec->sid, skb->secmark,
Paul Moored8395c82008-10-10 10:16:30 -04005480 SECCLASS_PACKET, PACKET__SEND, &ad))
Eric Paris2fe66ec2010-11-23 06:28:08 +00005481 return NF_DROP_ERR(-ECONNREFUSED);
James Morris4e5ab4c2006-06-09 00:33:33 -07005482
Steffen Klassertb9679a72011-02-23 12:55:21 +01005483 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5484 return NF_DROP_ERR(-ECONNREFUSED);
James Morris4e5ab4c2006-06-09 00:33:33 -07005485
Paul Mooreeffad8d2008-01-29 08:49:27 -05005486 return NF_ACCEPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005487}
5488
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005489static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5490 const struct net_device *outdev,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005491 u16 family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005492{
Paul Mooreeffad8d2008-01-29 08:49:27 -05005493 u32 secmark_perm;
5494 u32 peer_sid;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005495 int ifindex = outdev->ifindex;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005496 struct sock *sk;
Thomas Liu2bf49692009-07-14 12:14:09 -04005497 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005498 struct lsm_network_audit net = {0,};
Paul Mooreeffad8d2008-01-29 08:49:27 -05005499 char *addrp;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005500 u8 secmark_active;
5501 u8 peerlbl_active;
5502
Paul Mooreeffad8d2008-01-29 08:49:27 -05005503 /* If any sort of compatibility mode is enabled then handoff processing
5504 * to the selinux_ip_postroute_compat() function to deal with the
5505 * special handling. We do this in an attempt to keep this function
5506 * as fast and as clean as possible. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005507 if (!selinux_policycap_netpeer())
Paul Moored8395c82008-10-10 10:16:30 -04005508 return selinux_ip_postroute_compat(skb, ifindex, family);
Paul Moorec0828e52013-12-10 14:58:01 -05005509
Paul Mooreeffad8d2008-01-29 08:49:27 -05005510 secmark_active = selinux_secmark_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04005511 peerlbl_active = selinux_peerlbl_enabled();
Paul Mooreeffad8d2008-01-29 08:49:27 -05005512 if (!secmark_active && !peerlbl_active)
5513 return NF_ACCEPT;
5514
Eric Dumazet54abc682015-11-08 10:54:07 -08005515 sk = skb_to_full_sk(skb);
Paul Moorec0828e52013-12-10 14:58:01 -05005516
Paul Mooreeffad8d2008-01-29 08:49:27 -05005517#ifdef CONFIG_XFRM
5518 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5519 * packet transformation so allow the packet to pass without any checks
5520 * since we'll have another chance to perform access control checks
5521 * when the packet is on it's final way out.
5522 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
Paul Moorec0828e52013-12-10 14:58:01 -05005523 * is NULL, in this case go ahead and apply access control.
5524 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5525 * TCP listening state we cannot wait until the XFRM processing
5526 * is done as we will miss out on the SA label if we do;
5527 * unfortunately, this means more work, but it is only once per
5528 * connection. */
5529 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
Eric Dumazete446f9d2015-10-08 05:01:55 -07005530 !(sk && sk_listener(sk)))
Paul Mooreeffad8d2008-01-29 08:49:27 -05005531 return NF_ACCEPT;
5532#endif
Paul Mooreeffad8d2008-01-29 08:49:27 -05005533
Paul Moored8395c82008-10-10 10:16:30 -04005534 if (sk == NULL) {
Paul Moore446b8022013-12-04 16:10:51 -05005535 /* Without an associated socket the packet is either coming
5536 * from the kernel or it is being forwarded; check the packet
5537 * to determine which and if the packet is being forwarded
5538 * query the packet directly to determine the security label. */
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005539 if (skb->skb_iif) {
5540 secmark_perm = PACKET__FORWARD_OUT;
Paul Moored8395c82008-10-10 10:16:30 -04005541 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005542 return NF_DROP;
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005543 } else {
5544 secmark_perm = PACKET__SEND;
Paul Moored8395c82008-10-10 10:16:30 -04005545 peer_sid = SECINITSID_KERNEL;
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005546 }
Eric Dumazete446f9d2015-10-08 05:01:55 -07005547 } else if (sk_listener(sk)) {
Paul Moore446b8022013-12-04 16:10:51 -05005548 /* Locally generated packet but the associated socket is in the
5549 * listening state which means this is a SYN-ACK packet. In
5550 * this particular case the correct security label is assigned
5551 * to the connection/request_sock but unfortunately we can't
5552 * query the request_sock as it isn't queued on the parent
5553 * socket until after the SYN-ACK packet is sent; the only
5554 * viable choice is to regenerate the label like we do in
5555 * selinux_inet_conn_request(). See also selinux_ip_output()
5556 * for similar problems. */
5557 u32 skb_sid;
Eric Dumazete446f9d2015-10-08 05:01:55 -07005558 struct sk_security_struct *sksec;
5559
Eric Dumazete446f9d2015-10-08 05:01:55 -07005560 sksec = sk->sk_security;
Paul Moore446b8022013-12-04 16:10:51 -05005561 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5562 return NF_DROP;
Paul Moorec0828e52013-12-10 14:58:01 -05005563 /* At this point, if the returned skb peerlbl is SECSID_NULL
5564 * and the packet has been through at least one XFRM
5565 * transformation then we must be dealing with the "final"
5566 * form of labeled IPsec packet; since we've already applied
5567 * all of our access controls on this packet we can safely
5568 * pass the packet. */
5569 if (skb_sid == SECSID_NULL) {
5570 switch (family) {
5571 case PF_INET:
5572 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5573 return NF_ACCEPT;
5574 break;
5575 case PF_INET6:
5576 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5577 return NF_ACCEPT;
Paul Moorea7a91a12014-09-03 10:51:59 -04005578 break;
Paul Moorec0828e52013-12-10 14:58:01 -05005579 default:
5580 return NF_DROP_ERR(-ECONNREFUSED);
5581 }
5582 }
Paul Moore446b8022013-12-04 16:10:51 -05005583 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5584 return NF_DROP;
5585 secmark_perm = PACKET__SEND;
Paul Moored8395c82008-10-10 10:16:30 -04005586 } else {
Paul Moore446b8022013-12-04 16:10:51 -05005587 /* Locally generated packet, fetch the security label from the
5588 * associated socket. */
Paul Mooreeffad8d2008-01-29 08:49:27 -05005589 struct sk_security_struct *sksec = sk->sk_security;
5590 peer_sid = sksec->sid;
5591 secmark_perm = PACKET__SEND;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005592 }
5593
Eric Paris50c205f2012-04-04 15:01:43 -04005594 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005595 ad.u.net = &net;
5596 ad.u.net->netif = ifindex;
5597 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04005598 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
Eric Paris04f6d702010-11-23 06:28:02 +00005599 return NF_DROP;
Paul Moored8395c82008-10-10 10:16:30 -04005600
Paul Mooreeffad8d2008-01-29 08:49:27 -05005601 if (secmark_active)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005602 if (avc_has_perm(&selinux_state,
5603 peer_sid, skb->secmark,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005604 SECCLASS_PACKET, secmark_perm, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005605 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005606
5607 if (peerlbl_active) {
5608 u32 if_sid;
5609 u32 node_sid;
5610
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005611 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005612 return NF_DROP;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005613 if (avc_has_perm(&selinux_state,
5614 peer_sid, if_sid,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005615 SECCLASS_NETIF, NETIF__EGRESS, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005616 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005617
5618 if (sel_netnode_sid(addrp, family, &node_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005619 return NF_DROP;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005620 if (avc_has_perm(&selinux_state,
5621 peer_sid, node_sid,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005622 SECCLASS_NODE, NODE__SENDTO, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005623 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005624 }
5625
5626 return NF_ACCEPT;
5627}
5628
Eric W. Biederman06198b32015-09-18 14:33:06 -05005629static unsigned int selinux_ipv4_postroute(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005630 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005631 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005632{
David S. Miller238e54c2015-04-03 20:32:56 -04005633 return selinux_ip_postroute(skb, state->out, PF_INET);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005634}
5635
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005636#if IS_ENABLED(CONFIG_IPV6)
Eric W. Biederman06198b32015-09-18 14:33:06 -05005637static unsigned int selinux_ipv6_postroute(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005638 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005639 const struct nf_hook_state *state)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005640{
David S. Miller238e54c2015-04-03 20:32:56 -04005641 return selinux_ip_postroute(skb, state->out, PF_INET6);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005642}
Linus Torvalds1da177e2005-04-16 15:20:36 -07005643#endif /* IPV6 */
5644
5645#endif /* CONFIG_NETFILTER */
5646
Linus Torvalds1da177e2005-04-16 15:20:36 -07005647static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5648{
Stephen Smalley941fc5b2009-10-01 14:48:23 -04005649 return selinux_nlmsg_perm(sk, skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005650}
5651
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005652static int ipc_alloc_security(struct kern_ipc_perm *perm,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005653 u16 sclass)
5654{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005655 struct ipc_security_struct *isec;
5656
James Morris89d155e2005-10-30 14:59:21 -08005657 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005658 if (!isec)
5659 return -ENOMEM;
5660
Linus Torvalds1da177e2005-04-16 15:20:36 -07005661 isec->sclass = sclass;
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005662 isec->sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005663 perm->security = isec;
5664
5665 return 0;
5666}
5667
5668static void ipc_free_security(struct kern_ipc_perm *perm)
5669{
5670 struct ipc_security_struct *isec = perm->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005671 perm->security = NULL;
5672 kfree(isec);
5673}
5674
5675static int msg_msg_alloc_security(struct msg_msg *msg)
5676{
5677 struct msg_security_struct *msec;
5678
James Morris89d155e2005-10-30 14:59:21 -08005679 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005680 if (!msec)
