blob: 59b164d7134d0b463375363b64431cddc2a49455 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
Stephen Smalley7efbb602017-08-17 13:32:36 -04006 * Authors: Stephen Smalley, <sds@tycho.nsa.gov>
Eric Paris828dfe12008-04-17 13:17:49 -04007 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070010 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
Eric Paris2069f452008-07-04 09:47:13 +100012 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070014 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
Eric Paris828dfe12008-04-17 13:17:49 -040015 * <dgoeddel@trustedcs.com>
Paul Mooreed6d76e2009-08-28 18:12:49 -040016 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
Paul Moore82c21bf2011-08-01 11:10:33 +000017 * Paul Moore <paul@paul-moore.com>
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +090018 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
Eric Paris828dfe12008-04-17 13:17:49 -040019 * Yuichi Nakamura <ynakam@hitachisoft.jp>
Daniel Jurgens3a976fa2017-05-19 15:48:56 +030020 * Copyright (C) 2016 Mellanox Technologies
Linus Torvalds1da177e2005-04-16 15:20:36 -070021 *
22 * This program is free software; you can redistribute it and/or modify
23 * it under the terms of the GNU General Public License version 2,
Eric Paris828dfe12008-04-17 13:17:49 -040024 * as published by the Free Software Foundation.
Linus Torvalds1da177e2005-04-16 15:20:36 -070025 */
26
Linus Torvalds1da177e2005-04-16 15:20:36 -070027#include <linux/init.h>
Eric Paris0b24dcb2011-02-25 15:39:20 -050028#include <linux/kd.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070029#include <linux/kernel.h>
Roland McGrath0d094ef2008-07-25 19:45:49 -070030#include <linux/tracehook.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070031#include <linux/errno.h>
Ingo Molnar3f07c012017-02-08 18:51:30 +010032#include <linux/sched/signal.h>
Ingo Molnar29930022017-02-08 18:51:36 +010033#include <linux/sched/task.h>
Casey Schaufler3c4ed7b2015-05-02 15:10:46 -070034#include <linux/lsm_hooks.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070035#include <linux/xattr.h>
36#include <linux/capability.h>
37#include <linux/unistd.h>
38#include <linux/mm.h>
39#include <linux/mman.h>
40#include <linux/slab.h>
41#include <linux/pagemap.h>
Eric Paris0b24dcb2011-02-25 15:39:20 -050042#include <linux/proc_fs.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070043#include <linux/swap.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070044#include <linux/spinlock.h>
45#include <linux/syscalls.h>
Eric Paris2a7dba32011-02-01 11:05:39 -050046#include <linux/dcache.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070047#include <linux/file.h>
Al Viro9f3acc32008-04-24 07:44:08 -040048#include <linux/fdtable.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070049#include <linux/namei.h>
50#include <linux/mount.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070051#include <linux/netfilter_ipv4.h>
52#include <linux/netfilter_ipv6.h>
53#include <linux/tty.h>
54#include <net/icmp.h>
Stephen Hemminger227b60f2007-10-10 17:30:46 -070055#include <net/ip.h> /* for local_port_range[] */
Linus Torvalds1da177e2005-04-16 15:20:36 -070056#include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
Paul Moore47180062013-12-04 16:10:45 -050057#include <net/inet_connection_sock.h>
Paul Moore220deb92008-01-29 08:38:23 -050058#include <net/net_namespace.h>
Paul Moored621d352008-01-29 08:43:36 -050059#include <net/netlabel.h>
Eric Parisf5269712008-05-14 11:27:45 -040060#include <linux/uaccess.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070061#include <asm/ioctls.h>
Arun Sharma600634972011-07-26 16:09:06 -070062#include <linux/atomic.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070063#include <linux/bitops.h>
64#include <linux/interrupt.h>
65#include <linux/netdevice.h> /* for network interface checks */
Hong zhi guo77954982013-03-27 06:49:35 +000066#include <net/netlink.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070067#include <linux/tcp.h>
68#include <linux/udp.h>
James Morris2ee92d42006-11-13 16:09:01 -080069#include <linux/dccp.h>
Richard Hainesd4529302018-02-13 20:57:18 +000070#include <linux/sctp.h>
71#include <net/sctp/structs.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070072#include <linux/quota.h>
73#include <linux/un.h> /* for Unix socket types */
74#include <net/af_unix.h> /* for Unix socket types */
75#include <linux/parser.h>
76#include <linux/nfs_mount.h>
77#include <net/ipv6.h>
78#include <linux/hugetlb.h>
79#include <linux/personality.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070080#include <linux/audit.h>
Eric Paris6931dfc2005-06-30 02:58:51 -070081#include <linux/string.h>
Catherine Zhang877ce7c2006-06-29 12:27:47 -070082#include <linux/selinux.h>
Eric Paris23970742006-09-25 23:32:01 -070083#include <linux/mutex.h>
Frank Mayharf06febc2008-09-12 09:54:39 -070084#include <linux/posix-timers.h>
Kees Cook00234592010-02-03 15:36:43 -080085#include <linux/syslog.h>
Serge E. Hallyn34867402011-03-23 16:43:17 -070086#include <linux/user_namespace.h>
Paul Gortmaker44fc7ea2011-05-26 20:52:10 -040087#include <linux/export.h>
Al Viro40401532012-02-13 03:58:52 +000088#include <linux/msg.h>
89#include <linux/shm.h>
Chenbo Fengec27c352017-10-18 13:00:25 -070090#include <linux/bpf.h>
David Howellse262e32d2018-11-01 23:07:23 +000091#include <uapi/linux/mount.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070092
93#include "avc.h"
94#include "objsec.h"
95#include "netif.h"
Paul Moore224dfbd2008-01-29 08:38:13 -050096#include "netnode.h"
Paul Moore3e1121722008-04-10 10:48:14 -040097#include "netport.h"
Daniel Jurgens409dcf32017-05-19 15:48:59 +030098#include "ibpkey.h"
Trent Jaegerd28d1e02005-12-13 23:12:40 -080099#include "xfrm.h"
Paul Moorec60475b2007-02-28 15:14:23 -0500100#include "netlabel.h"
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +0200101#include "audit.h"
James Morris7b98a582011-08-30 12:52:32 +1000102#include "avc_ss.h"
Linus Torvalds1da177e2005-04-16 15:20:36 -0700103
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500104struct selinux_state selinux_state;
105
Paul Moored621d352008-01-29 08:43:36 -0500106/* SECMARK reference count */
James Morris56a4ca92011-08-17 11:08:43 +1000107static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
Paul Moored621d352008-01-29 08:43:36 -0500108
Linus Torvalds1da177e2005-04-16 15:20:36 -0700109#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500110static int selinux_enforcing_boot;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700111
112static int __init enforcing_setup(char *str)
113{
Eric Parisf5269712008-05-14 11:27:45 -0400114 unsigned long enforcing;
Jingoo Han29707b22014-02-05 15:13:14 +0900115 if (!kstrtoul(str, 0, &enforcing))
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500116 selinux_enforcing_boot = enforcing ? 1 : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700117 return 1;
118}
119__setup("enforcing=", enforcing_setup);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500120#else
121#define selinux_enforcing_boot 1
Linus Torvalds1da177e2005-04-16 15:20:36 -0700122#endif
123
124#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
125int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
126
127static int __init selinux_enabled_setup(char *str)
128{
Eric Parisf5269712008-05-14 11:27:45 -0400129 unsigned long enabled;
Jingoo Han29707b22014-02-05 15:13:14 +0900130 if (!kstrtoul(str, 0, &enabled))
Eric Parisf5269712008-05-14 11:27:45 -0400131 selinux_enabled = enabled ? 1 : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700132 return 1;
133}
134__setup("selinux=", selinux_enabled_setup);
Stephen Smalley30d55282006-05-03 10:52:36 -0400135#else
136int selinux_enabled = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700137#endif
138
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500139static unsigned int selinux_checkreqprot_boot =
140 CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
141
142static int __init checkreqprot_setup(char *str)
143{
144 unsigned long checkreqprot;
145
146 if (!kstrtoul(str, 0, &checkreqprot))
147 selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
148 return 1;
149}
150__setup("checkreqprot=", checkreqprot_setup);
151
Christoph Lametere18b8902006-12-06 20:33:20 -0800152static struct kmem_cache *sel_inode_cache;
Sangwoo63205652015-10-21 17:44:30 -0400153static struct kmem_cache *file_security_cache;
James Morris7cae7e22006-03-22 00:09:22 -0800154
Paul Moored621d352008-01-29 08:43:36 -0500155/**
156 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
157 *
158 * Description:
159 * This function checks the SECMARK reference counter to see if any SECMARK
160 * targets are currently configured, if the reference counter is greater than
161 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
Chris PeBenito2be4d742013-05-03 09:05:39 -0400162 * enabled, false (0) if SECMARK is disabled. If the always_check_network
163 * policy capability is enabled, SECMARK is always considered enabled.
Paul Moored621d352008-01-29 08:43:36 -0500164 *
165 */
166static int selinux_secmark_enabled(void)
167{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500168 return (selinux_policycap_alwaysnetwork() ||
169 atomic_read(&selinux_secmark_refcount));
Chris PeBenito2be4d742013-05-03 09:05:39 -0400170}
171
172/**
173 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
174 *
175 * Description:
176 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
177 * (1) if any are enabled or false (0) if neither are enabled. If the
178 * always_check_network policy capability is enabled, peer labeling
179 * is always considered enabled.
180 *
181 */
182static int selinux_peerlbl_enabled(void)
183{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500184 return (selinux_policycap_alwaysnetwork() ||
185 netlbl_enabled() || selinux_xfrm_enabled());
Paul Moored621d352008-01-29 08:43:36 -0500186}
187
Paul Moore615e51f2014-06-26 14:33:56 -0400188static int selinux_netcache_avc_callback(u32 event)
189{
190 if (event == AVC_CALLBACK_RESET) {
191 sel_netif_flush();
192 sel_netnode_flush();
193 sel_netport_flush();
194 synchronize_net();
195 }
196 return 0;
197}
198
Daniel Jurgens8f408ab2017-05-19 15:48:53 +0300199static int selinux_lsm_notifier_avc_callback(u32 event)
200{
Daniel Jurgens409dcf32017-05-19 15:48:59 +0300201 if (event == AVC_CALLBACK_RESET) {
202 sel_ib_pkey_flush();
Daniel Jurgens8f408ab2017-05-19 15:48:53 +0300203 call_lsm_notifier(LSM_POLICY_CHANGE, NULL);
Daniel Jurgens409dcf32017-05-19 15:48:59 +0300204 }
Daniel Jurgens8f408ab2017-05-19 15:48:53 +0300205
206 return 0;
207}
208
David Howellsd84f4f92008-11-14 10:39:23 +1100209/*
210 * initialise the security for the init task
211 */
212static void cred_init_security(void)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700213{
David Howells3b11a1d2008-11-14 10:39:26 +1100214 struct cred *cred = (struct cred *) current->real_cred;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700215 struct task_security_struct *tsec;
216
James Morris89d155e2005-10-30 14:59:21 -0800217 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700218 if (!tsec)
David Howellsd84f4f92008-11-14 10:39:23 +1100219 panic("SELinux: Failed to initialize initial task.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -0700220
David Howellsd84f4f92008-11-14 10:39:23 +1100221 tsec->osid = tsec->sid = SECINITSID_KERNEL;
David Howellsf1752ee2008-11-14 10:39:17 +1100222 cred->security = tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700223}
224
David Howells275bb412008-11-14 10:39:19 +1100225/*
David Howells88e67f32008-11-14 10:39:21 +1100226 * get the security ID of a set of credentials
227 */
228static inline u32 cred_sid(const struct cred *cred)
229{
230 const struct task_security_struct *tsec;
231
232 tsec = cred->security;
233 return tsec->sid;
234}
235
236/*
David Howells3b11a1d2008-11-14 10:39:26 +1100237 * get the objective security ID of a task
David Howells275bb412008-11-14 10:39:19 +1100238 */
239static inline u32 task_sid(const struct task_struct *task)
240{
David Howells275bb412008-11-14 10:39:19 +1100241 u32 sid;
242
243 rcu_read_lock();
David Howells88e67f32008-11-14 10:39:21 +1100244 sid = cred_sid(__task_cred(task));
David Howells275bb412008-11-14 10:39:19 +1100245 rcu_read_unlock();
246 return sid;
247}
248
David Howells88e67f32008-11-14 10:39:21 +1100249/* Allocate and free functions for each kind of security blob. */
250
Linus Torvalds1da177e2005-04-16 15:20:36 -0700251static int inode_alloc_security(struct inode *inode)
252{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700253 struct inode_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +1100254 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700255
Josef Bacika02fe132008-04-04 09:35:05 +1100256 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700257 if (!isec)
258 return -ENOMEM;
259
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +0100260 spin_lock_init(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700261 INIT_LIST_HEAD(&isec->list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700262 isec->inode = inode;
263 isec->sid = SECINITSID_UNLABELED;
264 isec->sclass = SECCLASS_FILE;
David Howells275bb412008-11-14 10:39:19 +1100265 isec->task_sid = sid;
Andreas Gruenbacher42059112016-11-10 22:18:27 +0100266 isec->initialized = LABEL_INVALID;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700267 inode->i_security = isec;
268
269 return 0;
270}
271
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500272static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
273
274/*
275 * Try reloading inode security labels that have been marked as invalid. The
276 * @may_sleep parameter indicates when sleeping and thus reloading labels is
Andreas Gruenbacher42059112016-11-10 22:18:27 +0100277 * allowed; when set to false, returns -ECHILD when the label is
Al Viroe9193282018-04-24 21:31:02 -0400278 * invalid. The @dentry parameter should be set to a dentry of the inode.
