blob: 630fe8883957e0e8df659f398d61dedb87ddc038 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
Stephen Smalley7efbb602017-08-17 13:32:36 -04006 * Authors: Stephen Smalley, <sds@tycho.nsa.gov>
Eric Paris828dfe12008-04-17 13:17:49 -04007 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070010 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
Eric Paris2069f452008-07-04 09:47:13 +100012 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070014 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
Eric Paris828dfe12008-04-17 13:17:49 -040015 * <dgoeddel@trustedcs.com>
Paul Mooreed6d76e2009-08-28 18:12:49 -040016 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
Paul Moore82c21bf2011-08-01 11:10:33 +000017 * Paul Moore <paul@paul-moore.com>
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +090018 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
Eric Paris828dfe12008-04-17 13:17:49 -040019 * Yuichi Nakamura <ynakam@hitachisoft.jp>
Daniel Jurgens3a976fa2017-05-19 15:48:56 +030020 * Copyright (C) 2016 Mellanox Technologies
Linus Torvalds1da177e2005-04-16 15:20:36 -070021 *
22 * This program is free software; you can redistribute it and/or modify
23 * it under the terms of the GNU General Public License version 2,
Eric Paris828dfe12008-04-17 13:17:49 -040024 * as published by the Free Software Foundation.
Linus Torvalds1da177e2005-04-16 15:20:36 -070025 */
26
Linus Torvalds1da177e2005-04-16 15:20:36 -070027#include <linux/init.h>
Eric Paris0b24dcb2011-02-25 15:39:20 -050028#include <linux/kd.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070029#include <linux/kernel.h>
Roland McGrath0d094ef2008-07-25 19:45:49 -070030#include <linux/tracehook.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070031#include <linux/errno.h>
Ingo Molnar3f07c012017-02-08 18:51:30 +010032#include <linux/sched/signal.h>
Ingo Molnar29930022017-02-08 18:51:36 +010033#include <linux/sched/task.h>
Casey Schaufler3c4ed7b2015-05-02 15:10:46 -070034#include <linux/lsm_hooks.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070035#include <linux/xattr.h>
36#include <linux/capability.h>
37#include <linux/unistd.h>
38#include <linux/mm.h>
39#include <linux/mman.h>
40#include <linux/slab.h>
41#include <linux/pagemap.h>
Eric Paris0b24dcb2011-02-25 15:39:20 -050042#include <linux/proc_fs.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070043#include <linux/swap.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070044#include <linux/spinlock.h>
45#include <linux/syscalls.h>
Eric Paris2a7dba32011-02-01 11:05:39 -050046#include <linux/dcache.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070047#include <linux/file.h>
Al Viro9f3acc32008-04-24 07:44:08 -040048#include <linux/fdtable.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070049#include <linux/namei.h>
50#include <linux/mount.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070051#include <linux/netfilter_ipv4.h>
52#include <linux/netfilter_ipv6.h>
53#include <linux/tty.h>
54#include <net/icmp.h>
Stephen Hemminger227b60f2007-10-10 17:30:46 -070055#include <net/ip.h> /* for local_port_range[] */
Linus Torvalds1da177e2005-04-16 15:20:36 -070056#include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
Paul Moore47180062013-12-04 16:10:45 -050057#include <net/inet_connection_sock.h>
Paul Moore220deb92008-01-29 08:38:23 -050058#include <net/net_namespace.h>
Paul Moored621d352008-01-29 08:43:36 -050059#include <net/netlabel.h>
Eric Parisf5269712008-05-14 11:27:45 -040060#include <linux/uaccess.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070061#include <asm/ioctls.h>
Arun Sharma600634972011-07-26 16:09:06 -070062#include <linux/atomic.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070063#include <linux/bitops.h>
64#include <linux/interrupt.h>
65#include <linux/netdevice.h> /* for network interface checks */
Hong zhi guo77954982013-03-27 06:49:35 +000066#include <net/netlink.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070067#include <linux/tcp.h>
68#include <linux/udp.h>
James Morris2ee92d42006-11-13 16:09:01 -080069#include <linux/dccp.h>
Richard Hainesd4529302018-02-13 20:57:18 +000070#include <linux/sctp.h>
71#include <net/sctp/structs.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070072#include <linux/quota.h>
73#include <linux/un.h> /* for Unix socket types */
74#include <net/af_unix.h> /* for Unix socket types */
75#include <linux/parser.h>
76#include <linux/nfs_mount.h>
77#include <net/ipv6.h>
78#include <linux/hugetlb.h>
79#include <linux/personality.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070080#include <linux/audit.h>
Eric Paris6931dfc2005-06-30 02:58:51 -070081#include <linux/string.h>
Catherine Zhang877ce7c2006-06-29 12:27:47 -070082#include <linux/selinux.h>
Eric Paris23970742006-09-25 23:32:01 -070083#include <linux/mutex.h>
Frank Mayharf06febc2008-09-12 09:54:39 -070084#include <linux/posix-timers.h>
Kees Cook00234592010-02-03 15:36:43 -080085#include <linux/syslog.h>
Serge E. Hallyn34867402011-03-23 16:43:17 -070086#include <linux/user_namespace.h>
Paul Gortmaker44fc7ea2011-05-26 20:52:10 -040087#include <linux/export.h>
Al Viro40401532012-02-13 03:58:52 +000088#include <linux/msg.h>
89#include <linux/shm.h>
Chenbo Fengec27c352017-10-18 13:00:25 -070090#include <linux/bpf.h>
David Howellse262e32d2018-11-01 23:07:23 +000091#include <uapi/linux/mount.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070092
93#include "avc.h"
94#include "objsec.h"
95#include "netif.h"
Paul Moore224dfbd2008-01-29 08:38:13 -050096#include "netnode.h"
Paul Moore3e1121722008-04-10 10:48:14 -040097#include "netport.h"
Daniel Jurgens409dcf32017-05-19 15:48:59 +030098#include "ibpkey.h"
Trent Jaegerd28d1e02005-12-13 23:12:40 -080099#include "xfrm.h"
Paul Moorec60475b2007-02-28 15:14:23 -0500100#include "netlabel.h"
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +0200101#include "audit.h"
James Morris7b98a582011-08-30 12:52:32 +1000102#include "avc_ss.h"
Linus Torvalds1da177e2005-04-16 15:20:36 -0700103
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500104struct selinux_state selinux_state;
105
Paul Moored621d352008-01-29 08:43:36 -0500106/* SECMARK reference count */
James Morris56a4ca92011-08-17 11:08:43 +1000107static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
Paul Moored621d352008-01-29 08:43:36 -0500108
Linus Torvalds1da177e2005-04-16 15:20:36 -0700109#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500110static int selinux_enforcing_boot;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700111
112static int __init enforcing_setup(char *str)
113{
Eric Parisf5269712008-05-14 11:27:45 -0400114 unsigned long enforcing;
Jingoo Han29707b22014-02-05 15:13:14 +0900115 if (!kstrtoul(str, 0, &enforcing))
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500116 selinux_enforcing_boot = enforcing ? 1 : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700117 return 1;
118}
119__setup("enforcing=", enforcing_setup);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500120#else
121#define selinux_enforcing_boot 1
Linus Torvalds1da177e2005-04-16 15:20:36 -0700122#endif
123
124#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
125int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
126
127static int __init selinux_enabled_setup(char *str)
128{
Eric Parisf5269712008-05-14 11:27:45 -0400129 unsigned long enabled;
Jingoo Han29707b22014-02-05 15:13:14 +0900130 if (!kstrtoul(str, 0, &enabled))
Eric Parisf5269712008-05-14 11:27:45 -0400131 selinux_enabled = enabled ? 1 : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700132 return 1;
133}
134__setup("selinux=", selinux_enabled_setup);
Stephen Smalley30d55282006-05-03 10:52:36 -0400135#else
136int selinux_enabled = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700137#endif
138
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500139static unsigned int selinux_checkreqprot_boot =
140 CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
141
142static int __init checkreqprot_setup(char *str)
143{
144 unsigned long checkreqprot;
145
146 if (!kstrtoul(str, 0, &checkreqprot))
147 selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
148 return 1;
149}
150__setup("checkreqprot=", checkreqprot_setup);
151
Christoph Lametere18b8902006-12-06 20:33:20 -0800152static struct kmem_cache *sel_inode_cache;
Sangwoo63205652015-10-21 17:44:30 -0400153static struct kmem_cache *file_security_cache;
James Morris7cae7e22006-03-22 00:09:22 -0800154
Paul Moored621d352008-01-29 08:43:36 -0500155/**
156 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
157 *
158 * Description:
159 * This function checks the SECMARK reference counter to see if any SECMARK
160 * targets are currently configured, if the reference counter is greater than
161 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
Chris PeBenito2be4d742013-05-03 09:05:39 -0400162 * enabled, false (0) if SECMARK is disabled. If the always_check_network
163 * policy capability is enabled, SECMARK is always considered enabled.
Paul Moored621d352008-01-29 08:43:36 -0500164 *
165 */
166static int selinux_secmark_enabled(void)
167{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500168 return (selinux_policycap_alwaysnetwork() ||
169 atomic_read(&selinux_secmark_refcount));
Chris PeBenito2be4d742013-05-03 09:05:39 -0400170}
171
172/**
173 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
174 *
175 * Description:
176 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
177 * (1) if any are enabled or false (0) if neither are enabled. If the
178 * always_check_network policy capability is enabled, peer labeling
179 * is always considered enabled.
180 *
181 */
182static int selinux_peerlbl_enabled(void)
183{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500184 return (selinux_policycap_alwaysnetwork() ||
185 netlbl_enabled() || selinux_xfrm_enabled());
Paul Moored621d352008-01-29 08:43:36 -0500186}
187
Paul Moore615e51f2014-06-26 14:33:56 -0400188static int selinux_netcache_avc_callback(u32 event)
189{
190 if (event == AVC_CALLBACK_RESET) {
191 sel_netif_flush();
192 sel_netnode_flush();
193 sel_netport_flush();
194 synchronize_net();
195 }
196 return 0;
197}
198
Daniel Jurgens8f408ab2017-05-19 15:48:53 +0300199static int selinux_lsm_notifier_avc_callback(u32 event)
200{
Daniel Jurgens409dcf32017-05-19 15:48:59 +0300201 if (event == AVC_CALLBACK_RESET) {
202 sel_ib_pkey_flush();
Daniel Jurgens8f408ab2017-05-19 15:48:53 +0300203 call_lsm_notifier(LSM_POLICY_CHANGE, NULL);
Daniel Jurgens409dcf32017-05-19 15:48:59 +0300204 }
Daniel Jurgens8f408ab2017-05-19 15:48:53 +0300205
206 return 0;
207}
208
David Howellsd84f4f92008-11-14 10:39:23 +1100209/*
210 * initialise the security for the init task
211 */
212static void cred_init_security(void)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700213{
David Howells3b11a1d2008-11-14 10:39:26 +1100214 struct cred *cred = (struct cred *) current->real_cred;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700215 struct task_security_struct *tsec;
216
James Morris89d155e2005-10-30 14:59:21 -0800217 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700218 if (!tsec)
David Howellsd84f4f92008-11-14 10:39:23 +1100219 panic("SELinux: Failed to initialize initial task.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -0700220
David Howellsd84f4f92008-11-14 10:39:23 +1100221 tsec->osid = tsec->sid = SECINITSID_KERNEL;
David Howellsf1752ee2008-11-14 10:39:17 +1100222 cred->security = tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700223}
224
David Howells275bb412008-11-14 10:39:19 +1100225/*
David Howells88e67f32008-11-14 10:39:21 +1100226 * get the security ID of a set of credentials
227 */
228static inline u32 cred_sid(const struct cred *cred)
229{
230 const struct task_security_struct *tsec;
231
232 tsec = cred->security;
233 return tsec->sid;
234}
235
236/*
David Howells3b11a1d2008-11-14 10:39:26 +1100237 * get the objective security ID of a task
David Howells275bb412008-11-14 10:39:19 +1100238 */
239static inline u32 task_sid(const struct task_struct *task)
240{
David Howells275bb412008-11-14 10:39:19 +1100241 u32 sid;
242
243 rcu_read_lock();
David Howells88e67f32008-11-14 10:39:21 +1100244 sid = cred_sid(__task_cred(task));
David Howells275bb412008-11-14 10:39:19 +1100245 rcu_read_unlock();
246 return sid;
247}
248
David Howells88e67f32008-11-14 10:39:21 +1100249/* Allocate and free functions for each kind of security blob. */
250
Linus Torvalds1da177e2005-04-16 15:20:36 -0700251static int inode_alloc_security(struct inode *inode)
252{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700253 struct inode_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +1100254 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700255
Josef Bacika02fe132008-04-04 09:35:05 +1100256 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700257 if (!isec)
258 return -ENOMEM;
259
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +0100260 spin_lock_init(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700261 INIT_LIST_HEAD(&isec->list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700262 isec->inode = inode;
263 isec->sid = SECINITSID_UNLABELED;
264 isec->sclass = SECCLASS_FILE;
David Howells275bb412008-11-14 10:39:19 +1100265 isec->task_sid = sid;
Andreas Gruenbacher42059112016-11-10 22:18:27 +0100266 isec->initialized = LABEL_INVALID;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700267 inode->i_security = isec;
268
269 return 0;
270}
271
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500272static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
273
274/*
275 * Try reloading inode security labels that have been marked as invalid. The
276 * @may_sleep parameter indicates when sleeping and thus reloading labels is
Andreas Gruenbacher42059112016-11-10 22:18:27 +0100277 * allowed; when set to false, returns -ECHILD when the label is
Al Viroe9193282018-04-24 21:31:02 -0400278 * invalid. The @dentry parameter should be set to a dentry of the inode.
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500279 */
280static int __inode_security_revalidate(struct inode *inode,
Al Viroe9193282018-04-24 21:31:02 -0400281 struct dentry *dentry,
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500282 bool may_sleep)
283{
284 struct inode_security_struct *isec = inode->i_security;
285
286 might_sleep_if(may_sleep);
287
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500288 if (selinux_state.initialized &&
289 isec->initialized != LABEL_INITIALIZED) {
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500290 if (!may_sleep)
291 return -ECHILD;
292
293 /*
294 * Try reloading the inode security label. This will fail if
295 * @opt_dentry is NULL and no dentry for this inode can be
296 * found; in that case, continue using the old label.
297 */
Al Viroe9193282018-04-24 21:31:02 -0400298 inode_doinit_with_dentry(inode, dentry);
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500299 }
300 return 0;
301}
302
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500303static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
304{
305 return inode->i_security;
306}
307
308static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
309{
310 int error;
311
312 error = __inode_security_revalidate(inode, NULL, !rcu);
313 if (error)
314 return ERR_PTR(error);
315 return inode->i_security;
316}
317
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500318/*
319 * Get the security label of an inode.
320 */
321static struct inode_security_struct *inode_security(struct inode *inode)
322{
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500323 __inode_security_revalidate(inode, NULL, true);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500324 return inode->i_security;
325}
326
Paul Moore2c971652016-04-19 16:36:28 -0400327static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
328{
329 struct inode *inode = d_backing_inode(dentry);
330
331 return inode->i_security;
332}
333
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500334/*
335 * Get the security label of a dentry's backing inode.
336 */
337static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
338{
339 struct inode *inode = d_backing_inode(dentry);
340
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500341 __inode_security_revalidate(inode, dentry, true);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500342 return inode->i_security;
343}
344
Steven Rostedt3dc91d42014-01-09 21:46:34 -0500345static void inode_free_rcu(struct rcu_head *head)
346{
347 struct inode_security_struct *isec;
348
349 isec = container_of(head, struct inode_security_struct, rcu);
350 kmem_cache_free(sel_inode_cache, isec);
351}
352
Linus Torvalds1da177e2005-04-16 15:20:36 -0700353static void inode_free_security(struct inode *inode)
354{
355 struct inode_security_struct *isec = inode->i_security;
356 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
357
Waiman Long9629d042015-07-10 17:19:56 -0400358 /*
359 * As not all inode security structures are in a list, we check for
360 * empty list outside of the lock to make sure that we won't waste
361 * time taking a lock doing nothing.
362 *
363 * The list_del_init() function can be safely called more than once.
364 * It should not be possible for this function to be called with
365 * concurrent list_add(), but for better safety against future changes
366 * in the code, we use list_empty_careful() here.
367 */
368 if (!list_empty_careful(&isec->list)) {
369 spin_lock(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700370 list_del_init(&isec->list);
Waiman Long9629d042015-07-10 17:19:56 -0400371 spin_unlock(&sbsec->isec_lock);
372 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700373
Steven Rostedt3dc91d42014-01-09 21:46:34 -0500374 /*
375 * The inode may still be referenced in a path walk and
376 * a call to selinux_inode_permission() can be made
377 * after inode_free_security() is called. Ideally, the VFS
378 * wouldn't do this, but fixing that is a much harder
379 * job. For now, simply free the i_security via RCU, and
380 * leave the current inode->i_security pointer intact.
381 * The inode will be freed after the RCU grace period too.
382 */
383 call_rcu(&isec->rcu, inode_free_rcu);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700384}
385
386static int file_alloc_security(struct file *file)
387{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700388 struct file_security_struct *fsec;
David Howells275bb412008-11-14 10:39:19 +1100389 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700390
Sangwoo63205652015-10-21 17:44:30 -0400391 fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700392 if (!fsec)
393 return -ENOMEM;
394
David Howells275bb412008-11-14 10:39:19 +1100395 fsec->sid = sid;
396 fsec->fown_sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700397 file->f_security = fsec;
398
399 return 0;
400}
401
402static void file_free_security(struct file *file)
403{
404 struct file_security_struct *fsec = file->f_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700405 file->f_security = NULL;
Sangwoo63205652015-10-21 17:44:30 -0400406 kmem_cache_free(file_security_cache, fsec);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700407}
408
409static int superblock_alloc_security(struct super_block *sb)
410{
411 struct superblock_security_struct *sbsec;
412
James Morris89d155e2005-10-30 14:59:21 -0800413 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700414 if (!sbsec)
415 return -ENOMEM;
416
Eric Parisbc7e9822006-09-25 23:32:02 -0700417 mutex_init(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700418 INIT_LIST_HEAD(&sbsec->isec_head);
419 spin_lock_init(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700420 sbsec->sb = sb;
421 sbsec->sid = SECINITSID_UNLABELED;
422 sbsec->def_sid = SECINITSID_FILE;
Eric Parisc312feb2006-07-10 04:43:53 -0700423 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700424 sb->s_security = sbsec;
425
426 return 0;
427}
428
429static void superblock_free_security(struct super_block *sb)
430{
431 struct superblock_security_struct *sbsec = sb->s_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700432 sb->s_security = NULL;
433 kfree(sbsec);
434}
435
Linus Torvalds1da177e2005-04-16 15:20:36 -0700436static inline int inode_doinit(struct inode *inode)
437{
438 return inode_doinit_with_dentry(inode, NULL);
439}
440
441enum {
Eric Paris31e87932007-09-19 17:19:12 -0400442 Opt_error = -1,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700443 Opt_context = 1,
444 Opt_fscontext = 2,
Eric Parisc9180a52007-11-30 13:00:35 -0500445 Opt_defcontext = 3,
446 Opt_rootcontext = 4,
David P. Quigley11689d42009-01-16 09:22:03 -0500447 Opt_labelsupport = 5,
Eric Parisd355987f2012-08-24 15:58:53 -0400448 Opt_nextmntopt = 6,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700449};
450
Eric Parisd355987f2012-08-24 15:58:53 -0400451#define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1)
452
Steven Whitehousea447c092008-10-13 10:46:57 +0100453static const match_table_t tokens = {
Eric Paris832cbd92008-04-01 13:24:09 -0400454 {Opt_context, CONTEXT_STR "%s"},
455 {Opt_fscontext, FSCONTEXT_STR "%s"},
456 {Opt_defcontext, DEFCONTEXT_STR "%s"},
457 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
David P. Quigley11689d42009-01-16 09:22:03 -0500458 {Opt_labelsupport, LABELSUPP_STR},
Eric Paris31e87932007-09-19 17:19:12 -0400459 {Opt_error, NULL},
Linus Torvalds1da177e2005-04-16 15:20:36 -0700460};
461
462#define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
463
Eric Parisc312feb2006-07-10 04:43:53 -0700464static int may_context_mount_sb_relabel(u32 sid,
465 struct superblock_security_struct *sbsec,
David Howells275bb412008-11-14 10:39:19 +1100466 const struct cred *cred)
Eric Parisc312feb2006-07-10 04:43:53 -0700467{
David Howells275bb412008-11-14 10:39:19 +1100468 const struct task_security_struct *tsec = cred->security;
Eric Parisc312feb2006-07-10 04:43:53 -0700469 int rc;
470
Stephen Smalley6b6bc622018-03-05 11:47:56 -0500471 rc = avc_has_perm(&selinux_state,
472 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
Eric Parisc312feb2006-07-10 04:43:53 -0700473 FILESYSTEM__RELABELFROM, NULL);
474 if (rc)
475 return rc;
476
Stephen Smalley6b6bc622018-03-05 11:47:56 -0500477 rc = avc_has_perm(&selinux_state,
478 tsec->sid, sid, SECCLASS_FILESYSTEM,
Eric Parisc312feb2006-07-10 04:43:53 -0700479 FILESYSTEM__RELABELTO, NULL);
480 return rc;
481}
482
Eric Paris08089252006-07-10 04:43:55 -0700483static int may_context_mount_inode_relabel(u32 sid,
484 struct superblock_security_struct *sbsec,
David Howells275bb412008-11-14 10:39:19 +1100485 const struct cred *cred)
Eric Paris08089252006-07-10 04:43:55 -0700486{
David Howells275bb412008-11-14 10:39:19 +1100487 const struct task_security_struct *tsec = cred->security;
Eric Paris08089252006-07-10 04:43:55 -0700488 int rc;
Stephen Smalley6b6bc622018-03-05 11:47:56 -0500489 rc = avc_has_perm(&selinux_state,
490 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
Eric Paris08089252006-07-10 04:43:55 -0700491 FILESYSTEM__RELABELFROM, NULL);
492 if (rc)
493 return rc;
494
Stephen Smalley6b6bc622018-03-05 11:47:56 -0500495 rc = avc_has_perm(&selinux_state,
496 sid, sbsec->sid, SECCLASS_FILESYSTEM,
Eric Paris08089252006-07-10 04:43:55 -0700497 FILESYSTEM__ASSOCIATE, NULL);
498 return rc;
499}
500
Eric Parisb43e7252012-10-10 14:27:35 -0400501static int selinux_is_sblabel_mnt(struct super_block *sb)
502{
503 struct superblock_security_struct *sbsec = sb->s_security;
504
Mark Salyzynd5f3a5f2015-02-04 11:34:30 -0500505 return sbsec->behavior == SECURITY_FS_USE_XATTR ||
506 sbsec->behavior == SECURITY_FS_USE_TRANS ||
507 sbsec->behavior == SECURITY_FS_USE_TASK ||
J. Bruce Fields9fc2b4b2015-06-04 15:57:25 -0400508 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
Mark Salyzynd5f3a5f2015-02-04 11:34:30 -0500509 /* Special handling. Genfs but also in-core setxattr handler */
510 !strcmp(sb->s_type->name, "sysfs") ||
511 !strcmp(sb->s_type->name, "pstore") ||
512 !strcmp(sb->s_type->name, "debugfs") ||
Yongqin Liua2c7c6f2017-01-09 10:07:30 -0500513 !strcmp(sb->s_type->name, "tracefs") ||
Stephen Smalley2651225b2017-02-28 10:35:56 -0500514 !strcmp(sb->s_type->name, "rootfs") ||
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500515 (selinux_policycap_cgroupseclabel() &&
Stephen Smalley2651225b2017-02-28 10:35:56 -0500516 (!strcmp(sb->s_type->name, "cgroup") ||
517 !strcmp(sb->s_type->name, "cgroup2")));
Eric Parisb43e7252012-10-10 14:27:35 -0400518}
519
Eric Parisc9180a52007-11-30 13:00:35 -0500520static int sb_finish_set_opts(struct super_block *sb)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700521{
522 struct superblock_security_struct *sbsec = sb->s_security;
523 struct dentry *root = sb->s_root;
David Howellsc6f493d2015-03-17 22:26:22 +0000524 struct inode *root_inode = d_backing_inode(root);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700525 int rc = 0;
526
Linus Torvalds1da177e2005-04-16 15:20:36 -0700527 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
528 /* Make sure that the xattr handler exists and that no
529 error other than -ENODATA is returned by getxattr on
530 the root directory. -ENODATA is ok, as this may be
531 the first boot of the SELinux kernel before we have
532 assigned xattr values to the filesystem. */
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +0200533 if (!(root_inode->i_opflags & IOP_XATTR)) {
peter enderborgc103a912018-06-12 10:09:03 +0200534 pr_warn("SELinux: (dev %s, type %s) has no "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800535 "xattr support\n", sb->s_id, sb->s_type->name);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700536 rc = -EOPNOTSUPP;
537 goto out;
538 }
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +0200539
540 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700541 if (rc < 0 && rc != -ENODATA) {
542 if (rc == -EOPNOTSUPP)
peter enderborgc103a912018-06-12 10:09:03 +0200543 pr_warn("SELinux: (dev %s, type "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800544 "%s) has no security xattr handler\n",
545 sb->s_id, sb->s_type->name);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700546 else
peter enderborgc103a912018-06-12 10:09:03 +0200547 pr_warn("SELinux: (dev %s, type "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800548 "%s) getxattr errno %d\n", sb->s_id,
549 sb->s_type->name, -rc);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700550 goto out;
551 }
552 }
553
Eric Pariseadcabc2012-08-24 15:59:14 -0400554 sbsec->flags |= SE_SBINITIALIZED;
Scott Mayhew0b4d3452017-06-05 11:45:04 -0400555
556 /*
557 * Explicitly set or clear SBLABEL_MNT. It's not sufficient to simply
558 * leave the flag untouched because sb_clone_mnt_opts might be handing
559 * us a superblock that needs the flag to be cleared.
560 */
Eric Parisb43e7252012-10-10 14:27:35 -0400561 if (selinux_is_sblabel_mnt(sb))
Eric Paris12f348b2012-10-09 10:56:25 -0400562 sbsec->flags |= SBLABEL_MNT;
Scott Mayhew0b4d3452017-06-05 11:45:04 -0400563 else
564 sbsec->flags &= ~SBLABEL_MNT;
David P. Quigleyddd29ec2009-09-09 14:25:37 -0400565
Linus Torvalds1da177e2005-04-16 15:20:36 -0700566 /* Initialize the root inode. */
Eric Parisc9180a52007-11-30 13:00:35 -0500567 rc = inode_doinit_with_dentry(root_inode, root);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700568
569 /* Initialize any other inodes associated with the superblock, e.g.
570 inodes created prior to initial policy load or inodes created
571 during get_sb by a pseudo filesystem that directly
572 populates itself. */
573 spin_lock(&sbsec->isec_lock);
Al Viro8d641242018-12-10 15:34:12 -0500574 while (!list_empty(&sbsec->isec_head)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700575 struct inode_security_struct *isec =
Al Viro8d641242018-12-10 15:34:12 -0500576 list_first_entry(&sbsec->isec_head,
Eric Parisc9180a52007-11-30 13:00:35 -0500577 struct inode_security_struct, list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700578 struct inode *inode = isec->inode;
Stephen Smalley923190d2014-10-06 16:32:52 -0400579 list_del_init(&isec->list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700580 spin_unlock(&sbsec->isec_lock);
581 inode = igrab(inode);
582 if (inode) {
Eric Parisc9180a52007-11-30 13:00:35 -0500583 if (!IS_PRIVATE(inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700584 inode_doinit(inode);
585 iput(inode);
586 }
587 spin_lock(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700588 }
589 spin_unlock(&sbsec->isec_lock);
590out:
Eric Parisc9180a52007-11-30 13:00:35 -0500591 return rc;
592}
593
594/*
595 * This function should allow an FS to ask what it's mount security
596 * options were so it can use those later for submounts, displaying
597 * mount options, or whatever.
598 */
599static int selinux_get_mnt_opts(const struct super_block *sb,
Eric Parise0007522008-03-05 10:31:54 -0500600 struct security_mnt_opts *opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500601{
602 int rc = 0, i;
603 struct superblock_security_struct *sbsec = sb->s_security;
604 char *context = NULL;
605 u32 len;
606 char tmp;
607
Eric Parise0007522008-03-05 10:31:54 -0500608 security_init_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500609
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500610 if (!(sbsec->flags & SE_SBINITIALIZED))
Eric Parisc9180a52007-11-30 13:00:35 -0500611 return -EINVAL;
612
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500613 if (!selinux_state.initialized)
Eric Parisc9180a52007-11-30 13:00:35 -0500614 return -EINVAL;
615
Eric Parisaf8e50c2012-08-24 15:59:00 -0400616 /* make sure we always check enough bits to cover the mask */
617 BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
618
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500619 tmp = sbsec->flags & SE_MNTMASK;
Eric Parisc9180a52007-11-30 13:00:35 -0500620 /* count the number of mount options for this sb */
Eric Parisaf8e50c2012-08-24 15:59:00 -0400621 for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
Eric Parisc9180a52007-11-30 13:00:35 -0500622 if (tmp & 0x01)
Eric Parise0007522008-03-05 10:31:54 -0500623 opts->num_mnt_opts++;
Eric Parisc9180a52007-11-30 13:00:35 -0500624 tmp >>= 1;
625 }
David P. Quigley11689d42009-01-16 09:22:03 -0500626 /* Check if the Label support flag is set */
Eric Paris0b4bdb32013-08-28 13:32:42 -0400627 if (sbsec->flags & SBLABEL_MNT)
David P. Quigley11689d42009-01-16 09:22:03 -0500628 opts->num_mnt_opts++;
Eric Parisc9180a52007-11-30 13:00:35 -0500629
Eric Parise0007522008-03-05 10:31:54 -0500630 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
631 if (!opts->mnt_opts) {
Eric Parisc9180a52007-11-30 13:00:35 -0500632 rc = -ENOMEM;
633 goto out_free;
634 }
635
Eric Parise0007522008-03-05 10:31:54 -0500636 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
637 if (!opts->mnt_opts_flags) {
Eric Parisc9180a52007-11-30 13:00:35 -0500638 rc = -ENOMEM;
639 goto out_free;
640 }
641
642 i = 0;
643 if (sbsec->flags & FSCONTEXT_MNT) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500644 rc = security_sid_to_context(&selinux_state, sbsec->sid,
645 &context, &len);
Eric Parisc9180a52007-11-30 13:00:35 -0500646 if (rc)
647 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500648 opts->mnt_opts[i] = context;
649 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500650 }
651 if (sbsec->flags & CONTEXT_MNT) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500652 rc = security_sid_to_context(&selinux_state,
653 sbsec->mntpoint_sid,
654 &context, &len);
Eric Parisc9180a52007-11-30 13:00:35 -0500655 if (rc)
656 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500657 opts->mnt_opts[i] = context;
658 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500659 }
660 if (sbsec->flags & DEFCONTEXT_MNT) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500661 rc = security_sid_to_context(&selinux_state, sbsec->def_sid,
662 &context, &len);
Eric Parisc9180a52007-11-30 13:00:35 -0500663 if (rc)
664 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500665 opts->mnt_opts[i] = context;
666 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500667 }
668 if (sbsec->flags & ROOTCONTEXT_MNT) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500669 struct dentry *root = sbsec->sb->s_root;
670 struct inode_security_struct *isec = backing_inode_security(root);
Eric Parisc9180a52007-11-30 13:00:35 -0500671
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500672 rc = security_sid_to_context(&selinux_state, isec->sid,
673 &context, &len);
Eric Parisc9180a52007-11-30 13:00:35 -0500674 if (rc)
675 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500676 opts->mnt_opts[i] = context;
677 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500678 }
Eric Paris12f348b2012-10-09 10:56:25 -0400679 if (sbsec->flags & SBLABEL_MNT) {
David P. Quigley11689d42009-01-16 09:22:03 -0500680 opts->mnt_opts[i] = NULL;
Eric Paris12f348b2012-10-09 10:56:25 -0400681 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
David P. Quigley11689d42009-01-16 09:22:03 -0500682 }
Eric Parisc9180a52007-11-30 13:00:35 -0500683
Eric Parise0007522008-03-05 10:31:54 -0500684 BUG_ON(i != opts->num_mnt_opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500685
686 return 0;
687
688out_free:
Eric Parise0007522008-03-05 10:31:54 -0500689 security_free_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500690 return rc;
691}
692
693static int bad_option(struct superblock_security_struct *sbsec, char flag,
694 u32 old_sid, u32 new_sid)
695{
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500696 char mnt_flags = sbsec->flags & SE_MNTMASK;
697
Eric Parisc9180a52007-11-30 13:00:35 -0500698 /* check if the old mount command had the same options */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500699 if (sbsec->flags & SE_SBINITIALIZED)
Eric Parisc9180a52007-11-30 13:00:35 -0500700 if (!(sbsec->flags & flag) ||
701 (old_sid != new_sid))
702 return 1;
703
704 /* check if we were passed the same options twice,
705 * aka someone passed context=a,context=b
706 */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500707 if (!(sbsec->flags & SE_SBINITIALIZED))
708 if (mnt_flags & flag)
Eric Parisc9180a52007-11-30 13:00:35 -0500709 return 1;
710 return 0;
711}
Eric Parise0007522008-03-05 10:31:54 -0500712
Eric Parisc9180a52007-11-30 13:00:35 -0500713/*
714 * Allow filesystems with binary mount data to explicitly set mount point
715 * labeling information.
716 */
Eric Parise0007522008-03-05 10:31:54 -0500717static int selinux_set_mnt_opts(struct super_block *sb,
David Quigley649f6e72013-05-22 12:50:36 -0400718 struct security_mnt_opts *opts,
719 unsigned long kern_flags,
720 unsigned long *set_kern_flags)
Eric Parisc9180a52007-11-30 13:00:35 -0500721{
David Howells275bb412008-11-14 10:39:19 +1100722 const struct cred *cred = current_cred();
Eric Parisc9180a52007-11-30 13:00:35 -0500723 int rc = 0, i;
Eric Parisc9180a52007-11-30 13:00:35 -0500724 struct superblock_security_struct *sbsec = sb->s_security;
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800725 const char *name = sb->s_type->name;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500726 struct dentry *root = sbsec->sb->s_root;
Paul Moore2c971652016-04-19 16:36:28 -0400727 struct inode_security_struct *root_isec;
Eric Parisc9180a52007-11-30 13:00:35 -0500728 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
729 u32 defcontext_sid = 0;
Eric Parise0007522008-03-05 10:31:54 -0500730 char **mount_options = opts->mnt_opts;
731 int *flags = opts->mnt_opts_flags;
732 int num_opts = opts->num_mnt_opts;
Eric Parisc9180a52007-11-30 13:00:35 -0500733
734 mutex_lock(&sbsec->lock);
735
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500736 if (!selinux_state.initialized) {
Eric Parisc9180a52007-11-30 13:00:35 -0500737 if (!num_opts) {
738 /* Defer initialization until selinux_complete_init,
739 after the initial policy is loaded and the security
740 server is ready to handle calls. */
Eric Parisc9180a52007-11-30 13:00:35 -0500741 goto out;
742 }
743 rc = -EINVAL;
peter enderborgc103a912018-06-12 10:09:03 +0200744 pr_warn("SELinux: Unable to set superblock options "
Eric Paris744ba352008-04-17 11:52:44 -0400745 "before the security server is initialized\n");
Eric Parisc9180a52007-11-30 13:00:35 -0500746 goto out;
747 }
David Quigley649f6e72013-05-22 12:50:36 -0400748 if (kern_flags && !set_kern_flags) {
749 /* Specifying internal flags without providing a place to
750 * place the results is not allowed */
751 rc = -EINVAL;
752 goto out;
753 }
Eric Parisc9180a52007-11-30 13:00:35 -0500754
755 /*
Eric Parise0007522008-03-05 10:31:54 -0500756 * Binary mount data FS will come through this function twice. Once
757 * from an explicit call and once from the generic calls from the vfs.
758 * Since the generic VFS calls will not contain any security mount data
759 * we need to skip the double mount verification.
760 *
761 * This does open a hole in which we will not notice if the first
762 * mount using this sb set explict options and a second mount using
763 * this sb does not set any security options. (The first options
764 * will be used for both mounts)
765 */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500766 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
Eric Parise0007522008-03-05 10:31:54 -0500767 && (num_opts == 0))
Eric Parisf5269712008-05-14 11:27:45 -0400768 goto out;
Eric Parise0007522008-03-05 10:31:54 -0500769
Paul Moore2c971652016-04-19 16:36:28 -0400770 root_isec = backing_inode_security_novalidate(root);
771
Eric Parise0007522008-03-05 10:31:54 -0500772 /*
Eric Parisc9180a52007-11-30 13:00:35 -0500773 * parse the mount options, check if they are valid sids.
774 * also check if someone is trying to mount the same sb more
775 * than once with different security options.