5681 return -ENOMEM;
5682
Linus Torvalds1da177e2005-04-16 15:20:36 -07005683 msec->sid = SECINITSID_UNLABELED;
5684 msg->security = msec;
5685
5686 return 0;
5687}
5688
5689static void msg_msg_free_security(struct msg_msg *msg)
5690{
5691 struct msg_security_struct *msec = msg->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005692
5693 msg->security = NULL;
5694 kfree(msec);
5695}
5696
5697static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
Stephen Smalley6af963f2005-05-01 08:58:39 -07005698 u32 perms)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005699{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005700 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005701 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005702 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005703
Linus Torvalds1da177e2005-04-16 15:20:36 -07005704 isec = ipc_perms->security;
5705
Eric Paris50c205f2012-04-04 15:01:43 -04005706 ad.type = LSM_AUDIT_DATA_IPC;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005707 ad.u.ipc_id = ipc_perms->key;
5708
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005709 return avc_has_perm(&selinux_state,
5710 sid, isec->sid, isec->sclass, perms, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005711}
5712
5713static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5714{
5715 return msg_msg_alloc_security(msg);
5716}
5717
5718static void selinux_msg_msg_free_security(struct msg_msg *msg)
5719{
5720 msg_msg_free_security(msg);
5721}
5722
5723/* message queue security operations */
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005724static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005725{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005726 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005727 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005728 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005729 int rc;
5730
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005731 rc = ipc_alloc_security(msq, SECCLASS_MSGQ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005732 if (rc)
5733 return rc;
5734
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005735 isec = msq->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005736
Eric Paris50c205f2012-04-04 15:01:43 -04005737 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005738 ad.u.ipc_id = msq->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005739
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005740 rc = avc_has_perm(&selinux_state,
5741 sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005742 MSGQ__CREATE, &ad);
5743 if (rc) {
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005744 ipc_free_security(msq);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005745 return rc;
5746 }
5747 return 0;
5748}
5749
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005750static void selinux_msg_queue_free_security(struct kern_ipc_perm *msq)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005751{
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005752 ipc_free_security(msq);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005753}
5754
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005755static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005756{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005757 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005758 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005759 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005760
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005761 isec = msq->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005762
Eric Paris50c205f2012-04-04 15:01:43 -04005763 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005764 ad.u.ipc_id = msq->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005765
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005766 return avc_has_perm(&selinux_state,
5767 sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005768 MSGQ__ASSOCIATE, &ad);
5769}
5770
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005771static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005772{
5773 int err;
5774 int perms;
5775
Eric Paris828dfe12008-04-17 13:17:49 -04005776 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005777 case IPC_INFO:
5778 case MSG_INFO:
5779 /* No specific object, just general system-wide information. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005780 return avc_has_perm(&selinux_state,
5781 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005782 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005783 case IPC_STAT:
5784 case MSG_STAT:
Davidlohr Bueso23c8cec2018-04-10 16:35:30 -07005785 case MSG_STAT_ANY:
Linus Torvalds1da177e2005-04-16 15:20:36 -07005786 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5787 break;
5788 case IPC_SET:
5789 perms = MSGQ__SETATTR;
5790 break;
5791 case IPC_RMID:
5792 perms = MSGQ__DESTROY;
5793 break;
5794 default:
5795 return 0;
5796 }
5797
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005798 err = ipc_has_perm(msq, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005799 return err;
5800}
5801
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005802static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005803{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005804 struct ipc_security_struct *isec;
5805 struct msg_security_struct *msec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005806 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005807 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005808 int rc;
5809
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005810 isec = msq->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005811 msec = msg->security;
5812
5813 /*
5814 * First time through, need to assign label to the message
5815 */
5816 if (msec->sid == SECINITSID_UNLABELED) {
5817 /*
5818 * Compute new sid based on current process and
5819 * message queue this message will be stored in
5820 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005821 rc = security_transition_sid(&selinux_state, sid, isec->sid,
5822 SECCLASS_MSG, NULL, &msec->sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005823 if (rc)
5824 return rc;
5825 }
5826
Eric Paris50c205f2012-04-04 15:01:43 -04005827 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005828 ad.u.ipc_id = msq->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005829
5830 /* Can this process write to the queue? */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005831 rc = avc_has_perm(&selinux_state,
5832 sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005833 MSGQ__WRITE, &ad);
5834 if (!rc)
5835 /* Can this process send the message */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005836 rc = avc_has_perm(&selinux_state,
5837 sid, msec->sid, SECCLASS_MSG,
David Howells275bb412008-11-14 10:39:19 +11005838 MSG__SEND, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005839 if (!rc)
5840 /* Can the message be put in the queue? */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005841 rc = avc_has_perm(&selinux_state,
5842 msec->sid, isec->sid, SECCLASS_MSGQ,
David Howells275bb412008-11-14 10:39:19 +11005843 MSGQ__ENQUEUE, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005844
5845 return rc;
5846}
5847
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005848static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005849 struct task_struct *target,
5850 long type, int mode)
5851{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005852 struct ipc_security_struct *isec;
5853 struct msg_security_struct *msec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005854 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005855 u32 sid = task_sid(target);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005856 int rc;
5857
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005858 isec = msq->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005859 msec = msg->security;
5860
Eric Paris50c205f2012-04-04 15:01:43 -04005861 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005862 ad.u.ipc_id = msq->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005863
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005864 rc = avc_has_perm(&selinux_state,
5865 sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005866 SECCLASS_MSGQ, MSGQ__READ, &ad);
5867 if (!rc)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005868 rc = avc_has_perm(&selinux_state,
5869 sid, msec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005870 SECCLASS_MSG, MSG__RECEIVE, &ad);
5871 return rc;
5872}
5873
5874/* Shared Memory security operations */
Eric W. Biederman7191adf2018-03-22 21:08:27 -05005875static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005876{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005877 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005878 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005879 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005880 int rc;
5881
Eric W. Biederman7191adf2018-03-22 21:08:27 -05005882 rc = ipc_alloc_security(shp, SECCLASS_SHM);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005883 if (rc)
5884 return rc;
5885
Eric W. Biederman7191adf2018-03-22 21:08:27 -05005886 isec = shp->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005887
Eric Paris50c205f2012-04-04 15:01:43 -04005888 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biederman7191adf2018-03-22 21:08:27 -05005889 ad.u.ipc_id = shp->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005890
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005891 rc = avc_has_perm(&selinux_state,
5892 sid, isec->sid, SECCLASS_SHM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005893 SHM__CREATE, &ad);
5894 if (rc) {
Eric W. Biederman7191adf2018-03-22 21:08:27 -05005895 ipc_free_security(shp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005896 return rc;
5897 }
5898 return 0;
5899}
5900
Eric W. Biederman7191adf2018-03-22 21:08:27 -05005901static void selinux_shm_free_security(struct kern_ipc_perm *shp)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005902{
Eric W. Biederman7191adf2018-03-22 21:08:27 -05005903 ipc_free_security(shp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005904}
5905
Eric W. Biederman7191adf2018-03-22 21:08:27 -05005906static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005907{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005908 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005909 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005910 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005911
Eric W. Biederman7191adf2018-03-22 21:08:27 -05005912 isec = shp->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005913
Eric Paris50c205f2012-04-04 15:01:43 -04005914 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biederman7191adf2018-03-22 21:08:27 -05005915 ad.u.ipc_id = shp->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005916