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500279 */
280static int __inode_security_revalidate(struct inode *inode,
Al Viroe9193282018-04-24 21:31:02 -0400281 struct dentry *dentry,
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500282 bool may_sleep)
283{
284 struct inode_security_struct *isec = inode->i_security;
285
286 might_sleep_if(may_sleep);
287
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500288 if (selinux_state.initialized &&
289 isec->initialized != LABEL_INITIALIZED) {
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500290 if (!may_sleep)
291 return -ECHILD;
292
293 /*
294 * Try reloading the inode security label. This will fail if
295 * @opt_dentry is NULL and no dentry for this inode can be
296 * found; in that case, continue using the old label.
297 */
Al Viroe9193282018-04-24 21:31:02 -0400298 inode_doinit_with_dentry(inode, dentry);
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500299 }
300 return 0;
301}
302
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500303static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
304{
305 return inode->i_security;
306}
307
308static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
309{
310 int error;
311
312 error = __inode_security_revalidate(inode, NULL, !rcu);
313 if (error)
314 return ERR_PTR(error);
315 return inode->i_security;
316}
317
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500318/*
319 * Get the security label of an inode.
320 */
321static struct inode_security_struct *inode_security(struct inode *inode)
322{
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500323 __inode_security_revalidate(inode, NULL, true);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500324 return inode->i_security;
325}
326
Paul Moore2c971652016-04-19 16:36:28 -0400327static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
328{
329 struct inode *inode = d_backing_inode(dentry);
330
331 return inode->i_security;
332}
333
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500334/*
335 * Get the security label of a dentry's backing inode.
336 */
337static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
338{
339 struct inode *inode = d_backing_inode(dentry);
340
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500341 __inode_security_revalidate(inode, dentry, true);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500342 return inode->i_security;
343}
344
Steven Rostedt3dc91d42014-01-09 21:46:34 -0500345static void inode_free_rcu(struct rcu_head *head)
346{
347 struct inode_security_struct *isec;
348
349 isec = container_of(head, struct inode_security_struct, rcu);
350 kmem_cache_free(sel_inode_cache, isec);
351}
352
Linus Torvalds1da177e2005-04-16 15:20:36 -0700353static void inode_free_security(struct inode *inode)
354{
355 struct inode_security_struct *isec = inode->i_security;
356 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
357
Waiman Long9629d042015-07-10 17:19:56 -0400358 /*
359 * As not all inode security structures are in a list, we check for
360 * empty list outside of the lock to make sure that we won't waste
361 * time taking a lock doing nothing.
362 *
363 * The list_del_init() function can be safely called more than once.
364 * It should not be possible for this function to be called with
365 * concurrent list_add(), but for better safety against future changes
366 * in the code, we use list_empty_careful() here.
367 */
368 if (!list_empty_careful(&isec->list)) {
369 spin_lock(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700370 list_del_init(&isec->list);
Waiman Long9629d042015-07-10 17:19:56 -0400371 spin_unlock(&sbsec->isec_lock);
372 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700373
Steven Rostedt3dc91d42014-01-09 21:46:34 -0500374 /*
375 * The inode may still be referenced in a path walk and
376 * a call to selinux_inode_permission() can be made
377 * after inode_free_security() is called. Ideally, the VFS
378 * wouldn't do this, but fixing that is a much harder
379 * job. For now, simply free the i_security via RCU, and
380 * leave the current inode->i_security pointer intact.
381 * The inode will be freed after the RCU grace period too.
382 */
383 call_rcu(&isec->rcu, inode_free_rcu);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700384}
385
386static int file_alloc_security(struct file *file)
387{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700388 struct file_security_struct *fsec;
David Howells275bb412008-11-14 10:39:19 +1100389 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700390
Sangwoo63205652015-10-21 17:44:30 -0400391 fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700392 if (!fsec)
393 return -ENOMEM;
394
David Howells275bb412008-11-14 10:39:19 +1100395 fsec->sid = sid;
396 fsec->fown_sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700397 file->f_security = fsec;
398
399 return 0;
400}
401
402static void file_free_security(struct file *file)
403{
404 struct file_security_struct *fsec = file->f_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700405 file->f_security = NULL;
Sangwoo63205652015-10-21 17:44:30 -0400406 kmem_cache_free(file_security_cache, fsec);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700407}
408
409static int superblock_alloc_security(struct super_block *sb)
410{
411 struct superblock_security_struct *sbsec;
412
James Morris89d155e2005-10-30 14:59:21 -0800413 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700414 if (!sbsec)
415 return -ENOMEM;
416
Eric Parisbc7e9822006-09-25 23:32:02 -0700417 mutex_init(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700418 INIT_LIST_HEAD(&sbsec->isec_head);
419 spin_lock_init(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700420 sbsec->sb = sb;
421 sbsec->sid = SECINITSID_UNLABELED;
422 sbsec->def_sid = SECINITSID_FILE;
Eric Parisc312feb2006-07-10 04:43:53 -0700423 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700424 sb->s_security = sbsec;
425
426 return 0;
427}
428
429static void superblock_free_security(struct super_block *sb)
430{
431 struct superblock_security_struct *sbsec = sb->s_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700432 sb->s_security = NULL;
433 kfree(sbsec);
434}
435
Linus Torvalds1da177e2005-04-16 15:20:36 -0700436static inline int inode_doinit(struct inode *inode)
437{
438 return inode_doinit_with_dentry(inode, NULL);
439}
440
441enum {
Eric Paris31e87932007-09-19 17:19:12 -0400442 Opt_error = -1,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700443 Opt_context = 1,
444 Opt_fscontext = 2,
Eric Parisc9180a52007-11-30 13:00:35 -0500445 Opt_defcontext = 3,
446 Opt_rootcontext = 4,
David P. Quigley11689d42009-01-16 09:22:03 -0500447 Opt_labelsupport = 5,
Eric Parisd355987f2012-08-24 15:58:53 -0400448 Opt_nextmntopt = 6,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700449};
450
Eric Parisd355987f2012-08-24 15:58:53 -0400451#define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1)
452
Steven Whitehousea447c092008-10-13 10:46:57 +0100453static const match_table_t tokens = {
Eric Paris832cbd92008-04-01 13:24:09 -0400454 {Opt_context, CONTEXT_STR "%s"},
455 {Opt_fscontext, FSCONTEXT_STR "%s"},
456 {Opt_defcontext, DEFCONTEXT_STR "%s"},
457 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
David P. Quigley11689d42009-01-16 09:22:03 -0500458 {Opt_labelsupport, LABELSUPP_STR},
Eric Paris31e87932007-09-19 17:19:12 -0400459 {Opt_error, NULL},
Linus Torvalds1da177e2005-04-16 15:20:36 -0700460};
461
462#define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
463
Eric Parisc312feb2006-07-10 04:43:53 -0700464static int may_context_mount_sb_relabel(u32 sid,
465 struct superblock_security_struct *sbsec,
David Howells275bb412008-11-14 10:39:19 +1100466 const struct cred *cred)
Eric Parisc312feb2006-07-10 04:43:53 -0700467{
David Howells275bb412008-11-14 10:39:19 +1100468 const struct task_security_struct *tsec = cred->security;
Eric Parisc312feb2006-07-10 04:43:53 -0700469 int rc;
470
Stephen Smalley6b6bc622018-03-05 11:47:56 -0500471 rc = avc_has_perm(&selinux_state,
472 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
Eric Parisc312feb2006-07-10 04:43:53 -0700473 FILESYSTEM__RELABELFROM, NULL);
474 if (rc)
475 return rc;
476
Stephen Smalley6b6bc622018-03-05 11:47:56 -0500477 rc = avc_has_perm(&selinux_state,
478 tsec->sid, sid, SECCLASS_FILESYSTEM,
Eric Parisc312feb2006-07-10 04:43:53 -0700479 FILESYSTEM__RELABELTO, NULL);
480 return rc;
481}
482
Eric Paris08089252006-07-10 04:43:55 -0700483static int may_context_mount_inode_relabel(u32 sid,
484 struct superblock_security_struct *sbsec,
David Howells275bb412008-11-14 10:39:19 +1100485 const struct cred *cred)
Eric Paris08089252006-07-10 04:43:55 -0700486{
David Howells275bb412008-11-14 10:39:19 +1100487 const struct task_security_struct *tsec = cred->security;
Eric Paris08089252006-07-10 04:43:55 -0700488 int rc;
Stephen Smalley6b6bc622018-03-05 11:47:56 -0500489 rc = avc_has_perm(&selinux_state,
490 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
Eric Paris08089252006-07-10 04:43:55 -0700491 FILESYSTEM__RELABELFROM, NULL);
492 if (rc)
493 return rc;
494
Stephen Smalley6b6bc622018-03-05 11:47:56 -0500495 rc = avc_has_perm(&selinux_state,
496 sid, sbsec->sid, SECCLASS_FILESYSTEM,
Eric Paris08089252006-07-10 04:43:55 -0700497 FILESYSTEM__ASSOCIATE, NULL);
498 return rc;
499}
500
Eric Parisb43e7252012-10-10 14:27:35 -0400501static int selinux_is_sblabel_mnt(struct super_block *sb)
502{
503 struct superblock_security_struct *sbsec = sb->s_security;
504
Mark Salyzynd5f3a5f2015-02-04 11:34:30 -0500505 return sbsec->behavior == SECURITY_FS_USE_XATTR ||
506 sbsec->behavior == SECURITY_FS_USE_TRANS ||
507 sbsec->behavior == SECURITY_FS_USE_TASK ||
J. Bruce Fields9fc2b4b2015-06-04 15:57:25 -0400508 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
Mark Salyzynd5f3a5f2015-02-04 11:34:30 -0500509 /* Special handling. Genfs but also in-core setxattr handler */
510 !strcmp(sb->s_type->name, "sysfs") ||
511 !strcmp(sb->s_type->name, "pstore") ||
512 !strcmp(sb->s_type->name, "debugfs") ||
Yongqin Liua2c7c6f2017-01-09 10:07:30 -0500513 !strcmp(sb->s_type->name, "tracefs") ||
Stephen Smalley2651225b2017-02-28 10:35:56 -0500514 !strcmp(sb->s_type->name, "rootfs") ||
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500515 (selinux_policycap_cgroupseclabel() &&
Stephen Smalley2651225b2017-02-28 10:35:56 -0500516 (!strcmp(sb->s_type->name, "cgroup") ||
517 !strcmp(sb->s_type->name, "cgroup2")));
Eric Parisb43e7252012-10-10 14:27:35 -0400518}
519
Eric Parisc9180a52007-11-30 13:00:35 -0500520static int sb_finish_set_opts(struct super_block *sb)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700521{
522 struct superblock_security_struct *sbsec = sb->s_security;
523 struct dentry *root = sb->s_root;
David Howellsc6f493d2015-03-17 22:26:22 +0000524 struct inode *root_inode = d_backing_inode(root);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700525 int rc = 0;
526
Linus Torvalds1da177e2005-04-16 15:20:36 -0700527 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
528 /* Make sure that the xattr handler exists and that no
529 error other than -ENODATA is returned by getxattr on
530 the root directory. -ENODATA is ok, as this may be
531 the first boot of the SELinux kernel before we have
532 assigned xattr values to the filesystem. */
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +0200533 if (!(root_inode->i_opflags & IOP_XATTR)) {
peter enderborgc103a912018-06-12 10:09:03 +0200534 pr_warn("SELinux: (dev %s, type %s) has no "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800535 "xattr support\n", sb->s_id, sb->s_type->name);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700536 rc = -EOPNOTSUPP;
537 goto out;
538 }
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +0200539
540 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700541 if (rc < 0 && rc != -ENODATA) {
542 if (rc == -EOPNOTSUPP)
peter enderborgc103a912018-06-12 10:09:03 +0200543 pr_warn("SELinux: (dev %s, type "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800544 "%s) has no security xattr handler\n",
545 sb->s_id, sb->s_type->name);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700546 else
peter enderborgc103a912018-06-12 10:09:03 +0200547 pr_warn("SELinux: (dev %s, type "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800548 "%s) getxattr errno %d\n", sb->s_id,
549 sb->s_type->name, -rc);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700550 goto out;
551 }
552 }
553
Eric Pariseadcabc2012-08-24 15:59:14 -0400554 sbsec->flags |= SE_SBINITIALIZED;
Scott Mayhew0b4d3452017-06-05 11:45:04 -0400555
556 /*
557 * Explicitly set or clear SBLABEL_MNT. It's not sufficient to simply
558 * leave the flag untouched because sb_clone_mnt_opts might be handing
559 * us a superblock that needs the flag to be cleared.
560 */
Eric Parisb43e7252012-10-10 14:27:35 -0400561 if (selinux_is_sblabel_mnt(sb))
Eric Paris12f348b2012-10-09 10:56:25 -0400562 sbsec->flags |= SBLABEL_MNT;
Scott Mayhew0b4d3452017-06-05 11:45:04 -0400563 else
564 sbsec->flags &= ~SBLABEL_MNT;
David P. Quigleyddd29ec2009-09-09 14:25:37 -0400565
Linus Torvalds1da177e2005-04-16 15:20:36 -0700566 /* Initialize the root inode. */
Eric Parisc9180a52007-11-30 13:00:35 -0500567 rc = inode_doinit_with_dentry(root_inode, root);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700568
569 /* Initialize any other inodes associated with the superblock, e.g.
570 inodes created prior to initial policy load or inodes created
571 during get_sb by a pseudo filesystem that directly
572 populates itself. */
573 spin_lock(&sbsec->isec_lock);
574next_inode:
575 if (!list_empty(&sbsec->isec_head)) {
576 struct inode_security_struct *isec =
577 list_entry(sbsec->isec_head.next,
Eric Parisc9180a52007-11-30 13:00:35 -0500578 struct inode_security_struct, list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700579 struct inode *inode = isec->inode;
Stephen Smalley923190d2014-10-06 16:32:52 -0400580 list_del_init(&isec->list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700581 spin_unlock(&sbsec->isec_lock);
582 inode = igrab(inode);
583 if (inode) {
Eric Parisc9180a52007-11-30 13:00:35 -0500584 if (!IS_PRIVATE(inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700585 inode_doinit(inode);
586 iput(inode);
587 }
588 spin_lock(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700589 goto next_inode;
590 }
591 spin_unlock(&sbsec->isec_lock);
592out:
Eric Parisc9180a52007-11-30 13:00:35 -0500593 return rc;
594}
595
596/*
597 * This function should allow an FS to ask what it's mount security
598 * options were so it can use those later for submounts, displaying
599 * mount options, or whatever.