776 */
777 for (i = 0; i < num_opts; i++) {
778 u32 sid;
David P. Quigley11689d42009-01-16 09:22:03 -0500779
Eric Paris12f348b2012-10-09 10:56:25 -0400780 if (flags[i] == SBLABEL_MNT)
David P. Quigley11689d42009-01-16 09:22:03 -0500781 continue;
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500782 rc = security_context_str_to_sid(&selinux_state,
783 mount_options[i], &sid,
784 GFP_KERNEL);
Eric Parisc9180a52007-11-30 13:00:35 -0500785 if (rc) {
peter enderborgc103a912018-06-12 10:09:03 +0200786 pr_warn("SELinux: security_context_str_to_sid"
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800787 "(%s) failed for (dev %s, type %s) errno=%d\n",
788 mount_options[i], sb->s_id, name, rc);
Eric Parisc9180a52007-11-30 13:00:35 -0500789 goto out;
790 }
791 switch (flags[i]) {
792 case FSCONTEXT_MNT:
793 fscontext_sid = sid;
794
795 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
796 fscontext_sid))
797 goto out_double_mount;
798
799 sbsec->flags |= FSCONTEXT_MNT;
800 break;
801 case CONTEXT_MNT:
802 context_sid = sid;
803
804 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
805 context_sid))
806 goto out_double_mount;
807
808 sbsec->flags |= CONTEXT_MNT;
809 break;
810 case ROOTCONTEXT_MNT:
811 rootcontext_sid = sid;
812
813 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
814 rootcontext_sid))
815 goto out_double_mount;
816
817 sbsec->flags |= ROOTCONTEXT_MNT;
818
819 break;
820 case DEFCONTEXT_MNT:
821 defcontext_sid = sid;
822
823 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
824 defcontext_sid))
825 goto out_double_mount;
826
827 sbsec->flags |= DEFCONTEXT_MNT;
828
829 break;
830 default:
831 rc = -EINVAL;
832 goto out;
833 }
834 }
835
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500836 if (sbsec->flags & SE_SBINITIALIZED) {
Eric Parisc9180a52007-11-30 13:00:35 -0500837 /* previously mounted with options, but not on this attempt? */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500838 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500839 goto out_double_mount;
840 rc = 0;
841 goto out;
842 }
843
James Morris089be432008-07-15 18:32:49 +1000844 if (strcmp(sb->s_type->name, "proc") == 0)
Stephen Smalley134509d2015-06-04 16:22:17 -0400845 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
846
Stephen Smalley8e014722015-06-04 16:22:17 -0400847 if (!strcmp(sb->s_type->name, "debugfs") ||
Jeff Vander Stoep6a391182017-06-20 09:35:33 -0700848 !strcmp(sb->s_type->name, "tracefs") ||
Stephen Smalley8e014722015-06-04 16:22:17 -0400849 !strcmp(sb->s_type->name, "sysfs") ||
Antonio Murdaca901ef842017-02-09 17:02:42 +0100850 !strcmp(sb->s_type->name, "pstore") ||
851 !strcmp(sb->s_type->name, "cgroup") ||
852 !strcmp(sb->s_type->name, "cgroup2"))
Stephen Smalley134509d2015-06-04 16:22:17 -0400853 sbsec->flags |= SE_SBGENFS;
Eric Parisc9180a52007-11-30 13:00:35 -0500854
David Quigleyeb9ae682013-05-22 12:50:37 -0400855 if (!sbsec->behavior) {
856 /*
857 * Determine the labeling behavior to use for this
858 * filesystem type.
859 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500860 rc = security_fs_use(&selinux_state, sb);
David Quigleyeb9ae682013-05-22 12:50:37 -0400861 if (rc) {
peter enderborgc103a912018-06-12 10:09:03 +0200862 pr_warn("%s: security_fs_use(%s) returned %d\n",
David Quigleyeb9ae682013-05-22 12:50:37 -0400863 __func__, sb->s_type->name, rc);
864 goto out;
865 }
Eric Parisc9180a52007-11-30 13:00:35 -0500866 }
Seth Forsheeaad82892016-04-26 14:36:20 -0500867
868 /*
Stephen Smalley01593d32017-01-09 10:07:31 -0500869 * If this is a user namespace mount and the filesystem type is not
870 * explicitly whitelisted, then no contexts are allowed on the command
871 * line and security labels must be ignored.
Seth Forsheeaad82892016-04-26 14:36:20 -0500872 */
Stephen Smalley01593d32017-01-09 10:07:31 -0500873 if (sb->s_user_ns != &init_user_ns &&
874 strcmp(sb->s_type->name, "tmpfs") &&
875 strcmp(sb->s_type->name, "ramfs") &&
876 strcmp(sb->s_type->name, "devpts")) {
Seth Forsheeaad82892016-04-26 14:36:20 -0500877 if (context_sid || fscontext_sid || rootcontext_sid ||
878 defcontext_sid) {
879 rc = -EACCES;
880 goto out;
881 }
882 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
883 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500884 rc = security_transition_sid(&selinux_state,
885 current_sid(),
886 current_sid(),
Seth Forsheeaad82892016-04-26 14:36:20 -0500887 SECCLASS_FILE, NULL,
888 &sbsec->mntpoint_sid);
889 if (rc)
890 goto out;
891 }
892 goto out_set_opts;
893 }
894
Eric Parisc9180a52007-11-30 13:00:35 -0500895 /* sets the context of the superblock for the fs being mounted. */
896 if (fscontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100897 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500898 if (rc)
899 goto out;
900
901 sbsec->sid = fscontext_sid;
902 }
903
904 /*
905 * Switch to using mount point labeling behavior.
906 * sets the label used on all file below the mountpoint, and will set
907 * the superblock context if not already set.
908 */
David Quigleyeb9ae682013-05-22 12:50:37 -0400909 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
910 sbsec->behavior = SECURITY_FS_USE_NATIVE;
911 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
912 }
913
Eric Parisc9180a52007-11-30 13:00:35 -0500914 if (context_sid) {
915 if (!fscontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100916 rc = may_context_mount_sb_relabel(context_sid, sbsec,
917 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500918 if (rc)
919 goto out;
920 sbsec->sid = context_sid;
921 } else {
David Howells275bb412008-11-14 10:39:19 +1100922 rc = may_context_mount_inode_relabel(context_sid, sbsec,
923 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500924 if (rc)
925 goto out;
926 }
927 if (!rootcontext_sid)
928 rootcontext_sid = context_sid;
929
930 sbsec->mntpoint_sid = context_sid;
931 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
932 }
933
934 if (rootcontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100935 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
936 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500937 if (rc)
938 goto out;
939
940 root_isec->sid = rootcontext_sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -0500941 root_isec->initialized = LABEL_INITIALIZED;
Eric Parisc9180a52007-11-30 13:00:35 -0500942 }
943
944 if (defcontext_sid) {
David Quigleyeb9ae682013-05-22 12:50:37 -0400945 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
946 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
Eric Parisc9180a52007-11-30 13:00:35 -0500947 rc = -EINVAL;
peter enderborgc103a912018-06-12 10:09:03 +0200948 pr_warn("SELinux: defcontext option is "
Eric Parisc9180a52007-11-30 13:00:35 -0500949 "invalid for this filesystem type\n");
950 goto out;
951 }
952
953 if (defcontext_sid != sbsec->def_sid) {
954 rc = may_context_mount_inode_relabel(defcontext_sid,
David Howells275bb412008-11-14 10:39:19 +1100955 sbsec, cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500956 if (rc)
957 goto out;
958 }
959
960 sbsec->def_sid = defcontext_sid;
961 }
962
Seth Forsheeaad82892016-04-26 14:36:20 -0500963out_set_opts:
Eric Parisc9180a52007-11-30 13:00:35 -0500964 rc = sb_finish_set_opts(sb);
965out:
Eric Parisbc7e9822006-09-25 23:32:02 -0700966 mutex_unlock(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700967 return rc;
Eric Parisc9180a52007-11-30 13:00:35 -0500968out_double_mount:
969 rc = -EINVAL;
peter enderborgc103a912018-06-12 10:09:03 +0200970 pr_warn("SELinux: mount invalid. Same superblock, different "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800971 "security settings for (dev %s, type %s)\n", sb->s_id, name);
Eric Parisc9180a52007-11-30 13:00:35 -0500972 goto out;
973}
974
Jeff Layton094f7b62013-04-01 08:14:24 -0400975static int selinux_cmp_sb_context(const struct super_block *oldsb,
976 const struct super_block *newsb)
977{
978 struct superblock_security_struct *old = oldsb->s_security;
979 struct superblock_security_struct *new = newsb->s_security;
980 char oldflags = old->flags & SE_MNTMASK;
981 char newflags = new->flags & SE_MNTMASK;
982
983 if (oldflags != newflags)
984 goto mismatch;
985 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
986 goto mismatch;
987 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
988 goto mismatch;
989 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
990 goto mismatch;
991 if (oldflags & ROOTCONTEXT_MNT) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500992 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
993 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
Jeff Layton094f7b62013-04-01 08:14:24 -0400994 if (oldroot->sid != newroot->sid)
995 goto mismatch;
996 }
997 return 0;
998mismatch:
peter enderborgc103a912018-06-12 10:09:03 +0200999 pr_warn("SELinux: mount invalid. Same superblock, "
Jeff Layton094f7b62013-04-01 08:14:24 -04001000 "different security settings for (dev %s, "
1001 "type %s)\n", newsb->s_id, newsb->s_type->name);
1002 return -EBUSY;
1003}
1004
1005static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001006 struct super_block *newsb,
1007 unsigned long kern_flags,
1008 unsigned long *set_kern_flags)
Eric Parisc9180a52007-11-30 13:00:35 -05001009{
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001010 int rc = 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001011 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
1012 struct superblock_security_struct *newsbsec = newsb->s_security;
1013
1014 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
1015 int set_context = (oldsbsec->flags & CONTEXT_MNT);
1016 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
1017
Eric Paris0f5e6422008-04-21 16:24:11 -04001018 /*
1019 * if the parent was able to be mounted it clearly had no special lsm
Al Viroe8c26252010-03-23 06:36:54 -04001020 * mount options. thus we can safely deal with this superblock later
Eric Paris0f5e6422008-04-21 16:24:11 -04001021 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001022 if (!selinux_state.initialized)
Jeff Layton094f7b62013-04-01 08:14:24 -04001023 return 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001024
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001025 /*
1026 * Specifying internal flags without providing a place to
1027 * place the results is not allowed.
1028 */
1029 if (kern_flags && !set_kern_flags)
1030 return -EINVAL;
1031
Eric Parisc9180a52007-11-30 13:00:35 -05001032 /* how can we clone if the old one wasn't set up?? */
David P. Quigley0d90a7e2009-01-16 09:22:02 -05001033 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
Eric Parisc9180a52007-11-30 13:00:35 -05001034
Jeff Layton094f7b62013-04-01 08:14:24 -04001035 /* if fs is reusing a sb, make sure that the contexts match */
David P. Quigley0d90a7e2009-01-16 09:22:02 -05001036 if (newsbsec->flags & SE_SBINITIALIZED)
Jeff Layton094f7b62013-04-01 08:14:24 -04001037 return selinux_cmp_sb_context(oldsb, newsb);
Eric Paris5a552612008-04-09 14:08:35 -04001038
Eric Parisc9180a52007-11-30 13:00:35 -05001039 mutex_lock(&newsbsec->lock);
1040
1041 newsbsec->flags = oldsbsec->flags;
1042
1043 newsbsec->sid = oldsbsec->sid;
1044 newsbsec->def_sid = oldsbsec->def_sid;
1045 newsbsec->behavior = oldsbsec->behavior;
1046
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001047 if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
1048 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001049 rc = security_fs_use(&selinux_state, newsb);
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001050 if (rc)
1051 goto out;
1052 }
1053
1054 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
1055 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
1056 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
1057 }
1058
Eric Parisc9180a52007-11-30 13:00:35 -05001059 if (set_context) {
1060 u32 sid = oldsbsec->mntpoint_sid;
1061
1062 if (!set_fscontext)
1063 newsbsec->sid = sid;
1064 if (!set_rootcontext) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001065 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
Eric Parisc9180a52007-11-30 13:00:35 -05001066 newisec->sid = sid;
1067 }
1068 newsbsec->mntpoint_sid = sid;
1069 }
1070 if (set_rootcontext) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001071 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
1072 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
Eric Parisc9180a52007-11-30 13:00:35 -05001073
1074 newisec->sid = oldisec->sid;
1075 }
1076
1077 sb_finish_set_opts(newsb);
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001078out:
Eric Parisc9180a52007-11-30 13:00:35 -05001079 mutex_unlock(&newsbsec->lock);
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001080 return rc;
Eric Parisc9180a52007-11-30 13:00:35 -05001081}
1082
Adrian Bunk2e1479d2008-03-17 22:29:23 +02001083static int selinux_parse_opts_str(char *options,
1084 struct security_mnt_opts *opts)
Eric Parisc9180a52007-11-30 13:00:35 -05001085{
Eric Parise0007522008-03-05 10:31:54 -05001086 char *p;
Eric Parisc9180a52007-11-30 13:00:35 -05001087 char *context = NULL, *defcontext = NULL;
1088 char *fscontext = NULL, *rootcontext = NULL;
Eric Parise0007522008-03-05 10:31:54 -05001089 int rc, num_mnt_opts = 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001090
Eric Parise0007522008-03-05 10:31:54 -05001091 opts->num_mnt_opts = 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001092
1093 /* Standard string-based options. */
1094 while ((p = strsep(&options, "|")) != NULL) {
1095 int token;
1096 substring_t args[MAX_OPT_ARGS];
1097
1098 if (!*p)
1099 continue;
1100
1101 token = match_token(p, tokens, args);
1102
1103 switch (token) {
1104 case Opt_context:
1105 if (context || defcontext) {
1106 rc = -EINVAL;
peter enderborgc103a912018-06-12 10:09:03 +02001107 pr_warn(SEL_MOUNT_FAIL_MSG);
Eric Parisc9180a52007-11-30 13:00:35 -05001108 goto out_err;
1109 }
1110 context = match_strdup(&args[0]);
1111 if (!context) {
1112 rc = -ENOMEM;
1113 goto out_err;
1114 }
1115 break;
1116
1117 case Opt_fscontext:
1118 if (fscontext) {
1119 rc = -EINVAL;
peter enderborgc103a912018-06-12 10:09:03 +02001120 pr_warn(SEL_MOUNT_FAIL_MSG);
Eric Parisc9180a52007-11-30 13:00:35 -05001121 goto out_err;
1122 }
1123 fscontext = match_strdup(&args[0]);
1124 if (!fscontext) {
1125 rc = -ENOMEM;
1126 goto out_err;
1127 }
1128 break;
1129
1130 case Opt_rootcontext:
1131 if (rootcontext) {
1132 rc = -EINVAL;
peter enderborgc103a912018-06-12 10:09:03 +02001133 pr_warn(SEL_MOUNT_FAIL_MSG);
Eric Parisc9180a52007-11-30 13:00:35 -05001134 goto out_err;
1135 }
1136 rootcontext = match_strdup(&args[0]);
1137 if (!rootcontext) {
1138 rc = -ENOMEM;
1139 goto out_err;
1140 }
1141 break;
1142
1143 case Opt_defcontext:
1144 if (context || defcontext) {
1145 rc = -EINVAL;
peter enderborgc103a912018-06-12 10:09:03 +02001146 pr_warn(SEL_MOUNT_FAIL_MSG);
Eric Parisc9180a52007-11-30 13:00:35 -05001147 goto out_err;
1148 }
1149 defcontext = match_strdup(&args[0]);
1150 if (!defcontext) {
1151 rc = -ENOMEM;
1152 goto out_err;
1153 }
1154 break;
David P. Quigley11689d42009-01-16 09:22:03 -05001155 case Opt_labelsupport:
1156 break;
Eric Parisc9180a52007-11-30 13:00:35 -05001157 default:
1158 rc = -EINVAL;
peter enderborgc103a912018-06-12 10:09:03 +02001159 pr_warn("SELinux: unknown mount option\n");
Eric Parisc9180a52007-11-30 13:00:35 -05001160 goto out_err;
1161
1162 }
1163 }
1164
Eric Parise0007522008-03-05 10:31:54 -05001165 rc = -ENOMEM;
Tetsuo Handa8931c3b2016-11-14 20:16:12 +09001166 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_KERNEL);
Eric Parise0007522008-03-05 10:31:54 -05001167 if (!opts->mnt_opts)
1168 goto out_err;
1169
Tetsuo Handa8931c3b2016-11-14 20:16:12 +09001170 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int),
1171 GFP_KERNEL);
Paul Moore023f1082017-06-07 16:48:19 -04001172 if (!opts->mnt_opts_flags)
Eric Parise0007522008-03-05 10:31:54 -05001173 goto out_err;
Eric Parisc9180a52007-11-30 13:00:35 -05001174
Eric Parise0007522008-03-05 10:31:54 -05001175 if (fscontext) {
1176 opts->mnt_opts[num_mnt_opts] = fscontext;
1177 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1178 }
1179 if (context) {
1180 opts->mnt_opts[num_mnt_opts] = context;
1181 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1182 }
1183 if (rootcontext) {
1184 opts->mnt_opts[num_mnt_opts] = rootcontext;
1185 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1186 }
1187 if (defcontext) {
1188 opts->mnt_opts[num_mnt_opts] = defcontext;
1189 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1190 }
1191
1192 opts->num_mnt_opts = num_mnt_opts;
1193 return 0;
1194
Eric Parisc9180a52007-11-30 13:00:35 -05001195out_err:
Paul Moore023f1082017-06-07 16:48:19 -04001196 security_free_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -05001197 kfree(context);
1198 kfree(defcontext);
1199 kfree(fscontext);
1200 kfree(rootcontext);
1201 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001202}
1203
Adrian Bunk3583a712008-07-22 20:21:23 +03001204static void selinux_write_opts(struct seq_file *m,
1205 struct security_mnt_opts *opts)
Eric Paris2069f452008-07-04 09:47:13 +10001206{
1207 int i;
1208 char *prefix;
1209
1210 for (i = 0; i < opts->num_mnt_opts; i++) {
David P. Quigley11689d42009-01-16 09:22:03 -05001211 char *has_comma;
1212
1213 if (opts->mnt_opts[i])
1214 has_comma = strchr(opts->mnt_opts[i], ',');
1215 else
1216 has_comma = NULL;
Eric Paris2069f452008-07-04 09:47:13 +10001217
1218 switch (opts->mnt_opts_flags[i]) {
1219 case CONTEXT_MNT:
1220 prefix = CONTEXT_STR;
1221 break;
1222 case FSCONTEXT_MNT:
1223 prefix = FSCONTEXT_STR;
1224 break;
1225 case ROOTCONTEXT_MNT:
1226 prefix = ROOTCONTEXT_STR;
1227 break;
1228 case DEFCONTEXT_MNT:
1229 prefix = DEFCONTEXT_STR;
1230 break;
Eric Paris12f348b2012-10-09 10:56:25 -04001231 case SBLABEL_MNT:
David P. Quigley11689d42009-01-16 09:22:03 -05001232 seq_putc(m, ',');
1233 seq_puts(m, LABELSUPP_STR);
1234 continue;
Eric Paris2069f452008-07-04 09:47:13 +10001235 default:
1236 BUG();
Eric Parisa35c6c832011-04-20 10:21:28 -04001237 return;
Eric Paris2069f452008-07-04 09:47:13 +10001238 };
1239 /* we need a comma before each option */
1240 seq_putc(m, ',');
1241 seq_puts(m, prefix);
1242 if (has_comma)
1243 seq_putc(m, '\"');
Kees Cooka068acf2015-09-04 15:44:57 -07001244 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
Eric Paris2069f452008-07-04 09:47:13 +10001245 if (has_comma)
1246 seq_putc(m, '\"');
1247 }
1248}
1249
1250static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1251{
1252 struct security_mnt_opts opts;
1253 int rc;
1254
1255 rc = selinux_get_mnt_opts(sb, &opts);
Eric Paris383795c2008-07-29 17:07:26 -04001256 if (rc) {
1257 /* before policy load we may get EINVAL, don't show anything */
1258 if (rc == -EINVAL)
1259 rc = 0;
Eric Paris2069f452008-07-04 09:47:13 +10001260 return rc;
Eric Paris383795c2008-07-29 17:07:26 -04001261 }
Eric Paris2069f452008-07-04 09:47:13 +10001262
1263 selinux_write_opts(m, &opts);
1264
1265 security_free_mnt_opts(&opts);
1266
1267 return rc;
1268}
1269
Linus Torvalds1da177e2005-04-16 15:20:36 -07001270static inline u16 inode_mode_to_security_class(umode_t mode)
1271{
1272 switch (mode & S_IFMT) {
1273 case S_IFSOCK:
1274 return SECCLASS_SOCK_FILE;
1275 case S_IFLNK:
1276 return SECCLASS_LNK_FILE;
1277 case S_IFREG:
1278 return SECCLASS_FILE;
1279 case S_IFBLK:
1280 return SECCLASS_BLK_FILE;
1281 case S_IFDIR:
1282 return SECCLASS_DIR;
1283 case S_IFCHR:
1284 return SECCLASS_CHR_FILE;
1285 case S_IFIFO:
1286 return SECCLASS_FIFO_FILE;
1287
1288 }
1289
1290 return SECCLASS_FILE;
1291}
1292
James Morris13402582005-09-30 14:24:34 -04001293static inline int default_protocol_stream(int protocol)
1294{
1295 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1296}
1297
1298static inline int default_protocol_dgram(int protocol)
1299{
1300 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1301}
1302
Linus Torvalds1da177e2005-04-16 15:20:36 -07001303static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1304{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001305 int extsockclass = selinux_policycap_extsockclass();
Stephen Smalleyda69a532017-01-09 10:07:30 -05001306
Linus Torvalds1da177e2005-04-16 15:20:36 -07001307 switch (family) {
1308 case PF_UNIX:
1309 switch (type) {
1310 case SOCK_STREAM:
1311 case SOCK_SEQPACKET:
1312 return SECCLASS_UNIX_STREAM_SOCKET;
1313 case SOCK_DGRAM:
Luis Ressel2a764b52017-07-25 15:13:41 -04001314 case SOCK_RAW:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001315 return SECCLASS_UNIX_DGRAM_SOCKET;
1316 }
1317 break;
1318 case PF_INET:
1319 case PF_INET6:
1320 switch (type) {
1321 case SOCK_STREAM:
Stephen Smalleyda69a532017-01-09 10:07:30 -05001322 case SOCK_SEQPACKET:
James Morris13402582005-09-30 14:24:34 -04001323 if (default_protocol_stream(protocol))
1324 return SECCLASS_TCP_SOCKET;
Stephen Smalleyda69a532017-01-09 10:07:30 -05001325 else if (extsockclass && protocol == IPPROTO_SCTP)
1326 return SECCLASS_SCTP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001327 else
1328 return SECCLASS_RAWIP_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001329 case SOCK_DGRAM:
James Morris13402582005-09-30 14:24:34 -04001330 if (default_protocol_dgram(protocol))
1331 return SECCLASS_UDP_SOCKET;
Stephen Smalleyef379792017-01-09 10:07:31 -05001332 else if (extsockclass && (protocol == IPPROTO_ICMP ||
1333 protocol == IPPROTO_ICMPV6))
Stephen Smalleyda69a532017-01-09 10:07:30 -05001334 return SECCLASS_ICMP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001335 else
1336 return SECCLASS_RAWIP_SOCKET;
James Morris2ee92d42006-11-13 16:09:01 -08001337 case SOCK_DCCP:
1338 return SECCLASS_DCCP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001339 default:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001340 return SECCLASS_RAWIP_SOCKET;
1341 }
1342 break;
1343 case PF_NETLINK:
1344 switch (protocol) {
1345 case NETLINK_ROUTE:
1346 return SECCLASS_NETLINK_ROUTE_SOCKET;
Pavel Emelyanov7f1fb602011-12-06 07:56:43 +00001347 case NETLINK_SOCK_DIAG:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001348 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1349 case NETLINK_NFLOG:
1350 return SECCLASS_NETLINK_NFLOG_SOCKET;
1351 case NETLINK_XFRM:
1352 return SECCLASS_NETLINK_XFRM_SOCKET;
1353 case NETLINK_SELINUX:
1354 return SECCLASS_NETLINK_SELINUX_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001355 case NETLINK_ISCSI:
1356 return SECCLASS_NETLINK_ISCSI_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001357 case NETLINK_AUDIT:
1358 return SECCLASS_NETLINK_AUDIT_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001359 case NETLINK_FIB_LOOKUP:
1360 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1361 case NETLINK_CONNECTOR:
1362 return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1363 case NETLINK_NETFILTER:
1364 return SECCLASS_NETLINK_NETFILTER_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001365 case NETLINK_DNRTMSG:
1366 return SECCLASS_NETLINK_DNRT_SOCKET;
James Morris0c9b7942005-04-16 15:24:13 -07001367 case NETLINK_KOBJECT_UEVENT:
1368 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001369 case NETLINK_GENERIC:
1370 return SECCLASS_NETLINK_GENERIC_SOCKET;
1371 case NETLINK_SCSITRANSPORT:
1372 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1373 case NETLINK_RDMA:
1374 return SECCLASS_NETLINK_RDMA_SOCKET;
1375 case NETLINK_CRYPTO:
1376 return SECCLASS_NETLINK_CRYPTO_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001377 default:
1378 return SECCLASS_NETLINK_SOCKET;
1379 }
1380 case PF_PACKET:
1381 return SECCLASS_PACKET_SOCKET;
1382 case PF_KEY:
1383 return SECCLASS_KEY_SOCKET;
Christopher J. PeBenito3e3ff152006-06-09 00:25:03 -07001384 case PF_APPLETALK:
1385 return SECCLASS_APPLETALK_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001386 }
1387
Stephen Smalleyda69a532017-01-09 10:07:30 -05001388 if (extsockclass) {
1389 switch (family) {
1390 case PF_AX25:
1391 return SECCLASS_AX25_SOCKET;
1392 case PF_IPX:
1393 return SECCLASS_IPX_SOCKET;
1394 case PF_NETROM:
1395 return SECCLASS_NETROM_SOCKET;
Stephen Smalleyda69a532017-01-09 10:07:30 -05001396 case PF_ATMPVC:
1397 return SECCLASS_ATMPVC_SOCKET;
1398 case PF_X25:
1399 return SECCLASS_X25_SOCKET;
1400 case PF_ROSE:
1401 return SECCLASS_ROSE_SOCKET;
1402 case PF_DECnet:
1403 return SECCLASS_DECNET_SOCKET;
1404 case PF_ATMSVC:
1405 return SECCLASS_ATMSVC_SOCKET;
1406 case PF_RDS:
1407 return SECCLASS_RDS_SOCKET;
1408 case PF_IRDA:
1409 return SECCLASS_IRDA_SOCKET;
1410 case PF_PPPOX:
1411 return SECCLASS_PPPOX_SOCKET;
1412 case PF_LLC:
1413 return SECCLASS_LLC_SOCKET;
Stephen Smalleyda69a532017-01-09 10:07:30 -05001414 case PF_CAN:
1415 return SECCLASS_CAN_SOCKET;
1416 case PF_TIPC:
1417 return SECCLASS_TIPC_SOCKET;
1418 case PF_BLUETOOTH:
1419 return SECCLASS_BLUETOOTH_SOCKET;
1420 case PF_IUCV:
1421 return SECCLASS_IUCV_SOCKET;
1422 case PF_RXRPC:
1423 return SECCLASS_RXRPC_SOCKET;
1424 case PF_ISDN:
1425 return SECCLASS_ISDN_SOCKET;
1426 case PF_PHONET:
1427 return SECCLASS_PHONET_SOCKET;
1428 case PF_IEEE802154:
1429 return SECCLASS_IEEE802154_SOCKET;
1430 case PF_CAIF:
1431 return SECCLASS_CAIF_SOCKET;
1432 case PF_ALG:
1433 return SECCLASS_ALG_SOCKET;
1434 case PF_NFC:
1435 return SECCLASS_NFC_SOCKET;
1436 case PF_VSOCK:
1437 return SECCLASS_VSOCK_SOCKET;
1438 case PF_KCM:
1439 return SECCLASS_KCM_SOCKET;
1440 case PF_QIPCRTR:
1441 return SECCLASS_QIPCRTR_SOCKET;
Linus Torvalds3051bf32017-02-22 10:15:09 -08001442 case PF_SMC:
1443 return SECCLASS_SMC_SOCKET;
Björn Töpel68e8b842018-05-02 13:01:22 +02001444 case PF_XDP:
1445 return SECCLASS_XDP_SOCKET;
1446#if PF_MAX > 45
Stephen Smalleyda69a532017-01-09 10:07:30 -05001447#error New address family defined, please update this function.
1448#endif
1449 }
1450 }
1451
Linus Torvalds1da177e2005-04-16 15:20:36 -07001452 return SECCLASS_SOCKET;
1453}
1454
Stephen Smalley134509d2015-06-04 16:22:17 -04001455static int selinux_genfs_get_sid(struct dentry *dentry,
1456 u16 tclass,
1457 u16 flags,
1458 u32 *sid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001459{
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001460 int rc;
Al Virofc640052016-04-10 01:33:30 -04001461 struct super_block *sb = dentry->d_sb;
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001462 char *buffer, *path;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001463
Eric Paris828dfe12008-04-17 13:17:49 -04001464 buffer = (char *)__get_free_page(GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001465 if (!buffer)
1466 return -ENOMEM;
1467
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001468 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1469 if (IS_ERR(path))
1470 rc = PTR_ERR(path);
1471 else {
Stephen Smalley134509d2015-06-04 16:22:17 -04001472 if (flags & SE_SBPROC) {
1473 /* each process gets a /proc/PID/ entry. Strip off the
1474 * PID part to get a valid selinux labeling.
1475 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1476 while (path[1] >= '0' && path[1] <= '9') {
1477 path[1] = '/';
1478 path++;
1479 }
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001480 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001481 rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1482 path, tclass, sid);
Stephen Smalley7bb185e2018-09-04 16:51:36 -04001483 if (rc == -ENOENT) {
1484 /* No match in policy, mark as unlabeled. */
1485 *sid = SECINITSID_UNLABELED;
1486 rc = 0;
1487 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001488 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001489 free_page((unsigned long)buffer);
1490 return rc;
1491}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001492
1493/* The inode's security attributes must be initialized before first use. */
1494static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1495{
1496 struct superblock_security_struct *sbsec = NULL;
1497 struct inode_security_struct *isec = inode->i_security;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001498 u32 task_sid, sid = 0;
1499 u16 sclass;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001500 struct dentry *dentry;
1501#define INITCONTEXTLEN 255
1502 char *context = NULL;
1503 unsigned len = 0;
1504 int rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001505
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05001506 if (isec->initialized == LABEL_INITIALIZED)
Andreas Gruenbacher13457d02016-11-10 22:18:29 +01001507 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001508
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001509 spin_lock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05001510 if (isec->initialized == LABEL_INITIALIZED)
Eric Paris23970742006-09-25 23:32:01 -07001511 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001512
Andreas Gruenbacher13457d02016-11-10 22:18:29 +01001513 if (isec->sclass == SECCLASS_FILE)
1514 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1515
Linus Torvalds1da177e2005-04-16 15:20:36 -07001516 sbsec = inode->i_sb->s_security;
David P. Quigley0d90a7e2009-01-16 09:22:02 -05001517 if (!(sbsec->flags & SE_SBINITIALIZED)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001518 /* Defer initialization until selinux_complete_init,
1519 after the initial policy is loaded and the security
1520 server is ready to handle calls. */
1521 spin_lock(&sbsec->isec_lock);
1522 if (list_empty(&isec->list))
1523 list_add(&isec->list, &sbsec->isec_head);
1524 spin_unlock(&sbsec->isec_lock);
Eric Paris23970742006-09-25 23:32:01 -07001525 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001526 }
1527
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001528 sclass = isec->sclass;
1529 task_sid = isec->task_sid;
1530 sid = isec->sid;
1531 isec->initialized = LABEL_PENDING;
1532 spin_unlock(&isec->lock);
1533
Linus Torvalds1da177e2005-04-16 15:20:36 -07001534 switch (sbsec->behavior) {
David Quigleyeb9ae682013-05-22 12:50:37 -04001535 case SECURITY_FS_USE_NATIVE:
1536 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001537 case SECURITY_FS_USE_XATTR:
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001538 if (!(inode->i_opflags & IOP_XATTR)) {
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001539 sid = sbsec->def_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001540 break;
1541 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001542 /* Need a dentry, since the xattr API requires one.
1543 Life would be simpler if we could just pass the inode. */
1544 if (opt_dentry) {
1545 /* Called from d_instantiate or d_splice_alias. */
1546 dentry = dget(opt_dentry);
1547 } else {
Al Virob1271252018-04-25 10:28:38 -04001548 /*
1549 * Called from selinux_complete_init, try to find a dentry.
1550 * Some filesystems really want a connected one, so try
1551 * that first. We could split SECURITY_FS_USE_XATTR in
1552 * two, depending upon that...
1553 */
Linus Torvalds1da177e2005-04-16 15:20:36 -07001554 dentry = d_find_alias(inode);
Al Virob1271252018-04-25 10:28:38 -04001555 if (!dentry)
1556 dentry = d_find_any_alias(inode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001557 }
1558 if (!dentry) {
Eric Parisdf7f54c2009-03-09 14:35:58 -04001559 /*
1560 * this is can be hit on boot when a file is accessed
1561 * before the policy is loaded. When we load policy we
1562 * may find inodes that have no dentry on the
1563 * sbsec->isec_head list. No reason to complain as these
1564 * will get fixed up the next time we go through
1565 * inode_doinit with a dentry, before these inodes could
1566 * be used again by userspace.
1567 */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001568 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001569 }
1570
1571 len = INITCONTEXTLEN;
Eric Paris4cb912f2009-02-12 14:50:05 -05001572 context = kmalloc(len+1, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001573 if (!context) {
1574 rc = -ENOMEM;
1575 dput(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001576 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001577 }
Eric Paris4cb912f2009-02-12 14:50:05 -05001578 context[len] = '\0';
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001579 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001580 if (rc == -ERANGE) {
James Morris314dabb2009-08-10 22:00:13 +10001581 kfree(context);
1582
Linus Torvalds1da177e2005-04-16 15:20:36 -07001583 /* Need a larger buffer. Query for the right size. */
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001584 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001585 if (rc < 0) {
1586 dput(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001587 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001588 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001589 len = rc;
Eric Paris4cb912f2009-02-12 14:50:05 -05001590 context = kmalloc(len+1, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001591 if (!context) {
1592 rc = -ENOMEM;
1593 dput(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001594 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001595 }
Eric Paris4cb912f2009-02-12 14:50:05 -05001596 context[len] = '\0';
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001597 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001598 }
1599 dput(dentry);
1600 if (rc < 0) {
1601 if (rc != -ENODATA) {
peter enderborgc103a912018-06-12 10:09:03 +02001602 pr_warn("SELinux: %s: getxattr returned "
Harvey Harrisondd6f9532008-03-06 10:03:59 +11001603 "%d for dev=%s ino=%ld\n", __func__,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001604 -rc, inode->i_sb->s_id, inode->i_ino);
1605 kfree(context);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001606 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001607 }
1608 /* Map ENODATA to the default file SID */
1609 sid = sbsec->def_sid;
1610 rc = 0;
1611 } else {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001612 rc = security_context_to_sid_default(&selinux_state,
1613 context, rc, &sid,
Stephen Smalley869ab512008-04-04 08:46:05 -04001614 sbsec->def_sid,
1615 GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001616 if (rc) {
Eric Paris4ba0a8a2009-02-12 15:01:10 -05001617 char *dev = inode->i_sb->s_id;
1618 unsigned long ino = inode->i_ino;
1619
1620 if (rc == -EINVAL) {
1621 if (printk_ratelimit())
peter enderborgc103a912018-06-12 10:09:03 +02001622 pr_notice("SELinux: inode=%lu on dev=%s was found to have an invalid "
Eric Paris4ba0a8a2009-02-12 15:01:10 -05001623 "context=%s. This indicates you may need to relabel the inode or the "
1624 "filesystem in question.\n", ino, dev, context);
1625 } else {
peter enderborgc103a912018-06-12 10:09:03 +02001626 pr_warn("SELinux: %s: context_to_sid(%s) "
Eric Paris4ba0a8a2009-02-12 15:01:10 -05001627 "returned %d for dev=%s ino=%ld\n",
1628 __func__, context, -rc, dev, ino);
1629 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001630 kfree(context);
1631 /* Leave with the unlabeled SID */
1632 rc = 0;
1633 break;
1634 }
1635 }
1636 kfree(context);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001637 break;
1638 case SECURITY_FS_USE_TASK:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001639 sid = task_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001640 break;
1641 case SECURITY_FS_USE_TRANS:
1642 /* Default to the fs SID. */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001643 sid = sbsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001644
1645 /* Try to obtain a transition SID. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001646 rc = security_transition_sid(&selinux_state, task_sid, sid,
1647 sclass, NULL, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001648 if (rc)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001649 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001650 break;
Eric Parisc312feb2006-07-10 04:43:53 -07001651 case SECURITY_FS_USE_MNTPOINT:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001652 sid = sbsec->mntpoint_sid;
Eric Parisc312feb2006-07-10 04:43:53 -07001653 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001654 default:
Eric Parisc312feb2006-07-10 04:43:53 -07001655 /* Default to the fs superblock SID. */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001656 sid = sbsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001657
Stephen Smalley134509d2015-06-04 16:22:17 -04001658 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
Paul Mooref64410e2014-03-19 16:46:18 -04001659 /* We must have a dentry to determine the label on
1660 * procfs inodes */
Al Virob1271252018-04-25 10:28:38 -04001661 if (opt_dentry) {
Paul Mooref64410e2014-03-19 16:46:18 -04001662 /* Called from d_instantiate or
1663 * d_splice_alias. */
1664 dentry = dget(opt_dentry);
Al Virob1271252018-04-25 10:28:38 -04001665 } else {
Paul Mooref64410e2014-03-19 16:46:18 -04001666 /* Called from selinux_complete_init, try to
Al Virob1271252018-04-25 10:28:38 -04001667 * find a dentry. Some filesystems really want
1668 * a connected one, so try that first.
1669 */
Paul Mooref64410e2014-03-19 16:46:18 -04001670 dentry = d_find_alias(inode);
Al Virob1271252018-04-25 10:28:38 -04001671 if (!dentry)
1672 dentry = d_find_any_alias(inode);
1673 }
Paul Mooref64410e2014-03-19 16:46:18 -04001674 /*
1675 * This can be hit on boot when a file is accessed
1676 * before the policy is loaded. When we load policy we
1677 * may find inodes that have no dentry on the
1678 * sbsec->isec_head list. No reason to complain as
1679 * these will get fixed up the next time we go through
1680 * inode_doinit() with a dentry, before these inodes
1681 * could be used again by userspace.