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005917 return avc_has_perm(&selinux_state,
5918 sid, isec->sid, SECCLASS_SHM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005919 SHM__ASSOCIATE, &ad);
5920}
5921
5922/* Note, at this point, shp is locked down */
Eric W. Biederman7191adf2018-03-22 21:08:27 -05005923static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005924{
5925 int perms;
5926 int err;
5927
Eric Paris828dfe12008-04-17 13:17:49 -04005928 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005929 case IPC_INFO:
5930 case SHM_INFO:
5931 /* No specific object, just general system-wide information. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005932 return avc_has_perm(&selinux_state,
5933 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005934 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005935 case IPC_STAT:
5936 case SHM_STAT:
Davidlohr Buesoc21a6972018-04-10 16:35:23 -07005937 case SHM_STAT_ANY:
Linus Torvalds1da177e2005-04-16 15:20:36 -07005938 perms = SHM__GETATTR | SHM__ASSOCIATE;
5939 break;
5940 case IPC_SET:
5941 perms = SHM__SETATTR;
5942 break;
5943 case SHM_LOCK:
5944 case SHM_UNLOCK:
5945 perms = SHM__LOCK;
5946 break;
5947 case IPC_RMID:
5948 perms = SHM__DESTROY;
5949 break;
5950 default:
5951 return 0;
5952 }
5953
Eric W. Biederman7191adf2018-03-22 21:08:27 -05005954 err = ipc_has_perm(shp, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005955 return err;
5956}
5957
Eric W. Biederman7191adf2018-03-22 21:08:27 -05005958static int selinux_shm_shmat(struct kern_ipc_perm *shp,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005959 char __user *shmaddr, int shmflg)
5960{
5961 u32 perms;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005962
5963 if (shmflg & SHM_RDONLY)
5964 perms = SHM__READ;
5965 else
5966 perms = SHM__READ | SHM__WRITE;
5967
Eric W. Biederman7191adf2018-03-22 21:08:27 -05005968 return ipc_has_perm(shp, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005969}
5970
5971/* Semaphore security operations */
Eric W. Biedermanaefad952018-03-22 20:52:43 -05005972static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005973{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005974 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005975 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005976 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005977 int rc;
5978
Eric W. Biedermanaefad952018-03-22 20:52:43 -05005979 rc = ipc_alloc_security(sma, SECCLASS_SEM);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005980 if (rc)
5981 return rc;
5982
Eric W. Biedermanaefad952018-03-22 20:52:43 -05005983 isec = sma->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005984
Eric Paris50c205f2012-04-04 15:01:43 -04005985 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermanaefad952018-03-22 20:52:43 -05005986 ad.u.ipc_id = sma->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005987
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005988 rc = avc_has_perm(&selinux_state,
5989 sid, isec->sid, SECCLASS_SEM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005990 SEM__CREATE, &ad);
5991 if (rc) {
Eric W. Biedermanaefad952018-03-22 20:52:43 -05005992 ipc_free_security(sma);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005993 return rc;
5994 }
5995 return 0;
5996}
5997
Eric W. Biedermanaefad952018-03-22 20:52:43 -05005998static void selinux_sem_free_security(struct kern_ipc_perm *sma)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005999{
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006000 ipc_free_security(sma);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006001}
6002
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006003static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006004{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006005 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006006 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006007 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006008
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006009 isec = sma->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006010
Eric Paris50c205f2012-04-04 15:01:43 -04006011 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006012 ad.u.ipc_id = sma->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006013
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006014 return avc_has_perm(&selinux_state,
6015 sid, isec->sid, SECCLASS_SEM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006016 SEM__ASSOCIATE, &ad);
6017}
6018
6019/* Note, at this point, sma is locked down */
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006020static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006021{
6022 int err;
6023 u32 perms;
6024
Eric Paris828dfe12008-04-17 13:17:49 -04006025 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006026 case IPC_INFO:
6027 case SEM_INFO:
6028 /* No specific object, just general system-wide information. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006029 return avc_has_perm(&selinux_state,
6030 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006031 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006032 case GETPID:
6033 case GETNCNT:
6034 case GETZCNT:
6035 perms = SEM__GETATTR;
6036 break;
6037 case GETVAL:
6038 case GETALL:
6039 perms = SEM__READ;
6040 break;
6041 case SETVAL:
6042 case SETALL:
6043 perms = SEM__WRITE;
6044 break;
6045 case IPC_RMID:
6046 perms = SEM__DESTROY;
6047 break;
6048 case IPC_SET:
6049 perms = SEM__SETATTR;
6050 break;
6051 case IPC_STAT:
6052 case SEM_STAT:
Davidlohr Buesoa280d6d2018-04-10 16:35:26 -07006053 case SEM_STAT_ANY:
Linus Torvalds1da177e2005-04-16 15:20:36 -07006054 perms = SEM__GETATTR | SEM__ASSOCIATE;
6055 break;
6056 default:
6057 return 0;
6058 }
6059
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006060 err = ipc_has_perm(sma, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006061 return err;
6062}
6063
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006064static int selinux_sem_semop(struct kern_ipc_perm *sma,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006065 struct sembuf *sops, unsigned nsops, int alter)
6066{
6067 u32 perms;
6068
6069 if (alter)
6070 perms = SEM__READ | SEM__WRITE;
6071 else
6072 perms = SEM__READ;
6073
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006074 return ipc_has_perm(sma, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006075}
6076
6077static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6078{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006079 u32 av = 0;
6080
Linus Torvalds1da177e2005-04-16 15:20:36 -07006081 av = 0;
6082 if (flag & S_IRUGO)
6083 av |= IPC__UNIX_READ;
6084 if (flag & S_IWUGO)
6085 av |= IPC__UNIX_WRITE;
6086
6087 if (av == 0)
6088 return 0;
6089
Stephen Smalley6af963f2005-05-01 08:58:39 -07006090 return ipc_has_perm(ipcp, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006091}
6092
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02006093static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6094{
6095 struct ipc_security_struct *isec = ipcp->security;
6096 *secid = isec->sid;
6097}
6098
Eric Paris828dfe12008-04-17 13:17:49 -04006099static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006100{
6101 if (inode)
6102 inode_doinit_with_dentry(inode, dentry);
6103}
6104
6105static int selinux_getprocattr(struct task_struct *p,
Al Viro04ff9702007-03-12 16:17:58 +00006106 char *name, char **value)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006107{
David Howells275bb412008-11-14 10:39:19 +11006108 const struct task_security_struct *__tsec;
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00006109 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006110 int error;
Al Viro04ff9702007-03-12 16:17:58 +00006111 unsigned len;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006112
David Howells275bb412008-11-14 10:39:19 +11006113 rcu_read_lock();
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07006114 __tsec = selinux_cred(__task_cred(p));
Linus Torvalds1da177e2005-04-16 15:20:36 -07006115
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006116 if (current != p) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006117 error = avc_has_perm(&selinux_state,
6118 current_sid(), __tsec->sid,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006119 SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6120 if (error)
6121 goto bad;
6122 }
6123
Linus Torvalds1da177e2005-04-16 15:20:36 -07006124 if (!strcmp(name, "current"))
David Howells275bb412008-11-14 10:39:19 +11006125 sid = __tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006126 else if (!strcmp(name, "prev"))
David Howells275bb412008-11-14 10:39:19 +11006127 sid = __tsec->osid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006128 else if (!strcmp(name, "exec"))
David Howells275bb412008-11-14 10:39:19 +11006129 sid = __tsec->exec_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006130 else if (!strcmp(name, "fscreate"))
David Howells275bb412008-11-14 10:39:19 +11006131 sid = __tsec->create_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07006132 else if (!strcmp(name, "keycreate"))
David Howells275bb412008-11-14 10:39:19 +11006133 sid = __tsec->keycreate_sid;
Eric Paris42c3e032006-06-26 00:26:03 -07006134 else if (!strcmp(name, "sockcreate"))
David Howells275bb412008-11-14 10:39:19 +11006135 sid = __tsec->sockcreate_sid;
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006136 else {
6137 error = -EINVAL;
6138 goto bad;
6139 }
David Howells275bb412008-11-14 10:39:19 +11006140 rcu_read_unlock();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006141
6142 if (!sid)
6143 return 0;
6144
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006145 error = security_sid_to_context(&selinux_state, sid, value, &len);
Al Viro04ff9702007-03-12 16:17:58 +00006146 if (error)
6147 return error;
6148 return len;
David Howells275bb412008-11-14 10:39:19 +11006149
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006150bad:
David Howells275bb412008-11-14 10:39:19 +11006151 rcu_read_unlock();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006152 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006153}
6154
Stephen Smalleyb21507e2017-01-09 10:07:31 -05006155static int selinux_setprocattr(const char *name, void *value, size_t size)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006156{
6157 struct task_security_struct *tsec;
David Howellsd84f4f92008-11-14 10:39:23 +11006158 struct cred *new;
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006159 u32 mysid = current_sid(), sid = 0, ptsid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006160 int error;
6161 char *str = value;
6162
Linus Torvalds1da177e2005-04-16 15:20:36 -07006163 /*
6164 * Basic control over ability to set these attributes at all.