600 */
601static int selinux_get_mnt_opts(const struct super_block *sb,
Eric Parise0007522008-03-05 10:31:54 -0500602 struct security_mnt_opts *opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500603{
604 int rc = 0, i;
605 struct superblock_security_struct *sbsec = sb->s_security;
606 char *context = NULL;
607 u32 len;
608 char tmp;
609
Eric Parise0007522008-03-05 10:31:54 -0500610 security_init_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500611
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500612 if (!(sbsec->flags & SE_SBINITIALIZED))
Eric Parisc9180a52007-11-30 13:00:35 -0500613 return -EINVAL;
614
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500615 if (!selinux_state.initialized)
Eric Parisc9180a52007-11-30 13:00:35 -0500616 return -EINVAL;
617
Eric Parisaf8e50c2012-08-24 15:59:00 -0400618 /* make sure we always check enough bits to cover the mask */
619 BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
620
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500621 tmp = sbsec->flags & SE_MNTMASK;
Eric Parisc9180a52007-11-30 13:00:35 -0500622 /* count the number of mount options for this sb */
Eric Parisaf8e50c2012-08-24 15:59:00 -0400623 for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
Eric Parisc9180a52007-11-30 13:00:35 -0500624 if (tmp & 0x01)
Eric Parise0007522008-03-05 10:31:54 -0500625 opts->num_mnt_opts++;
Eric Parisc9180a52007-11-30 13:00:35 -0500626 tmp >>= 1;
627 }
David P. Quigley11689d42009-01-16 09:22:03 -0500628 /* Check if the Label support flag is set */
Eric Paris0b4bdb32013-08-28 13:32:42 -0400629 if (sbsec->flags & SBLABEL_MNT)
David P. Quigley11689d42009-01-16 09:22:03 -0500630 opts->num_mnt_opts++;
Eric Parisc9180a52007-11-30 13:00:35 -0500631
Eric Parise0007522008-03-05 10:31:54 -0500632 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
633 if (!opts->mnt_opts) {
Eric Parisc9180a52007-11-30 13:00:35 -0500634 rc = -ENOMEM;
635 goto out_free;
636 }
637
Eric Parise0007522008-03-05 10:31:54 -0500638 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
639 if (!opts->mnt_opts_flags) {
Eric Parisc9180a52007-11-30 13:00:35 -0500640 rc = -ENOMEM;
641 goto out_free;
642 }
643
644 i = 0;
645 if (sbsec->flags & FSCONTEXT_MNT) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500646 rc = security_sid_to_context(&selinux_state, sbsec->sid,
647 &context, &len);
Eric Parisc9180a52007-11-30 13:00:35 -0500648 if (rc)
649 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500650 opts->mnt_opts[i] = context;
651 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500652 }
653 if (sbsec->flags & CONTEXT_MNT) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500654 rc = security_sid_to_context(&selinux_state,
655 sbsec->mntpoint_sid,
656 &context, &len);
Eric Parisc9180a52007-11-30 13:00:35 -0500657 if (rc)
658 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500659 opts->mnt_opts[i] = context;
660 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500661 }
662 if (sbsec->flags & DEFCONTEXT_MNT) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500663 rc = security_sid_to_context(&selinux_state, sbsec->def_sid,
664 &context, &len);
Eric Parisc9180a52007-11-30 13:00:35 -0500665 if (rc)
666 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500667 opts->mnt_opts[i] = context;
668 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500669 }
670 if (sbsec->flags & ROOTCONTEXT_MNT) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500671 struct dentry *root = sbsec->sb->s_root;
672 struct inode_security_struct *isec = backing_inode_security(root);
Eric Parisc9180a52007-11-30 13:00:35 -0500673
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500674 rc = security_sid_to_context(&selinux_state, isec->sid,
675 &context, &len);
Eric Parisc9180a52007-11-30 13:00:35 -0500676 if (rc)
677 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500678 opts->mnt_opts[i] = context;
679 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500680 }
Eric Paris12f348b2012-10-09 10:56:25 -0400681 if (sbsec->flags & SBLABEL_MNT) {
David P. Quigley11689d42009-01-16 09:22:03 -0500682 opts->mnt_opts[i] = NULL;
Eric Paris12f348b2012-10-09 10:56:25 -0400683 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
David P. Quigley11689d42009-01-16 09:22:03 -0500684 }
Eric Parisc9180a52007-11-30 13:00:35 -0500685
Eric Parise0007522008-03-05 10:31:54 -0500686 BUG_ON(i != opts->num_mnt_opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500687
688 return 0;
689
690out_free:
Eric Parise0007522008-03-05 10:31:54 -0500691 security_free_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500692 return rc;
693}
694
695static int bad_option(struct superblock_security_struct *sbsec, char flag,
696 u32 old_sid, u32 new_sid)
697{
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500698 char mnt_flags = sbsec->flags & SE_MNTMASK;
699
Eric Parisc9180a52007-11-30 13:00:35 -0500700 /* check if the old mount command had the same options */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500701 if (sbsec->flags & SE_SBINITIALIZED)
Eric Parisc9180a52007-11-30 13:00:35 -0500702 if (!(sbsec->flags & flag) ||
703 (old_sid != new_sid))
704 return 1;
705
706 /* check if we were passed the same options twice,
707 * aka someone passed context=a,context=b
708 */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500709 if (!(sbsec->flags & SE_SBINITIALIZED))
710 if (mnt_flags & flag)
Eric Parisc9180a52007-11-30 13:00:35 -0500711 return 1;
712 return 0;
713}
Eric Parise0007522008-03-05 10:31:54 -0500714
Eric Parisc9180a52007-11-30 13:00:35 -0500715/*
716 * Allow filesystems with binary mount data to explicitly set mount point
717 * labeling information.
718 */
Eric Parise0007522008-03-05 10:31:54 -0500719static int selinux_set_mnt_opts(struct super_block *sb,
David Quigley649f6e72013-05-22 12:50:36 -0400720 struct security_mnt_opts *opts,
721 unsigned long kern_flags,
722 unsigned long *set_kern_flags)
Eric Parisc9180a52007-11-30 13:00:35 -0500723{
David Howells275bb412008-11-14 10:39:19 +1100724 const struct cred *cred = current_cred();
Eric Parisc9180a52007-11-30 13:00:35 -0500725 int rc = 0, i;
Eric Parisc9180a52007-11-30 13:00:35 -0500726 struct superblock_security_struct *sbsec = sb->s_security;
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800727 const char *name = sb->s_type->name;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500728 struct dentry *root = sbsec->sb->s_root;
Paul Moore2c971652016-04-19 16:36:28 -0400729 struct inode_security_struct *root_isec;
Eric Parisc9180a52007-11-30 13:00:35 -0500730 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
731 u32 defcontext_sid = 0;
Eric Parise0007522008-03-05 10:31:54 -0500732 char **mount_options = opts->mnt_opts;
733 int *flags = opts->mnt_opts_flags;
734 int num_opts = opts->num_mnt_opts;
Eric Parisc9180a52007-11-30 13:00:35 -0500735
736 mutex_lock(&sbsec->lock);
737
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500738 if (!selinux_state.initialized) {
Eric Parisc9180a52007-11-30 13:00:35 -0500739 if (!num_opts) {
740 /* Defer initialization until selinux_complete_init,
741 after the initial policy is loaded and the security
742 server is ready to handle calls. */
Eric Parisc9180a52007-11-30 13:00:35 -0500743 goto out;
744 }
745 rc = -EINVAL;
peter enderborgc103a912018-06-12 10:09:03 +0200746 pr_warn("SELinux: Unable to set superblock options "
Eric Paris744ba352008-04-17 11:52:44 -0400747 "before the security server is initialized\n");
Eric Parisc9180a52007-11-30 13:00:35 -0500748 goto out;
749 }
David Quigley649f6e72013-05-22 12:50:36 -0400750 if (kern_flags && !set_kern_flags) {
751 /* Specifying internal flags without providing a place to
752 * place the results is not allowed */
753 rc = -EINVAL;
754 goto out;
755 }
Eric Parisc9180a52007-11-30 13:00:35 -0500756
757 /*
Eric Parise0007522008-03-05 10:31:54 -0500758 * Binary mount data FS will come through this function twice. Once
759 * from an explicit call and once from the generic calls from the vfs.
760 * Since the generic VFS calls will not contain any security mount data
761 * we need to skip the double mount verification.
762 *
763 * This does open a hole in which we will not notice if the first
764 * mount using this sb set explict options and a second mount using
765 * this sb does not set any security options. (The first options
766 * will be used for both mounts)
767 */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500768 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
Eric Parise0007522008-03-05 10:31:54 -0500769 && (num_opts == 0))
Eric Parisf5269712008-05-14 11:27:45 -0400770 goto out;
Eric Parise0007522008-03-05 10:31:54 -0500771
Paul Moore2c971652016-04-19 16:36:28 -0400772 root_isec = backing_inode_security_novalidate(root);
773
Eric Parise0007522008-03-05 10:31:54 -0500774 /*
Eric Parisc9180a52007-11-30 13:00:35 -0500775 * parse the mount options, check if they are valid sids.
776 * also check if someone is trying to mount the same sb more
777 * than once with different security options.
778 */
779 for (i = 0; i < num_opts; i++) {
780 u32 sid;
David P. Quigley11689d42009-01-16 09:22:03 -0500781
Eric Paris12f348b2012-10-09 10:56:25 -0400782 if (flags[i] == SBLABEL_MNT)
David P. Quigley11689d42009-01-16 09:22:03 -0500783 continue;
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500784 rc = security_context_str_to_sid(&selinux_state,
785 mount_options[i], &sid,
786 GFP_KERNEL);
Eric Parisc9180a52007-11-30 13:00:35 -0500787 if (rc) {
peter enderborgc103a912018-06-12 10:09:03 +0200788 pr_warn("SELinux: security_context_str_to_sid"
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800789 "(%s) failed for (dev %s, type %s) errno=%d\n",
790 mount_options[i], sb->s_id, name, rc);
Eric Parisc9180a52007-11-30 13:00:35 -0500791 goto out;
792 }
793 switch (flags[i]) {
794 case FSCONTEXT_MNT:
795 fscontext_sid = sid;
796
797 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
798 fscontext_sid))
799 goto out_double_mount;
800
801 sbsec->flags |= FSCONTEXT_MNT;
802 break;
803 case CONTEXT_MNT:
804 context_sid = sid;
805
806 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
807 context_sid))
808 goto out_double_mount;
809
810 sbsec->flags |= CONTEXT_MNT;
811 break;
812 case ROOTCONTEXT_MNT:
813 rootcontext_sid = sid;
814
815 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
816 rootcontext_sid))
817 goto out_double_mount;
818
819 sbsec->flags |= ROOTCONTEXT_MNT;
820
821 break;
822 case DEFCONTEXT_MNT:
823 defcontext_sid = sid;
824
825 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
826 defcontext_sid))
827 goto out_double_mount;
828
829 sbsec->flags |= DEFCONTEXT_MNT;
830
831 break;
832 default:
833 rc = -EINVAL;
834 goto out;
835 }
836 }
837
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500838 if (sbsec->flags & SE_SBINITIALIZED) {
Eric Parisc9180a52007-11-30 13:00:35 -0500839 /* previously mounted with options, but not on this attempt? */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500840 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500841 goto out_double_mount;
842 rc = 0;
843 goto out;
844 }
845
James Morris089be432008-07-15 18:32:49 +1000846 if (strcmp(sb->s_type->name, "proc") == 0)
Stephen Smalley134509d2015-06-04 16:22:17 -0400847 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
848
Stephen Smalley8e014722015-06-04 16:22:17 -0400849 if (!strcmp(sb->s_type->name, "debugfs") ||
Jeff Vander Stoep6a391182017-06-20 09:35:33 -0700850 !strcmp(sb->s_type->name, "tracefs") ||
Stephen Smalley8e014722015-06-04 16:22:17 -0400851 !strcmp(sb->s_type->name, "sysfs") ||
Antonio Murdaca901ef842017-02-09 17:02:42 +0100852 !strcmp(sb->s_type->name, "pstore") ||
853 !strcmp(sb->s_type->name, "cgroup") ||
854 !strcmp(sb->s_type->name, "cgroup2"))
Stephen Smalley134509d2015-06-04 16:22:17 -0400855 sbsec->flags |= SE_SBGENFS;
Eric Parisc9180a52007-11-30 13:00:35 -0500856
David Quigleyeb9ae682013-05-22 12:50:37 -0400857 if (!sbsec->behavior) {
858 /*
859 * Determine the labeling behavior to use for this
860 * filesystem type.
861 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500862 rc = security_fs_use(&selinux_state, sb);
David Quigleyeb9ae682013-05-22 12:50:37 -0400863 if (rc) {
peter enderborgc103a912018-06-12 10:09:03 +0200864 pr_warn("%s: security_fs_use(%s) returned %d\n",
David Quigleyeb9ae682013-05-22 12:50:37 -0400865 __func__, sb->s_type->name, rc);
866 goto out;
867 }
Eric Parisc9180a52007-11-30 13:00:35 -0500868 }
Seth Forsheeaad82892016-04-26 14:36:20 -0500869
870 /*
Stephen Smalley01593d32017-01-09 10:07:31 -0500871 * If this is a user namespace mount and the filesystem type is not
872 * explicitly whitelisted, then no contexts are allowed on the command
873 * line and security labels must be ignored.