1682 */
1683 if (!dentry)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001684 goto out;
1685 rc = selinux_genfs_get_sid(dentry, sclass,
Stephen Smalley134509d2015-06-04 16:22:17 -04001686 sbsec->flags, &sid);
Paul Mooref64410e2014-03-19 16:46:18 -04001687 dput(dentry);
1688 if (rc)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001689 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001690 }
1691 break;
1692 }
1693
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001694out:
1695 spin_lock(&isec->lock);
1696 if (isec->initialized == LABEL_PENDING) {
1697 if (!sid || rc) {
1698 isec->initialized = LABEL_INVALID;
1699 goto out_unlock;
1700 }
1701
1702 isec->initialized = LABEL_INITIALIZED;
1703 isec->sid = sid;
1704 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001705
Eric Paris23970742006-09-25 23:32:01 -07001706out_unlock:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001707 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001708 return rc;
1709}
1710
1711/* Convert a Linux signal to an access vector. */
1712static inline u32 signal_to_av(int sig)
1713{
1714 u32 perm = 0;
1715
1716 switch (sig) {
1717 case SIGCHLD:
1718 /* Commonly granted from child to parent. */
1719 perm = PROCESS__SIGCHLD;
1720 break;
1721 case SIGKILL:
1722 /* Cannot be caught or ignored */
1723 perm = PROCESS__SIGKILL;
1724 break;
1725 case SIGSTOP:
1726 /* Cannot be caught or ignored */
1727 perm = PROCESS__SIGSTOP;
1728 break;
1729 default:
1730 /* All other signals. */
1731 perm = PROCESS__SIGNAL;
1732 break;
1733 }
1734
1735 return perm;
1736}
1737
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001738#if CAP_LAST_CAP > 63
1739#error Fix SELinux to handle capabilities > 63.
1740#endif
1741
Linus Torvalds1da177e2005-04-16 15:20:36 -07001742/* Check whether a task is allowed to use a capability. */
Eric Paris6a9de492012-01-03 12:25:14 -05001743static int cred_has_capability(const struct cred *cred,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001744 int cap, int audit, bool initns)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001745{
Thomas Liu2bf49692009-07-14 12:14:09 -04001746 struct common_audit_data ad;
Eric Paris06112162008-11-11 22:02:50 +11001747 struct av_decision avd;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001748 u16 sclass;
David Howells3699c532009-01-06 22:27:01 +00001749 u32 sid = cred_sid(cred);
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001750 u32 av = CAP_TO_MASK(cap);
Eric Paris06112162008-11-11 22:02:50 +11001751 int rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001752
Eric Paris50c205f2012-04-04 15:01:43 -04001753 ad.type = LSM_AUDIT_DATA_CAP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001754 ad.u.cap = cap;
1755
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001756 switch (CAP_TO_INDEX(cap)) {
1757 case 0:
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001758 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001759 break;
1760 case 1:
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001761 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001762 break;
1763 default:
peter enderborgc103a912018-06-12 10:09:03 +02001764 pr_err("SELinux: out of range capability %d\n", cap);
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001765 BUG();
Eric Parisa35c6c832011-04-20 10:21:28 -04001766 return -EINVAL;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001767 }
Eric Paris06112162008-11-11 22:02:50 +11001768
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001769 rc = avc_has_perm_noaudit(&selinux_state,
1770 sid, sid, sclass, av, 0, &avd);
Eric Paris9ade0cf2011-04-25 16:26:29 -04001771 if (audit == SECURITY_CAP_AUDIT) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001772 int rc2 = avc_audit(&selinux_state,
1773 sid, sid, sclass, av, &avd, rc, &ad, 0);
Eric Paris9ade0cf2011-04-25 16:26:29 -04001774 if (rc2)
1775 return rc2;
1776 }
Eric Paris06112162008-11-11 22:02:50 +11001777 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001778}
1779
Linus Torvalds1da177e2005-04-16 15:20:36 -07001780/* Check whether a task has a particular permission to an inode.
1781 The 'adp' parameter is optional and allows other audit
1782 data to be passed (e.g. the dentry). */
David Howells88e67f32008-11-14 10:39:21 +11001783static int inode_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001784 struct inode *inode,
1785 u32 perms,
Linus Torvalds19e49832013-10-04 12:54:11 -07001786 struct common_audit_data *adp)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001787{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001788 struct inode_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +11001789 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001790
David Howellse0e81732009-09-02 09:13:40 +01001791 validate_creds(cred);
1792
Eric Paris828dfe12008-04-17 13:17:49 -04001793 if (unlikely(IS_PRIVATE(inode)))
Stephen Smalleybbaca6c2007-02-14 00:34:16 -08001794 return 0;
1795
David Howells88e67f32008-11-14 10:39:21 +11001796 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001797 isec = inode->i_security;
1798
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001799 return avc_has_perm(&selinux_state,
1800 sid, isec->sid, isec->sclass, perms, adp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001801}
1802
1803/* Same as inode_has_perm, but pass explicit audit data containing
1804 the dentry to help the auditing code to more easily generate the
1805 pathname if needed. */
David Howells88e67f32008-11-14 10:39:21 +11001806static inline int dentry_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001807 struct dentry *dentry,
1808 u32 av)
1809{
David Howellsc6f493d2015-03-17 22:26:22 +00001810 struct inode *inode = d_backing_inode(dentry);
Thomas Liu2bf49692009-07-14 12:14:09 -04001811 struct common_audit_data ad;
David Howells88e67f32008-11-14 10:39:21 +11001812
Eric Paris50c205f2012-04-04 15:01:43 -04001813 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Paris2875fa02011-04-28 16:04:24 -04001814 ad.u.dentry = dentry;
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05001815 __inode_security_revalidate(inode, dentry, true);
Linus Torvalds19e49832013-10-04 12:54:11 -07001816 return inode_has_perm(cred, inode, av, &ad);
Eric Paris2875fa02011-04-28 16:04:24 -04001817}
1818
1819/* Same as inode_has_perm, but pass explicit audit data containing
1820 the path to help the auditing code to more easily generate the
1821 pathname if needed. */
1822static inline int path_has_perm(const struct cred *cred,
Al Viro3f7036a2015-03-08 19:28:30 -04001823 const struct path *path,
Eric Paris2875fa02011-04-28 16:04:24 -04001824 u32 av)
1825{
David Howellsc6f493d2015-03-17 22:26:22 +00001826 struct inode *inode = d_backing_inode(path->dentry);
Eric Paris2875fa02011-04-28 16:04:24 -04001827 struct common_audit_data ad;
1828
Eric Paris50c205f2012-04-04 15:01:43 -04001829 ad.type = LSM_AUDIT_DATA_PATH;
Eric Paris2875fa02011-04-28 16:04:24 -04001830 ad.u.path = *path;
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05001831 __inode_security_revalidate(inode, path->dentry, true);
Linus Torvalds19e49832013-10-04 12:54:11 -07001832 return inode_has_perm(cred, inode, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001833}
1834
David Howells13f8e982013-06-13 23:37:55 +01001835/* Same as path_has_perm, but uses the inode from the file struct. */
1836static inline int file_path_has_perm(const struct cred *cred,
1837 struct file *file,
1838 u32 av)
1839{
1840 struct common_audit_data ad;
1841
Vivek Goyal43af5de2016-09-09 11:37:49 -04001842 ad.type = LSM_AUDIT_DATA_FILE;
1843 ad.u.file = file;
Linus Torvalds19e49832013-10-04 12:54:11 -07001844 return inode_has_perm(cred, file_inode(file), av, &ad);
David Howells13f8e982013-06-13 23:37:55 +01001845}
1846
Chenbo Fengf66e4482017-10-18 13:00:26 -07001847#ifdef CONFIG_BPF_SYSCALL
1848static int bpf_fd_pass(struct file *file, u32 sid);
1849#endif
1850
Linus Torvalds1da177e2005-04-16 15:20:36 -07001851/* Check whether a task can use an open file descriptor to
1852 access an inode in a given way. Check access to the
1853 descriptor itself, and then use dentry_has_perm to
1854 check a particular permission to the file.
1855 Access to the descriptor is implicitly granted if it
1856 has the same SID as the process. If av is zero, then
1857 access to the file is not checked, e.g. for cases
1858 where only the descriptor is affected like seek. */
David Howells88e67f32008-11-14 10:39:21 +11001859static int file_has_perm(const struct cred *cred,
1860 struct file *file,
1861 u32 av)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001862{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001863 struct file_security_struct *fsec = file->f_security;
Al Viro496ad9a2013-01-23 17:07:38 -05001864 struct inode *inode = file_inode(file);
Thomas Liu2bf49692009-07-14 12:14:09 -04001865 struct common_audit_data ad;
David Howells88e67f32008-11-14 10:39:21 +11001866 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001867 int rc;
1868
Vivek Goyal43af5de2016-09-09 11:37:49 -04001869 ad.type = LSM_AUDIT_DATA_FILE;
1870 ad.u.file = file;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001871
David Howells275bb412008-11-14 10:39:19 +11001872 if (sid != fsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001873 rc = avc_has_perm(&selinux_state,
1874 sid, fsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001875 SECCLASS_FD,
1876 FD__USE,
1877 &ad);
1878 if (rc)
David Howells88e67f32008-11-14 10:39:21 +11001879 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001880 }
1881
Chenbo Fengf66e4482017-10-18 13:00:26 -07001882#ifdef CONFIG_BPF_SYSCALL
1883 rc = bpf_fd_pass(file, cred_sid(cred));
1884 if (rc)
1885 return rc;
1886#endif
1887
Linus Torvalds1da177e2005-04-16 15:20:36 -07001888 /* av is zero if only checking access to the descriptor. */
David Howells88e67f32008-11-14 10:39:21 +11001889 rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001890 if (av)
Linus Torvalds19e49832013-10-04 12:54:11 -07001891 rc = inode_has_perm(cred, inode, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001892
David Howells88e67f32008-11-14 10:39:21 +11001893out:
1894 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001895}
1896
David Howellsc3c188b2015-07-10 17:19:58 -04001897/*
1898 * Determine the label for an inode that might be unioned.
1899 */
Vivek Goyalc957f6d2016-07-13 10:44:51 -04001900static int
1901selinux_determine_inode_label(const struct task_security_struct *tsec,
1902 struct inode *dir,
1903 const struct qstr *name, u16 tclass,
1904 u32 *_new_isid)
David Howellsc3c188b2015-07-10 17:19:58 -04001905{
1906 const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
David Howellsc3c188b2015-07-10 17:19:58 -04001907
1908 if ((sbsec->flags & SE_SBINITIALIZED) &&
1909 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1910 *_new_isid = sbsec->mntpoint_sid;
1911 } else if ((sbsec->flags & SBLABEL_MNT) &&
1912 tsec->create_sid) {
1913 *_new_isid = tsec->create_sid;
1914 } else {
Paul Moore20cdef82016-04-04 14:14:42 -04001915 const struct inode_security_struct *dsec = inode_security(dir);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001916 return security_transition_sid(&selinux_state, tsec->sid,
1917 dsec->sid, tclass,
David Howellsc3c188b2015-07-10 17:19:58 -04001918 name, _new_isid);
1919 }
1920
1921 return 0;
1922}
1923
Linus Torvalds1da177e2005-04-16 15:20:36 -07001924/* Check whether a task can create a file. */
1925static int may_create(struct inode *dir,
1926 struct dentry *dentry,
1927 u16 tclass)
1928{
Paul Moore5fb49872010-04-22 14:46:19 -04001929 const struct task_security_struct *tsec = current_security();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001930 struct inode_security_struct *dsec;
1931 struct superblock_security_struct *sbsec;
David Howells275bb412008-11-14 10:39:19 +11001932 u32 sid, newsid;
Thomas Liu2bf49692009-07-14 12:14:09 -04001933 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001934 int rc;
1935
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001936 dsec = inode_security(dir);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001937 sbsec = dir->i_sb->s_security;
1938
David Howells275bb412008-11-14 10:39:19 +11001939 sid = tsec->sid;
David Howells275bb412008-11-14 10:39:19 +11001940
Eric Paris50c205f2012-04-04 15:01:43 -04001941 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04001942 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001943
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001944 rc = avc_has_perm(&selinux_state,
1945 sid, dsec->sid, SECCLASS_DIR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001946 DIR__ADD_NAME | DIR__SEARCH,
1947 &ad);
1948 if (rc)
1949 return rc;
1950
Vivek Goyalc957f6d2016-07-13 10:44:51 -04001951 rc = selinux_determine_inode_label(current_security(), dir,
1952 &dentry->d_name, tclass, &newsid);
David Howellsc3c188b2015-07-10 17:19:58 -04001953 if (rc)
1954 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001955
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001956 rc = avc_has_perm(&selinux_state,
1957 sid, newsid, tclass, FILE__CREATE, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001958 if (rc)
1959 return rc;
1960
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001961 return avc_has_perm(&selinux_state,
1962 newsid, sbsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001963 SECCLASS_FILESYSTEM,
1964 FILESYSTEM__ASSOCIATE, &ad);
1965}
1966
Eric Paris828dfe12008-04-17 13:17:49 -04001967#define MAY_LINK 0
1968#define MAY_UNLINK 1
1969#define MAY_RMDIR 2
Linus Torvalds1da177e2005-04-16 15:20:36 -07001970
1971/* Check whether a task can link, unlink, or rmdir a file/directory. */
1972static int may_link(struct inode *dir,
1973 struct dentry *dentry,
1974 int kind)
1975
1976{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001977 struct inode_security_struct *dsec, *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04001978 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11001979 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001980 u32 av;
1981 int rc;
1982
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001983 dsec = inode_security(dir);
1984 isec = backing_inode_security(dentry);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001985
Eric Paris50c205f2012-04-04 15:01:43 -04001986 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04001987 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001988
1989 av = DIR__SEARCH;
1990 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001991 rc = avc_has_perm(&selinux_state,
1992 sid, dsec->sid, SECCLASS_DIR, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001993 if (rc)
1994 return rc;
1995
1996 switch (kind) {
1997 case MAY_LINK:
1998 av = FILE__LINK;
1999 break;
2000 case MAY_UNLINK:
2001 av = FILE__UNLINK;
2002 break;
2003 case MAY_RMDIR:
2004 av = DIR__RMDIR;
2005 break;
2006 default:
peter enderborgc103a912018-06-12 10:09:03 +02002007 pr_warn("SELinux: %s: unrecognized kind %d\n",
Eric Paris744ba352008-04-17 11:52:44 -04002008 __func__, kind);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002009 return 0;
2010 }
2011
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002012 rc = avc_has_perm(&selinux_state,
2013 sid, isec->sid, isec->sclass, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002014 return rc;
2015}
2016
2017static inline int may_rename(struct inode *old_dir,
2018 struct dentry *old_dentry,
2019 struct inode *new_dir,
2020 struct dentry *new_dentry)
2021{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002022 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04002023 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11002024 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002025 u32 av;
2026 int old_is_dir, new_is_dir;
2027 int rc;
2028
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002029 old_dsec = inode_security(old_dir);
2030 old_isec = backing_inode_security(old_dentry);
David Howellse36cb0b2015-01-29 12:02:35 +00002031 old_is_dir = d_is_dir(old_dentry);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002032 new_dsec = inode_security(new_dir);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002033
Eric Paris50c205f2012-04-04 15:01:43 -04002034 ad.type = LSM_AUDIT_DATA_DENTRY;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002035
Eric Parisa2694342011-04-25 13:10:27 -04002036 ad.u.dentry = old_dentry;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002037 rc = avc_has_perm(&selinux_state,
2038 sid, old_dsec->sid, SECCLASS_DIR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002039 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
2040 if (rc)
2041 return rc;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002042 rc = avc_has_perm(&selinux_state,
2043 sid, old_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002044 old_isec->sclass, FILE__RENAME, &ad);
2045 if (rc)
2046 return rc;
2047 if (old_is_dir && new_dir != old_dir) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002048 rc = avc_has_perm(&selinux_state,
2049 sid, old_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002050 old_isec->sclass, DIR__REPARENT, &ad);
2051 if (rc)
2052 return rc;
2053 }
2054
Eric Parisa2694342011-04-25 13:10:27 -04002055 ad.u.dentry = new_dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002056 av = DIR__ADD_NAME | DIR__SEARCH;
David Howells2c616d42015-01-29 12:02:33 +00002057 if (d_is_positive(new_dentry))
Linus Torvalds1da177e2005-04-16 15:20:36 -07002058 av |= DIR__REMOVE_NAME;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002059 rc = avc_has_perm(&selinux_state,
2060 sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002061 if (rc)
2062 return rc;
David Howells2c616d42015-01-29 12:02:33 +00002063 if (d_is_positive(new_dentry)) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002064 new_isec = backing_inode_security(new_dentry);
David Howellse36cb0b2015-01-29 12:02:35 +00002065 new_is_dir = d_is_dir(new_dentry);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002066 rc = avc_has_perm(&selinux_state,
2067 sid, new_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002068 new_isec->sclass,
2069 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
2070 if (rc)
2071 return rc;
2072 }
2073
2074 return 0;
2075}
2076
2077/* Check whether a task can perform a filesystem operation. */
David Howells88e67f32008-11-14 10:39:21 +11002078static int superblock_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002079 struct super_block *sb,
2080 u32 perms,
Thomas Liu2bf49692009-07-14 12:14:09 -04002081 struct common_audit_data *ad)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002082{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002083 struct superblock_security_struct *sbsec;
David Howells88e67f32008-11-14 10:39:21 +11002084 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002085
Linus Torvalds1da177e2005-04-16 15:20:36 -07002086 sbsec = sb->s_security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002087 return avc_has_perm(&selinux_state,
2088 sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002089}
2090
2091/* Convert a Linux mode and permission mask to an access vector. */
2092static inline u32 file_mask_to_av(int mode, int mask)
2093{
2094 u32 av = 0;
2095
Al Virodba19c62011-07-25 20:49:29 -04002096 if (!S_ISDIR(mode)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002097 if (mask & MAY_EXEC)
2098 av |= FILE__EXECUTE;
2099 if (mask & MAY_READ)
2100 av |= FILE__READ;
2101
2102 if (mask & MAY_APPEND)
2103 av |= FILE__APPEND;
2104 else if (mask & MAY_WRITE)
2105 av |= FILE__WRITE;
2106
2107 } else {
2108 if (mask & MAY_EXEC)
2109 av |= DIR__SEARCH;
2110 if (mask & MAY_WRITE)
2111 av |= DIR__WRITE;
2112 if (mask & MAY_READ)
2113 av |= DIR__READ;
2114 }
2115
2116 return av;
2117}
2118
2119/* Convert a Linux file to an access vector. */
2120static inline u32 file_to_av(struct file *file)
2121{
2122 u32 av = 0;
2123
2124 if (file->f_mode & FMODE_READ)
2125 av |= FILE__READ;
2126 if (file->f_mode & FMODE_WRITE) {
2127 if (file->f_flags & O_APPEND)
2128 av |= FILE__APPEND;
2129 else
2130 av |= FILE__WRITE;
2131 }
Stephen Smalley0794c662008-03-17 08:55:18 -04002132 if (!av) {
2133 /*
2134 * Special file opened with flags 3 for ioctl-only use.
2135 */
2136 av = FILE__IOCTL;
2137 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002138
2139 return av;
2140}
2141
Eric Paris8b6a5a32008-10-29 17:06:46 -04002142/*
2143 * Convert a file to an access vector and include the correct open
2144 * open permission.
2145 */
2146static inline u32 open_file_to_av(struct file *file)
2147{
2148 u32 av = file_to_av(file);
Stephen Smalleyccb54472017-05-12 12:41:24 -04002149 struct inode *inode = file_inode(file);
Eric Paris8b6a5a32008-10-29 17:06:46 -04002150
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002151 if (selinux_policycap_openperm() &&
2152 inode->i_sb->s_magic != SOCKFS_MAGIC)
Eric Paris49b7b8d2010-07-23 11:44:09 -04002153 av |= FILE__OPEN;
2154
Eric Paris8b6a5a32008-10-29 17:06:46 -04002155 return av;
2156}
2157
Linus Torvalds1da177e2005-04-16 15:20:36 -07002158/* Hook functions begin here. */
2159
Stephen Smalley79af7302015-01-21 10:54:10 -05002160static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2161{
2162 u32 mysid = current_sid();
2163 u32 mgrsid = task_sid(mgr);
2164
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002165 return avc_has_perm(&selinux_state,
2166 mysid, mgrsid, SECCLASS_BINDER,
Stephen Smalley79af7302015-01-21 10:54:10 -05002167 BINDER__SET_CONTEXT_MGR, NULL);
2168}
2169
2170static int selinux_binder_transaction(struct task_struct *from,
2171 struct task_struct *to)
2172{
2173 u32 mysid = current_sid();
2174 u32 fromsid = task_sid(from);
2175 u32 tosid = task_sid(to);
2176 int rc;
2177
2178 if (mysid != fromsid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002179 rc = avc_has_perm(&selinux_state,
2180 mysid, fromsid, SECCLASS_BINDER,
Stephen Smalley79af7302015-01-21 10:54:10 -05002181 BINDER__IMPERSONATE, NULL);
2182 if (rc)
2183 return rc;
2184 }
2185
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002186 return avc_has_perm(&selinux_state,
2187 fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
Stephen Smalley79af7302015-01-21 10:54:10 -05002188 NULL);
2189}
2190
2191static int selinux_binder_transfer_binder(struct task_struct *from,
2192 struct task_struct *to)
2193{
2194 u32 fromsid = task_sid(from);
2195 u32 tosid = task_sid(to);
2196
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002197 return avc_has_perm(&selinux_state,
2198 fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
Stephen Smalley79af7302015-01-21 10:54:10 -05002199 NULL);
2200}
2201
2202static int selinux_binder_transfer_file(struct task_struct *from,
2203 struct task_struct *to,
2204 struct file *file)
2205{
2206 u32 sid = task_sid(to);
2207 struct file_security_struct *fsec = file->f_security;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002208 struct dentry *dentry = file->f_path.dentry;
Paul Moore20cdef82016-04-04 14:14:42 -04002209 struct inode_security_struct *isec;
Stephen Smalley79af7302015-01-21 10:54:10 -05002210 struct common_audit_data ad;
2211 int rc;
2212
2213 ad.type = LSM_AUDIT_DATA_PATH;
2214 ad.u.path = file->f_path;
2215
2216 if (sid != fsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002217 rc = avc_has_perm(&selinux_state,
2218 sid, fsec->sid,
Stephen Smalley79af7302015-01-21 10:54:10 -05002219 SECCLASS_FD,
2220 FD__USE,
2221 &ad);
2222 if (rc)
2223 return rc;
2224 }
2225
Chenbo Fengf66e4482017-10-18 13:00:26 -07002226#ifdef CONFIG_BPF_SYSCALL
2227 rc = bpf_fd_pass(file, sid);
2228 if (rc)
2229 return rc;
2230#endif
2231
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002232 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
Stephen Smalley79af7302015-01-21 10:54:10 -05002233 return 0;
2234
Paul Moore20cdef82016-04-04 14:14:42 -04002235 isec = backing_inode_security(dentry);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002236 return avc_has_perm(&selinux_state,
2237 sid, isec->sid, isec->sclass, file_to_av(file),
Stephen Smalley79af7302015-01-21 10:54:10 -05002238 &ad);
2239}
2240
Ingo Molnar9e488582009-05-07 19:26:19 +10002241static int selinux_ptrace_access_check(struct task_struct *child,
David Howells5cd9c582008-08-14 11:37:28 +01002242 unsigned int mode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002243{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002244 u32 sid = current_sid();
2245 u32 csid = task_sid(child);
Stephen Smalley006ebb42008-05-19 08:32:49 -04002246
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002247 if (mode & PTRACE_MODE_READ)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002248 return avc_has_perm(&selinux_state,
2249 sid, csid, SECCLASS_FILE, FILE__READ, NULL);
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002250
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002251 return avc_has_perm(&selinux_state,
2252 sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
David Howells5cd9c582008-08-14 11:37:28 +01002253}
2254
2255static int selinux_ptrace_traceme(struct task_struct *parent)
2256{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002257 return avc_has_perm(&selinux_state,
2258 task_sid(parent), current_sid(), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002259 PROCESS__PTRACE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002260}
2261
2262static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
Eric Paris828dfe12008-04-17 13:17:49 -04002263 kernel_cap_t *inheritable, kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002264{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002265 return avc_has_perm(&selinux_state,
2266 current_sid(), task_sid(target), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002267 PROCESS__GETCAP, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002268}
2269
David Howellsd84f4f92008-11-14 10:39:23 +11002270static int selinux_capset(struct cred *new, const struct cred *old,
2271 const kernel_cap_t *effective,
2272 const kernel_cap_t *inheritable,
2273 const kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002274{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002275 return avc_has_perm(&selinux_state,
2276 cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002277 PROCESS__SETCAP, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002278}
2279
James Morris5626d3e2009-01-30 10:05:06 +11002280/*
2281 * (This comment used to live with the selinux_task_setuid hook,
2282 * which was removed).
2283 *
2284 * Since setuid only affects the current process, and since the SELinux
2285 * controls are not based on the Linux identity attributes, SELinux does not
2286 * need to control this operation. However, SELinux does control the use of
2287 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2288 */
2289
Eric Paris6a9de492012-01-03 12:25:14 -05002290static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2291 int cap, int audit)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002292{
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04002293 return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002294}
2295
Linus Torvalds1da177e2005-04-16 15:20:36 -07002296static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2297{
David Howells88e67f32008-11-14 10:39:21 +11002298 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002299 int rc = 0;
2300
2301 if (!sb)
2302 return 0;
2303
2304 switch (cmds) {
Eric Paris828dfe12008-04-17 13:17:49 -04002305 case Q_SYNC:
2306 case Q_QUOTAON:
2307 case Q_QUOTAOFF:
2308 case Q_SETINFO:
2309 case Q_SETQUOTA:
David Howells88e67f32008-11-14 10:39:21 +11002310 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04002311 break;
2312 case Q_GETFMT:
2313 case Q_GETINFO:
2314 case Q_GETQUOTA:
David Howells88e67f32008-11-14 10:39:21 +11002315 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04002316 break;
2317 default:
2318 rc = 0; /* let the kernel handle invalid cmds */
2319 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002320 }
2321 return rc;
2322}
2323
2324static int selinux_quota_on(struct dentry *dentry)
2325{
David Howells88e67f32008-11-14 10:39:21 +11002326 const struct cred *cred = current_cred();
2327
Eric Paris2875fa02011-04-28 16:04:24 -04002328 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002329}
2330
Eric Paris12b30522010-11-15 18:36:29 -05002331static int selinux_syslog(int type)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002332{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002333 switch (type) {
Kees Cookd78ca3c2010-02-03 15:37:13 -08002334 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2335 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002336 return avc_has_perm(&selinux_state,
2337 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002338 SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
Kees Cookd78ca3c2010-02-03 15:37:13 -08002339 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2340 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2341 /* Set level of messages printed to console */
2342 case SYSLOG_ACTION_CONSOLE_LEVEL:
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002343 return avc_has_perm(&selinux_state,
2344 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002345 SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2346 NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002347 }
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002348 /* All other syslog types */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002349 return avc_has_perm(&selinux_state,
2350 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002351 SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002352}
2353
2354/*
2355 * Check that a process has enough memory to allocate a new virtual
2356 * mapping. 0 means there is enough memory for the allocation to
2357 * succeed and -ENOMEM implies there is not.
2358 *
Linus Torvalds1da177e2005-04-16 15:20:36 -07002359 * Do not audit the selinux permission check, as this is applied to all
2360 * processes that allocate mappings.
2361 */
Alan Cox34b4e4a2007-08-22 14:01:28 -07002362static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002363{
2364 int rc, cap_sys_admin = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002365
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07002366 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04002367 SECURITY_CAP_NOAUDIT, true);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002368 if (rc == 0)
2369 cap_sys_admin = 1;
2370
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07002371 return cap_sys_admin;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002372}
2373
2374/* binprm security operations */
2375
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002376static u32 ptrace_parent_sid(void)
Paul Moore0c6181c2016-03-30 21:41:21 -04002377{
2378 u32 sid = 0;
2379 struct task_struct *tracer;
2380
2381 rcu_read_lock();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002382 tracer = ptrace_parent(current);
Paul Moore0c6181c2016-03-30 21:41:21 -04002383 if (tracer)
2384 sid = task_sid(tracer);
2385 rcu_read_unlock();
2386
2387 return sid;
2388}
2389
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002390static int check_nnp_nosuid(const struct linux_binprm *bprm,
2391 const struct task_security_struct *old_tsec,
2392 const struct task_security_struct *new_tsec)
2393{
2394 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
Andy Lutomirski380cf5b2016-06-23 16:41:05 -05002395 int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002396 int rc;
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002397 u32 av;
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002398
2399 if (!nnp && !nosuid)
2400 return 0; /* neither NNP nor nosuid */
2401
2402 if (new_tsec->sid == old_tsec->sid)
2403 return 0; /* No change in credentials */
2404
2405 /*
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002406 * If the policy enables the nnp_nosuid_transition policy capability,
2407 * then we permit transitions under NNP or nosuid if the
2408 * policy allows the corresponding permission between
2409 * the old and new contexts.
2410 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002411 if (selinux_policycap_nnp_nosuid_transition()) {
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002412 av = 0;
2413 if (nnp)
2414 av |= PROCESS2__NNP_TRANSITION;
2415 if (nosuid)
2416 av |= PROCESS2__NOSUID_TRANSITION;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002417 rc = avc_has_perm(&selinux_state,
2418 old_tsec->sid, new_tsec->sid,
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002419 SECCLASS_PROCESS2, av, NULL);
2420 if (!rc)
2421 return 0;
2422 }
2423
2424 /*
2425 * We also permit NNP or nosuid transitions to bounded SIDs,
2426 * i.e. SIDs that are guaranteed to only be allowed a subset
2427 * of the permissions of the current SID.
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002428 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002429 rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2430 new_tsec->sid);
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002431 if (!rc)
2432 return 0;
2433
2434 /*
2435 * On failure, preserve the errno values for NNP vs nosuid.
2436 * NNP: Operation not permitted for caller.
2437 * nosuid: Permission denied to file.
2438 */
2439 if (nnp)
2440 return -EPERM;
2441 return -EACCES;
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002442}
2443
David Howellsa6f76f22008-11-14 10:39:24 +11002444static int selinux_bprm_set_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002445{
David Howellsa6f76f22008-11-14 10:39:24 +11002446 const struct task_security_struct *old_tsec;
2447 struct task_security_struct *new_tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002448 struct inode_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04002449 struct common_audit_data ad;
Al Viro496ad9a2013-01-23 17:07:38 -05002450 struct inode *inode = file_inode(bprm->file);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002451 int rc;
2452
David Howellsa6f76f22008-11-14 10:39:24 +11002453 /* SELinux context only depends on initial program or script and not
2454 * the script interpreter */
Kees Cookddb4a142017-07-18 15:25:23 -07002455 if (bprm->called_set_creds)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002456 return 0;
2457
David Howellsa6f76f22008-11-14 10:39:24 +11002458 old_tsec = current_security();
2459 new_tsec = bprm->cred->security;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002460 isec = inode_security(inode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002461
2462 /* Default to the current task SID. */
David Howellsa6f76f22008-11-14 10:39:24 +11002463 new_tsec->sid = old_tsec->sid;
2464 new_tsec->osid = old_tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002465
Michael LeMay28eba5b2006-06-27 02:53:42 -07002466 /* Reset fs, key, and sock SIDs on execve. */
David Howellsa6f76f22008-11-14 10:39:24 +11002467 new_tsec->create_sid = 0;
2468 new_tsec->keycreate_sid = 0;
2469 new_tsec->sockcreate_sid = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002470
David Howellsa6f76f22008-11-14 10:39:24 +11002471 if (old_tsec->exec_sid) {
2472 new_tsec->sid = old_tsec->exec_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002473 /* Reset exec SID on execve. */
David Howellsa6f76f22008-11-14 10:39:24 +11002474 new_tsec->exec_sid = 0;
Andy Lutomirski259e5e62012-04-12 16:47:50 -05002475
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002476 /* Fail on NNP or nosuid if not an allowed transition. */
2477 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2478 if (rc)
2479 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002480 } else {
2481 /* Check for a default transition on this program. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002482 rc = security_transition_sid(&selinux_state, old_tsec->sid,
2483 isec->sid, SECCLASS_PROCESS, NULL,
Eric Paris652bb9b2011-02-01 11:05:40 -05002484 &new_tsec->sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002485 if (rc)
2486 return rc;
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002487
2488 /*
2489 * Fallback to old SID on NNP or nosuid if not an allowed
2490 * transition.
2491 */
2492 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2493 if (rc)
2494 new_tsec->sid = old_tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002495 }
2496
Vivek Goyal43af5de2016-09-09 11:37:49 -04002497 ad.type = LSM_AUDIT_DATA_FILE;
2498 ad.u.file = bprm->file;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002499
David Howellsa6f76f22008-11-14 10:39:24 +11002500 if (new_tsec->sid == old_tsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002501 rc = avc_has_perm(&selinux_state,
2502 old_tsec->sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002503 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2504 if (rc)
2505 return rc;
2506 } else {
2507 /* Check permissions for the transition. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002508 rc = avc_has_perm(&selinux_state,
2509 old_tsec->sid, new_tsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002510 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2511 if (rc)
2512 return rc;
2513
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002514 rc = avc_has_perm(&selinux_state,
2515 new_tsec->sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002516 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2517 if (rc)
2518 return rc;
2519
David Howellsa6f76f22008-11-14 10:39:24 +11002520 /* Check for shared state */
2521 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002522 rc = avc_has_perm(&selinux_state,
2523 old_tsec->sid, new_tsec->sid,
David Howellsa6f76f22008-11-14 10:39:24 +11002524 SECCLASS_PROCESS, PROCESS__SHARE,
2525 NULL);
2526 if (rc)
2527 return -EPERM;
2528 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002529
David Howellsa6f76f22008-11-14 10:39:24 +11002530 /* Make sure that anyone attempting to ptrace over a task that
2531 * changes its SID has the appropriate permit */
Eric W. Biederman9227dd22017-01-23 17:26:31 +13002532 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002533 u32 ptsid = ptrace_parent_sid();
David Howellsa6f76f22008-11-14 10:39:24 +11002534 if (ptsid != 0) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002535 rc = avc_has_perm(&selinux_state,
2536 ptsid, new_tsec->sid,
David Howellsa6f76f22008-11-14 10:39:24 +11002537 SECCLASS_PROCESS,
2538 PROCESS__PTRACE, NULL);
2539 if (rc)
2540 return -EPERM;
2541 }
2542 }
2543
2544 /* Clear any possibly unsafe personality bits on exec: */
2545 bprm->per_clear |= PER_CLEAR_ON_SETID;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002546
Linus Torvalds1da177e2005-04-16 15:20:36 -07002547 /* Enable secure mode for SIDs transitions unless
2548 the noatsecure permission is granted between
2549 the two SIDs, i.e. ahp returns 0. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002550 rc = avc_has_perm(&selinux_state,
2551 old_tsec->sid, new_tsec->sid,
Kees Cook62874c32017-07-18 15:25:25 -07002552 SECCLASS_PROCESS, PROCESS__NOATSECURE,
2553 NULL);
2554 bprm->secureexec |= !!rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002555 }
2556
Kees Cook62874c32017-07-18 15:25:25 -07002557 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002558}
2559
Al Viroc3c073f2012-08-21 22:32:06 -04002560static int match_file(const void *p, struct file *file, unsigned fd)
2561{
2562 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2563}
2564
Linus Torvalds1da177e2005-04-16 15:20:36 -07002565/* Derived from fs/exec.c:flush_old_files. */
David Howells745ca242008-11-14 10:39:22 +11002566static inline void flush_unauthorized_files(const struct cred *cred,
2567 struct files_struct *files)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002568{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002569 struct file *file, *devnull = NULL;
Stephen Smalleyb20c8122006-09-25 23:32:03 -07002570 struct tty_struct *tty;
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002571 int drop_tty = 0;
Al Viroc3c073f2012-08-21 22:32:06 -04002572 unsigned n;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002573
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002574 tty = get_current_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002575 if (tty) {
Peter Hurley4a510962016-01-09 21:35:23 -08002576 spin_lock(&tty->files_lock);
Eric Paris37dd0bd2008-10-31 17:40:00 -04002577 if (!list_empty(&tty->tty_files)) {
Nick Piggind996b622010-08-18 04:37:36 +10002578 struct tty_file_private *file_priv;
Eric Paris37dd0bd2008-10-31 17:40:00 -04002579
Linus Torvalds1da177e2005-04-16 15:20:36 -07002580 /* Revalidate access to controlling tty.
David Howells13f8e982013-06-13 23:37:55 +01002581 Use file_path_has_perm on the tty path directly
2582 rather than using file_has_perm, as this particular
2583 open file may belong to another process and we are
2584 only interested in the inode-based check here. */
Nick Piggind996b622010-08-18 04:37:36 +10002585 file_priv = list_first_entry(&tty->tty_files,
2586 struct tty_file_private, list);
2587 file = file_priv->file;
David Howells13f8e982013-06-13 23:37:55 +01002588 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002589 drop_tty = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002590 }
Peter Hurley4a510962016-01-09 21:35:23 -08002591 spin_unlock(&tty->files_lock);
Alan Cox452a00d2008-10-13 10:39:13 +01002592 tty_kref_put(tty);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002593 }
Eric W. Biederman98a27ba2007-05-08 00:26:56 -07002594 /* Reset controlling tty. */
2595 if (drop_tty)
2596 no_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002597
2598 /* Revalidate access to inherited open files. */
Al Viroc3c073f2012-08-21 22:32:06 -04002599 n = iterate_fd(files, 0, match_file, cred);
2600 if (!n) /* none found? */
2601 return;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002602
Al Viroc3c073f2012-08-21 22:32:06 -04002603 devnull = dentry_open(&selinux_null, O_RDWR, cred);
Al Viro45525b22012-10-16 13:30:07 -04002604 if (IS_ERR(devnull))
2605 devnull = NULL;
2606 /* replace all the matching ones with this */
2607 do {
2608 replace_fd(n - 1, devnull, 0);
2609 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2610 if (devnull)
Al Viroc3c073f2012-08-21 22:32:06 -04002611 fput(devnull);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002612}
2613
Linus Torvalds1da177e2005-04-16 15:20:36 -07002614/*
David Howellsa6f76f22008-11-14 10:39:24 +11002615 * Prepare a process for imminent new credential changes due to exec
Linus Torvalds1da177e2005-04-16 15:20:36 -07002616 */
David Howellsa6f76f22008-11-14 10:39:24 +11002617static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002618{
David Howellsa6f76f22008-11-14 10:39:24 +11002619 struct task_security_struct *new_tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002620 struct rlimit *rlim, *initrlim;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002621 int rc, i;
2622
David Howellsa6f76f22008-11-14 10:39:24 +11002623 new_tsec = bprm->cred->security;
2624 if (new_tsec->sid == new_tsec->osid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002625 return;
2626
2627 /* Close files for which the new task SID is not authorized. */
David Howellsa6f76f22008-11-14 10:39:24 +11002628 flush_unauthorized_files(bprm->cred, current->files);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002629
David Howellsa6f76f22008-11-14 10:39:24 +11002630 /* Always clear parent death signal on SID transitions. */
2631 current->pdeath_signal = 0;
2632
2633 /* Check whether the new SID can inherit resource limits from the old
2634 * SID. If not, reset all soft limits to the lower of the current
2635 * task's hard limit and the init task's soft limit.