Linus Torvalds1da177e2005-04-16 15:20:36 -07006165 */
6166 if (!strcmp(name, "exec"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006167 error = avc_has_perm(&selinux_state,
6168 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006169 PROCESS__SETEXEC, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006170 else if (!strcmp(name, "fscreate"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006171 error = avc_has_perm(&selinux_state,
6172 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006173 PROCESS__SETFSCREATE, NULL);
Michael LeMay4eb582c2006-06-26 00:24:57 -07006174 else if (!strcmp(name, "keycreate"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006175 error = avc_has_perm(&selinux_state,
6176 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006177 PROCESS__SETKEYCREATE, NULL);
Eric Paris42c3e032006-06-26 00:26:03 -07006178 else if (!strcmp(name, "sockcreate"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006179 error = avc_has_perm(&selinux_state,
6180 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006181 PROCESS__SETSOCKCREATE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006182 else if (!strcmp(name, "current"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006183 error = avc_has_perm(&selinux_state,
6184 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006185 PROCESS__SETCURRENT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006186 else
6187 error = -EINVAL;
6188 if (error)
6189 return error;
6190
6191 /* Obtain a SID for the context, if one was specified. */
Stephen Smalleya050a572017-01-31 11:54:04 -05006192 if (size && str[0] && str[0] != '\n') {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006193 if (str[size-1] == '\n') {
6194 str[size-1] = 0;
6195 size--;
6196 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006197 error = security_context_to_sid(&selinux_state, value, size,
6198 &sid, GFP_KERNEL);
Stephen Smalley12b29f32008-05-07 13:03:20 -04006199 if (error == -EINVAL && !strcmp(name, "fscreate")) {
Stephen Smalleydb590002017-04-20 11:31:30 -04006200 if (!has_cap_mac_admin(true)) {
Eric Parisd6ea83e2012-04-04 13:45:49 -04006201 struct audit_buffer *ab;
6202 size_t audit_size;
6203
6204 /* We strip a nul only if it is at the end, otherwise the
6205 * context contains a nul and we should audit that */
6206 if (str[size - 1] == '\0')
6207 audit_size = size - 1;
6208 else
6209 audit_size = size;
Richard Guy Briggscdfb6b32018-05-12 21:58:20 -04006210 ab = audit_log_start(audit_context(),
6211 GFP_ATOMIC,
6212 AUDIT_SELINUX_ERR);
Eric Parisd6ea83e2012-04-04 13:45:49 -04006213 audit_log_format(ab, "op=fscreate invalid_context=");
6214 audit_log_n_untrustedstring(ab, value, audit_size);
6215 audit_log_end(ab);
6216
Stephen Smalley12b29f32008-05-07 13:03:20 -04006217 return error;
Eric Parisd6ea83e2012-04-04 13:45:49 -04006218 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006219 error = security_context_to_sid_force(
6220 &selinux_state,
6221 value, size, &sid);
Stephen Smalley12b29f32008-05-07 13:03:20 -04006222 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07006223 if (error)
6224 return error;
6225 }
6226
David Howellsd84f4f92008-11-14 10:39:23 +11006227 new = prepare_creds();
6228 if (!new)
6229 return -ENOMEM;
6230
Linus Torvalds1da177e2005-04-16 15:20:36 -07006231 /* Permission checking based on the specified context is
6232 performed during the actual operation (execve,
6233 open/mkdir/...), when we know the full context of the
David Howellsd84f4f92008-11-14 10:39:23 +11006234 operation. See selinux_bprm_set_creds for the execve
Linus Torvalds1da177e2005-04-16 15:20:36 -07006235 checks and may_create for the file creation checks. The
6236 operation will then fail if the context is not permitted. */
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07006237 tsec = selinux_cred(new);
David Howellsd84f4f92008-11-14 10:39:23 +11006238 if (!strcmp(name, "exec")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006239 tsec->exec_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006240 } else if (!strcmp(name, "fscreate")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006241 tsec->create_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006242 } else if (!strcmp(name, "keycreate")) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006243 error = avc_has_perm(&selinux_state,
6244 mysid, sid, SECCLASS_KEY, KEY__CREATE,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006245 NULL);
Michael LeMay4eb582c2006-06-26 00:24:57 -07006246 if (error)
David Howellsd84f4f92008-11-14 10:39:23 +11006247 goto abort_change;
Michael LeMay4eb582c2006-06-26 00:24:57 -07006248 tsec->keycreate_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006249 } else if (!strcmp(name, "sockcreate")) {
Eric Paris42c3e032006-06-26 00:26:03 -07006250 tsec->sockcreate_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006251 } else if (!strcmp(name, "current")) {
6252 error = -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006253 if (sid == 0)
David Howellsd84f4f92008-11-14 10:39:23 +11006254 goto abort_change;
KaiGai Koheid9250de2008-08-28 16:35:57 +09006255
David Howellsd84f4f92008-11-14 10:39:23 +11006256 /* Only allow single threaded processes to change context */
6257 error = -EPERM;
Oleg Nesterov5bb459b2009-07-10 03:48:23 +02006258 if (!current_is_single_threaded()) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006259 error = security_bounded_transition(&selinux_state,
6260 tsec->sid, sid);
David Howellsd84f4f92008-11-14 10:39:23 +11006261 if (error)
6262 goto abort_change;
Eric Paris828dfe12008-04-17 13:17:49 -04006263 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07006264
6265 /* Check permissions for the transition. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006266 error = avc_has_perm(&selinux_state,
6267 tsec->sid, sid, SECCLASS_PROCESS,
Eric Paris828dfe12008-04-17 13:17:49 -04006268 PROCESS__DYNTRANSITION, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006269 if (error)
David Howellsd84f4f92008-11-14 10:39:23 +11006270 goto abort_change;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006271
6272 /* Check for ptracing, and update the task SID if ok.