Seth Forsheeaad82892016-04-26 14:36:20 -0500874 */
Stephen Smalley01593d32017-01-09 10:07:31 -0500875 if (sb->s_user_ns != &init_user_ns &&
876 strcmp(sb->s_type->name, "tmpfs") &&
877 strcmp(sb->s_type->name, "ramfs") &&
878 strcmp(sb->s_type->name, "devpts")) {
Seth Forsheeaad82892016-04-26 14:36:20 -0500879 if (context_sid || fscontext_sid || rootcontext_sid ||
880 defcontext_sid) {
881 rc = -EACCES;
882 goto out;
883 }
884 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
885 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500886 rc = security_transition_sid(&selinux_state,
887 current_sid(),
888 current_sid(),
Seth Forsheeaad82892016-04-26 14:36:20 -0500889 SECCLASS_FILE, NULL,
890 &sbsec->mntpoint_sid);
891 if (rc)
892 goto out;
893 }
894 goto out_set_opts;
895 }
896
Eric Parisc9180a52007-11-30 13:00:35 -0500897 /* sets the context of the superblock for the fs being mounted. */
898 if (fscontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100899 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500900 if (rc)
901 goto out;
902
903 sbsec->sid = fscontext_sid;
904 }
905
906 /*
907 * Switch to using mount point labeling behavior.
908 * sets the label used on all file below the mountpoint, and will set
909 * the superblock context if not already set.
910 */
David Quigleyeb9ae682013-05-22 12:50:37 -0400911 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
912 sbsec->behavior = SECURITY_FS_USE_NATIVE;
913 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
914 }
915
Eric Parisc9180a52007-11-30 13:00:35 -0500916 if (context_sid) {
917 if (!fscontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100918 rc = may_context_mount_sb_relabel(context_sid, sbsec,
919 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500920 if (rc)
921 goto out;
922 sbsec->sid = context_sid;
923 } else {
David Howells275bb412008-11-14 10:39:19 +1100924 rc = may_context_mount_inode_relabel(context_sid, sbsec,
925 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500926 if (rc)
927 goto out;
928 }
929 if (!rootcontext_sid)
930 rootcontext_sid = context_sid;
931
932 sbsec->mntpoint_sid = context_sid;
933 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
934 }
935
936 if (rootcontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100937 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
938 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500939 if (rc)
940 goto out;
941
942 root_isec->sid = rootcontext_sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -0500943 root_isec->initialized = LABEL_INITIALIZED;
Eric Parisc9180a52007-11-30 13:00:35 -0500944 }
945
946 if (defcontext_sid) {
David Quigleyeb9ae682013-05-22 12:50:37 -0400947 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
948 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
Eric Parisc9180a52007-11-30 13:00:35 -0500949 rc = -EINVAL;
peter enderborgc103a912018-06-12 10:09:03 +0200950 pr_warn("SELinux: defcontext option is "
Eric Parisc9180a52007-11-30 13:00:35 -0500951 "invalid for this filesystem type\n");
952 goto out;
953 }
954
955 if (defcontext_sid != sbsec->def_sid) {
956 rc = may_context_mount_inode_relabel(defcontext_sid,
David Howells275bb412008-11-14 10:39:19 +1100957 sbsec, cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500958 if (rc)
959 goto out;
960 }
961
962 sbsec->def_sid = defcontext_sid;
963 }
964
Seth Forsheeaad82892016-04-26 14:36:20 -0500965out_set_opts:
Eric Parisc9180a52007-11-30 13:00:35 -0500966 rc = sb_finish_set_opts(sb);
967out:
Eric Parisbc7e9822006-09-25 23:32:02 -0700968 mutex_unlock(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700969 return rc;
Eric Parisc9180a52007-11-30 13:00:35 -0500970out_double_mount:
971 rc = -EINVAL;
peter enderborgc103a912018-06-12 10:09:03 +0200972 pr_warn("SELinux: mount invalid. Same superblock, different "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800973 "security settings for (dev %s, type %s)\n", sb->s_id, name);
Eric Parisc9180a52007-11-30 13:00:35 -0500974 goto out;
975}
976
Jeff Layton094f7b62013-04-01 08:14:24 -0400977static int selinux_cmp_sb_context(const struct super_block *oldsb,
978 const struct super_block *newsb)
979{
980 struct superblock_security_struct *old = oldsb->s_security;
981 struct superblock_security_struct *new = newsb->s_security;
982 char oldflags = old->flags & SE_MNTMASK;
983 char newflags = new->flags & SE_MNTMASK;
984
985 if (oldflags != newflags)
986 goto mismatch;
987 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
988 goto mismatch;
989 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
990 goto mismatch;
991 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
992 goto mismatch;
993 if (oldflags & ROOTCONTEXT_MNT) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500994 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
995 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
Jeff Layton094f7b62013-04-01 08:14:24 -0400996 if (oldroot->sid != newroot->sid)
997 goto mismatch;
998 }
999 return 0;
1000mismatch:
peter enderborgc103a912018-06-12 10:09:03 +02001001 pr_warn("SELinux: mount invalid. Same superblock, "
Jeff Layton094f7b62013-04-01 08:14:24 -04001002 "different security settings for (dev %s, "
1003 "type %s)\n", newsb->s_id, newsb->s_type->name);
1004 return -EBUSY;
1005}
1006
1007static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001008 struct super_block *newsb,
1009 unsigned long kern_flags,
1010 unsigned long *set_kern_flags)
Eric Parisc9180a52007-11-30 13:00:35 -05001011{
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001012 int rc = 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001013 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
1014 struct superblock_security_struct *newsbsec = newsb->s_security;
1015
1016 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
1017 int set_context = (oldsbsec->flags & CONTEXT_MNT);
1018 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
1019
Eric Paris0f5e6422008-04-21 16:24:11 -04001020 /*
1021 * if the parent was able to be mounted it clearly had no special lsm
Al Viroe8c26252010-03-23 06:36:54 -04001022 * mount options. thus we can safely deal with this superblock later
Eric Paris0f5e6422008-04-21 16:24:11 -04001023 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001024 if (!selinux_state.initialized)
Jeff Layton094f7b62013-04-01 08:14:24 -04001025 return 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001026
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001027 /*
1028 * Specifying internal flags without providing a place to
1029 * place the results is not allowed.
1030 */
1031 if (kern_flags && !set_kern_flags)
1032 return -EINVAL;
1033
Eric Parisc9180a52007-11-30 13:00:35 -05001034 /* how can we clone if the old one wasn't set up?? */
David P. Quigley0d90a7e2009-01-16 09:22:02 -05001035 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
Eric Parisc9180a52007-11-30 13:00:35 -05001036
Jeff Layton094f7b62013-04-01 08:14:24 -04001037 /* if fs is reusing a sb, make sure that the contexts match */
David P. Quigley0d90a7e2009-01-16 09:22:02 -05001038 if (newsbsec->flags & SE_SBINITIALIZED)
Jeff Layton094f7b62013-04-01 08:14:24 -04001039 return selinux_cmp_sb_context(oldsb, newsb);
Eric Paris5a552612008-04-09 14:08:35 -04001040
Eric Parisc9180a52007-11-30 13:00:35 -05001041 mutex_lock(&newsbsec->lock);
1042
1043 newsbsec->flags = oldsbsec->flags;
1044
1045 newsbsec->sid = oldsbsec->sid;
1046 newsbsec->def_sid = oldsbsec->def_sid;
1047 newsbsec->behavior = oldsbsec->behavior;
1048
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001049 if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
1050 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001051 rc = security_fs_use(&selinux_state, newsb);
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001052 if (rc)
1053 goto out;
1054 }
1055
1056 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
1057 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
1058 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
1059 }
1060
Eric Parisc9180a52007-11-30 13:00:35 -05001061 if (set_context) {
1062 u32 sid = oldsbsec->mntpoint_sid;
1063
1064 if (!set_fscontext)
1065 newsbsec->sid = sid;
1066 if (!set_rootcontext) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001067 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
Eric Parisc9180a52007-11-30 13:00:35 -05001068 newisec->sid = sid;
1069 }
1070 newsbsec->mntpoint_sid = sid;
1071 }
1072 if (set_rootcontext) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001073 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
1074 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
Eric Parisc9180a52007-11-30 13:00:35 -05001075
1076 newisec->sid = oldisec->sid;
1077 }
1078
1079 sb_finish_set_opts(newsb);
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001080out:
Eric Parisc9180a52007-11-30 13:00:35 -05001081 mutex_unlock(&newsbsec->lock);
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001082 return rc;
Eric Parisc9180a52007-11-30 13:00:35 -05001083}
1084
Adrian Bunk2e1479d2008-03-17 22:29:23 +02001085static int selinux_parse_opts_str(char *options,
1086 struct security_mnt_opts *opts)
Eric Parisc9180a52007-11-30 13:00:35 -05001087{
Eric Parise0007522008-03-05 10:31:54 -05001088 char *p;
Eric Parisc9180a52007-11-30 13:00:35 -05001089 char *context = NULL, *defcontext = NULL;
1090 char *fscontext = NULL, *rootcontext = NULL;
Eric Parise0007522008-03-05 10:31:54 -05001091 int rc, num_mnt_opts = 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001092
Eric Parise0007522008-03-05 10:31:54 -05001093 opts->num_mnt_opts = 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001094
1095 /* Standard string-based options. */
1096 while ((p = strsep(&options, "|")) != NULL) {
1097 int token;
1098 substring_t args[MAX_OPT_ARGS];
1099
1100 if (!*p)
1101 continue;
1102
1103 token = match_token(p, tokens, args);
1104
1105 switch (token) {
1106 case Opt_context:
1107 if (context || defcontext) {
1108 rc = -EINVAL;
peter enderborgc103a912018-06-12 10:09:03 +02001109 pr_warn(SEL_MOUNT_FAIL_MSG);
Eric Parisc9180a52007-11-30 13:00:35 -05001110 goto out_err;
1111 }
1112 context = match_strdup(&args[0]);
1113 if (!context) {
1114 rc = -ENOMEM;
1115 goto out_err;
1116 }
1117 break;
1118
1119 case Opt_fscontext:
1120 if (fscontext) {
1121 rc = -EINVAL;
peter enderborgc103a912018-06-12 10:09:03 +02001122 pr_warn(SEL_MOUNT_FAIL_MSG);
Eric Parisc9180a52007-11-30 13:00:35 -05001123 goto out_err;
1124 }
1125 fscontext = match_strdup(&args[0]);
1126 if (!fscontext) {
1127 rc = -ENOMEM;
1128 goto out_err;
1129 }
1130 break;
1131
1132 case Opt_rootcontext:
1133 if (rootcontext) {
1134 rc = -EINVAL;
peter enderborgc103a912018-06-12 10:09:03 +02001135 pr_warn(SEL_MOUNT_FAIL_MSG);
Eric Parisc9180a52007-11-30 13:00:35 -05001136 goto out_err;
1137 }
1138 rootcontext = match_strdup(&args[0]);
1139 if (!rootcontext) {
1140 rc = -ENOMEM;
1141 goto out_err;
1142 }
1143 break;
1144
1145 case Opt_defcontext:
1146 if (context || defcontext) {
1147 rc = -EINVAL;
peter enderborgc103a912018-06-12 10:09:03 +02001148 pr_warn(SEL_MOUNT_FAIL_MSG);
Eric Parisc9180a52007-11-30 13:00:35 -05001149 goto out_err;
1150 }
1151 defcontext = match_strdup(&args[0]);
1152 if (!defcontext) {
1153 rc = -ENOMEM;
1154 goto out_err;
1155 }
1156 break;
David P. Quigley11689d42009-01-16 09:22:03 -05001157 case Opt_labelsupport:
1158 break;
Eric Parisc9180a52007-11-30 13:00:35 -05001159 default:
1160 rc = -EINVAL;
peter enderborgc103a912018-06-12 10:09:03 +02001161 pr_warn("SELinux: unknown mount option\n");
Eric Parisc9180a52007-11-30 13:00:35 -05001162 goto out_err;
1163
1164 }
1165 }
1166
Eric Parise0007522008-03-05 10:31:54 -05001167 rc = -ENOMEM;
Tetsuo Handa8931c3b2016-11-14 20:16:12 +09001168 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_KERNEL);
Eric Parise0007522008-03-05 10:31:54 -05001169 if (!opts->mnt_opts)
1170 goto out_err;
1171
Tetsuo Handa8931c3b2016-11-14 20:16:12 +09001172 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int),
1173 GFP_KERNEL);
Paul Moore023f1082017-06-07 16:48:19 -04001174 if (!opts->mnt_opts_flags)
Eric Parise0007522008-03-05 10:31:54 -05001175 goto out_err;
Eric Parisc9180a52007-11-30 13:00:35 -05001176
Eric Parise0007522008-03-05 10:31:54 -05001177 if (fscontext) {
1178 opts->mnt_opts[num_mnt_opts] = fscontext;
1179 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1180 }
1181 if (context) {
1182 opts->mnt_opts[num_mnt_opts] = context;
1183 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1184 }
1185 if (rootcontext) {
1186 opts->mnt_opts[num_mnt_opts] = rootcontext;
1187 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1188 }
1189 if (defcontext) {
1190 opts->mnt_opts[num_mnt_opts] = defcontext;
1191 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1192 }
1193
1194 opts->num_mnt_opts = num_mnt_opts;
1195 return 0;
1196
Eric Parisc9180a52007-11-30 13:00:35 -05001197out_err:
Paul Moore023f1082017-06-07 16:48:19 -04001198 security_free_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -05001199 kfree(context);
1200 kfree(defcontext);
1201 kfree(fscontext);
1202 kfree(rootcontext);
1203 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001204}
1205
Adrian Bunk3583a712008-07-22 20:21:23 +03001206static void selinux_write_opts(struct seq_file *m,
1207 struct security_mnt_opts *opts)