2636 *
2637 * Note that the setting of hard limits (even to lower them) can be
2638 * controlled by the setrlimit check. The inclusion of the init task's
2639 * soft limit into the computation is to avoid resetting soft limits
2640 * higher than the default soft limit for cases where the default is
2641 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2642 */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002643 rc = avc_has_perm(&selinux_state,
2644 new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
David Howellsa6f76f22008-11-14 10:39:24 +11002645 PROCESS__RLIMITINH, NULL);
2646 if (rc) {
Oleg Nesteroveb2d55a2010-06-23 22:43:32 +02002647 /* protect against do_prlimit() */
2648 task_lock(current);
David Howellsa6f76f22008-11-14 10:39:24 +11002649 for (i = 0; i < RLIM_NLIMITS; i++) {
2650 rlim = current->signal->rlim + i;
2651 initrlim = init_task.signal->rlim + i;
2652 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2653 }
Oleg Nesteroveb2d55a2010-06-23 22:43:32 +02002654 task_unlock(current);
Nicolas Pitrebaa73d92016-11-11 00:10:10 -05002655 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2656 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
David Howellsa6f76f22008-11-14 10:39:24 +11002657 }
2658}
2659
2660/*
2661 * Clean up the process immediately after the installation of new credentials
2662 * due to exec
2663 */
2664static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2665{
2666 const struct task_security_struct *tsec = current_security();
2667 struct itimerval itimer;
David Howellsa6f76f22008-11-14 10:39:24 +11002668 u32 osid, sid;
2669 int rc, i;
David Howellsa6f76f22008-11-14 10:39:24 +11002670
David Howellsa6f76f22008-11-14 10:39:24 +11002671 osid = tsec->osid;
2672 sid = tsec->sid;
2673
2674 if (sid == osid)
2675 return;
2676
2677 /* Check whether the new SID can inherit signal state from the old SID.
2678 * If not, clear itimers to avoid subsequent signal generation and
2679 * flush and unblock signals.
2680 *
2681 * This must occur _after_ the task SID has been updated so that any
2682 * kill done after the flush will be checked against the new SID.
2683 */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002684 rc = avc_has_perm(&selinux_state,
2685 osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002686 if (rc) {
Nicolas Pitrebaa73d92016-11-11 00:10:10 -05002687 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) {
2688 memset(&itimer, 0, sizeof itimer);
2689 for (i = 0; i < 3; i++)
2690 do_setitimer(i, &itimer, NULL);
2691 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002692 spin_lock_irq(&current->sighand->siglock);
Oleg Nesterov9e7c8f82015-06-04 16:22:16 -04002693 if (!fatal_signal_pending(current)) {
2694 flush_sigqueue(&current->pending);
2695 flush_sigqueue(&current->signal->shared_pending);
David Howells3bcac022009-04-29 13:45:05 +01002696 flush_signal_handlers(current, 1);
2697 sigemptyset(&current->blocked);
Oleg Nesterov9e7c8f82015-06-04 16:22:16 -04002698 recalc_sigpending();
David Howells3bcac022009-04-29 13:45:05 +01002699 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002700 spin_unlock_irq(&current->sighand->siglock);
2701 }
2702
David Howellsa6f76f22008-11-14 10:39:24 +11002703 /* Wake up the parent if it is waiting so that it can recheck
2704 * wait permission to the new task SID. */
Oleg Nesterovecd6de32009-04-29 16:02:24 +02002705 read_lock(&tasklist_lock);
Oleg Nesterov0b7570e2009-09-23 15:56:46 -07002706 __wake_up_parent(current, current->real_parent);
Oleg Nesterovecd6de32009-04-29 16:02:24 +02002707 read_unlock(&tasklist_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002708}
2709
2710/* superblock security operations */
2711
2712static int selinux_sb_alloc_security(struct super_block *sb)
2713{
2714 return superblock_alloc_security(sb);
2715}
2716
2717static void selinux_sb_free_security(struct super_block *sb)
2718{
2719 superblock_free_security(sb);
2720}
2721
2722static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2723{
2724 if (plen > olen)
2725 return 0;
2726
2727 return !memcmp(prefix, option, plen);
2728}
2729
2730static inline int selinux_option(char *option, int len)
2731{
Eric Paris832cbd92008-04-01 13:24:09 -04002732 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2733 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2734 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
David P. Quigley11689d42009-01-16 09:22:03 -05002735 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2736 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
Linus Torvalds1da177e2005-04-16 15:20:36 -07002737}
2738
2739static inline void take_option(char **to, char *from, int *first, int len)
2740{
2741 if (!*first) {
2742 **to = ',';
2743 *to += 1;
Cory Olmo3528a952006-09-29 01:58:44 -07002744 } else
Linus Torvalds1da177e2005-04-16 15:20:36 -07002745 *first = 0;
2746 memcpy(*to, from, len);
2747 *to += len;
2748}
2749
Eric Paris828dfe12008-04-17 13:17:49 -04002750static inline void take_selinux_option(char **to, char *from, int *first,
2751 int len)
Cory Olmo3528a952006-09-29 01:58:44 -07002752{
2753 int current_size = 0;
2754
2755 if (!*first) {
2756 **to = '|';
2757 *to += 1;
Eric Paris828dfe12008-04-17 13:17:49 -04002758 } else
Cory Olmo3528a952006-09-29 01:58:44 -07002759 *first = 0;
2760
2761 while (current_size < len) {
2762 if (*from != '"') {
2763 **to = *from;
2764 *to += 1;
2765 }
2766 from += 1;
2767 current_size += 1;
2768 }
2769}
2770
Eric Parise0007522008-03-05 10:31:54 -05002771static int selinux_sb_copy_data(char *orig, char *copy)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002772{
2773 int fnosec, fsec, rc = 0;
2774 char *in_save, *in_curr, *in_end;
2775 char *sec_curr, *nosec_save, *nosec;
Cory Olmo3528a952006-09-29 01:58:44 -07002776 int open_quote = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002777
2778 in_curr = orig;
2779 sec_curr = copy;
2780
Linus Torvalds1da177e2005-04-16 15:20:36 -07002781 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2782 if (!nosec) {
2783 rc = -ENOMEM;
2784 goto out;
2785 }
2786
2787 nosec_save = nosec;
2788 fnosec = fsec = 1;
2789 in_save = in_end = orig;
2790
2791 do {
Cory Olmo3528a952006-09-29 01:58:44 -07002792 if (*in_end == '"')
2793 open_quote = !open_quote;
2794 if ((*in_end == ',' && open_quote == 0) ||
2795 *in_end == '\0') {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002796 int len = in_end - in_curr;
2797
2798 if (selinux_option(in_curr, len))
Cory Olmo3528a952006-09-29 01:58:44 -07002799 take_selinux_option(&sec_curr, in_curr, &fsec, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002800 else
2801 take_option(&nosec, in_curr, &fnosec, len);
2802
2803 in_curr = in_end + 1;
2804 }
2805 } while (*in_end++);
2806
Eric Paris6931dfc2005-06-30 02:58:51 -07002807 strcpy(in_save, nosec_save);
Gerald Schaeferda3caa22005-06-21 17:15:18 -07002808 free_page((unsigned long)nosec_save);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002809out:
2810 return rc;
2811}
2812
Al Viroc039bc32018-12-01 23:06:57 -05002813static int selinux_sb_remount(struct super_block *sb,
2814 struct security_mnt_opts *opts)
Eric Paris026eb162011-03-03 16:09:14 -05002815{
Al Viroc039bc32018-12-01 23:06:57 -05002816 int i, *flags;
2817 char **mount_options;
Eric Paris026eb162011-03-03 16:09:14 -05002818 struct superblock_security_struct *sbsec = sb->s_security;
2819
2820 if (!(sbsec->flags & SE_SBINITIALIZED))
2821 return 0;
2822
Al Viroc039bc32018-12-01 23:06:57 -05002823 mount_options = opts->mnt_opts;
2824 flags = opts->mnt_opts_flags;
Eric Paris026eb162011-03-03 16:09:14 -05002825
Al Viroc039bc32018-12-01 23:06:57 -05002826 for (i = 0; i < opts->num_mnt_opts; i++) {
Eric Paris026eb162011-03-03 16:09:14 -05002827 u32 sid;
Al Viroc039bc32018-12-01 23:06:57 -05002828 int rc;
Eric Paris026eb162011-03-03 16:09:14 -05002829
Eric Paris12f348b2012-10-09 10:56:25 -04002830 if (flags[i] == SBLABEL_MNT)
Eric Paris026eb162011-03-03 16:09:14 -05002831 continue;
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002832 rc = security_context_str_to_sid(&selinux_state,
2833 mount_options[i], &sid,
2834 GFP_KERNEL);
Eric Paris026eb162011-03-03 16:09:14 -05002835 if (rc) {
peter enderborgc103a912018-06-12 10:09:03 +02002836 pr_warn("SELinux: security_context_str_to_sid"
Linus Torvalds29b1deb2013-12-15 11:17:45 -08002837 "(%s) failed for (dev %s, type %s) errno=%d\n",
2838 mount_options[i], sb->s_id, sb->s_type->name, rc);
Al Viroc039bc32018-12-01 23:06:57 -05002839 return rc;
Eric Paris026eb162011-03-03 16:09:14 -05002840 }
Eric Paris026eb162011-03-03 16:09:14 -05002841 switch (flags[i]) {
2842 case FSCONTEXT_MNT:
2843 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2844 goto out_bad_option;
2845 break;
2846 case CONTEXT_MNT:
2847 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2848 goto out_bad_option;
2849 break;
2850 case ROOTCONTEXT_MNT: {
2851 struct inode_security_struct *root_isec;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002852 root_isec = backing_inode_security(sb->s_root);
Eric Paris026eb162011-03-03 16:09:14 -05002853
2854 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2855 goto out_bad_option;
2856 break;
2857 }
2858 case DEFCONTEXT_MNT:
2859 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2860 goto out_bad_option;
2861 break;
2862 default:
Al Viroc039bc32018-12-01 23:06:57 -05002863 return -EINVAL;
Eric Paris026eb162011-03-03 16:09:14 -05002864 }
2865 }
Al Viroc039bc32018-12-01 23:06:57 -05002866 return 0;
Eric Paris026eb162011-03-03 16:09:14 -05002867
Eric Paris026eb162011-03-03 16:09:14 -05002868out_bad_option:
peter enderborgc103a912018-06-12 10:09:03 +02002869 pr_warn("SELinux: unable to change security options "
Linus Torvalds29b1deb2013-12-15 11:17:45 -08002870 "during remount (dev %s, type=%s)\n", sb->s_id,
2871 sb->s_type->name);
Al Viroc039bc32018-12-01 23:06:57 -05002872 return -EINVAL;
Eric Paris026eb162011-03-03 16:09:14 -05002873}
2874
Al Viroa10d7c22018-12-05 11:58:35 -05002875static int selinux_sb_kern_mount(struct super_block *sb)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002876{
David Howells88e67f32008-11-14 10:39:21 +11002877 const struct cred *cred = current_cred();
Thomas Liu2bf49692009-07-14 12:14:09 -04002878 struct common_audit_data ad;
James Morris74192242008-12-19 11:41:10 +11002879
Eric Paris50c205f2012-04-04 15:01:43 -04002880 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04002881 ad.u.dentry = sb->s_root;
David Howells88e67f32008-11-14 10:39:21 +11002882 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002883}
2884
David Howells726c3342006-06-23 02:02:58 -07002885static int selinux_sb_statfs(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002886{
David Howells88e67f32008-11-14 10:39:21 +11002887 const struct cred *cred = current_cred();
Thomas Liu2bf49692009-07-14 12:14:09 -04002888 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002889
Eric Paris50c205f2012-04-04 15:01:43 -04002890 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04002891 ad.u.dentry = dentry->d_sb->s_root;
David Howells88e67f32008-11-14 10:39:21 +11002892 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002893}
2894
Al Viro808d4e32012-10-11 11:42:01 -04002895static int selinux_mount(const char *dev_name,
Al Viro8a04c432016-03-25 14:52:53 -04002896 const struct path *path,
Al Viro808d4e32012-10-11 11:42:01 -04002897 const char *type,
Eric Paris828dfe12008-04-17 13:17:49 -04002898 unsigned long flags,
2899 void *data)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002900{
David Howells88e67f32008-11-14 10:39:21 +11002901 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002902
2903 if (flags & MS_REMOUNT)
Al Virod8c95842011-12-07 18:16:57 -05002904 return superblock_has_perm(cred, path->dentry->d_sb,
Eric Paris828dfe12008-04-17 13:17:49 -04002905 FILESYSTEM__REMOUNT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002906 else
Eric Paris2875fa02011-04-28 16:04:24 -04002907 return path_has_perm(cred, path, FILE__MOUNTON);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002908}
2909
2910static int selinux_umount(struct vfsmount *mnt, int flags)
2911{
David Howells88e67f32008-11-14 10:39:21 +11002912 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002913
David Howells88e67f32008-11-14 10:39:21 +11002914 return superblock_has_perm(cred, mnt->mnt_sb,
Eric Paris828dfe12008-04-17 13:17:49 -04002915 FILESYSTEM__UNMOUNT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002916}
2917
2918/* inode security operations */
2919
2920static int selinux_inode_alloc_security(struct inode *inode)
2921{
2922 return inode_alloc_security(inode);
2923}
2924
2925static void selinux_inode_free_security(struct inode *inode)
2926{
2927 inode_free_security(inode);
2928}
2929
David Quigleyd47be3d2013-05-22 12:50:34 -04002930static int selinux_dentry_init_security(struct dentry *dentry, int mode,
Al Viro4f3ccd72016-07-20 16:06:15 -04002931 const struct qstr *name, void **ctx,
David Quigleyd47be3d2013-05-22 12:50:34 -04002932 u32 *ctxlen)
2933{
David Quigleyd47be3d2013-05-22 12:50:34 -04002934 u32 newsid;
2935 int rc;
2936
Vivek Goyalc957f6d2016-07-13 10:44:51 -04002937 rc = selinux_determine_inode_label(current_security(),
2938 d_inode(dentry->d_parent), name,
David Howellsc3c188b2015-07-10 17:19:58 -04002939 inode_mode_to_security_class(mode),
2940 &newsid);
2941 if (rc)
2942 return rc;
David Quigleyd47be3d2013-05-22 12:50:34 -04002943
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002944 return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
2945 ctxlen);
David Quigleyd47be3d2013-05-22 12:50:34 -04002946}
2947
Vivek Goyala518b0a2016-07-13 10:44:53 -04002948static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2949 struct qstr *name,
2950 const struct cred *old,
2951 struct cred *new)
2952{
2953 u32 newsid;
2954 int rc;
2955 struct task_security_struct *tsec;
2956
2957 rc = selinux_determine_inode_label(old->security,
2958 d_inode(dentry->d_parent), name,
2959 inode_mode_to_security_class(mode),
2960 &newsid);
2961 if (rc)
2962 return rc;
2963
2964 tsec = new->security;
2965 tsec->create_sid = newsid;
2966 return 0;
2967}
2968
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002969static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
Tetsuo Handa95489062013-07-25 05:44:02 +09002970 const struct qstr *qstr,
2971 const char **name,
Eric Paris2a7dba32011-02-01 11:05:39 -05002972 void **value, size_t *len)
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002973{
Paul Moore5fb49872010-04-22 14:46:19 -04002974 const struct task_security_struct *tsec = current_security();
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002975 struct superblock_security_struct *sbsec;
Corentin LABBEc0d4f462017-10-04 20:32:17 +02002976 u32 newsid, clen;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002977 int rc;
Tetsuo Handa95489062013-07-25 05:44:02 +09002978 char *context;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002979
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002980 sbsec = dir->i_sb->s_security;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002981
David Howells275bb412008-11-14 10:39:19 +11002982 newsid = tsec->create_sid;
2983
Vivek Goyalc957f6d2016-07-13 10:44:51 -04002984 rc = selinux_determine_inode_label(current_security(),
David Howellsc3c188b2015-07-10 17:19:58 -04002985 dir, qstr,
2986 inode_mode_to_security_class(inode->i_mode),
2987 &newsid);
2988 if (rc)
2989 return rc;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002990
Eric Paris296fddf2006-09-25 23:32:00 -07002991 /* Possibly defer initialization to selinux_complete_init. */
David P. Quigley0d90a7e2009-01-16 09:22:02 -05002992 if (sbsec->flags & SE_SBINITIALIZED) {
Eric Paris296fddf2006-09-25 23:32:00 -07002993 struct inode_security_struct *isec = inode->i_security;
2994 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2995 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05002996 isec->initialized = LABEL_INITIALIZED;
Eric Paris296fddf2006-09-25 23:32:00 -07002997 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002998
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002999 if (!selinux_state.initialized || !(sbsec->flags & SBLABEL_MNT))
Stephen Smalley25a74f32005-11-08 21:34:33 -08003000 return -EOPNOTSUPP;
3001
Tetsuo Handa95489062013-07-25 05:44:02 +09003002 if (name)
3003 *name = XATTR_SELINUX_SUFFIX;
Stephen Smalley570bc1c2005-09-09 13:01:43 -07003004
3005 if (value && len) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003006 rc = security_sid_to_context_force(&selinux_state, newsid,
3007 &context, &clen);
Tetsuo Handa95489062013-07-25 05:44:02 +09003008 if (rc)
Stephen Smalley570bc1c2005-09-09 13:01:43 -07003009 return rc;
Stephen Smalley570bc1c2005-09-09 13:01:43 -07003010 *value = context;
3011 *len = clen;
3012 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003013
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003014 return 0;
3015}
3016
Al Viro4acdaf22011-07-26 01:42:34 -04003017static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003018{
3019 return may_create(dir, dentry, SECCLASS_FILE);
3020}
3021
Linus Torvalds1da177e2005-04-16 15:20:36 -07003022static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
3023{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003024 return may_link(dir, old_dentry, MAY_LINK);
3025}
3026
Linus Torvalds1da177e2005-04-16 15:20:36 -07003027static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
3028{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003029 return may_link(dir, dentry, MAY_UNLINK);
3030}
3031
3032static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
3033{
3034 return may_create(dir, dentry, SECCLASS_LNK_FILE);
3035}
3036
Al Viro18bb1db2011-07-26 01:41:39 -04003037static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003038{
3039 return may_create(dir, dentry, SECCLASS_DIR);
3040}
3041
Linus Torvalds1da177e2005-04-16 15:20:36 -07003042static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
3043{
3044 return may_link(dir, dentry, MAY_RMDIR);
3045}
3046
Al Viro1a67aaf2011-07-26 01:52:52 -04003047static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003048{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003049 return may_create(dir, dentry, inode_mode_to_security_class(mode));
3050}
3051
Linus Torvalds1da177e2005-04-16 15:20:36 -07003052static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
Eric Paris828dfe12008-04-17 13:17:49 -04003053 struct inode *new_inode, struct dentry *new_dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003054{
3055 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
3056}
3057
Linus Torvalds1da177e2005-04-16 15:20:36 -07003058static int selinux_inode_readlink(struct dentry *dentry)
3059{
David Howells88e67f32008-11-14 10:39:21 +11003060 const struct cred *cred = current_cred();
3061
Eric Paris2875fa02011-04-28 16:04:24 -04003062 return dentry_has_perm(cred, dentry, FILE__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003063}
3064
NeilBrownbda0be72015-03-23 13:37:39 +11003065static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
3066 bool rcu)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003067{
David Howells88e67f32008-11-14 10:39:21 +11003068 const struct cred *cred = current_cred();
NeilBrownbda0be72015-03-23 13:37:39 +11003069 struct common_audit_data ad;
3070 struct inode_security_struct *isec;
3071 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003072
NeilBrownbda0be72015-03-23 13:37:39 +11003073 validate_creds(cred);
3074
3075 ad.type = LSM_AUDIT_DATA_DENTRY;
3076 ad.u.dentry = dentry;
3077 sid = cred_sid(cred);
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05003078 isec = inode_security_rcu(inode, rcu);
3079 if (IS_ERR(isec))
3080 return PTR_ERR(isec);
NeilBrownbda0be72015-03-23 13:37:39 +11003081
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003082 return avc_has_perm_flags(&selinux_state,
3083 sid, isec->sid, isec->sclass, FILE__READ, &ad,
NeilBrownbda0be72015-03-23 13:37:39 +11003084 rcu ? MAY_NOT_BLOCK : 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003085}
3086
Eric Parisd4cf970d2012-04-04 15:01:42 -04003087static noinline int audit_inode_permission(struct inode *inode,
3088 u32 perms, u32 audited, u32 denied,
Stephen Smalley626b9742014-04-29 11:29:04 -07003089 int result,
Eric Parisd4cf970d2012-04-04 15:01:42 -04003090 unsigned flags)
3091{
3092 struct common_audit_data ad;
Eric Parisd4cf970d2012-04-04 15:01:42 -04003093 struct inode_security_struct *isec = inode->i_security;
3094 int rc;
3095
Eric Paris50c205f2012-04-04 15:01:43 -04003096 ad.type = LSM_AUDIT_DATA_INODE;
Eric Parisd4cf970d2012-04-04 15:01:42 -04003097 ad.u.inode = inode;
3098
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003099 rc = slow_avc_audit(&selinux_state,
3100 current_sid(), isec->sid, isec->sclass, perms,
Stephen Smalley626b9742014-04-29 11:29:04 -07003101 audited, denied, result, &ad, flags);
Eric Parisd4cf970d2012-04-04 15:01:42 -04003102 if (rc)
3103 return rc;
3104 return 0;
3105}
3106
Al Viroe74f71e2011-06-20 19:38:15 -04003107static int selinux_inode_permission(struct inode *inode, int mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003108{
David Howells88e67f32008-11-14 10:39:21 +11003109 const struct cred *cred = current_cred();
Eric Parisb782e0a2010-07-23 11:44:03 -04003110 u32 perms;
3111 bool from_access;
Al Virocf1dd1d2011-06-20 19:44:08 -04003112 unsigned flags = mask & MAY_NOT_BLOCK;
Eric Paris2e334052012-04-04 15:01:42 -04003113 struct inode_security_struct *isec;
3114 u32 sid;
3115 struct av_decision avd;
3116 int rc, rc2;
3117 u32 audited, denied;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003118
Eric Parisb782e0a2010-07-23 11:44:03 -04003119 from_access = mask & MAY_ACCESS;
Eric Parisd09ca732010-07-23 11:43:57 -04003120 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3121
Eric Parisb782e0a2010-07-23 11:44:03 -04003122 /* No permission to check. Existence test. */
3123 if (!mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003124 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003125
Eric Paris2e334052012-04-04 15:01:42 -04003126 validate_creds(cred);
Eric Parisb782e0a2010-07-23 11:44:03 -04003127
Eric Paris2e334052012-04-04 15:01:42 -04003128 if (unlikely(IS_PRIVATE(inode)))
3129 return 0;
Eric Parisb782e0a2010-07-23 11:44:03 -04003130
3131 perms = file_mask_to_av(inode->i_mode, mask);
3132
Eric Paris2e334052012-04-04 15:01:42 -04003133 sid = cred_sid(cred);
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05003134 isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3135 if (IS_ERR(isec))
3136 return PTR_ERR(isec);
Eric Paris2e334052012-04-04 15:01:42 -04003137
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003138 rc = avc_has_perm_noaudit(&selinux_state,
3139 sid, isec->sid, isec->sclass, perms, 0, &avd);
Eric Paris2e334052012-04-04 15:01:42 -04003140 audited = avc_audit_required(perms, &avd, rc,
3141 from_access ? FILE__AUDIT_ACCESS : 0,
3142 &denied);
3143 if (likely(!audited))
3144 return rc;
3145
Stephen Smalley626b9742014-04-29 11:29:04 -07003146 rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
Eric Paris2e334052012-04-04 15:01:42 -04003147 if (rc2)
3148 return rc2;
3149 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003150}
3151
3152static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3153{
David Howells88e67f32008-11-14 10:39:21 +11003154 const struct cred *cred = current_cred();
Stephen Smalleyccb54472017-05-12 12:41:24 -04003155 struct inode *inode = d_backing_inode(dentry);
Amerigo Wangbc6a6002009-08-20 19:29:02 -07003156 unsigned int ia_valid = iattr->ia_valid;
Eric Paris95dbf732012-04-04 13:45:34 -04003157 __u32 av = FILE__WRITE;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003158
Amerigo Wangbc6a6002009-08-20 19:29:02 -07003159 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3160 if (ia_valid & ATTR_FORCE) {
3161 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3162 ATTR_FORCE);
3163 if (!ia_valid)
3164 return 0;
3165 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003166
Amerigo Wangbc6a6002009-08-20 19:29:02 -07003167 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3168 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
Eric Paris2875fa02011-04-28 16:04:24 -04003169 return dentry_has_perm(cred, dentry, FILE__SETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003170
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003171 if (selinux_policycap_openperm() &&
Stephen Smalleyccb54472017-05-12 12:41:24 -04003172 inode->i_sb->s_magic != SOCKFS_MAGIC &&
3173 (ia_valid & ATTR_SIZE) &&
3174 !(ia_valid & ATTR_FILE))
Eric Paris95dbf732012-04-04 13:45:34 -04003175 av |= FILE__OPEN;
3176
3177 return dentry_has_perm(cred, dentry, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003178}
3179
Al Viro3f7036a2015-03-08 19:28:30 -04003180static int selinux_inode_getattr(const struct path *path)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003181{
Al Viro3f7036a2015-03-08 19:28:30 -04003182 return path_has_perm(current_cred(), path, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003183}
3184
Stephen Smalleydb590002017-04-20 11:31:30 -04003185static bool has_cap_mac_admin(bool audit)
3186{
3187 const struct cred *cred = current_cred();
3188 int cap_audit = audit ? SECURITY_CAP_AUDIT : SECURITY_CAP_NOAUDIT;
3189
3190 if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, cap_audit))
3191 return false;
3192 if (cred_has_capability(cred, CAP_MAC_ADMIN, cap_audit, true))
3193 return false;
3194 return true;
3195}
3196
David Howells8f0cfa52008-04-29 00:59:41 -07003197static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3198 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003199{
David Howellsc6f493d2015-03-17 22:26:22 +00003200 struct inode *inode = d_backing_inode(dentry);
Paul Moore20cdef82016-04-04 14:14:42 -04003201 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003202 struct superblock_security_struct *sbsec;
Thomas Liu2bf49692009-07-14 12:14:09 -04003203 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11003204 u32 newsid, sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003205 int rc = 0;
3206
Eric W. Biederman6b240302017-10-02 09:38:20 -05003207 if (strcmp(name, XATTR_NAME_SELINUX)) {
3208 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3209 if (rc)
3210 return rc;
3211
3212 /* Not an attribute we recognize, so just check the
3213 ordinary setattr permission. */
3214 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3215 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003216
3217 sbsec = inode->i_sb->s_security;
Eric Paris12f348b2012-10-09 10:56:25 -04003218 if (!(sbsec->flags & SBLABEL_MNT))
Linus Torvalds1da177e2005-04-16 15:20:36 -07003219 return -EOPNOTSUPP;
3220
Serge E. Hallyn2e149672011-03-23 16:43:26 -07003221 if (!inode_owner_or_capable(inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -07003222 return -EPERM;
3223
Eric Paris50c205f2012-04-04 15:01:43 -04003224 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04003225 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003226
Paul Moore20cdef82016-04-04 14:14:42 -04003227 isec = backing_inode_security(dentry);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003228 rc = avc_has_perm(&selinux_state,
3229 sid, isec->sid, isec->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003230 FILE__RELABELFROM, &ad);
3231 if (rc)
3232 return rc;
3233
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003234 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3235 GFP_KERNEL);
Stephen Smalley12b29f32008-05-07 13:03:20 -04003236 if (rc == -EINVAL) {
Stephen Smalleydb590002017-04-20 11:31:30 -04003237 if (!has_cap_mac_admin(true)) {
Eric Parisd6ea83e2012-04-04 13:45:49 -04003238 struct audit_buffer *ab;
3239 size_t audit_size;
Eric Parisd6ea83e2012-04-04 13:45:49 -04003240
3241 /* We strip a nul only if it is at the end, otherwise the
3242 * context contains a nul and we should audit that */
Al Viroe3fea3f2012-06-09 08:15:16 +01003243 if (value) {
Colin Ian Kingadd24372017-10-14 13:46:55 +01003244 const char *str = value;
3245
Al Viroe3fea3f2012-06-09 08:15:16 +01003246 if (str[size - 1] == '\0')
3247 audit_size = size - 1;
3248 else
3249 audit_size = size;
3250 } else {
Al Viroe3fea3f2012-06-09 08:15:16 +01003251 audit_size = 0;
3252 }
Richard Guy Briggscdfb6b32018-05-12 21:58:20 -04003253 ab = audit_log_start(audit_context(),
3254 GFP_ATOMIC, AUDIT_SELINUX_ERR);
Eric Parisd6ea83e2012-04-04 13:45:49 -04003255 audit_log_format(ab, "op=setxattr invalid_context=");
3256 audit_log_n_untrustedstring(ab, value, audit_size);
3257 audit_log_end(ab);
3258
Stephen Smalley12b29f32008-05-07 13:03:20 -04003259 return rc;
Eric Parisd6ea83e2012-04-04 13:45:49 -04003260 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003261 rc = security_context_to_sid_force(&selinux_state, value,
3262 size, &newsid);
Stephen Smalley12b29f32008-05-07 13:03:20 -04003263 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003264 if (rc)
3265 return rc;
3266
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003267 rc = avc_has_perm(&selinux_state,
3268 sid, newsid, isec->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003269 FILE__RELABELTO, &ad);
3270 if (rc)
3271 return rc;
3272
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003273 rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3274 sid, isec->sclass);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003275 if (rc)
3276 return rc;
3277
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003278 return avc_has_perm(&selinux_state,
3279 newsid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003280 sbsec->sid,
3281 SECCLASS_FILESYSTEM,
3282 FILESYSTEM__ASSOCIATE,
3283 &ad);
3284}
3285
David Howells8f0cfa52008-04-29 00:59:41 -07003286static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
Eric Parisf5269712008-05-14 11:27:45 -04003287 const void *value, size_t size,
David Howells8f0cfa52008-04-29 00:59:41 -07003288 int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003289{
David Howellsc6f493d2015-03-17 22:26:22 +00003290 struct inode *inode = d_backing_inode(dentry);
Paul Moore20cdef82016-04-04 14:14:42 -04003291 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003292 u32 newsid;
3293 int rc;
3294
3295 if (strcmp(name, XATTR_NAME_SELINUX)) {
3296 /* Not an attribute we recognize, so nothing to do. */
3297 return;
3298 }
3299
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003300 rc = security_context_to_sid_force(&selinux_state, value, size,
3301 &newsid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003302 if (rc) {
peter enderborgc103a912018-06-12 10:09:03 +02003303 pr_err("SELinux: unable to map context to SID"
Stephen Smalley12b29f32008-05-07 13:03:20 -04003304 "for (%s, %lu), rc=%d\n",
3305 inode->i_sb->s_id, inode->i_ino, -rc);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003306 return;
3307 }
3308
Paul Moore20cdef82016-04-04 14:14:42 -04003309 isec = backing_inode_security(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003310 spin_lock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003311 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003312 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05003313 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003314 spin_unlock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003315
Linus Torvalds1da177e2005-04-16 15:20:36 -07003316 return;
3317}
3318
David Howells8f0cfa52008-04-29 00:59:41 -07003319static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003320{
David Howells88e67f32008-11-14 10:39:21 +11003321 const struct cred *cred = current_cred();
3322
Eric Paris2875fa02011-04-28 16:04:24 -04003323 return dentry_has_perm(cred, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003324}
3325
Eric Paris828dfe12008-04-17 13:17:49 -04003326static int selinux_inode_listxattr(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003327{
David Howells88e67f32008-11-14 10:39:21 +11003328 const struct cred *cred = current_cred();
3329
Eric Paris2875fa02011-04-28 16:04:24 -04003330 return dentry_has_perm(cred, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003331}
3332
David Howells8f0cfa52008-04-29 00:59:41 -07003333static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003334{
Eric W. Biederman6b240302017-10-02 09:38:20 -05003335 if (strcmp(name, XATTR_NAME_SELINUX)) {
3336 int rc = cap_inode_removexattr(dentry, name);
3337 if (rc)
3338 return rc;
3339
3340 /* Not an attribute we recognize, so just check the
3341 ordinary setattr permission. */
3342 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3343 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003344
3345 /* No one is allowed to remove a SELinux security label.
3346 You can change the label, but all data must be labeled. */
3347 return -EACCES;
3348}
3349
James Morrisd381d8a2005-10-30 14:59:22 -08003350/*
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003351 * Copy the inode security context value to the user.
James Morrisd381d8a2005-10-30 14:59:22 -08003352 *
3353 * Permission check is handled by selinux_inode_getxattr hook.
3354 */
Andreas Gruenbacherea861df2015-12-24 11:09:39 -05003355static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003356{
David P. Quigley42492592008-02-04 22:29:39 -08003357 u32 size;
3358 int error;
3359 char *context = NULL;
Paul Moore20cdef82016-04-04 14:14:42 -04003360 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003361
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00003362 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3363 return -EOPNOTSUPP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003364
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003365 /*
3366 * If the caller has CAP_MAC_ADMIN, then get the raw context
3367 * value even if it is not defined by current policy; otherwise,
3368 * use the in-core value under current policy.
3369 * Use the non-auditing forms of the permission checks since
3370 * getxattr may be called by unprivileged processes commonly
3371 * and lack of permission just means that we fall back to the
3372 * in-core context value, not a denial.
3373 */
Paul Moore20cdef82016-04-04 14:14:42 -04003374 isec = inode_security(inode);
Stephen Smalleydb590002017-04-20 11:31:30 -04003375 if (has_cap_mac_admin(false))
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003376 error = security_sid_to_context_force(&selinux_state,
3377 isec->sid, &context,
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003378 &size);
3379 else
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003380 error = security_sid_to_context(&selinux_state, isec->sid,
3381 &context, &size);
David P. Quigley42492592008-02-04 22:29:39 -08003382 if (error)
3383 return error;
3384 error = size;
3385 if (alloc) {
3386 *buffer = context;
3387 goto out_nofree;
3388 }
3389 kfree(context);
3390out_nofree:
3391 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003392}
3393
3394static int selinux_inode_setsecurity(struct inode *inode, const char *name,
Eric Paris828dfe12008-04-17 13:17:49 -04003395 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003396{
Paul Moore2c971652016-04-19 16:36:28 -04003397 struct inode_security_struct *isec = inode_security_novalidate(inode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003398 u32 newsid;
3399 int rc;
3400
3401 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3402 return -EOPNOTSUPP;
3403
3404 if (!value || !size)
3405 return -EACCES;
3406
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003407 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3408 GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003409 if (rc)
3410 return rc;
3411
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003412 spin_lock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003413 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003414 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05003415 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003416 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003417 return 0;
3418}
3419
3420static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3421{
3422 const int len = sizeof(XATTR_NAME_SELINUX);
3423 if (buffer && len <= buffer_size)
3424 memcpy(buffer, XATTR_NAME_SELINUX, len);
3425 return len;
3426}
3427
Andreas Gruenbacherd6335d72015-12-24 11:09:39 -05003428static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02003429{
Andreas Gruenbachere817c2f2016-02-18 12:04:08 +01003430 struct inode_security_struct *isec = inode_security_novalidate(inode);
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02003431 *secid = isec->sid;
3432}
3433
Vivek Goyal56909eb2016-07-13 10:44:48 -04003434static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3435{
3436 u32 sid;
3437 struct task_security_struct *tsec;
3438 struct cred *new_creds = *new;
3439
3440 if (new_creds == NULL) {
3441 new_creds = prepare_creds();
3442 if (!new_creds)
3443 return -ENOMEM;
3444 }
3445
3446 tsec = new_creds->security;
3447 /* Get label from overlay inode and set it in create_sid */
3448 selinux_inode_getsecid(d_inode(src), &sid);
3449 tsec->create_sid = sid;
3450 *new = new_creds;
3451 return 0;
3452}
3453
Vivek Goyal19472b62016-07-13 10:44:50 -04003454static int selinux_inode_copy_up_xattr(const char *name)
3455{
3456 /* The copy_up hook above sets the initial context on an inode, but we
3457 * don't then want to overwrite it by blindly copying all the lower
3458 * xattrs up. Instead, we have to filter out SELinux-related xattrs.
3459 */
3460 if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3461 return 1; /* Discard */
3462 /*
3463 * Any other attribute apart from SELINUX is not claimed, supported
3464 * by selinux.
3465 */
3466 return -EOPNOTSUPP;
3467}
3468
Linus Torvalds1da177e2005-04-16 15:20:36 -07003469/* file security operations */
3470
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003471static int selinux_revalidate_file_permission(struct file *file, int mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003472{
David Howells88e67f32008-11-14 10:39:21 +11003473 const struct cred *cred = current_cred();
Al Viro496ad9a2013-01-23 17:07:38 -05003474 struct inode *inode = file_inode(file);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003475
Linus Torvalds1da177e2005-04-16 15:20:36 -07003476 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3477 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3478 mask |= MAY_APPEND;
3479
Paul Moore389fb8002009-03-27 17:10:34 -04003480 return file_has_perm(cred, file,
3481 file_mask_to_av(inode->i_mode, mask));
Linus Torvalds1da177e2005-04-16 15:20:36 -07003482}
3483
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003484static int selinux_file_permission(struct file *file, int mask)
3485{
Al Viro496ad9a2013-01-23 17:07:38 -05003486 struct inode *inode = file_inode(file);
Stephen Smalley20dda182009-06-22 14:54:53 -04003487 struct file_security_struct *fsec = file->f_security;
Andreas Gruenbacherb1973672016-01-05 23:12:33 +01003488 struct inode_security_struct *isec;
Stephen Smalley20dda182009-06-22 14:54:53 -04003489 u32 sid = current_sid();
3490
Paul Moore389fb8002009-03-27 17:10:34 -04003491 if (!mask)
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003492 /* No permission to check. Existence test. */
3493 return 0;
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003494
Andreas Gruenbacherb1973672016-01-05 23:12:33 +01003495 isec = inode_security(inode);
Stephen Smalley20dda182009-06-22 14:54:53 -04003496 if (sid == fsec->sid && fsec->isid == isec->sid &&
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003497 fsec->pseqno == avc_policy_seqno(&selinux_state))
Eric Paris83d49852012-04-04 13:45:40 -04003498 /* No change since file_open check. */
Stephen Smalley20dda182009-06-22 14:54:53 -04003499 return 0;
3500
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003501 return selinux_revalidate_file_permission(file, mask);
3502}
3503
Linus Torvalds1da177e2005-04-16 15:20:36 -07003504static int selinux_file_alloc_security(struct file *file)
3505{
3506 return file_alloc_security(file);
3507}
3508
3509static void selinux_file_free_security(struct file *file)
3510{
3511 file_free_security(file);
3512}
3513
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003514/*
3515 * Check whether a task has the ioctl permission and cmd
3516 * operation to an inode.