6273 Otherwise, leave SID unchanged and fail. */
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006274 ptsid = ptrace_parent_sid();
Paul Moore0c6181c2016-03-30 21:41:21 -04006275 if (ptsid != 0) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006276 error = avc_has_perm(&selinux_state,
6277 ptsid, sid, SECCLASS_PROCESS,
David Howellsd84f4f92008-11-14 10:39:23 +11006278 PROCESS__PTRACE, NULL);
6279 if (error)
6280 goto abort_change;
6281 }
6282
6283 tsec->sid = sid;
6284 } else {
6285 error = -EINVAL;
6286 goto abort_change;
6287 }
6288
6289 commit_creds(new);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006290 return size;
David Howellsd84f4f92008-11-14 10:39:23 +11006291
6292abort_change:
6293 abort_creds(new);
6294 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006295}
6296
David Quigley746df9b2013-05-22 12:50:35 -04006297static int selinux_ismaclabel(const char *name)
6298{
6299 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6300}
6301
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006302static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6303{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006304 return security_sid_to_context(&selinux_state, secid,
6305 secdata, seclen);
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006306}
6307
David Howells7bf570d2008-04-29 20:52:51 +01006308static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
David Howells63cb3442008-01-15 23:47:35 +00006309{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006310 return security_context_to_sid(&selinux_state, secdata, seclen,
6311 secid, GFP_KERNEL);
David Howells63cb3442008-01-15 23:47:35 +00006312}
6313
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006314static void selinux_release_secctx(char *secdata, u32 seclen)
6315{
Paul Moore088999e2007-08-01 11:12:58 -04006316 kfree(secdata);
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006317}
6318
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006319static void selinux_inode_invalidate_secctx(struct inode *inode)
6320{
6321 struct inode_security_struct *isec = inode->i_security;
6322
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01006323 spin_lock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006324 isec->initialized = LABEL_INVALID;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01006325 spin_unlock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006326}
6327
David P. Quigley1ee65e32009-09-03 14:25:57 -04006328/*
6329 * called with inode->i_mutex locked
6330 */
6331static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6332{
6333 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
6334}
6335
6336/*
6337 * called with inode->i_mutex locked
6338 */
6339static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6340{
6341 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6342}
6343
6344static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6345{
6346 int len = 0;
6347 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6348 ctx, true);
6349 if (len < 0)
6350 return len;
6351 *ctxlen = len;
6352 return 0;
6353}
Michael LeMayd7200242006-06-22 14:47:17 -07006354#ifdef CONFIG_KEYS
6355
David Howellsd84f4f92008-11-14 10:39:23 +11006356static int selinux_key_alloc(struct key *k, const struct cred *cred,
David Howells7e047ef2006-06-26 00:24:50 -07006357 unsigned long flags)
Michael LeMayd7200242006-06-22 14:47:17 -07006358{
David Howellsd84f4f92008-11-14 10:39:23 +11006359 const struct task_security_struct *tsec;
Michael LeMayd7200242006-06-22 14:47:17 -07006360 struct key_security_struct *ksec;
6361
6362 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6363 if (!ksec)
6364 return -ENOMEM;
6365
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07006366 tsec = selinux_cred(cred);
David Howellsd84f4f92008-11-14 10:39:23 +11006367 if (tsec->keycreate_sid)
6368 ksec->sid = tsec->keycreate_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07006369 else
David Howellsd84f4f92008-11-14 10:39:23 +11006370 ksec->sid = tsec->sid;
Michael LeMayd7200242006-06-22 14:47:17 -07006371
David Howells275bb412008-11-14 10:39:19 +11006372 k->security = ksec;
Michael LeMayd7200242006-06-22 14:47:17 -07006373 return 0;
6374}
6375
6376static void selinux_key_free(struct key *k)
6377{
6378 struct key_security_struct *ksec = k->security;
6379
6380 k->security = NULL;
6381 kfree(ksec);
6382}
6383
6384static int selinux_key_permission(key_ref_t key_ref,
David Howellsd84f4f92008-11-14 10:39:23 +11006385 const struct cred *cred,
David Howellsf5895942014-03-14 17:44:49 +00006386 unsigned perm)
Michael LeMayd7200242006-06-22 14:47:17 -07006387{
6388 struct key *key;
Michael LeMayd7200242006-06-22 14:47:17 -07006389 struct key_security_struct *ksec;
David Howells275bb412008-11-14 10:39:19 +11006390 u32 sid;
Michael LeMayd7200242006-06-22 14:47:17 -07006391
6392 /* if no specific permissions are requested, we skip the
6393 permission check. No serious, additional covert channels
6394 appear to be created. */
6395 if (perm == 0)
6396 return 0;
6397
David Howellsd84f4f92008-11-14 10:39:23 +11006398 sid = cred_sid(cred);
David Howells275bb412008-11-14 10:39:19 +11006399
6400 key = key_ref_to_ptr(key_ref);
6401 ksec = key->security;
6402
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006403 return avc_has_perm(&selinux_state,
6404 sid, ksec->sid, SECCLASS_KEY, perm, NULL);
Michael LeMayd7200242006-06-22 14:47:17 -07006405}
6406
David Howells70a5bb72008-04-29 01:01:26 -07006407static int selinux_key_getsecurity(struct key *key, char **_buffer)
6408{
6409 struct key_security_struct *ksec = key->security;
6410 char *context = NULL;
6411 unsigned len;
6412 int rc;
6413
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006414 rc = security_sid_to_context(&selinux_state, ksec->sid,
6415 &context, &len);
David Howells70a5bb72008-04-29 01:01:26 -07006416 if (!rc)
6417 rc = len;
6418 *_buffer = context;
6419 return rc;
6420}
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03006421#endif
David Howells70a5bb72008-04-29 01:01:26 -07006422
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03006423#ifdef CONFIG_SECURITY_INFINIBAND
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03006424static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6425{
6426 struct common_audit_data ad;
6427 int err;
6428 u32 sid = 0;
6429 struct ib_security_struct *sec = ib_sec;
6430 struct lsm_ibpkey_audit ibpkey;
6431
Daniel Jurgens409dcf32017-05-19 15:48:59 +03006432 err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03006433 if (err)
6434 return err;
6435
6436 ad.type = LSM_AUDIT_DATA_IBPKEY;
6437 ibpkey.subnet_prefix = subnet_prefix;
6438 ibpkey.pkey = pkey_val;
6439 ad.u.ibpkey = &ibpkey;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006440 return avc_has_perm(&selinux_state,
6441 sec->sid, sid,
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03006442 SECCLASS_INFINIBAND_PKEY,
6443 INFINIBAND_PKEY__ACCESS, &ad);
6444}
6445
Daniel Jurgensab861df2017-05-19 15:48:58 +03006446static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6447 u8 port_num)
6448{
6449 struct common_audit_data ad;
6450 int err;
6451 u32 sid = 0;
6452 struct ib_security_struct *sec = ib_sec;
6453 struct lsm_ibendport_audit ibendport;
6454
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006455 err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6456 &sid);
Daniel Jurgensab861df2017-05-19 15:48:58 +03006457
6458 if (err)
6459 return err;
6460
6461 ad.type = LSM_AUDIT_DATA_IBENDPORT;
6462 strncpy(ibendport.dev_name, dev_name, sizeof(ibendport.dev_name));
6463 ibendport.port = port_num;
6464 ad.u.ibendport = &ibendport;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006465 return avc_has_perm(&selinux_state,
6466 sec->sid, sid,
Daniel Jurgensab861df2017-05-19 15:48:58 +03006467 SECCLASS_INFINIBAND_ENDPORT,
6468 INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6469}
6470
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03006471static int selinux_ib_alloc_security(void **ib_sec)
6472{
6473 struct ib_security_struct *sec;
6474
6475 sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6476 if (!sec)
6477 return -ENOMEM;
6478 sec->sid = current_sid();
6479
6480 *ib_sec = sec;
6481 return 0;
6482}
6483
6484static void selinux_ib_free_security(void *ib_sec)
6485{
6486 kfree(ib_sec);
6487}
Michael LeMayd7200242006-06-22 14:47:17 -07006488#endif
6489
Chenbo Fengec27c352017-10-18 13:00:25 -07006490#ifdef CONFIG_BPF_SYSCALL
6491static int selinux_bpf(int cmd, union bpf_attr *attr,
6492 unsigned int size)
6493{
6494 u32 sid = current_sid();
6495 int ret;
6496
6497 switch (cmd) {
6498 case BPF_MAP_CREATE:
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006499 ret = avc_has_perm(&selinux_state,
6500 sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
Chenbo Fengec27c352017-10-18 13:00:25 -07006501 NULL);
6502 break;
6503 case BPF_PROG_LOAD:
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006504 ret = avc_has_perm(&selinux_state,
6505 sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
Chenbo Fengec27c352017-10-18 13:00:25 -07006506 NULL);
6507 break;
6508 default:
6509 ret = 0;
6510 break;
6511 }
6512
6513 return ret;
6514}
6515
6516static u32 bpf_map_fmode_to_av(fmode_t fmode)
6517{
6518 u32 av = 0;
6519
6520 if (fmode & FMODE_READ)
6521 av |= BPF__MAP_READ;
6522 if (fmode & FMODE_WRITE)
6523 av |= BPF__MAP_WRITE;
6524 return av;
6525}
6526
Chenbo Fengf66e4482017-10-18 13:00:26 -07006527/* This function will check the file pass through unix socket or binder to see
6528 * if it is a bpf related object. And apply correspinding checks on the bpf
6529 * object based on the type. The bpf maps and programs, not like other files and
6530 * socket, are using a shared anonymous inode inside the kernel as their inode.