Eric Paris2069f452008-07-04 09:47:13 +10001208{
1209 int i;
1210 char *prefix;
1211
1212 for (i = 0; i < opts->num_mnt_opts; i++) {
David P. Quigley11689d42009-01-16 09:22:03 -05001213 char *has_comma;
1214
1215 if (opts->mnt_opts[i])
1216 has_comma = strchr(opts->mnt_opts[i], ',');
1217 else
1218 has_comma = NULL;
Eric Paris2069f452008-07-04 09:47:13 +10001219
1220 switch (opts->mnt_opts_flags[i]) {
1221 case CONTEXT_MNT:
1222 prefix = CONTEXT_STR;
1223 break;
1224 case FSCONTEXT_MNT:
1225 prefix = FSCONTEXT_STR;
1226 break;
1227 case ROOTCONTEXT_MNT:
1228 prefix = ROOTCONTEXT_STR;
1229 break;
1230 case DEFCONTEXT_MNT:
1231 prefix = DEFCONTEXT_STR;
1232 break;
Eric Paris12f348b2012-10-09 10:56:25 -04001233 case SBLABEL_MNT:
David P. Quigley11689d42009-01-16 09:22:03 -05001234 seq_putc(m, ',');
1235 seq_puts(m, LABELSUPP_STR);
1236 continue;
Eric Paris2069f452008-07-04 09:47:13 +10001237 default:
1238 BUG();
Eric Parisa35c6c832011-04-20 10:21:28 -04001239 return;
Eric Paris2069f452008-07-04 09:47:13 +10001240 };
1241 /* we need a comma before each option */
1242 seq_putc(m, ',');
1243 seq_puts(m, prefix);
1244 if (has_comma)
1245 seq_putc(m, '\"');
Kees Cooka068acf2015-09-04 15:44:57 -07001246 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
Eric Paris2069f452008-07-04 09:47:13 +10001247 if (has_comma)
1248 seq_putc(m, '\"');
1249 }
1250}
1251
1252static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1253{
1254 struct security_mnt_opts opts;
1255 int rc;
1256
1257 rc = selinux_get_mnt_opts(sb, &opts);
Eric Paris383795c2008-07-29 17:07:26 -04001258 if (rc) {
1259 /* before policy load we may get EINVAL, don't show anything */
1260 if (rc == -EINVAL)
1261 rc = 0;
Eric Paris2069f452008-07-04 09:47:13 +10001262 return rc;
Eric Paris383795c2008-07-29 17:07:26 -04001263 }
Eric Paris2069f452008-07-04 09:47:13 +10001264
1265 selinux_write_opts(m, &opts);
1266
1267 security_free_mnt_opts(&opts);
1268
1269 return rc;
1270}
1271
Linus Torvalds1da177e2005-04-16 15:20:36 -07001272static inline u16 inode_mode_to_security_class(umode_t mode)
1273{
1274 switch (mode & S_IFMT) {
1275 case S_IFSOCK:
1276 return SECCLASS_SOCK_FILE;
1277 case S_IFLNK:
1278 return SECCLASS_LNK_FILE;
1279 case S_IFREG:
1280 return SECCLASS_FILE;
1281 case S_IFBLK:
1282 return SECCLASS_BLK_FILE;
1283 case S_IFDIR:
1284 return SECCLASS_DIR;
1285 case S_IFCHR:
1286 return SECCLASS_CHR_FILE;
1287 case S_IFIFO:
1288 return SECCLASS_FIFO_FILE;
1289
1290 }
1291
1292 return SECCLASS_FILE;
1293}
1294
James Morris13402582005-09-30 14:24:34 -04001295static inline int default_protocol_stream(int protocol)
1296{
1297 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1298}
1299
1300static inline int default_protocol_dgram(int protocol)
1301{
1302 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1303}
1304
Linus Torvalds1da177e2005-04-16 15:20:36 -07001305static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1306{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001307 int extsockclass = selinux_policycap_extsockclass();
Stephen Smalleyda69a532017-01-09 10:07:30 -05001308
Linus Torvalds1da177e2005-04-16 15:20:36 -07001309 switch (family) {
1310 case PF_UNIX:
1311 switch (type) {
1312 case SOCK_STREAM:
1313 case SOCK_SEQPACKET:
1314 return SECCLASS_UNIX_STREAM_SOCKET;
1315 case SOCK_DGRAM:
Luis Ressel2a764b52017-07-25 15:13:41 -04001316 case SOCK_RAW:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001317 return SECCLASS_UNIX_DGRAM_SOCKET;
1318 }
1319 break;
1320 case PF_INET:
1321 case PF_INET6:
1322 switch (type) {
1323 case SOCK_STREAM:
Stephen Smalleyda69a532017-01-09 10:07:30 -05001324 case SOCK_SEQPACKET:
James Morris13402582005-09-30 14:24:34 -04001325 if (default_protocol_stream(protocol))
1326 return SECCLASS_TCP_SOCKET;
Stephen Smalleyda69a532017-01-09 10:07:30 -05001327 else if (extsockclass && protocol == IPPROTO_SCTP)
1328 return SECCLASS_SCTP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001329 else
1330 return SECCLASS_RAWIP_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001331 case SOCK_DGRAM:
James Morris13402582005-09-30 14:24:34 -04001332 if (default_protocol_dgram(protocol))
1333 return SECCLASS_UDP_SOCKET;
Stephen Smalleyef379792017-01-09 10:07:31 -05001334 else if (extsockclass && (protocol == IPPROTO_ICMP ||
1335 protocol == IPPROTO_ICMPV6))
Stephen Smalleyda69a532017-01-09 10:07:30 -05001336 return SECCLASS_ICMP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001337 else
1338 return SECCLASS_RAWIP_SOCKET;
James Morris2ee92d42006-11-13 16:09:01 -08001339 case SOCK_DCCP:
1340 return SECCLASS_DCCP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001341 default:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001342 return SECCLASS_RAWIP_SOCKET;
1343 }
1344 break;
1345 case PF_NETLINK:
1346 switch (protocol) {
1347 case NETLINK_ROUTE:
1348 return SECCLASS_NETLINK_ROUTE_SOCKET;
Pavel Emelyanov7f1fb602011-12-06 07:56:43 +00001349 case NETLINK_SOCK_DIAG:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001350 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1351 case NETLINK_NFLOG:
1352 return SECCLASS_NETLINK_NFLOG_SOCKET;
1353 case NETLINK_XFRM:
1354 return SECCLASS_NETLINK_XFRM_SOCKET;
1355 case NETLINK_SELINUX:
1356 return SECCLASS_NETLINK_SELINUX_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001357 case NETLINK_ISCSI:
1358 return SECCLASS_NETLINK_ISCSI_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001359 case NETLINK_AUDIT:
1360 return SECCLASS_NETLINK_AUDIT_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001361 case NETLINK_FIB_LOOKUP:
1362 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1363 case NETLINK_CONNECTOR:
1364 return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1365 case NETLINK_NETFILTER:
1366 return SECCLASS_NETLINK_NETFILTER_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001367 case NETLINK_DNRTMSG:
1368 return SECCLASS_NETLINK_DNRT_SOCKET;
James Morris0c9b7942005-04-16 15:24:13 -07001369 case NETLINK_KOBJECT_UEVENT:
1370 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001371 case NETLINK_GENERIC:
1372 return SECCLASS_NETLINK_GENERIC_SOCKET;
1373 case NETLINK_SCSITRANSPORT:
1374 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1375 case NETLINK_RDMA:
1376 return SECCLASS_NETLINK_RDMA_SOCKET;
1377 case NETLINK_CRYPTO:
1378 return SECCLASS_NETLINK_CRYPTO_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001379 default:
1380 return SECCLASS_NETLINK_SOCKET;
1381 }
1382 case PF_PACKET:
1383 return SECCLASS_PACKET_SOCKET;
1384 case PF_KEY:
1385 return SECCLASS_KEY_SOCKET;
Christopher J. PeBenito3e3ff152006-06-09 00:25:03 -07001386 case PF_APPLETALK:
1387 return SECCLASS_APPLETALK_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001388 }
1389
Stephen Smalleyda69a532017-01-09 10:07:30 -05001390 if (extsockclass) {
1391 switch (family) {
1392 case PF_AX25:
1393 return SECCLASS_AX25_SOCKET;
1394 case PF_IPX:
1395 return SECCLASS_IPX_SOCKET;
1396 case PF_NETROM:
1397 return SECCLASS_NETROM_SOCKET;
Stephen Smalleyda69a532017-01-09 10:07:30 -05001398 case PF_ATMPVC:
1399 return SECCLASS_ATMPVC_SOCKET;
1400 case PF_X25:
1401 return SECCLASS_X25_SOCKET;
1402 case PF_ROSE:
1403 return SECCLASS_ROSE_SOCKET;
1404 case PF_DECnet:
1405 return SECCLASS_DECNET_SOCKET;
1406 case PF_ATMSVC:
1407 return SECCLASS_ATMSVC_SOCKET;
1408 case PF_RDS:
1409 return SECCLASS_RDS_SOCKET;
1410 case PF_IRDA:
1411 return SECCLASS_IRDA_SOCKET;
1412 case PF_PPPOX:
1413 return SECCLASS_PPPOX_SOCKET;
1414 case PF_LLC:
1415 return SECCLASS_LLC_SOCKET;
Stephen Smalleyda69a532017-01-09 10:07:30 -05001416 case PF_CAN:
1417 return SECCLASS_CAN_SOCKET;
1418 case PF_TIPC:
1419 return SECCLASS_TIPC_SOCKET;
1420 case PF_BLUETOOTH:
1421 return SECCLASS_BLUETOOTH_SOCKET;
1422 case PF_IUCV:
1423 return SECCLASS_IUCV_SOCKET;
1424 case PF_RXRPC:
1425 return SECCLASS_RXRPC_SOCKET;
1426 case PF_ISDN:
1427 return SECCLASS_ISDN_SOCKET;
1428 case PF_PHONET:
1429 return SECCLASS_PHONET_SOCKET;
1430 case PF_IEEE802154:
1431 return SECCLASS_IEEE802154_SOCKET;
1432 case PF_CAIF:
1433 return SECCLASS_CAIF_SOCKET;
1434 case PF_ALG:
1435 return SECCLASS_ALG_SOCKET;
1436 case PF_NFC:
1437 return SECCLASS_NFC_SOCKET;
1438 case PF_VSOCK:
1439 return SECCLASS_VSOCK_SOCKET;
1440 case PF_KCM:
1441 return SECCLASS_KCM_SOCKET;
1442 case PF_QIPCRTR:
1443 return SECCLASS_QIPCRTR_SOCKET;
Linus Torvalds3051bf32017-02-22 10:15:09 -08001444 case PF_SMC:
1445 return SECCLASS_SMC_SOCKET;
Björn Töpel68e8b842018-05-02 13:01:22 +02001446 case PF_XDP:
1447 return SECCLASS_XDP_SOCKET;
1448#if PF_MAX > 45
Stephen Smalleyda69a532017-01-09 10:07:30 -05001449#error New address family defined, please update this function.
1450#endif
1451 }
1452 }
1453
Linus Torvalds1da177e2005-04-16 15:20:36 -07001454 return SECCLASS_SOCKET;
1455}
1456
Stephen Smalley134509d2015-06-04 16:22:17 -04001457static int selinux_genfs_get_sid(struct dentry *dentry,
1458 u16 tclass,
1459 u16 flags,
1460 u32 *sid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001461{
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001462 int rc;
Al Virofc640052016-04-10 01:33:30 -04001463 struct super_block *sb = dentry->d_sb;
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001464 char *buffer, *path;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001465
Eric Paris828dfe12008-04-17 13:17:49 -04001466 buffer = (char *)__get_free_page(GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001467 if (!buffer)
1468 return -ENOMEM;
1469
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001470 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1471 if (IS_ERR(path))
1472 rc = PTR_ERR(path);
1473 else {
Stephen Smalley134509d2015-06-04 16:22:17 -04001474 if (flags & SE_SBPROC) {
1475 /* each process gets a /proc/PID/ entry. Strip off the
1476 * PID part to get a valid selinux labeling.
1477 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1478 while (path[1] >= '0' && path[1] <= '9') {
1479 path[1] = '/';
1480 path++;
1481 }
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001482 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001483 rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1484 path, tclass, sid);
Stephen Smalley7bb185e2018-09-04 16:51:36 -04001485 if (rc == -ENOENT) {
1486 /* No match in policy, mark as unlabeled. */
1487 *sid = SECINITSID_UNLABELED;
1488 rc = 0;
1489 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001490 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001491 free_page((unsigned long)buffer);
1492 return rc;
1493}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001494
1495/* The inode's security attributes must be initialized before first use. */
1496static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1497{
1498 struct superblock_security_struct *sbsec = NULL;
1499 struct inode_security_struct *isec = inode->i_security;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001500 u32 task_sid, sid = 0;
1501 u16 sclass;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001502 struct dentry *dentry;
1503#define INITCONTEXTLEN 255
1504 char *context = NULL;
1505 unsigned len = 0;
1506 int rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001507
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05001508 if (isec->initialized == LABEL_INITIALIZED)
Andreas Gruenbacher13457d02016-11-10 22:18:29 +01001509 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001510
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001511 spin_lock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05001512 if (isec->initialized == LABEL_INITIALIZED)
Eric Paris23970742006-09-25 23:32:01 -07001513 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001514
Andreas Gruenbacher13457d02016-11-10 22:18:29 +01001515 if (isec->sclass == SECCLASS_FILE)
1516 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1517
Linus Torvalds1da177e2005-04-16 15:20:36 -07001518 sbsec = inode->i_sb->s_security;
David P. Quigley0d90a7e2009-01-16 09:22:02 -05001519 if (!(sbsec->flags & SE_SBINITIALIZED)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001520 /* Defer initialization until selinux_complete_init,
1521 after the initial policy is loaded and the security
1522 server is ready to handle calls. */
1523 spin_lock(&sbsec->isec_lock);
1524 if (list_empty(&isec->list))
1525 list_add(&isec->list, &sbsec->isec_head);
1526 spin_unlock(&sbsec->isec_lock);
Eric Paris23970742006-09-25 23:32:01 -07001527 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001528 }
1529
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001530 sclass = isec->sclass;
1531 task_sid = isec->task_sid;
1532 sid = isec->sid;
1533 isec->initialized = LABEL_PENDING;
1534 spin_unlock(&isec->lock);
1535
Linus Torvalds1da177e2005-04-16 15:20:36 -07001536 switch (sbsec->behavior) {
David Quigleyeb9ae682013-05-22 12:50:37 -04001537 case SECURITY_FS_USE_NATIVE:
1538 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001539 case SECURITY_FS_USE_XATTR:
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001540 if (!(inode->i_opflags & IOP_XATTR)) {
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001541 sid = sbsec->def_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001542 break;
1543 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001544 /* Need a dentry, since the xattr API requires one.