3517 */
Geliang Tang1d2a1682015-10-21 17:44:27 -04003518static int ioctl_has_perm(const struct cred *cred, struct file *file,
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003519 u32 requested, u16 cmd)
3520{
3521 struct common_audit_data ad;
3522 struct file_security_struct *fsec = file->f_security;
3523 struct inode *inode = file_inode(file);
Paul Moore20cdef82016-04-04 14:14:42 -04003524 struct inode_security_struct *isec;
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003525 struct lsm_ioctlop_audit ioctl;
3526 u32 ssid = cred_sid(cred);
3527 int rc;
3528 u8 driver = cmd >> 8;
3529 u8 xperm = cmd & 0xff;
3530
3531 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3532 ad.u.op = &ioctl;
3533 ad.u.op->cmd = cmd;
3534 ad.u.op->path = file->f_path;
3535
3536 if (ssid != fsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003537 rc = avc_has_perm(&selinux_state,
3538 ssid, fsec->sid,
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003539 SECCLASS_FD,
3540 FD__USE,
3541 &ad);
3542 if (rc)
3543 goto out;
3544 }
3545
3546 if (unlikely(IS_PRIVATE(inode)))
3547 return 0;
3548
Paul Moore20cdef82016-04-04 14:14:42 -04003549 isec = inode_security(inode);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003550 rc = avc_has_extended_perms(&selinux_state,
3551 ssid, isec->sid, isec->sclass,
3552 requested, driver, xperm, &ad);
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003553out:
3554 return rc;
3555}
3556
Linus Torvalds1da177e2005-04-16 15:20:36 -07003557static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3558 unsigned long arg)
3559{
David Howells88e67f32008-11-14 10:39:21 +11003560 const struct cred *cred = current_cred();
Eric Paris0b24dcb2011-02-25 15:39:20 -05003561 int error = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003562
Eric Paris0b24dcb2011-02-25 15:39:20 -05003563 switch (cmd) {
3564 case FIONREAD:
3565 /* fall through */
3566 case FIBMAP:
3567 /* fall through */
3568 case FIGETBSZ:
3569 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003570 case FS_IOC_GETFLAGS:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003571 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003572 case FS_IOC_GETVERSION:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003573 error = file_has_perm(cred, file, FILE__GETATTR);
3574 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003575
Al Viro2f99c362012-03-23 16:04:05 -04003576 case FS_IOC_SETFLAGS:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003577 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003578 case FS_IOC_SETVERSION:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003579 error = file_has_perm(cred, file, FILE__SETATTR);
3580 break;
3581
3582 /* sys_ioctl() checks */
3583 case FIONBIO:
3584 /* fall through */
3585 case FIOASYNC:
3586 error = file_has_perm(cred, file, 0);
3587 break;
3588
3589 case KDSKBENT:
3590 case KDSKBSENT:
Eric Paris6a9de492012-01-03 12:25:14 -05003591 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04003592 SECURITY_CAP_AUDIT, true);
Eric Paris0b24dcb2011-02-25 15:39:20 -05003593 break;
3594
3595 /* default case assumes that the command will go
3596 * to the file's ioctl() function.
3597 */
3598 default:
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003599 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
Eric Paris0b24dcb2011-02-25 15:39:20 -05003600 }
3601 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003602}
3603
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003604static int default_noexec;
3605
Linus Torvalds1da177e2005-04-16 15:20:36 -07003606static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3607{
David Howells88e67f32008-11-14 10:39:21 +11003608 const struct cred *cred = current_cred();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003609 u32 sid = cred_sid(cred);
David Howellsd84f4f92008-11-14 10:39:23 +11003610 int rc = 0;
David Howells88e67f32008-11-14 10:39:21 +11003611
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003612 if (default_noexec &&
Stephen Smalley892e8ca2015-07-10 09:40:59 -04003613 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3614 (!shared && (prot & PROT_WRITE)))) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07003615 /*
3616 * We are making executable an anonymous mapping or a
3617 * private file mapping that will also be writable.
3618 * This has an additional check.
3619 */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003620 rc = avc_has_perm(&selinux_state,
3621 sid, sid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003622 PROCESS__EXECMEM, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003623 if (rc)
David Howellsd84f4f92008-11-14 10:39:23 +11003624 goto error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003625 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003626
3627 if (file) {
3628 /* read access is always possible with a mapping */
3629 u32 av = FILE__READ;
3630
3631 /* write access only matters if the mapping is shared */
3632 if (shared && (prot & PROT_WRITE))
3633 av |= FILE__WRITE;
3634
3635 if (prot & PROT_EXEC)
3636 av |= FILE__EXECUTE;
3637
David Howells88e67f32008-11-14 10:39:21 +11003638 return file_has_perm(cred, file, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003639 }
David Howellsd84f4f92008-11-14 10:39:23 +11003640
3641error:
3642 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003643}
3644
Al Viroe5467852012-05-30 13:30:51 -04003645static int selinux_mmap_addr(unsigned long addr)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003646{
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07003647 int rc = 0;
Paul Moore98883bf2014-03-19 16:46:11 -04003648
3649 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3650 u32 sid = current_sid();
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003651 rc = avc_has_perm(&selinux_state,
3652 sid, sid, SECCLASS_MEMPROTECT,
Paul Moore98883bf2014-03-19 16:46:11 -04003653 MEMPROTECT__MMAP_ZERO, NULL);
3654 }
3655
3656 return rc;
Al Viroe5467852012-05-30 13:30:51 -04003657}
Linus Torvalds1da177e2005-04-16 15:20:36 -07003658
Al Viroe5467852012-05-30 13:30:51 -04003659static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3660 unsigned long prot, unsigned long flags)
3661{
Stephen Smalley3ba4bf52017-05-05 09:14:48 -04003662 struct common_audit_data ad;
3663 int rc;
3664
3665 if (file) {
3666 ad.type = LSM_AUDIT_DATA_FILE;
3667 ad.u.file = file;
3668 rc = inode_has_perm(current_cred(), file_inode(file),
3669 FILE__MAP, &ad);
3670 if (rc)
3671 return rc;
3672 }
3673
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003674 if (selinux_state.checkreqprot)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003675 prot = reqprot;
3676
3677 return file_map_prot_check(file, prot,
3678 (flags & MAP_TYPE) == MAP_SHARED);
3679}
3680
3681static int selinux_file_mprotect(struct vm_area_struct *vma,
3682 unsigned long reqprot,
3683 unsigned long prot)
3684{
David Howells88e67f32008-11-14 10:39:21 +11003685 const struct cred *cred = current_cred();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003686 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003687
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003688 if (selinux_state.checkreqprot)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003689 prot = reqprot;
3690
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003691 if (default_noexec &&
3692 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
James Morrisd541bbe2009-01-29 12:19:51 +11003693 int rc = 0;
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003694 if (vma->vm_start >= vma->vm_mm->start_brk &&
3695 vma->vm_end <= vma->vm_mm->brk) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003696 rc = avc_has_perm(&selinux_state,
3697 sid, sid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003698 PROCESS__EXECHEAP, NULL);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003699 } else if (!vma->vm_file &&
Stephen Smalleyc2316db2016-04-08 13:55:03 -04003700 ((vma->vm_start <= vma->vm_mm->start_stack &&
3701 vma->vm_end >= vma->vm_mm->start_stack) ||
Andy Lutomirskid17af502016-09-30 10:58:58 -07003702 vma_is_stack_for_current(vma))) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003703 rc = avc_has_perm(&selinux_state,
3704 sid, sid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003705 PROCESS__EXECSTACK, NULL);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003706 } else if (vma->vm_file && vma->anon_vma) {
3707 /*
3708 * We are making executable a file mapping that has
3709 * had some COW done. Since pages might have been
3710 * written, check ability to execute the possibly
3711 * modified content. This typically should only
3712 * occur for text relocations.
3713 */
David Howellsd84f4f92008-11-14 10:39:23 +11003714 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003715 }
Lorenzo Hernandez García-Hierro6b992192005-06-25 14:54:34 -07003716 if (rc)
3717 return rc;
3718 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003719
3720 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3721}
3722
3723static int selinux_file_lock(struct file *file, unsigned int cmd)
3724{
David Howells88e67f32008-11-14 10:39:21 +11003725 const struct cred *cred = current_cred();
3726
3727 return file_has_perm(cred, file, FILE__LOCK);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003728}
3729
3730static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3731 unsigned long arg)
3732{
David Howells88e67f32008-11-14 10:39:21 +11003733 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003734 int err = 0;
3735
3736 switch (cmd) {
Eric Paris828dfe12008-04-17 13:17:49 -04003737 case F_SETFL:
Eric Paris828dfe12008-04-17 13:17:49 -04003738 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
David Howells88e67f32008-11-14 10:39:21 +11003739 err = file_has_perm(cred, file, FILE__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003740 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003741 }
3742 /* fall through */
3743 case F_SETOWN:
3744 case F_SETSIG:
3745 case F_GETFL:
3746 case F_GETOWN:
3747 case F_GETSIG:
Cyrill Gorcunov1d151c32012-07-30 14:43:00 -07003748 case F_GETOWNER_UIDS:
Eric Paris828dfe12008-04-17 13:17:49 -04003749 /* Just check FD__USE permission */
David Howells88e67f32008-11-14 10:39:21 +11003750 err = file_has_perm(cred, file, 0);
Eric Paris828dfe12008-04-17 13:17:49 -04003751 break;
3752 case F_GETLK:
3753 case F_SETLK:
3754 case F_SETLKW:
Jeff Layton0d3f7a22014-04-22 08:23:58 -04003755 case F_OFD_GETLK:
3756 case F_OFD_SETLK:
3757 case F_OFD_SETLKW:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003758#if BITS_PER_LONG == 32
Eric Paris828dfe12008-04-17 13:17:49 -04003759 case F_GETLK64:
3760 case F_SETLK64:
3761 case F_SETLKW64:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003762#endif
David Howells88e67f32008-11-14 10:39:21 +11003763 err = file_has_perm(cred, file, FILE__LOCK);
Eric Paris828dfe12008-04-17 13:17:49 -04003764 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003765 }
3766
3767 return err;
3768}
3769
Jeff Laytone0b93ed2014-08-22 11:27:32 -04003770static void selinux_file_set_fowner(struct file *file)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003771{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003772 struct file_security_struct *fsec;
3773
Linus Torvalds1da177e2005-04-16 15:20:36 -07003774 fsec = file->f_security;
David Howells275bb412008-11-14 10:39:19 +11003775 fsec->fown_sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003776}
3777
3778static int selinux_file_send_sigiotask(struct task_struct *tsk,
3779 struct fown_struct *fown, int signum)
3780{
Eric Paris828dfe12008-04-17 13:17:49 -04003781 struct file *file;
Stephen Smalley65c90bc2009-05-04 15:43:18 -04003782 u32 sid = task_sid(tsk);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003783 u32 perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003784 struct file_security_struct *fsec;
3785
3786 /* struct fown_struct is never outside the context of a struct file */
Eric Paris828dfe12008-04-17 13:17:49 -04003787 file = container_of(fown, struct file, f_owner);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003788
Linus Torvalds1da177e2005-04-16 15:20:36 -07003789 fsec = file->f_security;
3790
3791 if (!signum)
3792 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3793 else
3794 perm = signal_to_av(signum);
3795
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003796 return avc_has_perm(&selinux_state,
3797 fsec->fown_sid, sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003798 SECCLASS_PROCESS, perm, NULL);
3799}
3800
3801static int selinux_file_receive(struct file *file)
3802{
David Howells88e67f32008-11-14 10:39:21 +11003803 const struct cred *cred = current_cred();
3804
3805 return file_has_perm(cred, file, file_to_av(file));
Linus Torvalds1da177e2005-04-16 15:20:36 -07003806}
3807
Al Viro94817692018-07-10 14:13:18 -04003808static int selinux_file_open(struct file *file)
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003809{
3810 struct file_security_struct *fsec;
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003811 struct inode_security_struct *isec;
David Howellsd84f4f92008-11-14 10:39:23 +11003812
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003813 fsec = file->f_security;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05003814 isec = inode_security(file_inode(file));
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003815 /*
3816 * Save inode label and policy sequence number
3817 * at open-time so that selinux_file_permission
3818 * can determine whether revalidation is necessary.
3819 * Task label is already saved in the file security
3820 * struct as its SID.
3821 */
3822 fsec->isid = isec->sid;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003823 fsec->pseqno = avc_policy_seqno(&selinux_state);
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003824 /*
3825 * Since the inode label or policy seqno may have changed
3826 * between the selinux_inode_permission check and the saving
3827 * of state above, recheck that access is still permitted.
3828 * Otherwise, access might never be revalidated against the
3829 * new inode label or new policy.
3830 * This check is not redundant - do not remove.
3831 */
Al Viro94817692018-07-10 14:13:18 -04003832 return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003833}
3834
Linus Torvalds1da177e2005-04-16 15:20:36 -07003835/* task security operations */
3836
Tetsuo Handaa79be232017-03-28 23:08:45 +09003837static int selinux_task_alloc(struct task_struct *task,
3838 unsigned long clone_flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003839{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003840 u32 sid = current_sid();
3841
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003842 return avc_has_perm(&selinux_state,
3843 sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003844}
3845
David Howellsf1752ee2008-11-14 10:39:17 +11003846/*
David Howellsee18d642009-09-02 09:14:21 +01003847 * allocate the SELinux part of blank credentials
3848 */
3849static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3850{
3851 struct task_security_struct *tsec;
3852
3853 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3854 if (!tsec)
3855 return -ENOMEM;
3856
3857 cred->security = tsec;
3858 return 0;
3859}
3860
3861/*
David Howellsf1752ee2008-11-14 10:39:17 +11003862 * detach and free the LSM part of a set of credentials
3863 */
3864static void selinux_cred_free(struct cred *cred)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003865{
David Howellsf1752ee2008-11-14 10:39:17 +11003866 struct task_security_struct *tsec = cred->security;
David Howellse0e81732009-09-02 09:13:40 +01003867
Tetsuo Handa2edeaa32011-02-07 13:36:10 +00003868 /*
3869 * cred->security == NULL if security_cred_alloc_blank() or
3870 * security_prepare_creds() returned an error.
3871 */
3872 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
David Howellse0e81732009-09-02 09:13:40 +01003873 cred->security = (void *) 0x7UL;
David Howellsf1752ee2008-11-14 10:39:17 +11003874 kfree(tsec);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003875}
3876
David Howellsd84f4f92008-11-14 10:39:23 +11003877/*
3878 * prepare a new set of credentials for modification
3879 */
3880static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3881 gfp_t gfp)
3882{
3883 const struct task_security_struct *old_tsec;
3884 struct task_security_struct *tsec;
3885
3886 old_tsec = old->security;
3887
3888 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3889 if (!tsec)
3890 return -ENOMEM;
3891
3892 new->security = tsec;
3893 return 0;
3894}
3895
3896/*
David Howellsee18d642009-09-02 09:14:21 +01003897 * transfer the SELinux data to a blank set of creds
3898 */
3899static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3900{
3901 const struct task_security_struct *old_tsec = old->security;
3902 struct task_security_struct *tsec = new->security;
3903
3904 *tsec = *old_tsec;
3905}
3906
Matthew Garrett3ec30112018-01-08 13:36:19 -08003907static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
3908{
3909 *secid = cred_sid(c);
3910}
3911
David Howellsee18d642009-09-02 09:14:21 +01003912/*
David Howells3a3b7ce2008-11-14 10:39:28 +11003913 * set the security data for a kernel service
3914 * - all the creation contexts are set to unlabelled
3915 */
3916static int selinux_kernel_act_as(struct cred *new, u32 secid)
3917{
3918 struct task_security_struct *tsec = new->security;
3919 u32 sid = current_sid();
3920 int ret;
3921
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003922 ret = avc_has_perm(&selinux_state,
3923 sid, secid,
David Howells3a3b7ce2008-11-14 10:39:28 +11003924 SECCLASS_KERNEL_SERVICE,
3925 KERNEL_SERVICE__USE_AS_OVERRIDE,
3926 NULL);
3927 if (ret == 0) {
3928 tsec->sid = secid;
3929 tsec->create_sid = 0;
3930 tsec->keycreate_sid = 0;
3931 tsec->sockcreate_sid = 0;
3932 }
3933 return ret;
3934}
3935
3936/*
3937 * set the file creation context in a security record to the same as the
3938 * objective context of the specified inode
3939 */
3940static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3941{
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05003942 struct inode_security_struct *isec = inode_security(inode);
David Howells3a3b7ce2008-11-14 10:39:28 +11003943 struct task_security_struct *tsec = new->security;
3944 u32 sid = current_sid();
3945 int ret;
3946
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003947 ret = avc_has_perm(&selinux_state,
3948 sid, isec->sid,
David Howells3a3b7ce2008-11-14 10:39:28 +11003949 SECCLASS_KERNEL_SERVICE,
3950 KERNEL_SERVICE__CREATE_FILES_AS,
3951 NULL);
3952
3953 if (ret == 0)
3954 tsec->create_sid = isec->sid;
David Howellsef574712010-02-26 01:56:16 +00003955 return ret;
David Howells3a3b7ce2008-11-14 10:39:28 +11003956}
3957
Eric Parisdd8dbf22009-11-03 16:35:32 +11003958static int selinux_kernel_module_request(char *kmod_name)
Eric Paris25354c42009-08-13 09:45:03 -04003959{
Eric Parisdd8dbf22009-11-03 16:35:32 +11003960 struct common_audit_data ad;
3961
Eric Paris50c205f2012-04-04 15:01:43 -04003962 ad.type = LSM_AUDIT_DATA_KMOD;
Eric Parisdd8dbf22009-11-03 16:35:32 +11003963 ad.u.kmod_name = kmod_name;
3964
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003965 return avc_has_perm(&selinux_state,
3966 current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
Eric Parisdd8dbf22009-11-03 16:35:32 +11003967 SYSTEM__MODULE_REQUEST, &ad);
Eric Paris25354c42009-08-13 09:45:03 -04003968}
3969
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003970static int selinux_kernel_module_from_file(struct file *file)
3971{
3972 struct common_audit_data ad;
3973 struct inode_security_struct *isec;
3974 struct file_security_struct *fsec;
3975 u32 sid = current_sid();
3976 int rc;
3977
3978 /* init_module */
3979 if (file == NULL)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003980 return avc_has_perm(&selinux_state,
3981 sid, sid, SECCLASS_SYSTEM,
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003982 SYSTEM__MODULE_LOAD, NULL);
3983
3984 /* finit_module */
Paul Moore20cdef82016-04-04 14:14:42 -04003985
Vivek Goyal43af5de2016-09-09 11:37:49 -04003986 ad.type = LSM_AUDIT_DATA_FILE;
3987 ad.u.file = file;
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003988
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003989 fsec = file->f_security;
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003990 if (sid != fsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003991 rc = avc_has_perm(&selinux_state,
3992 sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003993 if (rc)
3994 return rc;
3995 }
3996
Paul Moore20cdef82016-04-04 14:14:42 -04003997 isec = inode_security(file_inode(file));
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003998 return avc_has_perm(&selinux_state,
3999 sid, isec->sid, SECCLASS_SYSTEM,
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07004000 SYSTEM__MODULE_LOAD, &ad);
4001}
4002
4003static int selinux_kernel_read_file(struct file *file,
4004 enum kernel_read_file_id id)
4005{
4006 int rc = 0;
4007
4008 switch (id) {
4009 case READING_MODULE:
4010 rc = selinux_kernel_module_from_file(file);
4011 break;
4012 default:
4013 break;
4014 }
4015
4016 return rc;
4017}
4018
Mimi Zoharc77b8cd2018-07-13 14:06:02 -04004019static int selinux_kernel_load_data(enum kernel_load_data_id id)
4020{
4021 int rc = 0;
4022
4023 switch (id) {
4024 case LOADING_MODULE:
4025 rc = selinux_kernel_module_from_file(NULL);
4026 default:
4027 break;
4028 }
4029
4030 return rc;
4031}
4032
Linus Torvalds1da177e2005-04-16 15:20:36 -07004033static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
4034{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004035 return avc_has_perm(&selinux_state,
4036 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004037 PROCESS__SETPGID, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004038}
4039
4040static int selinux_task_getpgid(struct task_struct *p)
4041{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004042 return avc_has_perm(&selinux_state,
4043 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004044 PROCESS__GETPGID, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004045}
4046
4047static int selinux_task_getsid(struct task_struct *p)
4048{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004049 return avc_has_perm(&selinux_state,
4050 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004051 PROCESS__GETSESSION, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004052}
4053
David Quigleyf9008e4c2006-06-30 01:55:46 -07004054static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
4055{
David Howells275bb412008-11-14 10:39:19 +11004056 *secid = task_sid(p);
David Quigleyf9008e4c2006-06-30 01:55:46 -07004057}
4058
Linus Torvalds1da177e2005-04-16 15:20:36 -07004059static int selinux_task_setnice(struct task_struct *p, int nice)
4060{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004061 return avc_has_perm(&selinux_state,
4062 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004063 PROCESS__SETSCHED, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004064}
4065
James Morris03e68062006-06-23 02:03:58 -07004066static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4067{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004068 return avc_has_perm(&selinux_state,
4069 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004070 PROCESS__SETSCHED, NULL);
James Morris03e68062006-06-23 02:03:58 -07004071}
4072
David Quigleya1836a42006-06-30 01:55:49 -07004073static int selinux_task_getioprio(struct task_struct *p)
4074{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004075 return avc_has_perm(&selinux_state,
4076 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004077 PROCESS__GETSCHED, NULL);
David Quigleya1836a42006-06-30 01:55:49 -07004078}
4079
Corentin LABBE42985552017-10-04 20:32:18 +02004080static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4081 unsigned int flags)
Stephen Smalley791ec492017-02-17 07:57:00 -05004082{
4083 u32 av = 0;
4084
Stephen Smalley84e68852017-02-28 09:35:08 -05004085 if (!flags)
4086 return 0;
Stephen Smalley791ec492017-02-17 07:57:00 -05004087 if (flags & LSM_PRLIMIT_WRITE)
4088 av |= PROCESS__SETRLIMIT;
4089 if (flags & LSM_PRLIMIT_READ)
4090 av |= PROCESS__GETRLIMIT;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004091 return avc_has_perm(&selinux_state,
4092 cred_sid(cred), cred_sid(tcred),
Stephen Smalley791ec492017-02-17 07:57:00 -05004093 SECCLASS_PROCESS, av, NULL);
4094}
4095
Jiri Slaby8fd00b42009-08-26 18:41:16 +02004096static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4097 struct rlimit *new_rlim)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004098{
Jiri Slaby8fd00b42009-08-26 18:41:16 +02004099 struct rlimit *old_rlim = p->signal->rlim + resource;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004100
4101 /* Control the ability to change the hard limit (whether
4102 lowering or raising it), so that the hard limit can
4103 later be used as a safe reset point for the soft limit
David Howellsd84f4f92008-11-14 10:39:23 +11004104 upon context transitions. See selinux_bprm_committing_creds. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07004105 if (old_rlim->rlim_max != new_rlim->rlim_max)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004106 return avc_has_perm(&selinux_state,
4107 current_sid(), task_sid(p),
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004108 SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004109
4110 return 0;
4111}
4112
KOSAKI Motohirob0ae1982010-10-15 04:21:18 +09004113static int selinux_task_setscheduler(struct task_struct *p)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004114{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004115 return avc_has_perm(&selinux_state,
4116 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004117 PROCESS__SETSCHED, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004118}
4119
4120static int selinux_task_getscheduler(struct task_struct *p)
4121{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004122 return avc_has_perm(&selinux_state,
4123 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004124 PROCESS__GETSCHED, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004125}
4126
David Quigley35601542006-06-23 02:04:01 -07004127static int selinux_task_movememory(struct task_struct *p)
4128{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004129 return avc_has_perm(&selinux_state,
4130 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004131 PROCESS__SETSCHED, NULL);
David Quigley35601542006-06-23 02:04:01 -07004132}
4133
Eric W. Biedermanae7795b2018-09-25 11:27:20 +02004134static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
Stephen Smalley6b4f3d02017-09-08 12:40:01 -04004135 int sig, const struct cred *cred)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004136{
Stephen Smalley6b4f3d02017-09-08 12:40:01 -04004137 u32 secid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004138 u32 perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004139
Linus Torvalds1da177e2005-04-16 15:20:36 -07004140 if (!sig)
4141 perm = PROCESS__SIGNULL; /* null signal; existence test */
4142 else
4143 perm = signal_to_av(sig);
Stephen Smalley6b4f3d02017-09-08 12:40:01 -04004144 if (!cred)
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004145 secid = current_sid();
Stephen Smalley6b4f3d02017-09-08 12:40:01 -04004146 else
4147 secid = cred_sid(cred);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004148 return avc_has_perm(&selinux_state,
4149 secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004150}
4151
Linus Torvalds1da177e2005-04-16 15:20:36 -07004152static void selinux_task_to_inode(struct task_struct *p,
4153 struct inode *inode)
4154{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004155 struct inode_security_struct *isec = inode->i_security;
David Howells275bb412008-11-14 10:39:19 +11004156 u32 sid = task_sid(p);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004157
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004158 spin_lock(&isec->lock);
Andreas Gruenbacherdb978da2016-11-10 22:18:28 +01004159 isec->sclass = inode_mode_to_security_class(inode->i_mode);
David Howells275bb412008-11-14 10:39:19 +11004160 isec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05004161 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004162 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004163}
4164
Linus Torvalds1da177e2005-04-16 15:20:36 -07004165/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004166static int selinux_parse_skb_ipv4(struct sk_buff *skb,
Thomas Liu2bf49692009-07-14 12:14:09 -04004167 struct common_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004168{
4169 int offset, ihlen, ret = -EINVAL;
4170 struct iphdr _iph, *ih;
4171
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03004172 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004173 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4174 if (ih == NULL)
4175 goto out;
4176
4177 ihlen = ih->ihl * 4;
4178 if (ihlen < sizeof(_iph))
4179 goto out;
4180
Eric Paris48c62af2012-04-02 13:15:44 -04004181 ad->u.net->v4info.saddr = ih->saddr;
4182 ad->u.net->v4info.daddr = ih->daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004183 ret = 0;
4184
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004185 if (proto)
4186 *proto = ih->protocol;
4187
Linus Torvalds1da177e2005-04-16 15:20:36 -07004188 switch (ih->protocol) {
Eric Paris828dfe12008-04-17 13:17:49 -04004189 case IPPROTO_TCP: {
4190 struct tcphdr _tcph, *th;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004191
Eric Paris828dfe12008-04-17 13:17:49 -04004192 if (ntohs(ih->frag_off) & IP_OFFSET)
4193 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004194
4195 offset += ihlen;
4196 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4197 if (th == NULL)
4198 break;
4199
Eric Paris48c62af2012-04-02 13:15:44 -04004200 ad->u.net->sport = th->source;
4201 ad->u.net->dport = th->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004202 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004203 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004204
Eric Paris828dfe12008-04-17 13:17:49 -04004205 case IPPROTO_UDP: {
4206 struct udphdr _udph, *uh;
4207
4208 if (ntohs(ih->frag_off) & IP_OFFSET)
4209 break;
4210
4211 offset += ihlen;
4212 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4213 if (uh == NULL)
4214 break;
4215
Eric Paris48c62af2012-04-02 13:15:44 -04004216 ad->u.net->sport = uh->source;
4217 ad->u.net->dport = uh->dest;
Eric Paris828dfe12008-04-17 13:17:49 -04004218 break;
4219 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004220
James Morris2ee92d42006-11-13 16:09:01 -08004221 case IPPROTO_DCCP: {
4222 struct dccp_hdr _dccph, *dh;
4223
4224 if (ntohs(ih->frag_off) & IP_OFFSET)
4225 break;
4226
4227 offset += ihlen;
4228 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4229 if (dh == NULL)
4230 break;
4231
Eric Paris48c62af2012-04-02 13:15:44 -04004232 ad->u.net->sport = dh->dccph_sport;
4233 ad->u.net->dport = dh->dccph_dport;
James Morris2ee92d42006-11-13 16:09:01 -08004234 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004235 }
James Morris2ee92d42006-11-13 16:09:01 -08004236
Richard Hainesd4529302018-02-13 20:57:18 +00004237#if IS_ENABLED(CONFIG_IP_SCTP)
4238 case IPPROTO_SCTP: {
4239 struct sctphdr _sctph, *sh;
4240
4241 if (ntohs(ih->frag_off) & IP_OFFSET)
4242 break;
4243
4244 offset += ihlen;
4245 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4246 if (sh == NULL)
4247 break;
4248
4249 ad->u.net->sport = sh->source;
4250 ad->u.net->dport = sh->dest;
4251 break;
4252 }
4253#endif
Eric Paris828dfe12008-04-17 13:17:49 -04004254 default:
4255 break;
4256 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004257out:
4258 return ret;
4259}
4260
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04004261#if IS_ENABLED(CONFIG_IPV6)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004262
4263/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004264static int selinux_parse_skb_ipv6(struct sk_buff *skb,
Thomas Liu2bf49692009-07-14 12:14:09 -04004265 struct common_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004266{
4267 u8 nexthdr;
4268 int ret = -EINVAL, offset;
4269 struct ipv6hdr _ipv6h, *ip6;
Jesse Gross75f28112011-11-30 17:05:51 -08004270 __be16 frag_off;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004271
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03004272 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004273 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4274 if (ip6 == NULL)
4275 goto out;
4276
Eric Paris48c62af2012-04-02 13:15:44 -04004277 ad->u.net->v6info.saddr = ip6->saddr;
4278 ad->u.net->v6info.daddr = ip6->daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004279 ret = 0;
4280
4281 nexthdr = ip6->nexthdr;
4282 offset += sizeof(_ipv6h);
Jesse Gross75f28112011-11-30 17:05:51 -08004283 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004284 if (offset < 0)
4285 goto out;
4286
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004287 if (proto)
4288 *proto = nexthdr;
4289
Linus Torvalds1da177e2005-04-16 15:20:36 -07004290 switch (nexthdr) {
4291 case IPPROTO_TCP: {
Eric Paris828dfe12008-04-17 13:17:49 -04004292 struct tcphdr _tcph, *th;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004293
4294 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4295 if (th == NULL)
4296 break;
4297
Eric Paris48c62af2012-04-02 13:15:44 -04004298 ad->u.net->sport = th->source;
4299 ad->u.net->dport = th->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004300 break;
4301 }
4302
4303 case IPPROTO_UDP: {
4304 struct udphdr _udph, *uh;
4305
4306 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4307 if (uh == NULL)
4308 break;
4309
Eric Paris48c62af2012-04-02 13:15:44 -04004310 ad->u.net->sport = uh->source;
4311 ad->u.net->dport = uh->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004312 break;
4313 }
4314
James Morris2ee92d42006-11-13 16:09:01 -08004315 case IPPROTO_DCCP: {
4316 struct dccp_hdr _dccph, *dh;
4317
4318 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4319 if (dh == NULL)
4320 break;
4321
Eric Paris48c62af2012-04-02 13:15:44 -04004322 ad->u.net->sport = dh->dccph_sport;
4323 ad->u.net->dport = dh->dccph_dport;
James Morris2ee92d42006-11-13 16:09:01 -08004324 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004325 }
James Morris2ee92d42006-11-13 16:09:01 -08004326
Richard Hainesd4529302018-02-13 20:57:18 +00004327#if IS_ENABLED(CONFIG_IP_SCTP)
4328 case IPPROTO_SCTP: {
4329 struct sctphdr _sctph, *sh;
4330
4331 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4332 if (sh == NULL)
4333 break;
4334
4335 ad->u.net->sport = sh->source;
4336 ad->u.net->dport = sh->dest;
4337 break;
4338 }
4339#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07004340 /* includes fragments */
4341 default:
4342 break;
4343 }
4344out:
4345 return ret;
4346}
4347
4348#endif /* IPV6 */
4349
Thomas Liu2bf49692009-07-14 12:14:09 -04004350static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
David Howellscf9481e2008-07-27 21:31:07 +10004351 char **_addrp, int src, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004352{
David Howellscf9481e2008-07-27 21:31:07 +10004353 char *addrp;
4354 int ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004355
Eric Paris48c62af2012-04-02 13:15:44 -04004356 switch (ad->u.net->family) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07004357 case PF_INET:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004358 ret = selinux_parse_skb_ipv4(skb, ad, proto);
David Howellscf9481e2008-07-27 21:31:07 +10004359 if (ret)
4360 goto parse_error;
Eric Paris48c62af2012-04-02 13:15:44 -04004361 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4362 &ad->u.net->v4info.daddr);
David Howellscf9481e2008-07-27 21:31:07 +10004363 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004364
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04004365#if IS_ENABLED(CONFIG_IPV6)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004366 case PF_INET6:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004367 ret = selinux_parse_skb_ipv6(skb, ad, proto);
David Howellscf9481e2008-07-27 21:31:07 +10004368 if (ret)
4369 goto parse_error;
Eric Paris48c62af2012-04-02 13:15:44 -04004370 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4371 &ad->u.net->v6info.daddr);
David Howellscf9481e2008-07-27 21:31:07 +10004372 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004373#endif /* IPV6 */
4374 default:
David Howellscf9481e2008-07-27 21:31:07 +10004375 addrp = NULL;
4376 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004377 }
4378
David Howellscf9481e2008-07-27 21:31:07 +10004379parse_error:
peter enderborgc103a912018-06-12 10:09:03 +02004380 pr_warn(
David Howellscf9481e2008-07-27 21:31:07 +10004381 "SELinux: failure in selinux_parse_skb(),"
4382 " unable to parse packet\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07004383 return ret;
David Howellscf9481e2008-07-27 21:31:07 +10004384
4385okay:
4386 if (_addrp)
4387 *_addrp = addrp;
4388 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004389}
4390
Paul Moore4f6a9932007-03-01 14:35:22 -05004391/**
Paul Moore220deb92008-01-29 08:38:23 -05004392 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
Paul Moore4f6a9932007-03-01 14:35:22 -05004393 * @skb: the packet
Paul Moore75e22912008-01-29 08:38:04 -05004394 * @family: protocol family
Paul Moore220deb92008-01-29 08:38:23 -05004395 * @sid: the packet's peer label SID
Paul Moore4f6a9932007-03-01 14:35:22 -05004396 *
4397 * Description:
Paul Moore220deb92008-01-29 08:38:23 -05004398 * Check the various different forms of network peer labeling and determine
4399 * the peer label/SID for the packet; most of the magic actually occurs in
4400 * the security server function security_net_peersid_cmp(). The function
4401 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4402 * or -EACCES if @sid is invalid due to inconsistencies with the different
4403 * peer labels.
Paul Moore4f6a9932007-03-01 14:35:22 -05004404 *
4405 */
Paul Moore220deb92008-01-29 08:38:23 -05004406static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
Paul Moore4f6a9932007-03-01 14:35:22 -05004407{
Paul Moore71f1cb02008-01-29 08:51:16 -05004408 int err;
Paul Moore4f6a9932007-03-01 14:35:22 -05004409 u32 xfrm_sid;
4410 u32 nlbl_sid;
Paul Moore220deb92008-01-29 08:38:23 -05004411 u32 nlbl_type;
Paul Moore4f6a9932007-03-01 14:35:22 -05004412
Paul Moore817eff72013-12-10 14:57:54 -05004413 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
Paul Moorebed4d7e2013-07-23 17:38:40 -04004414 if (unlikely(err))
4415 return -EACCES;
4416 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4417 if (unlikely(err))
4418 return -EACCES;
Paul Moore220deb92008-01-29 08:38:23 -05004419
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004420 err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4421 nlbl_type, xfrm_sid, sid);
Paul Moore71f1cb02008-01-29 08:51:16 -05004422 if (unlikely(err)) {
peter enderborgc103a912018-06-12 10:09:03 +02004423 pr_warn(
Paul Moore71f1cb02008-01-29 08:51:16 -05004424 "SELinux: failure in selinux_skb_peerlbl_sid(),"
4425 " unable to determine packet's peer label\n");
Paul Moore220deb92008-01-29 08:38:23 -05004426 return -EACCES;
Paul Moore71f1cb02008-01-29 08:51:16 -05004427 }
Paul Moore220deb92008-01-29 08:38:23 -05004428
4429 return 0;
Paul Moore4f6a9932007-03-01 14:35:22 -05004430}
4431
Paul Moore446b8022013-12-04 16:10:51 -05004432/**
4433 * selinux_conn_sid - Determine the child socket label for a connection
4434 * @sk_sid: the parent socket's SID
4435 * @skb_sid: the packet's SID
4436 * @conn_sid: the resulting connection SID
4437 *
4438 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4439 * combined with the MLS information from @skb_sid in order to create
4440 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
4441 * of @sk_sid. Returns zero on success, negative values on failure.