6531 * So checking that inode cannot identify if the process have privilege to
6532 * access the bpf object and that's why we have to add this additional check in
6533 * selinux_file_receive and selinux_binder_transfer_files.
6534 */
6535static int bpf_fd_pass(struct file *file, u32 sid)
6536{
6537 struct bpf_security_struct *bpfsec;
6538 struct bpf_prog *prog;
6539 struct bpf_map *map;
6540 int ret;
6541
6542 if (file->f_op == &bpf_map_fops) {
6543 map = file->private_data;
6544 bpfsec = map->security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006545 ret = avc_has_perm(&selinux_state,
6546 sid, bpfsec->sid, SECCLASS_BPF,
Chenbo Fengf66e4482017-10-18 13:00:26 -07006547 bpf_map_fmode_to_av(file->f_mode), NULL);
6548 if (ret)
6549 return ret;
6550 } else if (file->f_op == &bpf_prog_fops) {
6551 prog = file->private_data;
6552 bpfsec = prog->aux->security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006553 ret = avc_has_perm(&selinux_state,
6554 sid, bpfsec->sid, SECCLASS_BPF,
Chenbo Fengf66e4482017-10-18 13:00:26 -07006555 BPF__PROG_RUN, NULL);
6556 if (ret)
6557 return ret;
6558 }
6559 return 0;
6560}
6561
Chenbo Fengec27c352017-10-18 13:00:25 -07006562static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6563{
6564 u32 sid = current_sid();
6565 struct bpf_security_struct *bpfsec;
6566
6567 bpfsec = map->security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006568 return avc_has_perm(&selinux_state,
6569 sid, bpfsec->sid, SECCLASS_BPF,
Chenbo Fengec27c352017-10-18 13:00:25 -07006570 bpf_map_fmode_to_av(fmode), NULL);
6571}
6572
6573static int selinux_bpf_prog(struct bpf_prog *prog)
6574{
6575 u32 sid = current_sid();
6576 struct bpf_security_struct *bpfsec;
6577
6578 bpfsec = prog->aux->security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006579 return avc_has_perm(&selinux_state,
6580 sid, bpfsec->sid, SECCLASS_BPF,
Chenbo Fengec27c352017-10-18 13:00:25 -07006581 BPF__PROG_RUN, NULL);
6582}
6583
6584static int selinux_bpf_map_alloc(struct bpf_map *map)
6585{
6586 struct bpf_security_struct *bpfsec;
6587
6588 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6589 if (!bpfsec)
6590 return -ENOMEM;
6591
6592 bpfsec->sid = current_sid();
6593 map->security = bpfsec;
6594
6595 return 0;
6596}
6597
6598static void selinux_bpf_map_free(struct bpf_map *map)
6599{
6600 struct bpf_security_struct *bpfsec = map->security;
6601
6602 map->security = NULL;
6603 kfree(bpfsec);
6604}
6605
6606static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6607{
6608 struct bpf_security_struct *bpfsec;
6609
6610 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6611 if (!bpfsec)
6612 return -ENOMEM;
6613
6614 bpfsec->sid = current_sid();
6615 aux->security = bpfsec;
6616
6617 return 0;
6618}
6619
6620static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
6621{
6622 struct bpf_security_struct *bpfsec = aux->security;
6623
6624 aux->security = NULL;
6625 kfree(bpfsec);
6626}
6627#endif
6628
Casey Schauflerbbd36622018-11-12 09:30:56 -08006629struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = {
6630 .lbs_cred = sizeof(struct task_security_struct),
Casey Schaufler33bf60c2018-11-12 12:02:49 -08006631 .lbs_file = sizeof(struct file_security_struct),
Casey Schauflerbbd36622018-11-12 09:30:56 -08006632};
6633
James Morrisca97d932017-02-15 00:18:51 +11006634static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
Casey Schauflere20b0432015-05-02 15:11:36 -07006635 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6636 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6637 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6638 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02006639
Casey Schauflere20b0432015-05-02 15:11:36 -07006640 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6641 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6642 LSM_HOOK_INIT(capget, selinux_capget),
6643 LSM_HOOK_INIT(capset, selinux_capset),
6644 LSM_HOOK_INIT(capable, selinux_capable),
6645 LSM_HOOK_INIT(quotactl, selinux_quotactl),
6646 LSM_HOOK_INIT(quota_on, selinux_quota_on),
6647 LSM_HOOK_INIT(syslog, selinux_syslog),
6648 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
Stephen Smalley79af7302015-01-21 10:54:10 -05006649
Casey Schauflere20b0432015-05-02 15:11:36 -07006650 LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006651
Casey Schauflere20b0432015-05-02 15:11:36 -07006652 LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6653 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6654 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006655
Casey Schauflere20b0432015-05-02 15:11:36 -07006656 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6657 LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
Al Viro5b400232018-12-12 20:13:29 -05006658 LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts),
Al Viro204cc0c2018-12-13 13:41:47 -05006659 LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts),
Casey Schauflere20b0432015-05-02 15:11:36 -07006660 LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6661 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6662 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6663 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6664 LSM_HOOK_INIT(sb_mount, selinux_mount),
6665 LSM_HOOK_INIT(sb_umount, selinux_umount),
6666 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6667 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
Al Viro757cbe52018-12-14 23:42:21 -05006668 LSM_HOOK_INIT(sb_add_mnt_opt, selinux_add_mnt_opt),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006669
Casey Schauflere20b0432015-05-02 15:11:36 -07006670 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
Vivek Goyala518b0a2016-07-13 10:44:53 -04006671 LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
Eric Parise0007522008-03-05 10:31:54 -05006672
Casey Schauflere20b0432015-05-02 15:11:36 -07006673 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6674 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6675 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6676 LSM_HOOK_INIT(inode_create, selinux_inode_create),
6677 LSM_HOOK_INIT(inode_link, selinux_inode_link),
6678 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6679 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6680 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6681 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6682 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6683 LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6684 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6685 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6686 LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6687 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6688 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6689 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6690 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6691 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6692 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6693 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6694 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6695 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6696 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6697 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
Vivek Goyal56909eb2016-07-13 10:44:48 -04006698 LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
Vivek Goyal19472b62016-07-13 10:44:50 -04006699 LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006700
Casey Schauflere20b0432015-05-02 15:11:36 -07006701 LSM_HOOK_INIT(file_permission, selinux_file_permission),
6702 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
Casey Schauflere20b0432015-05-02 15:11:36 -07006703 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6704 LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6705 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6706 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6707 LSM_HOOK_INIT(file_lock, selinux_file_lock),
6708 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6709 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6710 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6711 LSM_HOOK_INIT(file_receive, selinux_file_receive),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006712
Casey Schauflere20b0432015-05-02 15:11:36 -07006713 LSM_HOOK_INIT(file_open, selinux_file_open),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006714
Tetsuo Handaa79be232017-03-28 23:08:45 +09006715 LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
Casey Schauflere20b0432015-05-02 15:11:36 -07006716 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6717 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
Matthew Garrett3ec30112018-01-08 13:36:19 -08006718 LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
Casey Schauflere20b0432015-05-02 15:11:36 -07006719 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6720 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6721 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
Mimi Zoharc77b8cd2018-07-13 14:06:02 -04006722 LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07006723 LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