1545 Life would be simpler if we could just pass the inode. */
1546 if (opt_dentry) {
1547 /* Called from d_instantiate or d_splice_alias. */
1548 dentry = dget(opt_dentry);
1549 } else {
Al Virob1271252018-04-25 10:28:38 -04001550 /*
1551 * Called from selinux_complete_init, try to find a dentry.
1552 * Some filesystems really want a connected one, so try
1553 * that first. We could split SECURITY_FS_USE_XATTR in
1554 * two, depending upon that...
1555 */
Linus Torvalds1da177e2005-04-16 15:20:36 -07001556 dentry = d_find_alias(inode);
Al Virob1271252018-04-25 10:28:38 -04001557 if (!dentry)
1558 dentry = d_find_any_alias(inode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001559 }
1560 if (!dentry) {
Eric Parisdf7f54c2009-03-09 14:35:58 -04001561 /*
1562 * this is can be hit on boot when a file is accessed
1563 * before the policy is loaded. When we load policy we
1564 * may find inodes that have no dentry on the
1565 * sbsec->isec_head list. No reason to complain as these
1566 * will get fixed up the next time we go through
1567 * inode_doinit with a dentry, before these inodes could
1568 * be used again by userspace.
1569 */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001570 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001571 }
1572
1573 len = INITCONTEXTLEN;
Eric Paris4cb912f2009-02-12 14:50:05 -05001574 context = kmalloc(len+1, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001575 if (!context) {
1576 rc = -ENOMEM;
1577 dput(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001578 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001579 }
Eric Paris4cb912f2009-02-12 14:50:05 -05001580 context[len] = '\0';
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001581 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001582 if (rc == -ERANGE) {
James Morris314dabb2009-08-10 22:00:13 +10001583 kfree(context);
1584
Linus Torvalds1da177e2005-04-16 15:20:36 -07001585 /* Need a larger buffer. Query for the right size. */
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001586 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001587 if (rc < 0) {
1588 dput(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001589 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001590 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001591 len = rc;
Eric Paris4cb912f2009-02-12 14:50:05 -05001592 context = kmalloc(len+1, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001593 if (!context) {
1594 rc = -ENOMEM;
1595 dput(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001596 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001597 }
Eric Paris4cb912f2009-02-12 14:50:05 -05001598 context[len] = '\0';
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001599 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001600 }
1601 dput(dentry);
1602 if (rc < 0) {
1603 if (rc != -ENODATA) {
peter enderborgc103a912018-06-12 10:09:03 +02001604 pr_warn("SELinux: %s: getxattr returned "
Harvey Harrisondd6f9532008-03-06 10:03:59 +11001605 "%d for dev=%s ino=%ld\n", __func__,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001606 -rc, inode->i_sb->s_id, inode->i_ino);
1607 kfree(context);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001608 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001609 }
1610 /* Map ENODATA to the default file SID */
1611 sid = sbsec->def_sid;
1612 rc = 0;
1613 } else {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001614 rc = security_context_to_sid_default(&selinux_state,
1615 context, rc, &sid,
Stephen Smalley869ab512008-04-04 08:46:05 -04001616 sbsec->def_sid,
1617 GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001618 if (rc) {
Eric Paris4ba0a8a2009-02-12 15:01:10 -05001619 char *dev = inode->i_sb->s_id;
1620 unsigned long ino = inode->i_ino;
1621
1622 if (rc == -EINVAL) {
1623 if (printk_ratelimit())
peter enderborgc103a912018-06-12 10:09:03 +02001624 pr_notice("SELinux: inode=%lu on dev=%s was found to have an invalid "
Eric Paris4ba0a8a2009-02-12 15:01:10 -05001625 "context=%s. This indicates you may need to relabel the inode or the "
1626 "filesystem in question.\n", ino, dev, context);
1627 } else {
peter enderborgc103a912018-06-12 10:09:03 +02001628 pr_warn("SELinux: %s: context_to_sid(%s) "
Eric Paris4ba0a8a2009-02-12 15:01:10 -05001629 "returned %d for dev=%s ino=%ld\n",
1630 __func__, context, -rc, dev, ino);
1631 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001632 kfree(context);
1633 /* Leave with the unlabeled SID */
1634 rc = 0;
1635 break;
1636 }
1637 }
1638 kfree(context);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001639 break;
1640 case SECURITY_FS_USE_TASK:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001641 sid = task_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001642 break;
1643 case SECURITY_FS_USE_TRANS:
1644 /* Default to the fs SID. */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001645 sid = sbsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001646
1647 /* Try to obtain a transition SID. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001648 rc = security_transition_sid(&selinux_state, task_sid, sid,
1649 sclass, NULL, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001650 if (rc)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001651 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001652 break;
Eric Parisc312feb2006-07-10 04:43:53 -07001653 case SECURITY_FS_USE_MNTPOINT:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001654 sid = sbsec->mntpoint_sid;
Eric Parisc312feb2006-07-10 04:43:53 -07001655 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001656 default:
Eric Parisc312feb2006-07-10 04:43:53 -07001657 /* Default to the fs superblock SID. */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001658 sid = sbsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001659
Stephen Smalley134509d2015-06-04 16:22:17 -04001660 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
Paul Mooref64410e2014-03-19 16:46:18 -04001661 /* We must have a dentry to determine the label on
1662 * procfs inodes */
Al Virob1271252018-04-25 10:28:38 -04001663 if (opt_dentry) {
Paul Mooref64410e2014-03-19 16:46:18 -04001664 /* Called from d_instantiate or
1665 * d_splice_alias. */
1666 dentry = dget(opt_dentry);
Al Virob1271252018-04-25 10:28:38 -04001667 } else {
Paul Mooref64410e2014-03-19 16:46:18 -04001668 /* Called from selinux_complete_init, try to
Al Virob1271252018-04-25 10:28:38 -04001669 * find a dentry. Some filesystems really want
1670 * a connected one, so try that first.
1671 */
Paul Mooref64410e2014-03-19 16:46:18 -04001672 dentry = d_find_alias(inode);
Al Virob1271252018-04-25 10:28:38 -04001673 if (!dentry)
1674 dentry = d_find_any_alias(inode);
1675 }
Paul Mooref64410e2014-03-19 16:46:18 -04001676 /*
1677 * This can be hit on boot when a file is accessed
1678 * before the policy is loaded. When we load policy we
1679 * may find inodes that have no dentry on the
1680 * sbsec->isec_head list. No reason to complain as
1681 * these will get fixed up the next time we go through
1682 * inode_doinit() with a dentry, before these inodes
1683 * could be used again by userspace.
1684 */
1685 if (!dentry)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001686 goto out;
1687 rc = selinux_genfs_get_sid(dentry, sclass,
Stephen Smalley134509d2015-06-04 16:22:17 -04001688 sbsec->flags, &sid);
Paul Mooref64410e2014-03-19 16:46:18 -04001689 dput(dentry);
1690 if (rc)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001691 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001692 }
1693 break;
1694 }
1695
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001696out:
1697 spin_lock(&isec->lock);
1698 if (isec->initialized == LABEL_PENDING) {
1699 if (!sid || rc) {
1700 isec->initialized = LABEL_INVALID;
1701 goto out_unlock;
1702 }
1703
1704 isec->initialized = LABEL_INITIALIZED;
1705 isec->sid = sid;
1706 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001707
Eric Paris23970742006-09-25 23:32:01 -07001708out_unlock:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001709 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001710 return rc;
1711}
1712
1713/* Convert a Linux signal to an access vector. */
1714static inline u32 signal_to_av(int sig)
1715{
1716 u32 perm = 0;
1717
1718 switch (sig) {
1719 case SIGCHLD:
1720 /* Commonly granted from child to parent. */
1721 perm = PROCESS__SIGCHLD;
1722 break;
1723 case SIGKILL:
1724 /* Cannot be caught or ignored */
1725 perm = PROCESS__SIGKILL;
1726 break;
1727 case SIGSTOP:
1728 /* Cannot be caught or ignored */
1729 perm = PROCESS__SIGSTOP;
1730 break;
1731 default:
1732 /* All other signals. */
1733 perm = PROCESS__SIGNAL;
1734 break;
1735 }
1736
1737 return perm;
1738}
1739
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001740#if CAP_LAST_CAP > 63
1741#error Fix SELinux to handle capabilities > 63.
1742#endif
1743
Linus Torvalds1da177e2005-04-16 15:20:36 -07001744/* Check whether a task is allowed to use a capability. */
Eric Paris6a9de492012-01-03 12:25:14 -05001745static int cred_has_capability(const struct cred *cred,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001746 int cap, int audit, bool initns)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001747{
Thomas Liu2bf49692009-07-14 12:14:09 -04001748 struct common_audit_data ad;
Eric Paris06112162008-11-11 22:02:50 +11001749 struct av_decision avd;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001750 u16 sclass;
David Howells3699c532009-01-06 22:27:01 +00001751 u32 sid = cred_sid(cred);
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001752 u32 av = CAP_TO_MASK(cap);
Eric Paris06112162008-11-11 22:02:50 +11001753 int rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001754
Eric Paris50c205f2012-04-04 15:01:43 -04001755 ad.type = LSM_AUDIT_DATA_CAP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001756 ad.u.cap = cap;
1757
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001758 switch (CAP_TO_INDEX(cap)) {
1759 case 0:
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001760 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001761 break;
1762 case 1:
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001763 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001764 break;
1765 default:
peter enderborgc103a912018-06-12 10:09:03 +02001766 pr_err("SELinux: out of range capability %d\n", cap);
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001767 BUG();
Eric Parisa35c6c832011-04-20 10:21:28 -04001768 return -EINVAL;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001769 }
Eric Paris06112162008-11-11 22:02:50 +11001770
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001771 rc = avc_has_perm_noaudit(&selinux_state,
1772 sid, sid, sclass, av, 0, &avd);
Eric Paris9ade0cf2011-04-25 16:26:29 -04001773 if (audit == SECURITY_CAP_AUDIT) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001774 int rc2 = avc_audit(&selinux_state,
1775 sid, sid, sclass, av, &avd, rc, &ad, 0);
Eric Paris9ade0cf2011-04-25 16:26:29 -04001776 if (rc2)
1777 return rc2;
1778 }
Eric Paris06112162008-11-11 22:02:50 +11001779 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001780}
1781
Linus Torvalds1da177e2005-04-16 15:20:36 -07001782/* Check whether a task has a particular permission to an inode.
1783 The 'adp' parameter is optional and allows other audit
1784 data to be passed (e.g. the dentry). */
David Howells88e67f32008-11-14 10:39:21 +11001785static int inode_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001786 struct inode *inode,
1787 u32 perms,
Linus Torvalds19e49832013-10-04 12:54:11 -07001788 struct common_audit_data *adp)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001789{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001790 struct inode_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +11001791 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001792
David Howellse0e81732009-09-02 09:13:40 +01001793 validate_creds(cred);
1794
Eric Paris828dfe12008-04-17 13:17:49 -04001795 if (unlikely(IS_PRIVATE(inode)))
Stephen Smalleybbaca6c2007-02-14 00:34:16 -08001796 return 0;
1797
David Howells88e67f32008-11-14 10:39:21 +11001798 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001799 isec = inode->i_security;
1800
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001801 return avc_has_perm(&selinux_state,
1802 sid, isec->sid, isec->sclass, perms, adp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001803}
1804
1805/* Same as inode_has_perm, but pass explicit audit data containing
1806 the dentry to help the auditing code to more easily generate the
1807 pathname if needed. */
David Howells88e67f32008-11-14 10:39:21 +11001808static inline int dentry_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001809 struct dentry *dentry,
1810 u32 av)
1811{
David Howellsc6f493d2015-03-17 22:26:22 +00001812 struct inode *inode = d_backing_inode(dentry);
Thomas Liu2bf49692009-07-14 12:14:09 -04001813 struct common_audit_data ad;
David Howells88e67f32008-11-14 10:39:21 +11001814
Eric Paris50c205f2012-04-04 15:01:43 -04001815 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Paris2875fa02011-04-28 16:04:24 -04001816 ad.u.dentry = dentry;
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05001817 __inode_security_revalidate(inode, dentry, true);
Linus Torvalds19e49832013-10-04 12:54:11 -07001818 return inode_has_perm(cred, inode, av, &ad);
Eric Paris2875fa02011-04-28 16:04:24 -04001819}
1820
1821/* Same as inode_has_perm, but pass explicit audit data containing
1822 the path to help the auditing code to more easily generate the
1823 pathname if needed. */
1824static inline int path_has_perm(const struct cred *cred,
Al Viro3f7036a2015-03-08 19:28:30 -04001825 const struct path *path,
Eric Paris2875fa02011-04-28 16:04:24 -04001826 u32 av)
1827{
David Howellsc6f493d2015-03-17 22:26:22 +00001828 struct inode *inode = d_backing_inode(path->dentry);
Eric Paris2875fa02011-04-28 16:04:24 -04001829 struct common_audit_data ad;
1830
Eric Paris50c205f2012-04-04 15:01:43 -04001831 ad.type = LSM_AUDIT_DATA_PATH;
Eric Paris2875fa02011-04-28 16:04:24 -04001832 ad.u.path = *path;
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05001833 __inode_security_revalidate(inode, path->dentry, true);
Linus Torvalds19e49832013-10-04 12:54:11 -07001834 return inode_has_perm(cred, inode, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001835}
1836
David Howells13f8e982013-06-13 23:37:55 +01001837/* Same as path_has_perm, but uses the inode from the file struct. */
1838static inline int file_path_has_perm(const struct cred *cred,
1839 struct file *file,
1840 u32 av)
1841{
1842 struct common_audit_data ad;
1843
Vivek Goyal43af5de2016-09-09 11:37:49 -04001844 ad.type = LSM_AUDIT_DATA_FILE;
1845 ad.u.file = file;
Linus Torvalds19e49832013-10-04 12:54:11 -07001846 return inode_has_perm(cred, file_inode(file), av, &ad);
David Howells13f8e982013-06-13 23:37:55 +01001847}
1848
Chenbo Fengf66e4482017-10-18 13:00:26 -07001849#ifdef CONFIG_BPF_SYSCALL
1850static int bpf_fd_pass(struct file *file, u32 sid);
1851#endif
1852
Linus Torvalds1da177e2005-04-16 15:20:36 -07001853/* Check whether a task can use an open file descriptor to
1854 access an inode in a given way. Check access to the
1855 descriptor itself, and then use dentry_has_perm to
1856 check a particular permission to the file.