4442 *
4443 */
4444static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4445{
4446 int err = 0;
4447
4448 if (skb_sid != SECSID_NULL)
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004449 err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4450 conn_sid);
Paul Moore446b8022013-12-04 16:10:51 -05004451 else
4452 *conn_sid = sk_sid;
4453
4454 return err;
4455}
4456
Linus Torvalds1da177e2005-04-16 15:20:36 -07004457/* socket security operations */
Paul Moored4f2d972010-04-22 14:46:18 -04004458
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004459static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4460 u16 secclass, u32 *socksid)
Paul Moored4f2d972010-04-22 14:46:18 -04004461{
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004462 if (tsec->sockcreate_sid > SECSID_NULL) {
4463 *socksid = tsec->sockcreate_sid;
4464 return 0;
4465 }
4466
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004467 return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4468 secclass, NULL, socksid);
Paul Moored4f2d972010-04-22 14:46:18 -04004469}
4470
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004471static int sock_has_perm(struct sock *sk, u32 perms)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004472{
Paul Moore253bfae2010-04-22 14:46:19 -04004473 struct sk_security_struct *sksec = sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004474 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004475 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004476
Paul Moore253bfae2010-04-22 14:46:19 -04004477 if (sksec->sid == SECINITSID_KERNEL)
4478 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004479
Eric Paris50c205f2012-04-04 15:01:43 -04004480 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004481 ad.u.net = &net;
4482 ad.u.net->sk = sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004483
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004484 return avc_has_perm(&selinux_state,
4485 current_sid(), sksec->sid, sksec->sclass, perms,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004486 &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004487}
4488
4489static int selinux_socket_create(int family, int type,
4490 int protocol, int kern)
4491{
Paul Moore5fb49872010-04-22 14:46:19 -04004492 const struct task_security_struct *tsec = current_security();
Paul Moored4f2d972010-04-22 14:46:18 -04004493 u32 newsid;
David Howells275bb412008-11-14 10:39:19 +11004494 u16 secclass;
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004495 int rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004496
4497 if (kern)
Paul Moored4f2d972010-04-22 14:46:18 -04004498 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004499
David Howells275bb412008-11-14 10:39:19 +11004500 secclass = socket_type_to_security_class(family, type, protocol);
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004501 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4502 if (rc)
4503 return rc;
4504
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004505 return avc_has_perm(&selinux_state,
4506 tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004507}
4508
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07004509static int selinux_socket_post_create(struct socket *sock, int family,
4510 int type, int protocol, int kern)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004511{
Paul Moore5fb49872010-04-22 14:46:19 -04004512 const struct task_security_struct *tsec = current_security();
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05004513 struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004514 struct sk_security_struct *sksec;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004515 u16 sclass = socket_type_to_security_class(family, type, protocol);
4516 u32 sid = SECINITSID_KERNEL;
David Howells275bb412008-11-14 10:39:19 +11004517 int err = 0;
4518
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004519 if (!kern) {
4520 err = socket_sockcreate_sid(tsec, sclass, &sid);
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004521 if (err)
4522 return err;
4523 }
David Howells275bb412008-11-14 10:39:19 +11004524
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004525 isec->sclass = sclass;
4526 isec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05004527 isec->initialized = LABEL_INITIALIZED;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004528
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004529 if (sock->sk) {
4530 sksec = sock->sk->sk_security;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004531 sksec->sclass = sclass;
4532 sksec->sid = sid;
Richard Hainesd4529302018-02-13 20:57:18 +00004533 /* Allows detection of the first association on this socket */
4534 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4535 sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4536
Paul Moore389fb8002009-03-27 17:10:34 -04004537 err = selinux_netlbl_socket_post_create(sock->sk, family);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004538 }
4539
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07004540 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004541}
4542
David Herrmann0b811db2018-05-04 16:28:21 +02004543static int selinux_socket_socketpair(struct socket *socka,
4544 struct socket *sockb)
4545{
4546 struct sk_security_struct *sksec_a = socka->sk->sk_security;
4547 struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4548
4549 sksec_a->peer_sid = sksec_b->sid;
4550 sksec_b->peer_sid = sksec_a->sid;
4551
4552 return 0;
4553}
4554
Linus Torvalds1da177e2005-04-16 15:20:36 -07004555/* Range of port numbers used to automatically bind.
4556 Need to determine whether we should perform a name_bind
4557 permission check between the socket and the port number. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07004558
4559static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4560{
Paul Moore253bfae2010-04-22 14:46:19 -04004561 struct sock *sk = sock->sk;
Alexey Kodanev0f8db8c2018-05-11 20:15:11 +03004562 struct sk_security_struct *sksec = sk->sk_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004563 u16 family;
4564 int err;
4565
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004566 err = sock_has_perm(sk, SOCKET__BIND);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004567 if (err)
4568 goto out;
4569
Richard Hainesd4529302018-02-13 20:57:18 +00004570 /* If PF_INET or PF_INET6, check name_bind permission for the port. */
Paul Moore253bfae2010-04-22 14:46:19 -04004571 family = sk->sk_family;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004572 if (family == PF_INET || family == PF_INET6) {
4573 char *addrp;
Thomas Liu2bf49692009-07-14 12:14:09 -04004574 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004575 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004576 struct sockaddr_in *addr4 = NULL;
4577 struct sockaddr_in6 *addr6 = NULL;
Alexey Kodanev0f8db8c2018-05-11 20:15:11 +03004578 u16 family_sa = address->sa_family;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004579 unsigned short snum;
James Morrise399f982008-06-12 01:39:58 +10004580 u32 sid, node_perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004581
Richard Hainesd4529302018-02-13 20:57:18 +00004582 /*
4583 * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4584 * that validates multiple binding addresses. Because of this
4585 * need to check address->sa_family as it is possible to have
4586 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4587 */
Alexey Kodanev0f8db8c2018-05-11 20:15:11 +03004588 switch (family_sa) {
4589 case AF_UNSPEC:
Richard Haines68741a8a2018-03-02 19:54:34 +00004590 case AF_INET:
4591 if (addrlen < sizeof(struct sockaddr_in))
4592 return -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004593 addr4 = (struct sockaddr_in *)address;
Alexey Kodanev0f8db8c2018-05-11 20:15:11 +03004594 if (family_sa == AF_UNSPEC) {
4595 /* see __inet_bind(), we only want to allow
4596 * AF_UNSPEC if the address is INADDR_ANY
4597 */
4598 if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4599 goto err_af;
4600 family_sa = AF_INET;
4601 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004602 snum = ntohs(addr4->sin_port);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004603 addrp = (char *)&addr4->sin_addr.s_addr;
Richard Haines68741a8a2018-03-02 19:54:34 +00004604 break;
4605 case AF_INET6:
4606 if (addrlen < SIN6_LEN_RFC2133)
4607 return -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004608 addr6 = (struct sockaddr_in6 *)address;
4609 snum = ntohs(addr6->sin6_port);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004610 addrp = (char *)&addr6->sin6_addr.s6_addr;
Richard Haines68741a8a2018-03-02 19:54:34 +00004611 break;
4612 default:
Alexey Kodanev0f8db8c2018-05-11 20:15:11 +03004613 goto err_af;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004614 }
4615
Alexey Kodanev88b7d372018-05-11 20:15:12 +03004616 ad.type = LSM_AUDIT_DATA_NET;
4617 ad.u.net = &net;
4618 ad.u.net->sport = htons(snum);
4619 ad.u.net->family = family_sa;
4620
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004621 if (snum) {
4622 int low, high;
4623
Eric W. Biederman0bbf87d2013-09-28 14:10:59 -07004624 inet_get_local_port_range(sock_net(sk), &low, &high);
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004625
Krister Johansen4548b682017-01-20 17:49:11 -08004626 if (snum < max(inet_prot_sock(sock_net(sk)), low) ||
4627 snum > high) {
Paul Moore3e1121722008-04-10 10:48:14 -04004628 err = sel_netport_sid(sk->sk_protocol,
4629 snum, &sid);
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004630 if (err)
4631 goto out;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004632 err = avc_has_perm(&selinux_state,
4633 sksec->sid, sid,
Paul Moore253bfae2010-04-22 14:46:19 -04004634 sksec->sclass,
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004635 SOCKET__NAME_BIND, &ad);
4636 if (err)
4637 goto out;
4638 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004639 }
Eric Paris828dfe12008-04-17 13:17:49 -04004640
Paul Moore253bfae2010-04-22 14:46:19 -04004641 switch (sksec->sclass) {
James Morris13402582005-09-30 14:24:34 -04004642 case SECCLASS_TCP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004643 node_perm = TCP_SOCKET__NODE_BIND;
4644 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004645
James Morris13402582005-09-30 14:24:34 -04004646 case SECCLASS_UDP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004647 node_perm = UDP_SOCKET__NODE_BIND;
4648 break;
James Morris2ee92d42006-11-13 16:09:01 -08004649
4650 case SECCLASS_DCCP_SOCKET:
4651 node_perm = DCCP_SOCKET__NODE_BIND;
4652 break;
4653
Richard Hainesd4529302018-02-13 20:57:18 +00004654 case SECCLASS_SCTP_SOCKET:
4655 node_perm = SCTP_SOCKET__NODE_BIND;
4656 break;
4657
Linus Torvalds1da177e2005-04-16 15:20:36 -07004658 default:
4659 node_perm = RAWIP_SOCKET__NODE_BIND;
4660 break;
4661 }
Eric Paris828dfe12008-04-17 13:17:49 -04004662
Alexey Kodanev88b7d372018-05-11 20:15:12 +03004663 err = sel_netnode_sid(addrp, family_sa, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004664 if (err)
4665 goto out;
Eric Paris828dfe12008-04-17 13:17:49 -04004666
Alexey Kodanev0f8db8c2018-05-11 20:15:11 +03004667 if (family_sa == AF_INET)
Eric Paris48c62af2012-04-02 13:15:44 -04004668 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004669 else
Eric Paris48c62af2012-04-02 13:15:44 -04004670 ad.u.net->v6info.saddr = addr6->sin6_addr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004671
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004672 err = avc_has_perm(&selinux_state,
4673 sksec->sid, sid,
Paul Moore253bfae2010-04-22 14:46:19 -04004674 sksec->sclass, node_perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004675 if (err)
4676 goto out;
4677 }
4678out:
4679 return err;
Alexey Kodanev0f8db8c2018-05-11 20:15:11 +03004680err_af:
4681 /* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4682 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4683 return -EINVAL;
4684 return -EAFNOSUPPORT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004685}
4686
Richard Hainesd4529302018-02-13 20:57:18 +00004687/* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
Mauro Carvalho Chehab5fb94e92018-05-08 15:14:57 -03004688 * and sctp_sendmsg(3) as described in Documentation/security/LSM-sctp.rst
Richard Hainesd4529302018-02-13 20:57:18 +00004689 */
4690static int selinux_socket_connect_helper(struct socket *sock,
4691 struct sockaddr *address, int addrlen)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004692{
Paul Moore014ab192008-10-10 10:16:33 -04004693 struct sock *sk = sock->sk;
Paul Moore253bfae2010-04-22 14:46:19 -04004694 struct sk_security_struct *sksec = sk->sk_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004695 int err;
4696
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004697 err = sock_has_perm(sk, SOCKET__CONNECT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004698 if (err)
4699 return err;
4700
4701 /*
Richard Hainesd4529302018-02-13 20:57:18 +00004702 * If a TCP, DCCP or SCTP socket, check name_connect permission
4703 * for the port.
Linus Torvalds1da177e2005-04-16 15:20:36 -07004704 */
Paul Moore253bfae2010-04-22 14:46:19 -04004705 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
Richard Hainesd4529302018-02-13 20:57:18 +00004706 sksec->sclass == SECCLASS_DCCP_SOCKET ||
4707 sksec->sclass == SECCLASS_SCTP_SOCKET) {
Thomas Liu2bf49692009-07-14 12:14:09 -04004708 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004709 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004710 struct sockaddr_in *addr4 = NULL;
4711 struct sockaddr_in6 *addr6 = NULL;
4712 unsigned short snum;
James Morris2ee92d42006-11-13 16:09:01 -08004713 u32 sid, perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004714
Richard Hainesd4529302018-02-13 20:57:18 +00004715 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4716 * that validates multiple connect addresses. Because of this
4717 * need to check address->sa_family as it is possible to have
4718 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4719 */
Richard Haines68741a8a2018-03-02 19:54:34 +00004720 switch (address->sa_family) {
4721 case AF_INET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004722 addr4 = (struct sockaddr_in *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07004723 if (addrlen < sizeof(struct sockaddr_in))
Linus Torvalds1da177e2005-04-16 15:20:36 -07004724 return -EINVAL;
4725 snum = ntohs(addr4->sin_port);
Richard Haines68741a8a2018-03-02 19:54:34 +00004726 break;
4727 case AF_INET6:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004728 addr6 = (struct sockaddr_in6 *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07004729 if (addrlen < SIN6_LEN_RFC2133)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004730 return -EINVAL;
4731 snum = ntohs(addr6->sin6_port);
Richard Haines68741a8a2018-03-02 19:54:34 +00004732 break;
4733 default:
4734 /* Note that SCTP services expect -EINVAL, whereas
4735 * others expect -EAFNOSUPPORT.
4736 */
4737 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4738 return -EINVAL;
4739 else
4740 return -EAFNOSUPPORT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004741 }
4742
Paul Moore3e1121722008-04-10 10:48:14 -04004743 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004744 if (err)
Richard Hainesd4529302018-02-13 20:57:18 +00004745 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004746
Richard Hainesd4529302018-02-13 20:57:18 +00004747 switch (sksec->sclass) {
4748 case SECCLASS_TCP_SOCKET:
4749 perm = TCP_SOCKET__NAME_CONNECT;
4750 break;
4751 case SECCLASS_DCCP_SOCKET:
4752 perm = DCCP_SOCKET__NAME_CONNECT;
4753 break;
4754 case SECCLASS_SCTP_SOCKET:
4755 perm = SCTP_SOCKET__NAME_CONNECT;
4756 break;
4757 }
James Morris2ee92d42006-11-13 16:09:01 -08004758
Eric Paris50c205f2012-04-04 15:01:43 -04004759 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004760 ad.u.net = &net;
4761 ad.u.net->dport = htons(snum);
Alexey Kodanev88b7d372018-05-11 20:15:12 +03004762 ad.u.net->family = address->sa_family;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004763 err = avc_has_perm(&selinux_state,
4764 sksec->sid, sid, sksec->sclass, perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004765 if (err)
Richard Hainesd4529302018-02-13 20:57:18 +00004766 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004767 }
4768
Richard Hainesd4529302018-02-13 20:57:18 +00004769 return 0;
4770}
Paul Moore014ab192008-10-10 10:16:33 -04004771
Richard Hainesd4529302018-02-13 20:57:18 +00004772/* Supports connect(2), see comments in selinux_socket_connect_helper() */
4773static int selinux_socket_connect(struct socket *sock,
4774 struct sockaddr *address, int addrlen)
4775{
4776 int err;
4777 struct sock *sk = sock->sk;
4778
4779 err = selinux_socket_connect_helper(sock, address, addrlen);
4780 if (err)
4781 return err;
4782
4783 return selinux_netlbl_socket_connect(sk, address);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004784}
4785
4786static int selinux_socket_listen(struct socket *sock, int backlog)
4787{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004788 return sock_has_perm(sock->sk, SOCKET__LISTEN);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004789}
4790
4791static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4792{
4793 int err;
4794 struct inode_security_struct *isec;
4795 struct inode_security_struct *newisec;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004796 u16 sclass;
4797 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004798
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004799 err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004800 if (err)
4801 return err;
4802
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05004803 isec = inode_security_novalidate(SOCK_INODE(sock));
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004804 spin_lock(&isec->lock);
4805 sclass = isec->sclass;
4806 sid = isec->sid;
4807 spin_unlock(&isec->lock);
4808
4809 newisec = inode_security_novalidate(SOCK_INODE(newsock));
4810 newisec->sclass = sclass;
4811 newisec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05004812 newisec->initialized = LABEL_INITIALIZED;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004813
4814 return 0;
4815}
4816
4817static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
Eric Paris828dfe12008-04-17 13:17:49 -04004818 int size)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004819{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004820 return sock_has_perm(sock->sk, SOCKET__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004821}
4822
4823static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4824 int size, int flags)
4825{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004826 return sock_has_perm(sock->sk, SOCKET__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004827}
4828
4829static int selinux_socket_getsockname(struct socket *sock)
4830{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004831 return sock_has_perm(sock->sk, SOCKET__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004832}
4833
4834static int selinux_socket_getpeername(struct socket *sock)
4835{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004836 return sock_has_perm(sock->sk, SOCKET__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004837}
4838
Eric Paris828dfe12008-04-17 13:17:49 -04004839static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004840{
Paul Mooref8687af2006-10-30 15:22:15 -08004841 int err;
4842
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004843 err = sock_has_perm(sock->sk, SOCKET__SETOPT);
Paul Mooref8687af2006-10-30 15:22:15 -08004844 if (err)
4845 return err;
4846
4847 return selinux_netlbl_socket_setsockopt(sock, level, optname);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004848}
4849
4850static int selinux_socket_getsockopt(struct socket *sock, int level,
4851 int optname)
4852{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004853 return sock_has_perm(sock->sk, SOCKET__GETOPT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004854}
4855
4856static int selinux_socket_shutdown(struct socket *sock, int how)
4857{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004858 return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004859}
4860
David S. Miller3610cda2011-01-05 15:38:53 -08004861static int selinux_socket_unix_stream_connect(struct sock *sock,
4862 struct sock *other,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004863 struct sock *newsk)
4864{
David S. Miller3610cda2011-01-05 15:38:53 -08004865 struct sk_security_struct *sksec_sock = sock->sk_security;
4866 struct sk_security_struct *sksec_other = other->sk_security;
Paul Moore4d1e2452010-04-22 14:46:18 -04004867 struct sk_security_struct *sksec_new = newsk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004868 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004869 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004870 int err;
4871
Eric Paris50c205f2012-04-04 15:01:43 -04004872 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004873 ad.u.net = &net;
4874 ad.u.net->sk = other;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004875
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004876 err = avc_has_perm(&selinux_state,
4877 sksec_sock->sid, sksec_other->sid,
Paul Moore4d1e2452010-04-22 14:46:18 -04004878 sksec_other->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004879 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4880 if (err)
4881 return err;
4882
Linus Torvalds1da177e2005-04-16 15:20:36 -07004883 /* server child socket */
Paul Moore4d1e2452010-04-22 14:46:18 -04004884 sksec_new->peer_sid = sksec_sock->sid;
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004885 err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
4886 sksec_sock->sid, &sksec_new->sid);
Paul Moore4d1e2452010-04-22 14:46:18 -04004887 if (err)
4888 return err;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004889
Paul Moore4d1e2452010-04-22 14:46:18 -04004890 /* connecting socket */
4891 sksec_sock->peer_sid = sksec_new->sid;
4892
4893 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004894}
4895
4896static int selinux_socket_unix_may_send(struct socket *sock,
4897 struct socket *other)
4898{
Paul Moore253bfae2010-04-22 14:46:19 -04004899 struct sk_security_struct *ssec = sock->sk->sk_security;
4900 struct sk_security_struct *osec = other->sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004901 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004902 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004903
Eric Paris50c205f2012-04-04 15:01:43 -04004904 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004905 ad.u.net = &net;
4906 ad.u.net->sk = other->sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004907
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004908 return avc_has_perm(&selinux_state,
4909 ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
Paul Moore253bfae2010-04-22 14:46:19 -04004910 &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004911}
4912
Paul Moorecbe0d6e2014-09-10 17:09:57 -04004913static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4914 char *addrp, u16 family, u32 peer_sid,
Thomas Liu2bf49692009-07-14 12:14:09 -04004915 struct common_audit_data *ad)
Paul Mooreeffad8d2008-01-29 08:49:27 -05004916{
4917 int err;
4918 u32 if_sid;
4919 u32 node_sid;
4920
Paul Moorecbe0d6e2014-09-10 17:09:57 -04004921 err = sel_netif_sid(ns, ifindex, &if_sid);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004922 if (err)
4923 return err;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004924 err = avc_has_perm(&selinux_state,
4925 peer_sid, if_sid,
Paul Mooreeffad8d2008-01-29 08:49:27 -05004926 SECCLASS_NETIF, NETIF__INGRESS, ad);
4927 if (err)
4928 return err;
4929
4930 err = sel_netnode_sid(addrp, family, &node_sid);
4931 if (err)
4932 return err;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004933 return avc_has_perm(&selinux_state,
4934 peer_sid, node_sid,
Paul Mooreeffad8d2008-01-29 08:49:27 -05004935 SECCLASS_NODE, NODE__RECVFROM, ad);
4936}
4937
Paul Moore220deb92008-01-29 08:38:23 -05004938static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
Paul Moored8395c82008-10-10 10:16:30 -04004939 u16 family)
Paul Moore220deb92008-01-29 08:38:23 -05004940{
Paul Moore277d3422008-12-31 12:54:11 -05004941 int err = 0;
Paul Moore220deb92008-01-29 08:38:23 -05004942 struct sk_security_struct *sksec = sk->sk_security;
Paul Moore220deb92008-01-29 08:38:23 -05004943 u32 sk_sid = sksec->sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04004944 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004945 struct lsm_network_audit net = {0,};
Paul Moored8395c82008-10-10 10:16:30 -04004946 char *addrp;
4947
Eric Paris50c205f2012-04-04 15:01:43 -04004948 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004949 ad.u.net = &net;
4950 ad.u.net->netif = skb->skb_iif;
4951 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04004952 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4953 if (err)
4954 return err;
Paul Moore220deb92008-01-29 08:38:23 -05004955
Paul Moore58bfbb52009-03-27 17:10:41 -04004956 if (selinux_secmark_enabled()) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004957 err = avc_has_perm(&selinux_state,
4958 sk_sid, skb->secmark, SECCLASS_PACKET,
Paul Moored8395c82008-10-10 10:16:30 -04004959 PACKET__RECV, &ad);
Paul Moore58bfbb52009-03-27 17:10:41 -04004960 if (err)
4961 return err;
4962 }
Paul Moore220deb92008-01-29 08:38:23 -05004963
Steffen Klassertb9679a72011-02-23 12:55:21 +01004964 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4965 if (err)
4966 return err;
4967 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004968
James Morris4e5ab4c2006-06-09 00:33:33 -07004969 return err;
4970}
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004971
James Morris4e5ab4c2006-06-09 00:33:33 -07004972static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4973{
Paul Moore220deb92008-01-29 08:38:23 -05004974 int err;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004975 struct sk_security_struct *sksec = sk->sk_security;
Paul Moore220deb92008-01-29 08:38:23 -05004976 u16 family = sk->sk_family;
4977 u32 sk_sid = sksec->sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04004978 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004979 struct lsm_network_audit net = {0,};
Paul Moore220deb92008-01-29 08:38:23 -05004980 char *addrp;
Paul Moored8395c82008-10-10 10:16:30 -04004981 u8 secmark_active;
4982 u8 peerlbl_active;
James Morris4e5ab4c2006-06-09 00:33:33 -07004983
James Morris4e5ab4c2006-06-09 00:33:33 -07004984 if (family != PF_INET && family != PF_INET6)
Paul Moore220deb92008-01-29 08:38:23 -05004985 return 0;
James Morris4e5ab4c2006-06-09 00:33:33 -07004986
4987 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
Al Viro87fcd702006-12-04 22:00:55 +00004988 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
James Morris4e5ab4c2006-06-09 00:33:33 -07004989 family = PF_INET;
4990
Paul Moored8395c82008-10-10 10:16:30 -04004991 /* If any sort of compatibility mode is enabled then handoff processing
4992 * to the selinux_sock_rcv_skb_compat() function to deal with the
4993 * special handling. We do this in an attempt to keep this function
4994 * as fast and as clean as possible. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004995 if (!selinux_policycap_netpeer())
Paul Moored8395c82008-10-10 10:16:30 -04004996 return selinux_sock_rcv_skb_compat(sk, skb, family);
4997
4998 secmark_active = selinux_secmark_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04004999 peerlbl_active = selinux_peerlbl_enabled();
Paul Moored8395c82008-10-10 10:16:30 -04005000 if (!secmark_active && !peerlbl_active)
5001 return 0;
5002
Eric Paris50c205f2012-04-04 15:01:43 -04005003 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005004 ad.u.net = &net;
5005 ad.u.net->netif = skb->skb_iif;
5006 ad.u.net->family = family;
Paul Moore224dfbd2008-01-29 08:38:13 -05005007 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
James Morris4e5ab4c2006-06-09 00:33:33 -07005008 if (err)
Paul Moore220deb92008-01-29 08:38:23 -05005009 return err;
James Morris4e5ab4c2006-06-09 00:33:33 -07005010
Paul Moored8395c82008-10-10 10:16:30 -04005011 if (peerlbl_active) {
Paul Moored621d352008-01-29 08:43:36 -05005012 u32 peer_sid;
5013
5014 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
5015 if (err)
5016 return err;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005017 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
5018 addrp, family, peer_sid, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04005019 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04005020 selinux_netlbl_err(skb, family, err, 0);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005021 return err;
Paul Mooredfaebe92008-10-10 10:16:31 -04005022 }
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005023 err = avc_has_perm(&selinux_state,
5024 sk_sid, peer_sid, SECCLASS_PEER,
Paul Moored621d352008-01-29 08:43:36 -05005025 PEER__RECV, &ad);
Chad Hanson46d01d62013-12-23 17:45:01 -05005026 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04005027 selinux_netlbl_err(skb, family, err, 0);
Chad Hanson46d01d62013-12-23 17:45:01 -05005028 return err;
5029 }
Paul Moored621d352008-01-29 08:43:36 -05005030 }
5031
Paul Moored8395c82008-10-10 10:16:30 -04005032 if (secmark_active) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005033 err = avc_has_perm(&selinux_state,
5034 sk_sid, skb->secmark, SECCLASS_PACKET,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005035 PACKET__RECV, &ad);
5036 if (err)
5037 return err;
5038 }
5039
Paul Moored621d352008-01-29 08:43:36 -05005040 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005041}
5042
Catherine Zhang2c7946a2006-03-20 22:41:23 -08005043static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
5044 int __user *optlen, unsigned len)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005045{
5046 int err = 0;
5047 char *scontext;
5048 u32 scontext_len;
Paul Moore253bfae2010-04-22 14:46:19 -04005049 struct sk_security_struct *sksec = sock->sk->sk_security;
Paul Moore3de4bab2006-11-17 17:38:54 -05005050 u32 peer_sid = SECSID_NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005051
Paul Moore253bfae2010-04-22 14:46:19 -04005052 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
Richard Hainesd4529302018-02-13 20:57:18 +00005053 sksec->sclass == SECCLASS_TCP_SOCKET ||
5054 sksec->sclass == SECCLASS_SCTP_SOCKET)
Eric Parisdd3e7832010-04-07 15:08:46 -04005055 peer_sid = sksec->peer_sid;
Paul Moore253bfae2010-04-22 14:46:19 -04005056 if (peer_sid == SECSID_NULL)
5057 return -ENOPROTOOPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005058
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005059 err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
5060 &scontext_len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005061 if (err)
Paul Moore253bfae2010-04-22 14:46:19 -04005062 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005063
5064 if (scontext_len > len) {
5065 err = -ERANGE;
5066 goto out_len;
5067 }
5068
5069 if (copy_to_user(optval, scontext, scontext_len))
5070 err = -EFAULT;
5071
5072out_len:
5073 if (put_user(scontext_len, optlen))
5074 err = -EFAULT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005075 kfree(scontext);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005076 return err;
5077}
5078
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005079static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
Catherine Zhang2c7946a2006-03-20 22:41:23 -08005080{
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005081 u32 peer_secid = SECSID_NULL;
Paul Moore75e22912008-01-29 08:38:04 -05005082 u16 family;
Paul Moore899134f2016-03-28 15:19:10 -04005083 struct inode_security_struct *isec;
Catherine Zhang877ce7c2006-06-29 12:27:47 -07005084
Paul Mooreaa862902008-10-10 10:16:29 -04005085 if (skb && skb->protocol == htons(ETH_P_IP))
5086 family = PF_INET;
5087 else if (skb && skb->protocol == htons(ETH_P_IPV6))
5088 family = PF_INET6;
5089 else if (sock)
Paul Moore75e22912008-01-29 08:38:04 -05005090 family = sock->sk->sk_family;
Paul Moore75e22912008-01-29 08:38:04 -05005091 else
5092 goto out;
5093
Paul Moore899134f2016-03-28 15:19:10 -04005094 if (sock && family == PF_UNIX) {
5095 isec = inode_security_novalidate(SOCK_INODE(sock));
5096 peer_secid = isec->sid;
5097 } else if (skb)
Paul Moore220deb92008-01-29 08:38:23 -05005098 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
Catherine Zhang2c7946a2006-03-20 22:41:23 -08005099
Paul Moore75e22912008-01-29 08:38:04 -05005100out:
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005101 *secid = peer_secid;
Paul Moore75e22912008-01-29 08:38:04 -05005102 if (peer_secid == SECSID_NULL)
5103 return -EINVAL;
5104 return 0;
Catherine Zhang2c7946a2006-03-20 22:41:23 -08005105}
5106
Al Viro7d877f32005-10-21 03:20:43 -04005107static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005108{
Paul Moore84914b72010-04-22 14:46:18 -04005109 struct sk_security_struct *sksec;
5110
5111 sksec = kzalloc(sizeof(*sksec), priority);
5112 if (!sksec)
5113 return -ENOMEM;
5114
5115 sksec->peer_sid = SECINITSID_UNLABELED;
5116 sksec->sid = SECINITSID_UNLABELED;
Stephen Smalley5dee25d2015-07-10 17:19:57 -04005117 sksec->sclass = SECCLASS_SOCKET;
Paul Moore84914b72010-04-22 14:46:18 -04005118 selinux_netlbl_sk_security_reset(sksec);
5119 sk->sk_security = sksec;
5120
5121 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005122}
5123
5124static void selinux_sk_free_security(struct sock *sk)
5125{
Paul Moore84914b72010-04-22 14:46:18 -04005126 struct sk_security_struct *sksec = sk->sk_security;
5127
5128 sk->sk_security = NULL;
5129 selinux_netlbl_sk_security_free(sksec);
5130 kfree(sksec);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005131}
5132
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005133static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5134{
Eric Parisdd3e7832010-04-07 15:08:46 -04005135 struct sk_security_struct *sksec = sk->sk_security;
5136 struct sk_security_struct *newsksec = newsk->sk_security;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005137
Eric Parisdd3e7832010-04-07 15:08:46 -04005138 newsksec->sid = sksec->sid;
5139 newsksec->peer_sid = sksec->peer_sid;
5140 newsksec->sclass = sksec->sclass;
Paul Moore99f59ed2006-08-29 17:53:48 -07005141
Eric Parisdd3e7832010-04-07 15:08:46 -04005142 selinux_netlbl_sk_security_reset(newsksec);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005143}
5144
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07005145static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005146{
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005147 if (!sk)
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07005148 *secid = SECINITSID_ANY_SOCKET;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005149 else {
5150 struct sk_security_struct *sksec = sk->sk_security;
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005151
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07005152 *secid = sksec->sid;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005153 }
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005154}
5155
Eric Paris828dfe12008-04-17 13:17:49 -04005156static void selinux_sock_graft(struct sock *sk, struct socket *parent)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005157{
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05005158 struct inode_security_struct *isec =
5159 inode_security_novalidate(SOCK_INODE(parent));
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005160 struct sk_security_struct *sksec = sk->sk_security;
5161
Paul Moore2873ead2014-07-28 10:42:48 -04005162 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5163 sk->sk_family == PF_UNIX)
David Woodhouse2148ccc2006-09-29 15:50:25 -07005164 isec->sid = sksec->sid;
Paul Moore220deb92008-01-29 08:38:23 -05005165 sksec->sclass = isec->sclass;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005166}
5167
Richard Hainesd4529302018-02-13 20:57:18 +00005168/* Called whenever SCTP receives an INIT chunk. This happens when an incoming
5169 * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
5170 * already present).
5171 */
5172static int selinux_sctp_assoc_request(struct sctp_endpoint *ep,
5173 struct sk_buff *skb)
5174{
5175 struct sk_security_struct *sksec = ep->base.sk->sk_security;
5176 struct common_audit_data ad;
5177 struct lsm_network_audit net = {0,};
5178 u8 peerlbl_active;
5179 u32 peer_sid = SECINITSID_UNLABELED;
5180 u32 conn_sid;
5181 int err = 0;
5182
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005183 if (!selinux_policycap_extsockclass())
Richard Hainesd4529302018-02-13 20:57:18 +00005184 return 0;
5185
5186 peerlbl_active = selinux_peerlbl_enabled();
5187
5188 if (peerlbl_active) {
5189 /* This will return peer_sid = SECSID_NULL if there are
5190 * no peer labels, see security_net_peersid_resolve().
5191 */
5192 err = selinux_skb_peerlbl_sid(skb, ep->base.sk->sk_family,
5193 &peer_sid);
5194 if (err)
5195 return err;
5196
5197 if (peer_sid == SECSID_NULL)
5198 peer_sid = SECINITSID_UNLABELED;
5199 }
5200
5201 if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5202 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5203
5204 /* Here as first association on socket. As the peer SID
5205 * was allowed by peer recv (and the netif/node checks),
5206 * then it is approved by policy and used as the primary
5207 * peer SID for getpeercon(3).
5208 */
5209 sksec->peer_sid = peer_sid;
5210 } else if (sksec->peer_sid != peer_sid) {
5211 /* Other association peer SIDs are checked to enforce
5212 * consistency among the peer SIDs.
5213 */
5214 ad.type = LSM_AUDIT_DATA_NET;
5215 ad.u.net = &net;
5216 ad.u.net->sk = ep->base.sk;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005217 err = avc_has_perm(&selinux_state,
5218 sksec->peer_sid, peer_sid, sksec->sclass,
Richard Hainesd4529302018-02-13 20:57:18 +00005219 SCTP_SOCKET__ASSOCIATION, &ad);
5220 if (err)
5221 return err;
5222 }
5223
5224 /* Compute the MLS component for the connection and store
5225 * the information in ep. This will be used by SCTP TCP type
5226 * sockets and peeled off connections as they cause a new
5227 * socket to be generated. selinux_sctp_sk_clone() will then
5228 * plug this into the new socket.
5229 */
5230 err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
5231 if (err)
5232 return err;
5233
5234 ep->secid = conn_sid;
5235 ep->peer_secid = peer_sid;
5236
5237 /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5238 return selinux_netlbl_sctp_assoc_request(ep, skb);
5239}
5240
5241/* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5242 * based on their @optname.
5243 */
5244static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5245 struct sockaddr *address,
5246 int addrlen)
5247{
5248 int len, err = 0, walk_size = 0;
5249 void *addr_buf;
5250 struct sockaddr *addr;
5251 struct socket *sock;
5252
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005253 if (!selinux_policycap_extsockclass())
Richard Hainesd4529302018-02-13 20:57:18 +00005254 return 0;
5255
5256 /* Process one or more addresses that may be IPv4 or IPv6 */
5257 sock = sk->sk_socket;
5258 addr_buf = address;
5259
5260 while (walk_size < addrlen) {
5261 addr = addr_buf;
5262 switch (addr->sa_family) {
Alexey Kodanev4152dc92018-05-11 20:15:13 +03005263 case AF_UNSPEC:
Richard Hainesd4529302018-02-13 20:57:18 +00005264 case AF_INET:
5265 len = sizeof(struct sockaddr_in);
5266 break;
5267 case AF_INET6:
5268 len = sizeof(struct sockaddr_in6);
5269 break;
5270 default:
Alexey Kodanev4152dc92018-05-11 20:15:13 +03005271 return -EINVAL;
Richard Hainesd4529302018-02-13 20:57:18 +00005272 }
5273
5274 err = -EINVAL;
5275 switch (optname) {
5276 /* Bind checks */
5277 case SCTP_PRIMARY_ADDR:
5278 case SCTP_SET_PEER_PRIMARY_ADDR:
5279 case SCTP_SOCKOPT_BINDX_ADD:
5280 err = selinux_socket_bind(sock, addr, len);
5281 break;
5282 /* Connect checks */
5283 case SCTP_SOCKOPT_CONNECTX:
5284 case SCTP_PARAM_SET_PRIMARY:
5285 case SCTP_PARAM_ADD_IP:
5286 case SCTP_SENDMSG_CONNECT:
5287 err = selinux_socket_connect_helper(sock, addr, len);
5288 if (err)
5289 return err;
5290
5291 /* As selinux_sctp_bind_connect() is called by the
5292 * SCTP protocol layer, the socket is already locked,
5293 * therefore selinux_netlbl_socket_connect_locked() is
5294 * is called here. The situations handled are:
5295 * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5296 * whenever a new IP address is added or when a new
5297 * primary address is selected.
5298 * Note that an SCTP connect(2) call happens before
5299 * the SCTP protocol layer and is handled via
5300 * selinux_socket_connect().
5301 */
5302 err = selinux_netlbl_socket_connect_locked(sk, addr);
5303 break;
5304 }
5305
5306 if (err)
5307 return err;
5308
5309 addr_buf += len;
5310 walk_size += len;
5311 }
5312
5313 return 0;
5314}
5315
5316/* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5317static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
5318 struct sock *newsk)
5319{
5320 struct sk_security_struct *sksec = sk->sk_security;
5321 struct sk_security_struct *newsksec = newsk->sk_security;
5322
5323 /* If policy does not support SECCLASS_SCTP_SOCKET then call
5324 * the non-sctp clone version.
5325 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005326 if (!selinux_policycap_extsockclass())
Richard Hainesd4529302018-02-13 20:57:18 +00005327 return selinux_sk_clone_security(sk, newsk);
5328
5329 newsksec->sid = ep->secid;
5330 newsksec->peer_sid = ep->peer_secid;
5331 newsksec->sclass = sksec->sclass;
5332 selinux_netlbl_sctp_sk_clone(sk, newsk);
5333}
5334
Adrian Bunk9a673e52006-08-15 00:03:53 -07005335static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
5336 struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005337{
5338 struct sk_security_struct *sksec = sk->sk_security;
5339 int err;
Paul Moore0b1f24e2013-12-03 11:39:13 -05005340 u16 family = req->rsk_ops->family;
Paul Moore446b8022013-12-04 16:10:51 -05005341 u32 connsid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005342 u32 peersid;
5343
Paul Mooreaa862902008-10-10 10:16:29 -04005344 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
Paul Moore220deb92008-01-29 08:38:23 -05005345 if (err)
5346 return err;
Paul Moore446b8022013-12-04 16:10:51 -05005347 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5348 if (err)
5349 return err;
5350 req->secid = connsid;
5351 req->peer_secid = peersid;
Venkat Yekkiralaa51c64f2006-07-27 22:01:34 -07005352
Paul Moore389fb8002009-03-27 17:10:34 -04005353 return selinux_netlbl_inet_conn_request(req, family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005354}
5355
Adrian Bunk9a673e52006-08-15 00:03:53 -07005356static void selinux_inet_csk_clone(struct sock *newsk,
5357 const struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005358{
5359 struct sk_security_struct *newsksec = newsk->sk_security;
5360
5361 newsksec->sid = req->secid;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005362 newsksec->peer_sid = req->peer_secid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005363 /* NOTE: Ideally, we should also get the isec->sid for the
5364 new socket in sync, but we don't have the isec available yet.