Casey Schauflere20b0432015-05-02 15:11:36 -07006724 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6725 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6726 LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6727 LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6728 LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6729 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6730 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
Stephen Smalley791ec492017-02-17 07:57:00 -05006731 LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
Casey Schauflere20b0432015-05-02 15:11:36 -07006732 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6733 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6734 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6735 LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6736 LSM_HOOK_INIT(task_kill, selinux_task_kill),
Casey Schauflere20b0432015-05-02 15:11:36 -07006737 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09006738
Casey Schauflere20b0432015-05-02 15:11:36 -07006739 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6740 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006741
Casey Schauflere20b0432015-05-02 15:11:36 -07006742 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6743 LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006744
Casey Schauflere20b0432015-05-02 15:11:36 -07006745 LSM_HOOK_INIT(msg_queue_alloc_security,
6746 selinux_msg_queue_alloc_security),
6747 LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6748 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6749 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6750 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6751 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006752
Casey Schauflere20b0432015-05-02 15:11:36 -07006753 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6754 LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6755 LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6756 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6757 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006758
Casey Schauflere20b0432015-05-02 15:11:36 -07006759 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6760 LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6761 LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6762 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6763 LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006764
Casey Schauflere20b0432015-05-02 15:11:36 -07006765 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006766
Casey Schauflere20b0432015-05-02 15:11:36 -07006767 LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6768 LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006769
Casey Schauflere20b0432015-05-02 15:11:36 -07006770 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6771 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6772 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6773 LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006774 LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
Casey Schauflere20b0432015-05-02 15:11:36 -07006775 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6776 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6777 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006778
Casey Schauflere20b0432015-05-02 15:11:36 -07006779 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6780 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006781
Casey Schauflere20b0432015-05-02 15:11:36 -07006782 LSM_HOOK_INIT(socket_create, selinux_socket_create),
6783 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
David Herrmann0b811db2018-05-04 16:28:21 +02006784 LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
Casey Schauflere20b0432015-05-02 15:11:36 -07006785 LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6786 LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6787 LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6788 LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6789 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6790 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6791 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6792 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6793 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6794 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6795 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6796 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6797 LSM_HOOK_INIT(socket_getpeersec_stream,
6798 selinux_socket_getpeersec_stream),
6799 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6800 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6801 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6802 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6803 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6804 LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
Richard Hainesd4529302018-02-13 20:57:18 +00006805 LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
6806 LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
6807 LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
Casey Schauflere20b0432015-05-02 15:11:36 -07006808 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6809 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6810 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6811 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6812 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6813 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6814 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6815 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6816 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6817 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6818 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6819 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6820 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03006821#ifdef CONFIG_SECURITY_INFINIBAND
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03006822 LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
Daniel Jurgensab861df2017-05-19 15:48:58 +03006823 LSM_HOOK_INIT(ib_endport_manage_subnet,
6824 selinux_ib_endport_manage_subnet),
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03006825 LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
6826 LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
6827#endif
Trent Jaegerd28d1e02005-12-13 23:12:40 -08006828#ifdef CONFIG_SECURITY_NETWORK_XFRM
Casey Schauflere20b0432015-05-02 15:11:36 -07006829 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6830 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6831 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6832 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6833 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6834 LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6835 selinux_xfrm_state_alloc_acquire),
6836 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6837 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6838 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6839 LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6840 selinux_xfrm_state_pol_flow_match),
6841 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006842#endif
Michael LeMayd7200242006-06-22 14:47:17 -07006843
6844#ifdef CONFIG_KEYS
Casey Schauflere20b0432015-05-02 15:11:36 -07006845 LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6846 LSM_HOOK_INIT(key_free, selinux_key_free),
6847 LSM_HOOK_INIT(key_permission, selinux_key_permission),
6848 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
Michael LeMayd7200242006-06-22 14:47:17 -07006849#endif
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +02006850
6851#ifdef CONFIG_AUDIT
Casey Schauflere20b0432015-05-02 15:11:36 -07006852 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6853 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6854 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6855 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +02006856#endif
Chenbo Fengec27c352017-10-18 13:00:25 -07006857
6858#ifdef CONFIG_BPF_SYSCALL
6859 LSM_HOOK_INIT(bpf, selinux_bpf),
6860 LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
6861 LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
6862 LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
6863 LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
6864 LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
6865 LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
6866#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07006867};
6868
6869static __init int selinux_init(void)
6870{
peter enderborgc103a912018-06-12 10:09:03 +02006871 pr_info("SELinux: Initializing.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07006872
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006873 memset(&selinux_state, 0, sizeof(selinux_state));
Paul Mooree5a5ca92018-03-01 17:38:30 -05006874 enforcing_set(&selinux_state, selinux_enforcing_boot);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006875 selinux_state.checkreqprot = selinux_checkreqprot_boot;