1857 Access to the descriptor is implicitly granted if it
1858 has the same SID as the process. If av is zero, then
1859 access to the file is not checked, e.g. for cases
1860 where only the descriptor is affected like seek. */
David Howells88e67f32008-11-14 10:39:21 +11001861static int file_has_perm(const struct cred *cred,
1862 struct file *file,
1863 u32 av)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001864{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001865 struct file_security_struct *fsec = file->f_security;
Al Viro496ad9a2013-01-23 17:07:38 -05001866 struct inode *inode = file_inode(file);
Thomas Liu2bf49692009-07-14 12:14:09 -04001867 struct common_audit_data ad;
David Howells88e67f32008-11-14 10:39:21 +11001868 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001869 int rc;
1870
Vivek Goyal43af5de2016-09-09 11:37:49 -04001871 ad.type = LSM_AUDIT_DATA_FILE;
1872 ad.u.file = file;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001873
David Howells275bb412008-11-14 10:39:19 +11001874 if (sid != fsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001875 rc = avc_has_perm(&selinux_state,
1876 sid, fsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001877 SECCLASS_FD,
1878 FD__USE,
1879 &ad);
1880 if (rc)
David Howells88e67f32008-11-14 10:39:21 +11001881 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001882 }
1883
Chenbo Fengf66e4482017-10-18 13:00:26 -07001884#ifdef CONFIG_BPF_SYSCALL
1885 rc = bpf_fd_pass(file, cred_sid(cred));
1886 if (rc)
1887 return rc;
1888#endif
1889
Linus Torvalds1da177e2005-04-16 15:20:36 -07001890 /* av is zero if only checking access to the descriptor. */
David Howells88e67f32008-11-14 10:39:21 +11001891 rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001892 if (av)
Linus Torvalds19e49832013-10-04 12:54:11 -07001893 rc = inode_has_perm(cred, inode, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001894
David Howells88e67f32008-11-14 10:39:21 +11001895out:
1896 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001897}
1898
David Howellsc3c188b2015-07-10 17:19:58 -04001899/*
1900 * Determine the label for an inode that might be unioned.
1901 */
Vivek Goyalc957f6d2016-07-13 10:44:51 -04001902static int
1903selinux_determine_inode_label(const struct task_security_struct *tsec,
1904 struct inode *dir,
1905 const struct qstr *name, u16 tclass,
1906 u32 *_new_isid)
David Howellsc3c188b2015-07-10 17:19:58 -04001907{
1908 const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
David Howellsc3c188b2015-07-10 17:19:58 -04001909
1910 if ((sbsec->flags & SE_SBINITIALIZED) &&
1911 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1912 *_new_isid = sbsec->mntpoint_sid;
1913 } else if ((sbsec->flags & SBLABEL_MNT) &&
1914 tsec->create_sid) {
1915 *_new_isid = tsec->create_sid;
1916 } else {
Paul Moore20cdef82016-04-04 14:14:42 -04001917 const struct inode_security_struct *dsec = inode_security(dir);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001918 return security_transition_sid(&selinux_state, tsec->sid,
1919 dsec->sid, tclass,
David Howellsc3c188b2015-07-10 17:19:58 -04001920 name, _new_isid);
1921 }
1922
1923 return 0;
1924}
1925
Linus Torvalds1da177e2005-04-16 15:20:36 -07001926/* Check whether a task can create a file. */
1927static int may_create(struct inode *dir,
1928 struct dentry *dentry,
1929 u16 tclass)
1930{
Paul Moore5fb49872010-04-22 14:46:19 -04001931 const struct task_security_struct *tsec = current_security();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001932 struct inode_security_struct *dsec;
1933 struct superblock_security_struct *sbsec;
David Howells275bb412008-11-14 10:39:19 +11001934 u32 sid, newsid;
Thomas Liu2bf49692009-07-14 12:14:09 -04001935 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001936 int rc;
1937
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001938 dsec = inode_security(dir);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001939 sbsec = dir->i_sb->s_security;
1940
David Howells275bb412008-11-14 10:39:19 +11001941 sid = tsec->sid;
David Howells275bb412008-11-14 10:39:19 +11001942
Eric Paris50c205f2012-04-04 15:01:43 -04001943 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04001944 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001945
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001946 rc = avc_has_perm(&selinux_state,
1947 sid, dsec->sid, SECCLASS_DIR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001948 DIR__ADD_NAME | DIR__SEARCH,
1949 &ad);
1950 if (rc)
1951 return rc;
1952
Vivek Goyalc957f6d2016-07-13 10:44:51 -04001953 rc = selinux_determine_inode_label(current_security(), dir,
1954 &dentry->d_name, tclass, &newsid);
David Howellsc3c188b2015-07-10 17:19:58 -04001955 if (rc)
1956 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001957
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001958 rc = avc_has_perm(&selinux_state,
1959 sid, newsid, tclass, FILE__CREATE, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001960 if (rc)
1961 return rc;
1962
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001963 return avc_has_perm(&selinux_state,
1964 newsid, sbsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001965 SECCLASS_FILESYSTEM,
1966 FILESYSTEM__ASSOCIATE, &ad);
1967}
1968
Eric Paris828dfe12008-04-17 13:17:49 -04001969#define MAY_LINK 0
1970#define MAY_UNLINK 1
1971#define MAY_RMDIR 2
Linus Torvalds1da177e2005-04-16 15:20:36 -07001972
1973/* Check whether a task can link, unlink, or rmdir a file/directory. */
1974static int may_link(struct inode *dir,
1975 struct dentry *dentry,
1976 int kind)
1977
1978{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001979 struct inode_security_struct *dsec, *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04001980 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11001981 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001982 u32 av;
1983 int rc;
1984
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001985 dsec = inode_security(dir);
1986 isec = backing_inode_security(dentry);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001987
Eric Paris50c205f2012-04-04 15:01:43 -04001988 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04001989 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001990
1991 av = DIR__SEARCH;
1992 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001993 rc = avc_has_perm(&selinux_state,
1994 sid, dsec->sid, SECCLASS_DIR, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001995 if (rc)
1996 return rc;
1997
1998 switch (kind) {
1999 case MAY_LINK:
2000 av = FILE__LINK;
2001 break;
2002 case MAY_UNLINK:
2003 av = FILE__UNLINK;
2004 break;
2005 case MAY_RMDIR:
2006 av = DIR__RMDIR;
2007 break;
2008 default:
peter enderborgc103a912018-06-12 10:09:03 +02002009 pr_warn("SELinux: %s: unrecognized kind %d\n",
Eric Paris744ba352008-04-17 11:52:44 -04002010 __func__, kind);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002011 return 0;
2012 }
2013
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002014 rc = avc_has_perm(&selinux_state,
2015 sid, isec->sid, isec->sclass, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002016 return rc;
2017}
2018
2019static inline int may_rename(struct inode *old_dir,
2020 struct dentry *old_dentry,
2021 struct inode *new_dir,
2022 struct dentry *new_dentry)
2023{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002024 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04002025 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11002026 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002027 u32 av;
2028 int old_is_dir, new_is_dir;
2029 int rc;
2030
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002031 old_dsec = inode_security(old_dir);
2032 old_isec = backing_inode_security(old_dentry);
David Howellse36cb0b2015-01-29 12:02:35 +00002033 old_is_dir = d_is_dir(old_dentry);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002034 new_dsec = inode_security(new_dir);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002035
Eric Paris50c205f2012-04-04 15:01:43 -04002036 ad.type = LSM_AUDIT_DATA_DENTRY;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002037
Eric Parisa2694342011-04-25 13:10:27 -04002038 ad.u.dentry = old_dentry;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002039 rc = avc_has_perm(&selinux_state,
2040 sid, old_dsec->sid, SECCLASS_DIR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002041 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
2042 if (rc)
2043 return rc;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002044 rc = avc_has_perm(&selinux_state,
2045 sid, old_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002046 old_isec->sclass, FILE__RENAME, &ad);
2047 if (rc)
2048 return rc;
2049 if (old_is_dir && new_dir != old_dir) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002050 rc = avc_has_perm(&selinux_state,
2051 sid, old_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002052 old_isec->sclass, DIR__REPARENT, &ad);
2053 if (rc)
2054 return rc;
2055 }
2056
Eric Parisa2694342011-04-25 13:10:27 -04002057 ad.u.dentry = new_dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002058 av = DIR__ADD_NAME | DIR__SEARCH;
David Howells2c616d42015-01-29 12:02:33 +00002059 if (d_is_positive(new_dentry))
Linus Torvalds1da177e2005-04-16 15:20:36 -07002060 av |= DIR__REMOVE_NAME;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002061 rc = avc_has_perm(&selinux_state,
2062 sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002063 if (rc)
2064 return rc;
David Howells2c616d42015-01-29 12:02:33 +00002065 if (d_is_positive(new_dentry)) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002066 new_isec = backing_inode_security(new_dentry);
David Howellse36cb0b2015-01-29 12:02:35 +00002067 new_is_dir = d_is_dir(new_dentry);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002068 rc = avc_has_perm(&selinux_state,
2069 sid, new_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002070 new_isec->sclass,
2071 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
2072 if (rc)
2073 return rc;
2074 }
2075
2076 return 0;
2077}
2078
2079/* Check whether a task can perform a filesystem operation. */
David Howells88e67f32008-11-14 10:39:21 +11002080static int superblock_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002081 struct super_block *sb,
2082 u32 perms,
Thomas Liu2bf49692009-07-14 12:14:09 -04002083 struct common_audit_data *ad)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002084{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002085 struct superblock_security_struct *sbsec;
David Howells88e67f32008-11-14 10:39:21 +11002086 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002087
Linus Torvalds1da177e2005-04-16 15:20:36 -07002088 sbsec = sb->s_security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002089 return avc_has_perm(&selinux_state,
2090 sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002091}
2092
2093/* Convert a Linux mode and permission mask to an access vector. */
2094static inline u32 file_mask_to_av(int mode, int mask)
2095{
2096 u32 av = 0;
2097
Al Virodba19c62011-07-25 20:49:29 -04002098 if (!S_ISDIR(mode)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002099 if (mask & MAY_EXEC)
2100 av |= FILE__EXECUTE;
2101 if (mask & MAY_READ)
2102 av |= FILE__READ;
2103
2104 if (mask & MAY_APPEND)
2105 av |= FILE__APPEND;
2106 else if (mask & MAY_WRITE)
2107 av |= FILE__WRITE;
2108
2109 } else {
2110 if (mask & MAY_EXEC)
2111 av |= DIR__SEARCH;
2112 if (mask & MAY_WRITE)
2113 av |= DIR__WRITE;
2114 if (mask & MAY_READ)
2115 av |= DIR__READ;
2116 }
2117
2118 return av;
2119}
2120
2121/* Convert a Linux file to an access vector. */
2122static inline u32 file_to_av(struct file *file)
2123{
2124 u32 av = 0;
2125
2126 if (file->f_mode & FMODE_READ)
2127 av |= FILE__READ;
2128 if (file->f_mode & FMODE_WRITE) {
2129 if (file->f_flags & O_APPEND)
2130 av |= FILE__APPEND;
2131 else
2132 av |= FILE__WRITE;
2133 }
Stephen Smalley0794c662008-03-17 08:55:18 -04002134 if (!av) {
2135 /*
2136 * Special file opened with flags 3 for ioctl-only use.
2137 */
2138 av = FILE__IOCTL;
2139 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002140
2141 return av;
2142}
2143
Eric Paris8b6a5a32008-10-29 17:06:46 -04002144/*
2145 * Convert a file to an access vector and include the correct open
2146 * open permission.