5365 So we will wait until sock_graft to do it, by which
5366 time it will have been created and available. */
Paul Moore99f59ed2006-08-29 17:53:48 -07005367
Paul Moore9f2ad662006-11-17 17:38:53 -05005368 /* We don't need to take any sort of lock here as we are the only
5369 * thread with access to newsksec */
Paul Moore389fb8002009-03-27 17:10:34 -04005370 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005371}
5372
Paul Moore014ab192008-10-10 10:16:33 -04005373static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005374{
Paul Mooreaa862902008-10-10 10:16:29 -04005375 u16 family = sk->sk_family;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005376 struct sk_security_struct *sksec = sk->sk_security;
5377
Paul Mooreaa862902008-10-10 10:16:29 -04005378 /* handle mapped IPv4 packets arriving via IPv6 sockets */
5379 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5380 family = PF_INET;
5381
5382 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005383}
5384
Eric Paris2606fd12010-10-13 16:24:41 -04005385static int selinux_secmark_relabel_packet(u32 sid)
5386{
5387 const struct task_security_struct *__tsec;
5388 u32 tsid;
5389
5390 __tsec = current_security();
5391 tsid = __tsec->sid;
5392
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005393 return avc_has_perm(&selinux_state,
5394 tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5395 NULL);
Eric Paris2606fd12010-10-13 16:24:41 -04005396}
5397
5398static void selinux_secmark_refcount_inc(void)
5399{
5400 atomic_inc(&selinux_secmark_refcount);
5401}
5402
5403static void selinux_secmark_refcount_dec(void)
5404{
5405 atomic_dec(&selinux_secmark_refcount);
5406}
5407
Adrian Bunk9a673e52006-08-15 00:03:53 -07005408static void selinux_req_classify_flow(const struct request_sock *req,
5409 struct flowi *fl)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005410{
David S. Miller1d28f422011-03-12 00:29:39 -05005411 fl->flowi_secid = req->secid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005412}
5413
Paul Moore5dbbaf22013-01-14 07:12:19 +00005414static int selinux_tun_dev_alloc_security(void **security)
5415{
5416 struct tun_security_struct *tunsec;
5417
5418 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5419 if (!tunsec)
5420 return -ENOMEM;
5421 tunsec->sid = current_sid();
5422
5423 *security = tunsec;
5424 return 0;
5425}
5426
5427static void selinux_tun_dev_free_security(void *security)
5428{
5429 kfree(security);
5430}
5431
Paul Mooreed6d76e2009-08-28 18:12:49 -04005432static int selinux_tun_dev_create(void)
5433{
5434 u32 sid = current_sid();
5435
5436 /* we aren't taking into account the "sockcreate" SID since the socket
5437 * that is being created here is not a socket in the traditional sense,
5438 * instead it is a private sock, accessible only to the kernel, and
5439 * representing a wide range of network traffic spanning multiple
5440 * connections unlike traditional sockets - check the TUN driver to
5441 * get a better understanding of why this socket is special */
5442
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005443 return avc_has_perm(&selinux_state,
5444 sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
Paul Mooreed6d76e2009-08-28 18:12:49 -04005445 NULL);
5446}
5447
Paul Moore5dbbaf22013-01-14 07:12:19 +00005448static int selinux_tun_dev_attach_queue(void *security)
Paul Mooreed6d76e2009-08-28 18:12:49 -04005449{
Paul Moore5dbbaf22013-01-14 07:12:19 +00005450 struct tun_security_struct *tunsec = security;
5451
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005452 return avc_has_perm(&selinux_state,
5453 current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
Paul Moore5dbbaf22013-01-14 07:12:19 +00005454 TUN_SOCKET__ATTACH_QUEUE, NULL);
5455}
5456
5457static int selinux_tun_dev_attach(struct sock *sk, void *security)
5458{
5459 struct tun_security_struct *tunsec = security;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005460 struct sk_security_struct *sksec = sk->sk_security;
5461
5462 /* we don't currently perform any NetLabel based labeling here and it
5463 * isn't clear that we would want to do so anyway; while we could apply
5464 * labeling without the support of the TUN user the resulting labeled
5465 * traffic from the other end of the connection would almost certainly
5466 * cause confusion to the TUN user that had no idea network labeling
5467 * protocols were being used */
5468
Paul Moore5dbbaf22013-01-14 07:12:19 +00005469 sksec->sid = tunsec->sid;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005470 sksec->sclass = SECCLASS_TUN_SOCKET;
Paul Moore5dbbaf22013-01-14 07:12:19 +00005471
5472 return 0;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005473}
5474
Paul Moore5dbbaf22013-01-14 07:12:19 +00005475static int selinux_tun_dev_open(void *security)
Paul Mooreed6d76e2009-08-28 18:12:49 -04005476{
Paul Moore5dbbaf22013-01-14 07:12:19 +00005477 struct tun_security_struct *tunsec = security;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005478 u32 sid = current_sid();
5479 int err;
5480
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005481 err = avc_has_perm(&selinux_state,
5482 sid, tunsec->sid, SECCLASS_TUN_SOCKET,
Paul Mooreed6d76e2009-08-28 18:12:49 -04005483 TUN_SOCKET__RELABELFROM, NULL);
5484 if (err)
5485 return err;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005486 err = avc_has_perm(&selinux_state,
5487 sid, sid, SECCLASS_TUN_SOCKET,
Paul Mooreed6d76e2009-08-28 18:12:49 -04005488 TUN_SOCKET__RELABELTO, NULL);
5489 if (err)
5490 return err;
Paul Moore5dbbaf22013-01-14 07:12:19 +00005491 tunsec->sid = sid;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005492
5493 return 0;
5494}
5495
Linus Torvalds1da177e2005-04-16 15:20:36 -07005496static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5497{
5498 int err = 0;
5499 u32 perm;
5500 struct nlmsghdr *nlh;
Paul Moore253bfae2010-04-22 14:46:19 -04005501 struct sk_security_struct *sksec = sk->sk_security;
Eric Paris828dfe12008-04-17 13:17:49 -04005502
Hong zhi guo77954982013-03-27 06:49:35 +00005503 if (skb->len < NLMSG_HDRLEN) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005504 err = -EINVAL;
5505 goto out;
5506 }
Arnaldo Carvalho de Melob529ccf2007-04-25 19:08:35 -07005507 nlh = nlmsg_hdr(skb);
Eric Paris828dfe12008-04-17 13:17:49 -04005508
Paul Moore253bfae2010-04-22 14:46:19 -04005509 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005510 if (err) {
5511 if (err == -EINVAL) {
Vladis Dronov76319942015-12-24 11:09:41 -05005512 pr_warn_ratelimited("SELinux: unrecognized netlink"
5513 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5514 " pig=%d comm=%s\n",
Marek Milkoviccded3ff2015-06-04 16:22:16 -04005515 sk->sk_protocol, nlh->nlmsg_type,
Vladis Dronov76319942015-12-24 11:09:41 -05005516 secclass_map[sksec->sclass - 1].name,
5517 task_pid_nr(current), current->comm);
Paul Mooree5a5ca92018-03-01 17:38:30 -05005518 if (!enforcing_enabled(&selinux_state) ||
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005519 security_get_allow_unknown(&selinux_state))
Linus Torvalds1da177e2005-04-16 15:20:36 -07005520 err = 0;
5521 }
5522
5523 /* Ignore */
5524 if (err == -ENOENT)
5525 err = 0;
5526 goto out;
5527 }
5528
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005529 err = sock_has_perm(sk, perm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005530out:
5531 return err;
5532}
5533
5534#ifdef CONFIG_NETFILTER
5535
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005536static unsigned int selinux_ip_forward(struct sk_buff *skb,
5537 const struct net_device *indev,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005538 u16 family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005539{
Paul Mooredfaebe92008-10-10 10:16:31 -04005540 int err;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005541 char *addrp;
5542 u32 peer_sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04005543 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005544 struct lsm_network_audit net = {0,};
Paul Mooreeffad8d2008-01-29 08:49:27 -05005545 u8 secmark_active;
Paul Moore948bf852008-10-10 10:16:32 -04005546 u8 netlbl_active;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005547 u8 peerlbl_active;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005548
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005549 if (!selinux_policycap_netpeer())
Paul Mooreeffad8d2008-01-29 08:49:27 -05005550 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005551
Paul Mooreeffad8d2008-01-29 08:49:27 -05005552 secmark_active = selinux_secmark_enabled();
Paul Moore948bf852008-10-10 10:16:32 -04005553 netlbl_active = netlbl_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04005554 peerlbl_active = selinux_peerlbl_enabled();
Paul Mooreeffad8d2008-01-29 08:49:27 -05005555 if (!secmark_active && !peerlbl_active)
5556 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005557
Paul Moored8395c82008-10-10 10:16:30 -04005558 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5559 return NF_DROP;
5560
Eric Paris50c205f2012-04-04 15:01:43 -04005561 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005562 ad.u.net = &net;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005563 ad.u.net->netif = indev->ifindex;
Eric Paris48c62af2012-04-02 13:15:44 -04005564 ad.u.net->family = family;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005565 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5566 return NF_DROP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005567
Paul Mooredfaebe92008-10-10 10:16:31 -04005568 if (peerlbl_active) {
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005569 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5570 addrp, family, peer_sid, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04005571 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04005572 selinux_netlbl_err(skb, family, err, 1);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005573 return NF_DROP;
Paul Mooredfaebe92008-10-10 10:16:31 -04005574 }
5575 }
Paul Mooreeffad8d2008-01-29 08:49:27 -05005576
5577 if (secmark_active)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005578 if (avc_has_perm(&selinux_state,
5579 peer_sid, skb->secmark,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005580 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5581 return NF_DROP;
5582
Paul Moore948bf852008-10-10 10:16:32 -04005583 if (netlbl_active)
5584 /* we do this in the FORWARD path and not the POST_ROUTING
5585 * path because we want to make sure we apply the necessary
5586 * labeling before IPsec is applied so we can leverage AH
5587 * protection */
5588 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5589 return NF_DROP;
5590
Paul Mooreeffad8d2008-01-29 08:49:27 -05005591 return NF_ACCEPT;
5592}
5593
Eric W. Biederman06198b32015-09-18 14:33:06 -05005594static unsigned int selinux_ipv4_forward(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005595 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005596 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005597{
David S. Miller238e54c2015-04-03 20:32:56 -04005598 return selinux_ip_forward(skb, state->in, PF_INET);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005599}
5600
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005601#if IS_ENABLED(CONFIG_IPV6)
Eric W. Biederman06198b32015-09-18 14:33:06 -05005602static unsigned int selinux_ipv6_forward(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005603 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005604 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005605{
David S. Miller238e54c2015-04-03 20:32:56 -04005606 return selinux_ip_forward(skb, state->in, PF_INET6);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005607}
5608#endif /* IPV6 */
5609
Paul Moore948bf852008-10-10 10:16:32 -04005610static unsigned int selinux_ip_output(struct sk_buff *skb,
5611 u16 family)
5612{
Paul Moore47180062013-12-04 16:10:45 -05005613 struct sock *sk;
Paul Moore948bf852008-10-10 10:16:32 -04005614 u32 sid;
5615
5616 if (!netlbl_enabled())
5617 return NF_ACCEPT;
5618
5619 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5620 * because we want to make sure we apply the necessary labeling
5621 * before IPsec is applied so we can leverage AH protection */
Paul Moore47180062013-12-04 16:10:45 -05005622 sk = skb->sk;
5623 if (sk) {
5624 struct sk_security_struct *sksec;
5625
Eric Dumazete446f9d2015-10-08 05:01:55 -07005626 if (sk_listener(sk))
Paul Moore47180062013-12-04 16:10:45 -05005627 /* if the socket is the listening state then this
5628 * packet is a SYN-ACK packet which means it needs to
5629 * be labeled based on the connection/request_sock and
5630 * not the parent socket. unfortunately, we can't
5631 * lookup the request_sock yet as it isn't queued on
5632 * the parent socket until after the SYN-ACK is sent.
5633 * the "solution" is to simply pass the packet as-is
5634 * as any IP option based labeling should be copied
5635 * from the initial connection request (in the IP
5636 * layer). it is far from ideal, but until we get a
5637 * security label in the packet itself this is the
5638 * best we can do. */
5639 return NF_ACCEPT;
5640
5641 /* standard practice, label using the parent socket */
5642 sksec = sk->sk_security;
Paul Moore948bf852008-10-10 10:16:32 -04005643 sid = sksec->sid;
5644 } else
5645 sid = SECINITSID_KERNEL;
5646 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5647 return NF_DROP;
5648
5649 return NF_ACCEPT;
5650}
5651
Eric W. Biederman06198b32015-09-18 14:33:06 -05005652static unsigned int selinux_ipv4_output(void *priv,
Paul Moore948bf852008-10-10 10:16:32 -04005653 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005654 const struct nf_hook_state *state)
Paul Moore948bf852008-10-10 10:16:32 -04005655{
5656 return selinux_ip_output(skb, PF_INET);
5657}
5658
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005659#if IS_ENABLED(CONFIG_IPV6)
Huw Davies2917f572016-06-27 15:06:15 -04005660static unsigned int selinux_ipv6_output(void *priv,
5661 struct sk_buff *skb,
5662 const struct nf_hook_state *state)
5663{
5664 return selinux_ip_output(skb, PF_INET6);
5665}
5666#endif /* IPV6 */
5667
Paul Mooreeffad8d2008-01-29 08:49:27 -05005668static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5669 int ifindex,
Paul Moored8395c82008-10-10 10:16:30 -04005670 u16 family)
James Morris4e5ab4c2006-06-09 00:33:33 -07005671{
Eric Dumazet54abc682015-11-08 10:54:07 -08005672 struct sock *sk = skb_to_full_sk(skb);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005673 struct sk_security_struct *sksec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005674 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005675 struct lsm_network_audit net = {0,};
Paul Moored8395c82008-10-10 10:16:30 -04005676 char *addrp;
5677 u8 proto;
James Morris4e5ab4c2006-06-09 00:33:33 -07005678
Paul Mooreeffad8d2008-01-29 08:49:27 -05005679 if (sk == NULL)
5680 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005681 sksec = sk->sk_security;
James Morris4e5ab4c2006-06-09 00:33:33 -07005682
Eric Paris50c205f2012-04-04 15:01:43 -04005683 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005684 ad.u.net = &net;
5685 ad.u.net->netif = ifindex;
5686 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04005687 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5688 return NF_DROP;
5689
Paul Moore58bfbb52009-03-27 17:10:41 -04005690 if (selinux_secmark_enabled())
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005691 if (avc_has_perm(&selinux_state,
5692 sksec->sid, skb->secmark,
Paul Moored8395c82008-10-10 10:16:30 -04005693 SECCLASS_PACKET, PACKET__SEND, &ad))
Eric Paris2fe66ec2010-11-23 06:28:08 +00005694 return NF_DROP_ERR(-ECONNREFUSED);
James Morris4e5ab4c2006-06-09 00:33:33 -07005695
Steffen Klassertb9679a72011-02-23 12:55:21 +01005696 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5697 return NF_DROP_ERR(-ECONNREFUSED);
James Morris4e5ab4c2006-06-09 00:33:33 -07005698
Paul Mooreeffad8d2008-01-29 08:49:27 -05005699 return NF_ACCEPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005700}
5701
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005702static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5703 const struct net_device *outdev,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005704 u16 family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005705{
Paul Mooreeffad8d2008-01-29 08:49:27 -05005706 u32 secmark_perm;
5707 u32 peer_sid;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005708 int ifindex = outdev->ifindex;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005709 struct sock *sk;
Thomas Liu2bf49692009-07-14 12:14:09 -04005710 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005711 struct lsm_network_audit net = {0,};
Paul Mooreeffad8d2008-01-29 08:49:27 -05005712 char *addrp;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005713 u8 secmark_active;
5714 u8 peerlbl_active;
5715
Paul Mooreeffad8d2008-01-29 08:49:27 -05005716 /* If any sort of compatibility mode is enabled then handoff processing
5717 * to the selinux_ip_postroute_compat() function to deal with the
5718 * special handling. We do this in an attempt to keep this function
5719 * as fast and as clean as possible. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005720 if (!selinux_policycap_netpeer())
Paul Moored8395c82008-10-10 10:16:30 -04005721 return selinux_ip_postroute_compat(skb, ifindex, family);
Paul Moorec0828e52013-12-10 14:58:01 -05005722
Paul Mooreeffad8d2008-01-29 08:49:27 -05005723 secmark_active = selinux_secmark_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04005724 peerlbl_active = selinux_peerlbl_enabled();
Paul Mooreeffad8d2008-01-29 08:49:27 -05005725 if (!secmark_active && !peerlbl_active)
5726 return NF_ACCEPT;
5727
Eric Dumazet54abc682015-11-08 10:54:07 -08005728 sk = skb_to_full_sk(skb);
Paul Moorec0828e52013-12-10 14:58:01 -05005729
Paul Mooreeffad8d2008-01-29 08:49:27 -05005730#ifdef CONFIG_XFRM
5731 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5732 * packet transformation so allow the packet to pass without any checks
5733 * since we'll have another chance to perform access control checks
5734 * when the packet is on it's final way out.
5735 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
Paul Moorec0828e52013-12-10 14:58:01 -05005736 * is NULL, in this case go ahead and apply access control.
5737 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5738 * TCP listening state we cannot wait until the XFRM processing
5739 * is done as we will miss out on the SA label if we do;
5740 * unfortunately, this means more work, but it is only once per
5741 * connection. */
5742 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
Eric Dumazete446f9d2015-10-08 05:01:55 -07005743 !(sk && sk_listener(sk)))
Paul Mooreeffad8d2008-01-29 08:49:27 -05005744 return NF_ACCEPT;
5745#endif
Paul Mooreeffad8d2008-01-29 08:49:27 -05005746
Paul Moored8395c82008-10-10 10:16:30 -04005747 if (sk == NULL) {
Paul Moore446b8022013-12-04 16:10:51 -05005748 /* Without an associated socket the packet is either coming
5749 * from the kernel or it is being forwarded; check the packet
5750 * to determine which and if the packet is being forwarded
5751 * query the packet directly to determine the security label. */
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005752 if (skb->skb_iif) {
5753 secmark_perm = PACKET__FORWARD_OUT;
Paul Moored8395c82008-10-10 10:16:30 -04005754 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005755 return NF_DROP;
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005756 } else {
5757 secmark_perm = PACKET__SEND;
Paul Moored8395c82008-10-10 10:16:30 -04005758 peer_sid = SECINITSID_KERNEL;
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005759 }
Eric Dumazete446f9d2015-10-08 05:01:55 -07005760 } else if (sk_listener(sk)) {
Paul Moore446b8022013-12-04 16:10:51 -05005761 /* Locally generated packet but the associated socket is in the
5762 * listening state which means this is a SYN-ACK packet. In
5763 * this particular case the correct security label is assigned
5764 * to the connection/request_sock but unfortunately we can't
5765 * query the request_sock as it isn't queued on the parent
5766 * socket until after the SYN-ACK packet is sent; the only
5767 * viable choice is to regenerate the label like we do in
5768 * selinux_inet_conn_request(). See also selinux_ip_output()
5769 * for similar problems. */
5770 u32 skb_sid;
Eric Dumazete446f9d2015-10-08 05:01:55 -07005771 struct sk_security_struct *sksec;
5772
Eric Dumazete446f9d2015-10-08 05:01:55 -07005773 sksec = sk->sk_security;
Paul Moore446b8022013-12-04 16:10:51 -05005774 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5775 return NF_DROP;
Paul Moorec0828e52013-12-10 14:58:01 -05005776 /* At this point, if the returned skb peerlbl is SECSID_NULL
5777 * and the packet has been through at least one XFRM
5778 * transformation then we must be dealing with the "final"
5779 * form of labeled IPsec packet; since we've already applied
5780 * all of our access controls on this packet we can safely
5781 * pass the packet. */
5782 if (skb_sid == SECSID_NULL) {
5783 switch (family) {
5784 case PF_INET:
5785 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5786 return NF_ACCEPT;
5787 break;
5788 case PF_INET6:
5789 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5790 return NF_ACCEPT;
Paul Moorea7a91a12014-09-03 10:51:59 -04005791 break;
Paul Moorec0828e52013-12-10 14:58:01 -05005792 default:
5793 return NF_DROP_ERR(-ECONNREFUSED);
5794 }
5795 }
Paul Moore446b8022013-12-04 16:10:51 -05005796 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5797 return NF_DROP;
5798 secmark_perm = PACKET__SEND;
Paul Moored8395c82008-10-10 10:16:30 -04005799 } else {
Paul Moore446b8022013-12-04 16:10:51 -05005800 /* Locally generated packet, fetch the security label from the
5801 * associated socket. */
Paul Mooreeffad8d2008-01-29 08:49:27 -05005802 struct sk_security_struct *sksec = sk->sk_security;
5803 peer_sid = sksec->sid;
5804 secmark_perm = PACKET__SEND;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005805 }
5806
Eric Paris50c205f2012-04-04 15:01:43 -04005807 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005808 ad.u.net = &net;
5809 ad.u.net->netif = ifindex;
5810 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04005811 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
Eric Paris04f6d702010-11-23 06:28:02 +00005812 return NF_DROP;
Paul Moored8395c82008-10-10 10:16:30 -04005813
Paul Mooreeffad8d2008-01-29 08:49:27 -05005814 if (secmark_active)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005815 if (avc_has_perm(&selinux_state,
5816 peer_sid, skb->secmark,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005817 SECCLASS_PACKET, secmark_perm, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005818 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005819
5820 if (peerlbl_active) {
5821 u32 if_sid;
5822 u32 node_sid;
5823
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005824 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005825 return NF_DROP;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005826 if (avc_has_perm(&selinux_state,
5827 peer_sid, if_sid,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005828 SECCLASS_NETIF, NETIF__EGRESS, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005829 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005830
5831 if (sel_netnode_sid(addrp, family, &node_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005832 return NF_DROP;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005833 if (avc_has_perm(&selinux_state,
5834 peer_sid, node_sid,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005835 SECCLASS_NODE, NODE__SENDTO, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005836 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005837 }
5838
5839 return NF_ACCEPT;
5840}
5841
Eric W. Biederman06198b32015-09-18 14:33:06 -05005842static unsigned int selinux_ipv4_postroute(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005843 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005844 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005845{
David S. Miller238e54c2015-04-03 20:32:56 -04005846 return selinux_ip_postroute(skb, state->out, PF_INET);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005847}
5848
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005849#if IS_ENABLED(CONFIG_IPV6)
Eric W. Biederman06198b32015-09-18 14:33:06 -05005850static unsigned int selinux_ipv6_postroute(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005851 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005852 const struct nf_hook_state *state)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005853{
David S. Miller238e54c2015-04-03 20:32:56 -04005854 return selinux_ip_postroute(skb, state->out, PF_INET6);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005855}
Linus Torvalds1da177e2005-04-16 15:20:36 -07005856#endif /* IPV6 */
5857
5858#endif /* CONFIG_NETFILTER */
5859
Linus Torvalds1da177e2005-04-16 15:20:36 -07005860static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5861{
Stephen Smalley941fc5b2009-10-01 14:48:23 -04005862 return selinux_nlmsg_perm(sk, skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005863}
5864
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005865static int ipc_alloc_security(struct kern_ipc_perm *perm,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005866 u16 sclass)
5867{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005868 struct ipc_security_struct *isec;
5869
James Morris89d155e2005-10-30 14:59:21 -08005870 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005871 if (!isec)
5872 return -ENOMEM;
5873
Linus Torvalds1da177e2005-04-16 15:20:36 -07005874 isec->sclass = sclass;
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005875 isec->sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005876 perm->security = isec;
5877
5878 return 0;
5879}
5880
5881static void ipc_free_security(struct kern_ipc_perm *perm)
5882{
5883 struct ipc_security_struct *isec = perm->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005884 perm->security = NULL;
5885 kfree(isec);
5886}
5887
5888static int msg_msg_alloc_security(struct msg_msg *msg)
5889{
5890 struct msg_security_struct *msec;
5891
James Morris89d155e2005-10-30 14:59:21 -08005892 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005893 if (!msec)
5894 return -ENOMEM;
5895
Linus Torvalds1da177e2005-04-16 15:20:36 -07005896 msec->sid = SECINITSID_UNLABELED;
5897 msg->security = msec;
5898
5899 return 0;
5900}
5901
5902static void msg_msg_free_security(struct msg_msg *msg)
5903{
5904 struct msg_security_struct *msec = msg->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005905
5906 msg->security = NULL;
5907 kfree(msec);
5908}
5909
5910static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
Stephen Smalley6af963f2005-05-01 08:58:39 -07005911 u32 perms)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005912{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005913 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005914 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005915 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005916
Linus Torvalds1da177e2005-04-16 15:20:36 -07005917 isec = ipc_perms->security;
5918
Eric Paris50c205f2012-04-04 15:01:43 -04005919 ad.type = LSM_AUDIT_DATA_IPC;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005920 ad.u.ipc_id = ipc_perms->key;
5921
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005922 return avc_has_perm(&selinux_state,
5923 sid, isec->sid, isec->sclass, perms, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005924}
5925
5926static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5927{
5928 return msg_msg_alloc_security(msg);
5929}
5930
5931static void selinux_msg_msg_free_security(struct msg_msg *msg)
5932{
5933 msg_msg_free_security(msg);
5934}
5935
5936/* message queue security operations */
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005937static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005938{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005939 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005940 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005941 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005942 int rc;
5943
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005944 rc = ipc_alloc_security(msq, SECCLASS_MSGQ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005945 if (rc)
5946 return rc;
5947
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005948 isec = msq->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005949
Eric Paris50c205f2012-04-04 15:01:43 -04005950 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005951 ad.u.ipc_id = msq->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005952
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005953 rc = avc_has_perm(&selinux_state,
5954 sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005955 MSGQ__CREATE, &ad);
5956 if (rc) {
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005957 ipc_free_security(msq);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005958 return rc;
5959 }
5960 return 0;
5961}
5962
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005963static void selinux_msg_queue_free_security(struct kern_ipc_perm *msq)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005964{
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005965 ipc_free_security(msq);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005966}
5967
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005968static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005969{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005970 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005971 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005972 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005973
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005974 isec = msq->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005975
Eric Paris50c205f2012-04-04 15:01:43 -04005976 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005977 ad.u.ipc_id = msq->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005978
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005979 return avc_has_perm(&selinux_state,
5980 sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005981 MSGQ__ASSOCIATE, &ad);
5982}
5983
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005984static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005985{
5986 int err;
5987 int perms;
5988
Eric Paris828dfe12008-04-17 13:17:49 -04005989 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005990 case IPC_INFO:
5991 case MSG_INFO:
5992 /* No specific object, just general system-wide information. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005993 return avc_has_perm(&selinux_state,
5994 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005995 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005996 case IPC_STAT:
5997 case MSG_STAT:
Davidlohr Bueso23c8cec2018-04-10 16:35:30 -07005998 case MSG_STAT_ANY:
Linus Torvalds1da177e2005-04-16 15:20:36 -07005999 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
6000 break;
6001 case IPC_SET:
6002 perms = MSGQ__SETATTR;
6003 break;
6004 case IPC_RMID:
6005 perms = MSGQ__DESTROY;
6006 break;
6007 default:
6008 return 0;
6009 }
6010
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006011 err = ipc_has_perm(msq, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006012 return err;
6013}
6014
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006015static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006016{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006017 struct ipc_security_struct *isec;
6018 struct msg_security_struct *msec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006019 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006020 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006021 int rc;
6022
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006023 isec = msq->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006024 msec = msg->security;
6025
6026 /*
6027 * First time through, need to assign label to the message
6028 */
6029 if (msec->sid == SECINITSID_UNLABELED) {
6030 /*
6031 * Compute new sid based on current process and
6032 * message queue this message will be stored in
6033 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006034 rc = security_transition_sid(&selinux_state, sid, isec->sid,
6035 SECCLASS_MSG, NULL, &msec->sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006036 if (rc)
6037 return rc;
6038 }
6039
Eric Paris50c205f2012-04-04 15:01:43 -04006040 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006041 ad.u.ipc_id = msq->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006042
6043 /* Can this process write to the queue? */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006044 rc = avc_has_perm(&selinux_state,
6045 sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006046 MSGQ__WRITE, &ad);
6047 if (!rc)
6048 /* Can this process send the message */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006049 rc = avc_has_perm(&selinux_state,
6050 sid, msec->sid, SECCLASS_MSG,
David Howells275bb412008-11-14 10:39:19 +11006051 MSG__SEND, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006052 if (!rc)
6053 /* Can the message be put in the queue? */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006054 rc = avc_has_perm(&selinux_state,
6055 msec->sid, isec->sid, SECCLASS_MSGQ,
David Howells275bb412008-11-14 10:39:19 +11006056 MSGQ__ENQUEUE, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006057
6058 return rc;
6059}
6060
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006061static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006062 struct task_struct *target,
6063 long type, int mode)
6064{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006065 struct ipc_security_struct *isec;
6066 struct msg_security_struct *msec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006067 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006068 u32 sid = task_sid(target);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006069 int rc;
6070
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006071 isec = msq->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006072 msec = msg->security;
6073
Eric Paris50c205f2012-04-04 15:01:43 -04006074 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006075 ad.u.ipc_id = msq->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006076
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006077 rc = avc_has_perm(&selinux_state,
6078 sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006079 SECCLASS_MSGQ, MSGQ__READ, &ad);
6080 if (!rc)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006081 rc = avc_has_perm(&selinux_state,
6082 sid, msec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006083 SECCLASS_MSG, MSG__RECEIVE, &ad);
6084 return rc;
6085}
6086
6087/* Shared Memory security operations */
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006088static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006089{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006090 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006091 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006092 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006093 int rc;
6094
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006095 rc = ipc_alloc_security(shp, SECCLASS_SHM);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006096 if (rc)
6097 return rc;
6098
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006099 isec = shp->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006100
Eric Paris50c205f2012-04-04 15:01:43 -04006101 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006102 ad.u.ipc_id = shp->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006103
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006104 rc = avc_has_perm(&selinux_state,
6105 sid, isec->sid, SECCLASS_SHM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006106 SHM__CREATE, &ad);
6107 if (rc) {
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006108 ipc_free_security(shp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006109 return rc;
6110 }
6111 return 0;
6112}
6113
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006114static void selinux_shm_free_security(struct kern_ipc_perm *shp)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006115{
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006116 ipc_free_security(shp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006117}
6118
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006119static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006120{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006121 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006122 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006123 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006124
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006125 isec = shp->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006126
Eric Paris50c205f2012-04-04 15:01:43 -04006127 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006128 ad.u.ipc_id = shp->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006129
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006130 return avc_has_perm(&selinux_state,
6131 sid, isec->sid, SECCLASS_SHM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006132 SHM__ASSOCIATE, &ad);
6133}
6134
6135/* Note, at this point, shp is locked down */
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006136static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006137{
6138 int perms;
6139 int err;
6140
Eric Paris828dfe12008-04-17 13:17:49 -04006141 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006142 case IPC_INFO:
6143 case SHM_INFO:
6144 /* No specific object, just general system-wide information. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006145 return avc_has_perm(&selinux_state,
6146 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006147 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006148 case IPC_STAT:
6149 case SHM_STAT:
Davidlohr Buesoc21a6972018-04-10 16:35:23 -07006150 case SHM_STAT_ANY:
Linus Torvalds1da177e2005-04-16 15:20:36 -07006151 perms = SHM__GETATTR | SHM__ASSOCIATE;
6152 break;
6153 case IPC_SET:
6154 perms = SHM__SETATTR;
6155 break;
6156 case SHM_LOCK:
6157 case SHM_UNLOCK:
6158 perms = SHM__LOCK;
6159 break;
6160 case IPC_RMID:
6161 perms = SHM__DESTROY;
6162 break;
6163 default:
6164 return 0;
6165 }
6166
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006167 err = ipc_has_perm(shp, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006168 return err;
6169}
6170
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006171static int selinux_shm_shmat(struct kern_ipc_perm *shp,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006172 char __user *shmaddr, int shmflg)
6173{
6174 u32 perms;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006175
6176 if (shmflg & SHM_RDONLY)
6177 perms = SHM__READ;
6178 else
6179 perms = SHM__READ | SHM__WRITE;
6180
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006181 return ipc_has_perm(shp, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006182}
6183
6184/* Semaphore security operations */
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006185static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006186{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006187 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006188 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006189 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006190 int rc;
6191
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006192 rc = ipc_alloc_security(sma, SECCLASS_SEM);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006193 if (rc)
6194 return rc;
6195
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006196 isec = sma->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006197
Eric Paris50c205f2012-04-04 15:01:43 -04006198 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006199 ad.u.ipc_id = sma->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006200
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006201 rc = avc_has_perm(&selinux_state,
6202 sid, isec->sid, SECCLASS_SEM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006203 SEM__CREATE, &ad);
6204 if (rc) {
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006205 ipc_free_security(sma);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006206 return rc;
6207 }
6208 return 0;
6209}
6210
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006211static void selinux_sem_free_security(struct kern_ipc_perm *sma)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006212{
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006213 ipc_free_security(sma);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006214}
6215
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006216static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006217{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006218 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006219 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006220 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006221
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006222 isec = sma->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006223
Eric Paris50c205f2012-04-04 15:01:43 -04006224 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006225 ad.u.ipc_id = sma->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006226
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006227 return avc_has_perm(&selinux_state,
6228 sid, isec->sid, SECCLASS_SEM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006229 SEM__ASSOCIATE, &ad);
6230}
6231
6232/* Note, at this point, sma is locked down */
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006233static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006234{
6235 int err;
6236 u32 perms;
6237
Eric Paris828dfe12008-04-17 13:17:49 -04006238 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006239 case IPC_INFO:
6240 case SEM_INFO:
6241 /* No specific object, just general system-wide information. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006242 return avc_has_perm(&selinux_state,
6243 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006244 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006245 case GETPID:
6246 case GETNCNT:
6247 case GETZCNT:
6248 perms = SEM__GETATTR;
6249 break;
6250 case GETVAL:
6251 case GETALL:
6252 perms = SEM__READ;
6253 break;
6254 case SETVAL:
6255 case SETALL:
6256 perms = SEM__WRITE;
6257 break;
6258 case IPC_RMID:
6259 perms = SEM__DESTROY;
6260 break;
6261 case IPC_SET:
6262 perms = SEM__SETATTR;
6263 break;
6264 case IPC_STAT:
6265 case SEM_STAT:
Davidlohr Buesoa280d6d2018-04-10 16:35:26 -07006266 case SEM_STAT_ANY:
Linus Torvalds1da177e2005-04-16 15:20:36 -07006267 perms = SEM__GETATTR | SEM__ASSOCIATE;
6268 break;
6269 default:
6270 return 0;
6271 }
6272
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006273 err = ipc_has_perm(sma, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006274 return err;
6275}
6276
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006277static int selinux_sem_semop(struct kern_ipc_perm *sma,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006278 struct sembuf *sops, unsigned nsops, int alter)
6279{
6280 u32 perms;
6281
6282 if (alter)
6283 perms = SEM__READ | SEM__WRITE;
6284 else
6285 perms = SEM__READ;
6286
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006287 return ipc_has_perm(sma, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006288}
6289
6290static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6291{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006292 u32 av = 0;
6293
Linus Torvalds1da177e2005-04-16 15:20:36 -07006294 av = 0;
6295 if (flag & S_IRUGO)
6296 av |= IPC__UNIX_READ;
6297 if (flag & S_IWUGO)
6298 av |= IPC__UNIX_WRITE;
6299
6300 if (av == 0)
6301 return 0;
6302
Stephen Smalley6af963f2005-05-01 08:58:39 -07006303 return ipc_has_perm(ipcp, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006304}
6305
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02006306static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6307{
6308 struct ipc_security_struct *isec = ipcp->security;
6309 *secid = isec->sid;
6310}
6311
Eric Paris828dfe12008-04-17 13:17:49 -04006312static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006313{
6314 if (inode)
6315 inode_doinit_with_dentry(inode, dentry);
6316}
6317
6318static int selinux_getprocattr(struct task_struct *p,
Al Viro04ff9702007-03-12 16:17:58 +00006319 char *name, char **value)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006320{
David Howells275bb412008-11-14 10:39:19 +11006321 const struct task_security_struct *__tsec;
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00006322 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006323 int error;
Al Viro04ff9702007-03-12 16:17:58 +00006324 unsigned len;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006325
David Howells275bb412008-11-14 10:39:19 +11006326 rcu_read_lock();
6327 __tsec = __task_cred(p)->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006328
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006329 if (current != p) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006330 error = avc_has_perm(&selinux_state,
6331 current_sid(), __tsec->sid,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006332 SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6333 if (error)
6334 goto bad;
6335 }
6336
Linus Torvalds1da177e2005-04-16 15:20:36 -07006337 if (!strcmp(name, "current"))
David Howells275bb412008-11-14 10:39:19 +11006338 sid = __tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006339 else if (!strcmp(name, "prev"))
David Howells275bb412008-11-14 10:39:19 +11006340 sid = __tsec->osid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006341 else if (!strcmp(name, "exec"))
David Howells275bb412008-11-14 10:39:19 +11006342 sid = __tsec->exec_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006343 else if (!strcmp(name, "fscreate"))
David Howells275bb412008-11-14 10:39:19 +11006344 sid = __tsec->create_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07006345 else if (!strcmp(name, "keycreate"))
David Howells275bb412008-11-14 10:39:19 +11006346 sid = __tsec->keycreate_sid;
Eric Paris42c3e032006-06-26 00:26:03 -07006347 else if (!strcmp(name, "sockcreate"))
David Howells275bb412008-11-14 10:39:19 +11006348 sid = __tsec->sockcreate_sid;
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006349 else {
6350 error = -EINVAL;
6351 goto bad;
6352 }
David Howells275bb412008-11-14 10:39:19 +11006353 rcu_read_unlock();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006354
6355 if (!sid)
6356 return 0;
6357
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006358 error = security_sid_to_context(&selinux_state, sid, value, &len);
Al Viro04ff9702007-03-12 16:17:58 +00006359 if (error)
6360 return error;
6361 return len;
David Howells275bb412008-11-14 10:39:19 +11006362
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006363bad:
David Howells275bb412008-11-14 10:39:19 +11006364 rcu_read_unlock();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006365 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006366}
6367
Stephen Smalleyb21507e2017-01-09 10:07:31 -05006368static int selinux_setprocattr(const char *name, void *value, size_t size)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006369{
6370 struct task_security_struct *tsec;
David Howellsd84f4f92008-11-14 10:39:23 +11006371 struct cred *new;
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006372 u32 mysid = current_sid(), sid = 0, ptsid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006373 int error;
6374 char *str = value;
6375
Linus Torvalds1da177e2005-04-16 15:20:36 -07006376 /*
6377 * Basic control over ability to set these attributes at all.