6876 selinux_ss_init(&selinux_state.ss);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006877 selinux_avc_init(&selinux_state.avc);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006878
Linus Torvalds1da177e2005-04-16 15:20:36 -07006879 /* Set the security state for the initial task. */
David Howellsd84f4f92008-11-14 10:39:23 +11006880 cred_init_security();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006881
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04006882 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6883
James Morris7cae7e22006-03-22 00:09:22 -08006884 sel_inode_cache = kmem_cache_create("selinux_inode_security",
6885 sizeof(struct inode_security_struct),
Paul Mundt20c2df82007-07-20 10:11:58 +09006886 0, SLAB_PANIC, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006887 avc_init();
6888
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006889 avtab_cache_init();
6890
6891 ebitmap_cache_init();
6892
6893 hashtab_cache_init();
6894
Casey Schauflerd69dece52017-01-18 17:09:05 -08006895 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
Linus Torvalds1da177e2005-04-16 15:20:36 -07006896
Paul Moore615e51f2014-06-26 14:33:56 -04006897 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6898 panic("SELinux: Unable to register AVC netcache callback\n");
6899
Daniel Jurgens8f408ab2017-05-19 15:48:53 +03006900 if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
6901 panic("SELinux: Unable to register AVC LSM notifier callback\n");
6902
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006903 if (selinux_enforcing_boot)
peter enderborgc103a912018-06-12 10:09:03 +02006904 pr_debug("SELinux: Starting in enforcing mode\n");
Eric Paris828dfe12008-04-17 13:17:49 -04006905 else
peter enderborgc103a912018-06-12 10:09:03 +02006906 pr_debug("SELinux: Starting in permissive mode\n");
Michael LeMayd7200242006-06-22 14:47:17 -07006907
Linus Torvalds1da177e2005-04-16 15:20:36 -07006908 return 0;
6909}
6910
Al Viroe8c26252010-03-23 06:36:54 -04006911static void delayed_superblock_init(struct super_block *sb, void *unused)
6912{
Al Viro204cc0c2018-12-13 13:41:47 -05006913 selinux_set_mnt_opts(sb, NULL, 0, NULL);
Al Viroe8c26252010-03-23 06:36:54 -04006914}
6915
Linus Torvalds1da177e2005-04-16 15:20:36 -07006916void selinux_complete_init(void)
6917{
peter enderborgc103a912018-06-12 10:09:03 +02006918 pr_debug("SELinux: Completing initialization.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07006919
6920 /* Set up any superblocks initialized prior to the policy load. */
peter enderborgc103a912018-06-12 10:09:03 +02006921 pr_debug("SELinux: Setting up existing superblocks.\n");
Al Viroe8c26252010-03-23 06:36:54 -04006922 iterate_supers(delayed_superblock_init, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006923}
6924
6925/* SELinux requires early initialization in order to label
6926 all processes and objects when they are created. */
Kees Cook3d6e5f62018-10-10 17:18:23 -07006927DEFINE_LSM(selinux) = {
Kees Cook07aed2f2018-10-10 17:18:24 -07006928 .name = "selinux",
Kees Cook14bd99c2018-09-19 19:57:06 -07006929 .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
Kees Cookc5459b82018-09-13 22:28:48 -07006930 .enabled = &selinux_enabled,
Casey Schauflerbbd36622018-11-12 09:30:56 -08006931 .blobs = &selinux_blob_sizes,
Kees Cook3d6e5f62018-10-10 17:18:23 -07006932 .init = selinux_init,
6933};
Linus Torvalds1da177e2005-04-16 15:20:36 -07006934
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08006935#if defined(CONFIG_NETFILTER)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006936
Florian Westphal591bb2782017-07-26 11:40:52 +02006937static const struct nf_hook_ops selinux_nf_ops[] = {
Paul Mooreeffad8d2008-01-29 08:49:27 -05006938 {
6939 .hook = selinux_ipv4_postroute,
Alban Crequy2597a832012-05-14 03:56:39 +00006940 .pf = NFPROTO_IPV4,
Paul Mooreeffad8d2008-01-29 08:49:27 -05006941 .hooknum = NF_INET_POST_ROUTING,
6942 .priority = NF_IP_PRI_SELINUX_LAST,
6943 },
6944 {
6945 .hook = selinux_ipv4_forward,
Alban Crequy2597a832012-05-14 03:56:39 +00006946 .pf = NFPROTO_IPV4,
Paul Mooreeffad8d2008-01-29 08:49:27 -05006947 .hooknum = NF_INET_FORWARD,
6948 .priority = NF_IP_PRI_SELINUX_FIRST,
Paul Moore948bf852008-10-10 10:16:32 -04006949 },
6950 {
6951 .hook = selinux_ipv4_output,
Alban Crequy2597a832012-05-14 03:56:39 +00006952 .pf = NFPROTO_IPV4,
Paul Moore948bf852008-10-10 10:16:32 -04006953 .hooknum = NF_INET_LOCAL_OUT,
6954 .priority = NF_IP_PRI_SELINUX_FIRST,
Jiri Pirko25db6be2014-09-03 17:42:13 +02006955 },
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04006956#if IS_ENABLED(CONFIG_IPV6)
Paul Mooreeffad8d2008-01-29 08:49:27 -05006957 {
6958 .hook = selinux_ipv6_postroute,
Alban Crequy2597a832012-05-14 03:56:39 +00006959 .pf = NFPROTO_IPV6,
Paul Mooreeffad8d2008-01-29 08:49:27 -05006960 .hooknum = NF_INET_POST_ROUTING,
6961 .priority = NF_IP6_PRI_SELINUX_LAST,
6962 },
6963 {
6964 .hook = selinux_ipv6_forward,
Alban Crequy2597a832012-05-14 03:56:39 +00006965 .pf = NFPROTO_IPV6,
Paul Mooreeffad8d2008-01-29 08:49:27 -05006966 .hooknum = NF_INET_FORWARD,
6967 .priority = NF_IP6_PRI_SELINUX_FIRST,
Jiri Pirko25db6be2014-09-03 17:42:13 +02006968 },
Huw Davies2917f572016-06-27 15:06:15 -04006969 {
6970 .hook = selinux_ipv6_output,
6971 .pf = NFPROTO_IPV6,
6972 .hooknum = NF_INET_LOCAL_OUT,
6973 .priority = NF_IP6_PRI_SELINUX_FIRST,
6974 },
Linus Torvalds1da177e2005-04-16 15:20:36 -07006975#endif /* IPV6 */
Jiri Pirko25db6be2014-09-03 17:42:13 +02006976};
Linus Torvalds1da177e2005-04-16 15:20:36 -07006977
Florian Westphal8e71bf72017-04-21 11:49:09 +02006978static int __net_init selinux_nf_register(struct net *net)
6979{
6980 return nf_register_net_hooks(net, selinux_nf_ops,
6981 ARRAY_SIZE(selinux_nf_ops));
6982}
6983
6984static void __net_exit selinux_nf_unregister(struct net *net)
6985{
6986 nf_unregister_net_hooks(net, selinux_nf_ops,
6987 ARRAY_SIZE(selinux_nf_ops));
6988}
6989
6990static struct pernet_operations selinux_net_ops = {
6991 .init = selinux_nf_register,
6992 .exit = selinux_nf_unregister,
6993};
6994
Linus Torvalds1da177e2005-04-16 15:20:36 -07006995static int __init selinux_nf_ip_init(void)
6996{
Jiri Pirko25db6be2014-09-03 17:42:13 +02006997 int err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006998
6999 if (!selinux_enabled)
Jiri Pirko25db6be2014-09-03 17:42:13 +02007000 return 0;
Eric Parisfadcdb42007-02-22 18:11:31 -05007001
peter enderborgc103a912018-06-12 10:09:03 +02007002 pr_debug("SELinux: Registering netfilter hooks\n");
Eric Parisfadcdb42007-02-22 18:11:31 -05007003
Florian Westphal8e71bf72017-04-21 11:49:09 +02007004 err = register_pernet_subsys(&selinux_net_ops);
Alexey Dobriyan6c5a9d22008-07-26 17:48:15 -07007005 if (err)
Florian Westphal8e71bf72017-04-21 11:49:09 +02007006 panic("SELinux: register_pernet_subsys: error %d\n", err);
Linus Torvalds1da177e2005-04-16 15:20:36 -07007007
Jiri Pirko25db6be2014-09-03 17:42:13 +02007008 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07007009}
Linus Torvalds1da177e2005-04-16 15:20:36 -07007010__initcall(selinux_nf_ip_init);
7011
7012#ifdef CONFIG_SECURITY_SELINUX_DISABLE
7013static void selinux_nf_ip_exit(void)
7014{
peter enderborgc103a912018-06-12 10:09:03 +02007015 pr_debug("SELinux: Unregistering netfilter hooks\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07007016
Florian Westphal8e71bf72017-04-21 11:49:09 +02007017 unregister_pernet_subsys(&selinux_net_ops);
Linus Torvalds1da177e2005-04-16 15:20:36 -07007018}
7019#endif
7020
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08007021#else /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07007022
7023#ifdef CONFIG_SECURITY_SELINUX_DISABLE
7024#define selinux_nf_ip_exit()
7025#endif
7026
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08007027#endif /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07007028
7029#ifdef CONFIG_SECURITY_SELINUX_DISABLE
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007030int selinux_disable(struct selinux_state *state)
Linus Torvalds1da177e2005-04-16 15:20:36 -07007031{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007032 if (state->initialized) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07007033 /* Not permitted after initial policy load. */
7034 return -EINVAL;
7035 }
7036
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007037 if (state->disabled) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07007038 /* Only do this once. */
7039 return -EINVAL;
7040 }
7041
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007042 state->disabled = 1;
7043
peter enderborgc103a912018-06-12 10:09:03 +02007044 pr_info("SELinux: Disabled at runtime.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07007045
Stephen Smalley30d55282006-05-03 10:52:36 -04007046 selinux_enabled = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07007047
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07007048 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
Linus Torvalds1da177e2005-04-16 15:20:36 -07007049
Eric Parisaf8ff042009-09-20 21:23:01 -04007050 /* Try to destroy the avc node cache */
7051 avc_disable();
7052
Linus Torvalds1da177e2005-04-16 15:20:36 -07007053 /* Unregister netfilter hooks. */
7054 selinux_nf_ip_exit();
7055
7056 /* Unregister selinuxfs. */
7057 exit_sel_fs();
7058
7059 return 0;
7060}
7061#endif