Linus Torvalds1da177e2005-04-16 15:20:36 -07006378 */
6379 if (!strcmp(name, "exec"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006380 error = avc_has_perm(&selinux_state,
6381 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006382 PROCESS__SETEXEC, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006383 else if (!strcmp(name, "fscreate"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006384 error = avc_has_perm(&selinux_state,
6385 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006386 PROCESS__SETFSCREATE, NULL);
Michael LeMay4eb582c2006-06-26 00:24:57 -07006387 else if (!strcmp(name, "keycreate"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006388 error = avc_has_perm(&selinux_state,
6389 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006390 PROCESS__SETKEYCREATE, NULL);
Eric Paris42c3e032006-06-26 00:26:03 -07006391 else if (!strcmp(name, "sockcreate"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006392 error = avc_has_perm(&selinux_state,
6393 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006394 PROCESS__SETSOCKCREATE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006395 else if (!strcmp(name, "current"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006396 error = avc_has_perm(&selinux_state,
6397 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006398 PROCESS__SETCURRENT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006399 else
6400 error = -EINVAL;
6401 if (error)
6402 return error;
6403
6404 /* Obtain a SID for the context, if one was specified. */
Stephen Smalleya050a572017-01-31 11:54:04 -05006405 if (size && str[0] && str[0] != '\n') {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006406 if (str[size-1] == '\n') {
6407 str[size-1] = 0;
6408 size--;
6409 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006410 error = security_context_to_sid(&selinux_state, value, size,
6411 &sid, GFP_KERNEL);
Stephen Smalley12b29f32008-05-07 13:03:20 -04006412 if (error == -EINVAL && !strcmp(name, "fscreate")) {
Stephen Smalleydb590002017-04-20 11:31:30 -04006413 if (!has_cap_mac_admin(true)) {
Eric Parisd6ea83e2012-04-04 13:45:49 -04006414 struct audit_buffer *ab;
6415 size_t audit_size;
6416
6417 /* We strip a nul only if it is at the end, otherwise the
6418 * context contains a nul and we should audit that */
6419 if (str[size - 1] == '\0')
6420 audit_size = size - 1;
6421 else
6422 audit_size = size;
Richard Guy Briggscdfb6b32018-05-12 21:58:20 -04006423 ab = audit_log_start(audit_context(),
6424 GFP_ATOMIC,
6425 AUDIT_SELINUX_ERR);
Eric Parisd6ea83e2012-04-04 13:45:49 -04006426 audit_log_format(ab, "op=fscreate invalid_context=");
6427 audit_log_n_untrustedstring(ab, value, audit_size);
6428 audit_log_end(ab);
6429
Stephen Smalley12b29f32008-05-07 13:03:20 -04006430 return error;
Eric Parisd6ea83e2012-04-04 13:45:49 -04006431 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006432 error = security_context_to_sid_force(
6433 &selinux_state,
6434 value, size, &sid);
Stephen Smalley12b29f32008-05-07 13:03:20 -04006435 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07006436 if (error)
6437 return error;
6438 }
6439
David Howellsd84f4f92008-11-14 10:39:23 +11006440 new = prepare_creds();
6441 if (!new)
6442 return -ENOMEM;
6443
Linus Torvalds1da177e2005-04-16 15:20:36 -07006444 /* Permission checking based on the specified context is
6445 performed during the actual operation (execve,
6446 open/mkdir/...), when we know the full context of the
David Howellsd84f4f92008-11-14 10:39:23 +11006447 operation. See selinux_bprm_set_creds for the execve
Linus Torvalds1da177e2005-04-16 15:20:36 -07006448 checks and may_create for the file creation checks. The
6449 operation will then fail if the context is not permitted. */
David Howellsd84f4f92008-11-14 10:39:23 +11006450 tsec = new->security;
6451 if (!strcmp(name, "exec")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006452 tsec->exec_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006453 } else if (!strcmp(name, "fscreate")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006454 tsec->create_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006455 } else if (!strcmp(name, "keycreate")) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006456 error = avc_has_perm(&selinux_state,
6457 mysid, sid, SECCLASS_KEY, KEY__CREATE,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006458 NULL);
Michael LeMay4eb582c2006-06-26 00:24:57 -07006459 if (error)
David Howellsd84f4f92008-11-14 10:39:23 +11006460 goto abort_change;
Michael LeMay4eb582c2006-06-26 00:24:57 -07006461 tsec->keycreate_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006462 } else if (!strcmp(name, "sockcreate")) {
Eric Paris42c3e032006-06-26 00:26:03 -07006463 tsec->sockcreate_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006464 } else if (!strcmp(name, "current")) {
6465 error = -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006466 if (sid == 0)
David Howellsd84f4f92008-11-14 10:39:23 +11006467 goto abort_change;
KaiGai Koheid9250de2008-08-28 16:35:57 +09006468
David Howellsd84f4f92008-11-14 10:39:23 +11006469 /* Only allow single threaded processes to change context */
6470 error = -EPERM;
Oleg Nesterov5bb459b2009-07-10 03:48:23 +02006471 if (!current_is_single_threaded()) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006472 error = security_bounded_transition(&selinux_state,
6473 tsec->sid, sid);
David Howellsd84f4f92008-11-14 10:39:23 +11006474 if (error)
6475 goto abort_change;
Eric Paris828dfe12008-04-17 13:17:49 -04006476 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07006477
6478 /* Check permissions for the transition. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006479 error = avc_has_perm(&selinux_state,
6480 tsec->sid, sid, SECCLASS_PROCESS,
Eric Paris828dfe12008-04-17 13:17:49 -04006481 PROCESS__DYNTRANSITION, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006482 if (error)
David Howellsd84f4f92008-11-14 10:39:23 +11006483 goto abort_change;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006484
6485 /* Check for ptracing, and update the task SID if ok.
6486 Otherwise, leave SID unchanged and fail. */
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006487 ptsid = ptrace_parent_sid();
Paul Moore0c6181c2016-03-30 21:41:21 -04006488 if (ptsid != 0) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006489 error = avc_has_perm(&selinux_state,
6490 ptsid, sid, SECCLASS_PROCESS,
David Howellsd84f4f92008-11-14 10:39:23 +11006491 PROCESS__PTRACE, NULL);
6492 if (error)
6493 goto abort_change;
6494 }
6495
6496 tsec->sid = sid;
6497 } else {
6498 error = -EINVAL;
6499 goto abort_change;
6500 }
6501
6502 commit_creds(new);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006503 return size;
David Howellsd84f4f92008-11-14 10:39:23 +11006504
6505abort_change:
6506 abort_creds(new);
6507 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006508}
6509
David Quigley746df9b2013-05-22 12:50:35 -04006510static int selinux_ismaclabel(const char *name)
6511{
6512 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6513}
6514
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006515static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6516{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006517 return security_sid_to_context(&selinux_state, secid,
6518 secdata, seclen);
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006519}
6520
David Howells7bf570d2008-04-29 20:52:51 +01006521static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
David Howells63cb3442008-01-15 23:47:35 +00006522{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006523 return security_context_to_sid(&selinux_state, secdata, seclen,
6524 secid, GFP_KERNEL);
David Howells63cb3442008-01-15 23:47:35 +00006525}
6526
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006527static void selinux_release_secctx(char *secdata, u32 seclen)
6528{
Paul Moore088999e2007-08-01 11:12:58 -04006529 kfree(secdata);
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006530}
6531
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006532static void selinux_inode_invalidate_secctx(struct inode *inode)
6533{
6534 struct inode_security_struct *isec = inode->i_security;
6535
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01006536 spin_lock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006537 isec->initialized = LABEL_INVALID;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01006538 spin_unlock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006539}
6540
David P. Quigley1ee65e32009-09-03 14:25:57 -04006541/*
6542 * called with inode->i_mutex locked
6543 */
6544static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6545{
6546 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
6547}
6548
6549/*
6550 * called with inode->i_mutex locked
6551 */
6552static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6553{
6554 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6555}
6556
6557static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6558{
6559 int len = 0;
6560 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6561 ctx, true);
6562 if (len < 0)
6563 return len;
6564 *ctxlen = len;
6565 return 0;
6566}
Michael LeMayd7200242006-06-22 14:47:17 -07006567#ifdef CONFIG_KEYS
6568
David Howellsd84f4f92008-11-14 10:39:23 +11006569static int selinux_key_alloc(struct key *k, const struct cred *cred,
David Howells7e047ef2006-06-26 00:24:50 -07006570 unsigned long flags)
Michael LeMayd7200242006-06-22 14:47:17 -07006571{
David Howellsd84f4f92008-11-14 10:39:23 +11006572 const struct task_security_struct *tsec;
Michael LeMayd7200242006-06-22 14:47:17 -07006573 struct key_security_struct *ksec;
6574
6575 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6576 if (!ksec)
6577 return -ENOMEM;
6578
David Howellsd84f4f92008-11-14 10:39:23 +11006579 tsec = cred->security;
6580 if (tsec->keycreate_sid)
6581 ksec->sid = tsec->keycreate_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07006582 else
David Howellsd84f4f92008-11-14 10:39:23 +11006583 ksec->sid = tsec->sid;
Michael LeMayd7200242006-06-22 14:47:17 -07006584
David Howells275bb412008-11-14 10:39:19 +11006585 k->security = ksec;
Michael LeMayd7200242006-06-22 14:47:17 -07006586 return 0;
6587}
6588
6589static void selinux_key_free(struct key *k)
6590{
6591 struct key_security_struct *ksec = k->security;
6592
6593 k->security = NULL;
6594 kfree(ksec);
6595}
6596
6597static int selinux_key_permission(key_ref_t key_ref,
David Howellsd84f4f92008-11-14 10:39:23 +11006598 const struct cred *cred,
David Howellsf5895942014-03-14 17:44:49 +00006599 unsigned perm)
Michael LeMayd7200242006-06-22 14:47:17 -07006600{
6601 struct key *key;
Michael LeMayd7200242006-06-22 14:47:17 -07006602 struct key_security_struct *ksec;
David Howells275bb412008-11-14 10:39:19 +11006603 u32 sid;
Michael LeMayd7200242006-06-22 14:47:17 -07006604
6605 /* if no specific permissions are requested, we skip the
6606 permission check. No serious, additional covert channels
6607 appear to be created. */
6608 if (perm == 0)
6609 return 0;
6610
David Howellsd84f4f92008-11-14 10:39:23 +11006611 sid = cred_sid(cred);
David Howells275bb412008-11-14 10:39:19 +11006612
6613 key = key_ref_to_ptr(key_ref);
6614 ksec = key->security;
6615
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006616 return avc_has_perm(&selinux_state,
6617 sid, ksec->sid, SECCLASS_KEY, perm, NULL);
Michael LeMayd7200242006-06-22 14:47:17 -07006618}
6619
David Howells70a5bb72008-04-29 01:01:26 -07006620static int selinux_key_getsecurity(struct key *key, char **_buffer)
6621{
6622 struct key_security_struct *ksec = key->security;
6623 char *context = NULL;
6624 unsigned len;
6625 int rc;
6626
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006627 rc = security_sid_to_context(&selinux_state, ksec->sid,
6628 &context, &len);
David Howells70a5bb72008-04-29 01:01:26 -07006629 if (!rc)
6630 rc = len;
6631 *_buffer = context;
6632 return rc;
6633}
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03006634#endif
David Howells70a5bb72008-04-29 01:01:26 -07006635
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03006636#ifdef CONFIG_SECURITY_INFINIBAND
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03006637static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6638{
6639 struct common_audit_data ad;
6640 int err;
6641 u32 sid = 0;
6642 struct ib_security_struct *sec = ib_sec;
6643 struct lsm_ibpkey_audit ibpkey;
6644
Daniel Jurgens409dcf32017-05-19 15:48:59 +03006645 err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03006646 if (err)
6647 return err;
6648
6649 ad.type = LSM_AUDIT_DATA_IBPKEY;
6650 ibpkey.subnet_prefix = subnet_prefix;
6651 ibpkey.pkey = pkey_val;
6652 ad.u.ibpkey = &ibpkey;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006653 return avc_has_perm(&selinux_state,
6654 sec->sid, sid,
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03006655 SECCLASS_INFINIBAND_PKEY,
6656 INFINIBAND_PKEY__ACCESS, &ad);
6657}
6658
Daniel Jurgensab861df2017-05-19 15:48:58 +03006659static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6660 u8 port_num)
6661{
6662 struct common_audit_data ad;
6663 int err;
6664 u32 sid = 0;
6665 struct ib_security_struct *sec = ib_sec;
6666 struct lsm_ibendport_audit ibendport;
6667
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006668 err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6669 &sid);
Daniel Jurgensab861df2017-05-19 15:48:58 +03006670
6671 if (err)
6672 return err;
6673
6674 ad.type = LSM_AUDIT_DATA_IBENDPORT;
6675 strncpy(ibendport.dev_name, dev_name, sizeof(ibendport.dev_name));
6676 ibendport.port = port_num;
6677 ad.u.ibendport = &ibendport;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006678 return avc_has_perm(&selinux_state,
6679 sec->sid, sid,
Daniel Jurgensab861df2017-05-19 15:48:58 +03006680 SECCLASS_INFINIBAND_ENDPORT,
6681 INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6682}
6683
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03006684static int selinux_ib_alloc_security(void **ib_sec)
6685{
6686 struct ib_security_struct *sec;
6687
6688 sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6689 if (!sec)
6690 return -ENOMEM;
6691 sec->sid = current_sid();
6692
6693 *ib_sec = sec;
6694 return 0;
6695}
6696
6697static void selinux_ib_free_security(void *ib_sec)
6698{
6699 kfree(ib_sec);
6700}
Michael LeMayd7200242006-06-22 14:47:17 -07006701#endif
6702
Chenbo Fengec27c352017-10-18 13:00:25 -07006703#ifdef CONFIG_BPF_SYSCALL
6704static int selinux_bpf(int cmd, union bpf_attr *attr,
6705 unsigned int size)
6706{
6707 u32 sid = current_sid();
6708 int ret;
6709
6710 switch (cmd) {
6711 case BPF_MAP_CREATE:
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006712 ret = avc_has_perm(&selinux_state,
6713 sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
Chenbo Fengec27c352017-10-18 13:00:25 -07006714 NULL);
6715 break;
6716 case BPF_PROG_LOAD:
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006717 ret = avc_has_perm(&selinux_state,
6718 sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
Chenbo Fengec27c352017-10-18 13:00:25 -07006719 NULL);
6720 break;
6721 default:
6722 ret = 0;
6723 break;
6724 }
6725
6726 return ret;
6727}
6728
6729static u32 bpf_map_fmode_to_av(fmode_t fmode)
6730{
6731 u32 av = 0;
6732
6733 if (fmode & FMODE_READ)
6734 av |= BPF__MAP_READ;
6735 if (fmode & FMODE_WRITE)
6736 av |= BPF__MAP_WRITE;
6737 return av;
6738}
6739
Chenbo Fengf66e4482017-10-18 13:00:26 -07006740/* This function will check the file pass through unix socket or binder to see
6741 * if it is a bpf related object. And apply correspinding checks on the bpf
6742 * object based on the type. The bpf maps and programs, not like other files and
6743 * socket, are using a shared anonymous inode inside the kernel as their inode.
6744 * So checking that inode cannot identify if the process have privilege to
6745 * access the bpf object and that's why we have to add this additional check in
6746 * selinux_file_receive and selinux_binder_transfer_files.
6747 */
6748static int bpf_fd_pass(struct file *file, u32 sid)
6749{
6750 struct bpf_security_struct *bpfsec;
6751 struct bpf_prog *prog;
6752 struct bpf_map *map;
6753 int ret;
6754
6755 if (file->f_op == &bpf_map_fops) {
6756 map = file->private_data;
6757 bpfsec = map->security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006758 ret = avc_has_perm(&selinux_state,
6759 sid, bpfsec->sid, SECCLASS_BPF,
Chenbo Fengf66e4482017-10-18 13:00:26 -07006760 bpf_map_fmode_to_av(file->f_mode), NULL);
6761 if (ret)
6762 return ret;
6763 } else if (file->f_op == &bpf_prog_fops) {
6764 prog = file->private_data;
6765 bpfsec = prog->aux->security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006766 ret = avc_has_perm(&selinux_state,
6767 sid, bpfsec->sid, SECCLASS_BPF,
Chenbo Fengf66e4482017-10-18 13:00:26 -07006768 BPF__PROG_RUN, NULL);
6769 if (ret)
6770 return ret;
6771 }
6772 return 0;
6773}
6774
Chenbo Fengec27c352017-10-18 13:00:25 -07006775static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6776{
6777 u32 sid = current_sid();
6778 struct bpf_security_struct *bpfsec;
6779
6780 bpfsec = map->security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006781 return avc_has_perm(&selinux_state,
6782 sid, bpfsec->sid, SECCLASS_BPF,
Chenbo Fengec27c352017-10-18 13:00:25 -07006783 bpf_map_fmode_to_av(fmode), NULL);
6784}
6785
6786static int selinux_bpf_prog(struct bpf_prog *prog)
6787{
6788 u32 sid = current_sid();
6789 struct bpf_security_struct *bpfsec;
6790
6791 bpfsec = prog->aux->security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006792 return avc_has_perm(&selinux_state,
6793 sid, bpfsec->sid, SECCLASS_BPF,
Chenbo Fengec27c352017-10-18 13:00:25 -07006794 BPF__PROG_RUN, NULL);
6795}
6796
6797static int selinux_bpf_map_alloc(struct bpf_map *map)
6798{
6799 struct bpf_security_struct *bpfsec;
6800
6801 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6802 if (!bpfsec)
6803 return -ENOMEM;
6804
6805 bpfsec->sid = current_sid();
6806 map->security = bpfsec;
6807
6808 return 0;
6809}
6810
6811static void selinux_bpf_map_free(struct bpf_map *map)
6812{
6813 struct bpf_security_struct *bpfsec = map->security;
6814
6815 map->security = NULL;
6816 kfree(bpfsec);
6817}
6818
6819static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6820{
6821 struct bpf_security_struct *bpfsec;
6822
6823 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6824 if (!bpfsec)
6825 return -ENOMEM;
6826
6827 bpfsec->sid = current_sid();
6828 aux->security = bpfsec;
6829
6830 return 0;
6831}
6832
6833static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
6834{
6835 struct bpf_security_struct *bpfsec = aux->security;
6836
6837 aux->security = NULL;
6838 kfree(bpfsec);
6839}
6840#endif
6841
James Morrisca97d932017-02-15 00:18:51 +11006842static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
Casey Schauflere20b0432015-05-02 15:11:36 -07006843 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6844 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6845 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6846 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02006847
Casey Schauflere20b0432015-05-02 15:11:36 -07006848 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6849 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6850 LSM_HOOK_INIT(capget, selinux_capget),
6851 LSM_HOOK_INIT(capset, selinux_capset),
6852 LSM_HOOK_INIT(capable, selinux_capable),
6853 LSM_HOOK_INIT(quotactl, selinux_quotactl),
6854 LSM_HOOK_INIT(quota_on, selinux_quota_on),
6855 LSM_HOOK_INIT(syslog, selinux_syslog),
6856 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
Stephen Smalley79af7302015-01-21 10:54:10 -05006857
Casey Schauflere20b0432015-05-02 15:11:36 -07006858 LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006859
Casey Schauflere20b0432015-05-02 15:11:36 -07006860 LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6861 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6862 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006863
Casey Schauflere20b0432015-05-02 15:11:36 -07006864 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6865 LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6866 LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
6867 LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6868 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6869 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6870 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6871 LSM_HOOK_INIT(sb_mount, selinux_mount),
6872 LSM_HOOK_INIT(sb_umount, selinux_umount),
6873 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6874 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6875 LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006876
Casey Schauflere20b0432015-05-02 15:11:36 -07006877 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
Vivek Goyala518b0a2016-07-13 10:44:53 -04006878 LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
Eric Parise0007522008-03-05 10:31:54 -05006879
Casey Schauflere20b0432015-05-02 15:11:36 -07006880 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6881 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6882 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6883 LSM_HOOK_INIT(inode_create, selinux_inode_create),
6884 LSM_HOOK_INIT(inode_link, selinux_inode_link),
6885 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6886 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6887 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6888 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6889 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6890 LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6891 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6892 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6893 LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6894 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6895 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6896 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6897 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6898 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6899 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6900 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6901 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6902 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6903 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6904 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
Vivek Goyal56909eb2016-07-13 10:44:48 -04006905 LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
Vivek Goyal19472b62016-07-13 10:44:50 -04006906 LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006907
Casey Schauflere20b0432015-05-02 15:11:36 -07006908 LSM_HOOK_INIT(file_permission, selinux_file_permission),
6909 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6910 LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
6911 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6912 LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6913 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6914 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6915 LSM_HOOK_INIT(file_lock, selinux_file_lock),
6916 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6917 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6918 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6919 LSM_HOOK_INIT(file_receive, selinux_file_receive),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006920
Casey Schauflere20b0432015-05-02 15:11:36 -07006921 LSM_HOOK_INIT(file_open, selinux_file_open),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006922
Tetsuo Handaa79be232017-03-28 23:08:45 +09006923 LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
Casey Schauflere20b0432015-05-02 15:11:36 -07006924 LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
6925 LSM_HOOK_INIT(cred_free, selinux_cred_free),
6926 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6927 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
Matthew Garrett3ec30112018-01-08 13:36:19 -08006928 LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
Casey Schauflere20b0432015-05-02 15:11:36 -07006929 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6930 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6931 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
Mimi Zoharc77b8cd2018-07-13 14:06:02 -04006932 LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07006933 LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
Casey Schauflere20b0432015-05-02 15:11:36 -07006934 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6935 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6936 LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6937 LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6938 LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6939 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6940 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
Stephen Smalley791ec492017-02-17 07:57:00 -05006941 LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
Casey Schauflere20b0432015-05-02 15:11:36 -07006942 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6943 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6944 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6945 LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6946 LSM_HOOK_INIT(task_kill, selinux_task_kill),
Casey Schauflere20b0432015-05-02 15:11:36 -07006947 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09006948
Casey Schauflere20b0432015-05-02 15:11:36 -07006949 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6950 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006951
Casey Schauflere20b0432015-05-02 15:11:36 -07006952 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6953 LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006954
Casey Schauflere20b0432015-05-02 15:11:36 -07006955 LSM_HOOK_INIT(msg_queue_alloc_security,
6956 selinux_msg_queue_alloc_security),
6957 LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6958 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6959 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6960 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6961 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006962
Casey Schauflere20b0432015-05-02 15:11:36 -07006963 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6964 LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6965 LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6966 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6967 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006968
Casey Schauflere20b0432015-05-02 15:11:36 -07006969 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6970 LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6971 LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6972 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6973 LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006974
Casey Schauflere20b0432015-05-02 15:11:36 -07006975 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006976
Casey Schauflere20b0432015-05-02 15:11:36 -07006977 LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6978 LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006979
Casey Schauflere20b0432015-05-02 15:11:36 -07006980 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6981 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6982 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6983 LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006984 LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
Casey Schauflere20b0432015-05-02 15:11:36 -07006985 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6986 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6987 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006988
Casey Schauflere20b0432015-05-02 15:11:36 -07006989 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6990 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006991
Casey Schauflere20b0432015-05-02 15:11:36 -07006992 LSM_HOOK_INIT(socket_create, selinux_socket_create),
6993 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
David Herrmann0b811db2018-05-04 16:28:21 +02006994 LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
Casey Schauflere20b0432015-05-02 15:11:36 -07006995 LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6996 LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6997 LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6998 LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6999 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
7000 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
7001 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
7002 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
7003 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
7004 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
7005 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
7006 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
7007 LSM_HOOK_INIT(socket_getpeersec_stream,
7008 selinux_socket_getpeersec_stream),
7009 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
7010 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
7011 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
7012 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
7013 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
7014 LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
Richard Hainesd4529302018-02-13 20:57:18 +00007015 LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
7016 LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
7017 LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
Casey Schauflere20b0432015-05-02 15:11:36 -07007018 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
7019 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
7020 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
7021 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
7022 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
7023 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
7024 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
7025 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
7026 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
7027 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
7028 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
7029 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
7030 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03007031#ifdef CONFIG_SECURITY_INFINIBAND
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03007032 LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
Daniel Jurgensab861df2017-05-19 15:48:58 +03007033 LSM_HOOK_INIT(ib_endport_manage_subnet,
7034 selinux_ib_endport_manage_subnet),
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03007035 LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
7036 LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
7037#endif
Trent Jaegerd28d1e02005-12-13 23:12:40 -08007038#ifdef CONFIG_SECURITY_NETWORK_XFRM
Casey Schauflere20b0432015-05-02 15:11:36 -07007039 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
7040 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
7041 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
7042 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
7043 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
7044 LSM_HOOK_INIT(xfrm_state_alloc_acquire,
7045 selinux_xfrm_state_alloc_acquire),
7046 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
7047 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
7048 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
7049 LSM_HOOK_INIT(xfrm_state_pol_flow_match,
7050 selinux_xfrm_state_pol_flow_match),
7051 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
Linus Torvalds1da177e2005-04-16 15:20:36 -07007052#endif
Michael LeMayd7200242006-06-22 14:47:17 -07007053
7054#ifdef CONFIG_KEYS
Casey Schauflere20b0432015-05-02 15:11:36 -07007055 LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
7056 LSM_HOOK_INIT(key_free, selinux_key_free),
7057 LSM_HOOK_INIT(key_permission, selinux_key_permission),
7058 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
Michael LeMayd7200242006-06-22 14:47:17 -07007059#endif
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +02007060
7061#ifdef CONFIG_AUDIT
Casey Schauflere20b0432015-05-02 15:11:36 -07007062 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
7063 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
7064 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
7065 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +02007066#endif
Chenbo Fengec27c352017-10-18 13:00:25 -07007067
7068#ifdef CONFIG_BPF_SYSCALL
7069 LSM_HOOK_INIT(bpf, selinux_bpf),
7070 LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
7071 LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
7072 LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
7073 LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
7074 LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
7075 LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
7076#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07007077};
7078
7079static __init int selinux_init(void)
7080{
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07007081 if (!security_module_enable("selinux")) {
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02007082 selinux_enabled = 0;
7083 return 0;
7084 }
7085
Linus Torvalds1da177e2005-04-16 15:20:36 -07007086 if (!selinux_enabled) {
peter enderborgc103a912018-06-12 10:09:03 +02007087 pr_info("SELinux: Disabled at boot.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07007088 return 0;
7089 }
7090
peter enderborgc103a912018-06-12 10:09:03 +02007091 pr_info("SELinux: Initializing.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07007092
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007093 memset(&selinux_state, 0, sizeof(selinux_state));
Paul Mooree5a5ca92018-03-01 17:38:30 -05007094 enforcing_set(&selinux_state, selinux_enforcing_boot);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007095 selinux_state.checkreqprot = selinux_checkreqprot_boot;
7096 selinux_ss_init(&selinux_state.ss);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05007097 selinux_avc_init(&selinux_state.avc);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007098
Linus Torvalds1da177e2005-04-16 15:20:36 -07007099 /* Set the security state for the initial task. */
David Howellsd84f4f92008-11-14 10:39:23 +11007100 cred_init_security();
Linus Torvalds1da177e2005-04-16 15:20:36 -07007101
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04007102 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
7103
James Morris7cae7e22006-03-22 00:09:22 -08007104 sel_inode_cache = kmem_cache_create("selinux_inode_security",
7105 sizeof(struct inode_security_struct),
Paul Mundt20c2df82007-07-20 10:11:58 +09007106 0, SLAB_PANIC, NULL);
Sangwoo63205652015-10-21 17:44:30 -04007107 file_security_cache = kmem_cache_create("selinux_file_security",
7108 sizeof(struct file_security_struct),
7109 0, SLAB_PANIC, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07007110 avc_init();
7111
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007112 avtab_cache_init();
7113
7114 ebitmap_cache_init();
7115
7116 hashtab_cache_init();
7117
Casey Schauflerd69dece52017-01-18 17:09:05 -08007118 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
Linus Torvalds1da177e2005-04-16 15:20:36 -07007119
Paul Moore615e51f2014-06-26 14:33:56 -04007120 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
7121 panic("SELinux: Unable to register AVC netcache callback\n");
7122
Daniel Jurgens8f408ab2017-05-19 15:48:53 +03007123 if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7124 panic("SELinux: Unable to register AVC LSM notifier callback\n");
7125
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007126 if (selinux_enforcing_boot)
peter enderborgc103a912018-06-12 10:09:03 +02007127 pr_debug("SELinux: Starting in enforcing mode\n");
Eric Paris828dfe12008-04-17 13:17:49 -04007128 else
peter enderborgc103a912018-06-12 10:09:03 +02007129 pr_debug("SELinux: Starting in permissive mode\n");
Michael LeMayd7200242006-06-22 14:47:17 -07007130
Linus Torvalds1da177e2005-04-16 15:20:36 -07007131 return 0;
7132}
7133
Al Viroe8c26252010-03-23 06:36:54 -04007134static void delayed_superblock_init(struct super_block *sb, void *unused)
7135{
Al Viro17f3b552018-11-10 23:46:07 -05007136 struct security_mnt_opts opts;
7137
7138 security_init_mnt_opts(&opts);
7139 selinux_set_mnt_opts(sb, &opts, 0, NULL);
7140 security_free_mnt_opts(&opts);
Al Viroe8c26252010-03-23 06:36:54 -04007141}
7142
Linus Torvalds1da177e2005-04-16 15:20:36 -07007143void selinux_complete_init(void)
7144{
peter enderborgc103a912018-06-12 10:09:03 +02007145 pr_debug("SELinux: Completing initialization.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07007146
7147 /* Set up any superblocks initialized prior to the policy load. */
peter enderborgc103a912018-06-12 10:09:03 +02007148 pr_debug("SELinux: Setting up existing superblocks.\n");
Al Viroe8c26252010-03-23 06:36:54 -04007149 iterate_supers(delayed_superblock_init, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07007150}
7151
7152/* SELinux requires early initialization in order to label
7153 all processes and objects when they are created. */
Kees Cook3d6e5f62018-10-10 17:18:23 -07007154DEFINE_LSM(selinux) = {
Kees Cook07aed2f2018-10-10 17:18:24 -07007155 .name = "selinux",
Kees Cook3d6e5f62018-10-10 17:18:23 -07007156 .init = selinux_init,
7157};
Linus Torvalds1da177e2005-04-16 15:20:36 -07007158
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08007159#if defined(CONFIG_NETFILTER)
Linus Torvalds1da177e2005-04-16 15:20:36 -07007160
Florian Westphal591bb2782017-07-26 11:40:52 +02007161static const struct nf_hook_ops selinux_nf_ops[] = {
Paul Mooreeffad8d2008-01-29 08:49:27 -05007162 {
7163 .hook = selinux_ipv4_postroute,
Alban Crequy2597a832012-05-14 03:56:39 +00007164 .pf = NFPROTO_IPV4,
Paul Mooreeffad8d2008-01-29 08:49:27 -05007165 .hooknum = NF_INET_POST_ROUTING,
7166 .priority = NF_IP_PRI_SELINUX_LAST,
7167 },
7168 {
7169 .hook = selinux_ipv4_forward,
Alban Crequy2597a832012-05-14 03:56:39 +00007170 .pf = NFPROTO_IPV4,
Paul Mooreeffad8d2008-01-29 08:49:27 -05007171 .hooknum = NF_INET_FORWARD,
7172 .priority = NF_IP_PRI_SELINUX_FIRST,
Paul Moore948bf852008-10-10 10:16:32 -04007173 },
7174 {
7175 .hook = selinux_ipv4_output,
Alban Crequy2597a832012-05-14 03:56:39 +00007176 .pf = NFPROTO_IPV4,
Paul Moore948bf852008-10-10 10:16:32 -04007177 .hooknum = NF_INET_LOCAL_OUT,
7178 .priority = NF_IP_PRI_SELINUX_FIRST,
Jiri Pirko25db6be2014-09-03 17:42:13 +02007179 },
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04007180#if IS_ENABLED(CONFIG_IPV6)
Paul Mooreeffad8d2008-01-29 08:49:27 -05007181 {
7182 .hook = selinux_ipv6_postroute,
Alban Crequy2597a832012-05-14 03:56:39 +00007183 .pf = NFPROTO_IPV6,
Paul Mooreeffad8d2008-01-29 08:49:27 -05007184 .hooknum = NF_INET_POST_ROUTING,
7185 .priority = NF_IP6_PRI_SELINUX_LAST,
7186 },
7187 {
7188 .hook = selinux_ipv6_forward,
Alban Crequy2597a832012-05-14 03:56:39 +00007189 .pf = NFPROTO_IPV6,
Paul Mooreeffad8d2008-01-29 08:49:27 -05007190 .hooknum = NF_INET_FORWARD,
7191 .priority = NF_IP6_PRI_SELINUX_FIRST,
Jiri Pirko25db6be2014-09-03 17:42:13 +02007192 },
Huw Davies2917f572016-06-27 15:06:15 -04007193 {
7194 .hook = selinux_ipv6_output,
7195 .pf = NFPROTO_IPV6,
7196 .hooknum = NF_INET_LOCAL_OUT,
7197 .priority = NF_IP6_PRI_SELINUX_FIRST,
7198 },
Linus Torvalds1da177e2005-04-16 15:20:36 -07007199#endif /* IPV6 */
Jiri Pirko25db6be2014-09-03 17:42:13 +02007200};
Linus Torvalds1da177e2005-04-16 15:20:36 -07007201
Florian Westphal8e71bf72017-04-21 11:49:09 +02007202static int __net_init selinux_nf_register(struct net *net)
7203{
7204 return nf_register_net_hooks(net, selinux_nf_ops,
7205 ARRAY_SIZE(selinux_nf_ops));
7206}
7207
7208static void __net_exit selinux_nf_unregister(struct net *net)
7209{
7210 nf_unregister_net_hooks(net, selinux_nf_ops,
7211 ARRAY_SIZE(selinux_nf_ops));
7212}
7213
7214static struct pernet_operations selinux_net_ops = {
7215 .init = selinux_nf_register,
7216 .exit = selinux_nf_unregister,
7217};
7218
Linus Torvalds1da177e2005-04-16 15:20:36 -07007219static int __init selinux_nf_ip_init(void)
7220{
Jiri Pirko25db6be2014-09-03 17:42:13 +02007221 int err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07007222
7223 if (!selinux_enabled)
Jiri Pirko25db6be2014-09-03 17:42:13 +02007224 return 0;
Eric Parisfadcdb42007-02-22 18:11:31 -05007225
peter enderborgc103a912018-06-12 10:09:03 +02007226 pr_debug("SELinux: Registering netfilter hooks\n");
Eric Parisfadcdb42007-02-22 18:11:31 -05007227
Florian Westphal8e71bf72017-04-21 11:49:09 +02007228 err = register_pernet_subsys(&selinux_net_ops);
Alexey Dobriyan6c5a9d22008-07-26 17:48:15 -07007229 if (err)
Florian Westphal8e71bf72017-04-21 11:49:09 +02007230 panic("SELinux: register_pernet_subsys: error %d\n", err);
Linus Torvalds1da177e2005-04-16 15:20:36 -07007231
Jiri Pirko25db6be2014-09-03 17:42:13 +02007232 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07007233}
Linus Torvalds1da177e2005-04-16 15:20:36 -07007234__initcall(selinux_nf_ip_init);
7235
7236#ifdef CONFIG_SECURITY_SELINUX_DISABLE
7237static void selinux_nf_ip_exit(void)
7238{
peter enderborgc103a912018-06-12 10:09:03 +02007239 pr_debug("SELinux: Unregistering netfilter hooks\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07007240
Florian Westphal8e71bf72017-04-21 11:49:09 +02007241 unregister_pernet_subsys(&selinux_net_ops);
Linus Torvalds1da177e2005-04-16 15:20:36 -07007242}
7243#endif
7244
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08007245#else /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07007246
7247#ifdef CONFIG_SECURITY_SELINUX_DISABLE
7248#define selinux_nf_ip_exit()
7249#endif
7250
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08007251#endif /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07007252
7253#ifdef CONFIG_SECURITY_SELINUX_DISABLE
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007254int selinux_disable(struct selinux_state *state)
Linus Torvalds1da177e2005-04-16 15:20:36 -07007255{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007256 if (state->initialized) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07007257 /* Not permitted after initial policy load. */
7258 return -EINVAL;
7259 }
7260
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007261 if (state->disabled) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07007262 /* Only do this once. */
7263 return -EINVAL;
7264 }
7265
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007266 state->disabled = 1;
7267
peter enderborgc103a912018-06-12 10:09:03 +02007268 pr_info("SELinux: Disabled at runtime.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07007269
Stephen Smalley30d55282006-05-03 10:52:36 -04007270 selinux_enabled = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07007271
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07007272 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
Linus Torvalds1da177e2005-04-16 15:20:36 -07007273
Eric Parisaf8ff042009-09-20 21:23:01 -04007274 /* Try to destroy the avc node cache */
7275 avc_disable();
7276
Linus Torvalds1da177e2005-04-16 15:20:36 -07007277 /* Unregister netfilter hooks. */
7278 selinux_nf_ip_exit();
7279
7280 /* Unregister selinuxfs. */
7281 exit_sel_fs();
7282
7283 return 0;
7284}
7285#endif