2147 */
2148static inline u32 open_file_to_av(struct file *file)
2149{
2150 u32 av = file_to_av(file);
Stephen Smalleyccb54472017-05-12 12:41:24 -04002151 struct inode *inode = file_inode(file);
Eric Paris8b6a5a32008-10-29 17:06:46 -04002152
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002153 if (selinux_policycap_openperm() &&
2154 inode->i_sb->s_magic != SOCKFS_MAGIC)
Eric Paris49b7b8d2010-07-23 11:44:09 -04002155 av |= FILE__OPEN;
2156
Eric Paris8b6a5a32008-10-29 17:06:46 -04002157 return av;
2158}
2159
Linus Torvalds1da177e2005-04-16 15:20:36 -07002160/* Hook functions begin here. */
2161
Stephen Smalley79af7302015-01-21 10:54:10 -05002162static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2163{
2164 u32 mysid = current_sid();
2165 u32 mgrsid = task_sid(mgr);
2166
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002167 return avc_has_perm(&selinux_state,
2168 mysid, mgrsid, SECCLASS_BINDER,
Stephen Smalley79af7302015-01-21 10:54:10 -05002169 BINDER__SET_CONTEXT_MGR, NULL);
2170}
2171
2172static int selinux_binder_transaction(struct task_struct *from,
2173 struct task_struct *to)
2174{
2175 u32 mysid = current_sid();
2176 u32 fromsid = task_sid(from);
2177 u32 tosid = task_sid(to);
2178 int rc;
2179
2180 if (mysid != fromsid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002181 rc = avc_has_perm(&selinux_state,
2182 mysid, fromsid, SECCLASS_BINDER,
Stephen Smalley79af7302015-01-21 10:54:10 -05002183 BINDER__IMPERSONATE, NULL);
2184 if (rc)
2185 return rc;
2186 }
2187
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002188 return avc_has_perm(&selinux_state,
2189 fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
Stephen Smalley79af7302015-01-21 10:54:10 -05002190 NULL);
2191}
2192
2193static int selinux_binder_transfer_binder(struct task_struct *from,
2194 struct task_struct *to)
2195{
2196 u32 fromsid = task_sid(from);
2197 u32 tosid = task_sid(to);
2198
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002199 return avc_has_perm(&selinux_state,
2200 fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
Stephen Smalley79af7302015-01-21 10:54:10 -05002201 NULL);
2202}
2203
2204static int selinux_binder_transfer_file(struct task_struct *from,
2205 struct task_struct *to,
2206 struct file *file)
2207{
2208 u32 sid = task_sid(to);
2209 struct file_security_struct *fsec = file->f_security;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002210 struct dentry *dentry = file->f_path.dentry;
Paul Moore20cdef82016-04-04 14:14:42 -04002211 struct inode_security_struct *isec;
Stephen Smalley79af7302015-01-21 10:54:10 -05002212 struct common_audit_data ad;
2213 int rc;
2214
2215 ad.type = LSM_AUDIT_DATA_PATH;
2216 ad.u.path = file->f_path;
2217
2218 if (sid != fsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002219 rc = avc_has_perm(&selinux_state,
2220 sid, fsec->sid,
Stephen Smalley79af7302015-01-21 10:54:10 -05002221 SECCLASS_FD,
2222 FD__USE,
2223 &ad);
2224 if (rc)
2225 return rc;
2226 }
2227
Chenbo Fengf66e4482017-10-18 13:00:26 -07002228#ifdef CONFIG_BPF_SYSCALL
2229 rc = bpf_fd_pass(file, sid);
2230 if (rc)
2231 return rc;
2232#endif
2233
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002234 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
Stephen Smalley79af7302015-01-21 10:54:10 -05002235 return 0;
2236
Paul Moore20cdef82016-04-04 14:14:42 -04002237 isec = backing_inode_security(dentry);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002238 return avc_has_perm(&selinux_state,
2239 sid, isec->sid, isec->sclass, file_to_av(file),
Stephen Smalley79af7302015-01-21 10:54:10 -05002240 &ad);
2241}
2242
Ingo Molnar9e488582009-05-07 19:26:19 +10002243static int selinux_ptrace_access_check(struct task_struct *child,
David Howells5cd9c582008-08-14 11:37:28 +01002244 unsigned int mode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002245{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002246 u32 sid = current_sid();
2247 u32 csid = task_sid(child);
Stephen Smalley006ebb42008-05-19 08:32:49 -04002248
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002249 if (mode & PTRACE_MODE_READ)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002250 return avc_has_perm(&selinux_state,
2251 sid, csid, SECCLASS_FILE, FILE__READ, NULL);
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002252
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002253 return avc_has_perm(&selinux_state,
2254 sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
David Howells5cd9c582008-08-14 11:37:28 +01002255}
2256
2257static int selinux_ptrace_traceme(struct task_struct *parent)
2258{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002259 return avc_has_perm(&selinux_state,
2260 task_sid(parent), current_sid(), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002261 PROCESS__PTRACE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002262}
2263
2264static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
Eric Paris828dfe12008-04-17 13:17:49 -04002265 kernel_cap_t *inheritable, kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002266{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002267 return avc_has_perm(&selinux_state,
2268 current_sid(), task_sid(target), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002269 PROCESS__GETCAP, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002270}
2271
David Howellsd84f4f92008-11-14 10:39:23 +11002272static int selinux_capset(struct cred *new, const struct cred *old,
2273 const kernel_cap_t *effective,
2274 const kernel_cap_t *inheritable,
2275 const kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002276{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002277 return avc_has_perm(&selinux_state,
2278 cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002279 PROCESS__SETCAP, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002280}
2281
James Morris5626d3e2009-01-30 10:05:06 +11002282/*
2283 * (This comment used to live with the selinux_task_setuid hook,
2284 * which was removed).
2285 *
2286 * Since setuid only affects the current process, and since the SELinux
2287 * controls are not based on the Linux identity attributes, SELinux does not
2288 * need to control this operation. However, SELinux does control the use of
2289 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2290 */
2291
Eric Paris6a9de492012-01-03 12:25:14 -05002292static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2293 int cap, int audit)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002294{
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04002295 return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002296}
2297
Linus Torvalds1da177e2005-04-16 15:20:36 -07002298static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2299{
David Howells88e67f32008-11-14 10:39:21 +11002300 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002301 int rc = 0;
2302
2303 if (!sb)
2304 return 0;
2305
2306 switch (cmds) {
Eric Paris828dfe12008-04-17 13:17:49 -04002307 case Q_SYNC:
2308 case Q_QUOTAON:
2309 case Q_QUOTAOFF:
2310 case Q_SETINFO:
2311 case Q_SETQUOTA:
David Howells88e67f32008-11-14 10:39:21 +11002312 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04002313 break;
2314 case Q_GETFMT:
2315 case Q_GETINFO:
2316 case Q_GETQUOTA:
David Howells88e67f32008-11-14 10:39:21 +11002317 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04002318 break;
2319 default:
2320 rc = 0; /* let the kernel handle invalid cmds */
2321 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002322 }
2323 return rc;
2324}
2325
2326static int selinux_quota_on(struct dentry *dentry)
2327{
David Howells88e67f32008-11-14 10:39:21 +11002328 const struct cred *cred = current_cred();
2329
Eric Paris2875fa02011-04-28 16:04:24 -04002330 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002331}
2332
Eric Paris12b30522010-11-15 18:36:29 -05002333static int selinux_syslog(int type)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002334{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002335 switch (type) {
Kees Cookd78ca3c2010-02-03 15:37:13 -08002336 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2337 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002338 return avc_has_perm(&selinux_state,
2339 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002340 SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
Kees Cookd78ca3c2010-02-03 15:37:13 -08002341 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2342 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2343 /* Set level of messages printed to console */
2344 case SYSLOG_ACTION_CONSOLE_LEVEL:
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002345 return avc_has_perm(&selinux_state,
2346 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002347 SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2348 NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002349 }
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002350 /* All other syslog types */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002351 return avc_has_perm(&selinux_state,
2352 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002353 SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002354}
2355
2356/*
2357 * Check that a process has enough memory to allocate a new virtual
2358 * mapping. 0 means there is enough memory for the allocation to
2359 * succeed and -ENOMEM implies there is not.
2360 *
Linus Torvalds1da177e2005-04-16 15:20:36 -07002361 * Do not audit the selinux permission check, as this is applied to all
2362 * processes that allocate mappings.
2363 */
Alan Cox34b4e4a2007-08-22 14:01:28 -07002364static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002365{
2366 int rc, cap_sys_admin = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002367
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07002368 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04002369 SECURITY_CAP_NOAUDIT, true);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002370 if (rc == 0)
2371 cap_sys_admin = 1;
2372
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07002373 return cap_sys_admin;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002374}
2375
2376/* binprm security operations */
2377
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002378static u32 ptrace_parent_sid(void)
Paul Moore0c6181c2016-03-30 21:41:21 -04002379{
2380 u32 sid = 0;
2381 struct task_struct *tracer;
2382
2383 rcu_read_lock();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002384 tracer = ptrace_parent(current);
Paul Moore0c6181c2016-03-30 21:41:21 -04002385 if (tracer)
2386 sid = task_sid(tracer);
2387 rcu_read_unlock();
2388
2389 return sid;
2390}
2391
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002392static int check_nnp_nosuid(const struct linux_binprm *bprm,
2393 const struct task_security_struct *old_tsec,
2394 const struct task_security_struct *new_tsec)
2395{
2396 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
Andy Lutomirski380cf5b2016-06-23 16:41:05 -05002397 int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002398 int rc;
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002399 u32 av;
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002400
2401 if (!nnp && !nosuid)
2402 return 0; /* neither NNP nor nosuid */
2403
2404 if (new_tsec->sid == old_tsec->sid)
2405 return 0; /* No change in credentials */
2406
2407 /*
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002408 * If the policy enables the nnp_nosuid_transition policy capability,
2409 * then we permit transitions under NNP or nosuid if the
2410 * policy allows the corresponding permission between
2411 * the old and new contexts.
2412 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002413 if (selinux_policycap_nnp_nosuid_transition()) {
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002414 av = 0;
2415 if (nnp)
2416 av |= PROCESS2__NNP_TRANSITION;
2417 if (nosuid)
2418 av |= PROCESS2__NOSUID_TRANSITION;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002419 rc = avc_has_perm(&selinux_state,
2420 old_tsec->sid, new_tsec->sid,
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002421 SECCLASS_PROCESS2, av, NULL);
2422 if (!rc)
2423 return 0;
2424 }
2425
2426 /*
2427 * We also permit NNP or nosuid transitions to bounded SIDs,
2428 * i.e. SIDs that are guaranteed to only be allowed a subset
2429 * of the permissions of the current SID.
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002430 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002431 rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2432 new_tsec->sid);
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002433 if (!rc)
2434 return 0;
2435
2436 /*
2437 * On failure, preserve the errno values for NNP vs nosuid.
2438 * NNP: Operation not permitted for caller.
2439 * nosuid: Permission denied to file.
2440 */
2441 if (nnp)
2442 return -EPERM;
2443 return -EACCES;
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002444}
2445
David Howellsa6f76f22008-11-14 10:39:24 +11002446static int selinux_bprm_set_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002447{
David Howellsa6f76f22008-11-14 10:39:24 +11002448 const struct task_security_struct *old_tsec;
2449 struct task_security_struct *new_tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002450 struct inode_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04002451 struct common_audit_data ad;
Al Viro496ad9a2013-01-23 17:07:38 -05002452 struct inode *inode = file_inode(bprm->file);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002453 int rc;
2454
David Howellsa6f76f22008-11-14 10:39:24 +11002455 /* SELinux context only depends on initial program or script and not
2456 * the script interpreter */
Kees Cookddb4a142017-07-18 15:25:23 -07002457 if (bprm->called_set_creds)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002458 return 0;
2459
David Howellsa6f76f22008-11-14 10:39:24 +11002460 old_tsec = current_security();
2461 new_tsec = bprm->cred->security;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002462 isec = inode_security(inode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002463
2464 /* Default to the current task SID. */
David Howellsa6f76f22008-11-14 10:39:24 +11002465 new_tsec->sid = old_tsec->sid;
2466 new_tsec->osid = old_tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002467
Michael LeMay28eba5b2006-06-27 02:53:42 -07002468 /* Reset fs, key, and sock SIDs on execve. */
David Howellsa6f76f22008-11-14 10:39:24 +11002469 new_tsec->create_sid = 0;
2470 new_tsec->keycreate_sid = 0;
2471 new_tsec->sockcreate_sid = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002472
David Howellsa6f76f22008-11-14 10:39:24 +11002473 if (old_tsec->exec_sid) {
2474 new_tsec->sid = old_tsec->exec_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002475 /* Reset exec SID on execve. */
David Howellsa6f76f22008-11-14 10:39:24 +11002476 new_tsec->exec_sid = 0;
Andy Lutomirski259e5e62012-04-12 16:47:50 -05002477
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002478 /* Fail on NNP or nosuid if not an allowed transition. */
2479 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2480 if (rc)
2481 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002482 } else {
2483 /* Check for a default transition on this program. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002484 rc = security_transition_sid(&selinux_state, old_tsec->sid,
2485 isec->sid, SECCLASS_PROCESS, NULL,
Eric Paris652bb9b2011-02-01 11:05:40 -05002486 &new_tsec->sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002487 if (rc)
2488 return rc;
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002489
2490 /*
2491 * Fallback to old SID on NNP or nosuid if not an allowed
2492 * transition.
2493 */
2494 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2495 if (rc)
2496 new_tsec->sid = old_tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002497 }
2498
Vivek Goyal43af5de2016-09-09 11:37:49 -04002499 ad.type = LSM_AUDIT_DATA_FILE;
2500 ad.u.file = bprm->file;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002501
David Howellsa6f76f22008-11-14 10:39:24 +11002502 if (new_tsec->sid == old_tsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002503 rc = avc_has_perm(&selinux_state,
2504 old_tsec->sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002505 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2506 if (rc)
2507 return rc;
2508 } else {
2509 /* Check permissions for the transition. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002510 rc = avc_has_perm(&selinux_state,
2511 old_tsec->sid, new_tsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002512 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2513 if (rc)
2514 return rc;
2515
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002516 rc = avc_has_perm(&selinux_state,
2517 new_tsec->sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002518 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2519 if (rc)
2520 return rc;
2521
David Howellsa6f76f22008-11-14 10:39:24 +11002522 /* Check for shared state */
2523 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002524 rc = avc_has_perm(&selinux_state,
2525 old_tsec->sid, new_tsec->sid,
David Howellsa6f76f22008-11-14 10:39:24 +11002526 SECCLASS_PROCESS, PROCESS__SHARE,
2527 NULL);
2528 if (rc)
2529 return -EPERM;
2530 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002531
David Howellsa6f76f22008-11-14 10:39:24 +11002532 /* Make sure that anyone attempting to ptrace over a task that
2533 * changes its SID has the appropriate permit */
Eric W. Biederman9227dd22017-01-23 17:26:31 +13002534 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002535 u32 ptsid = ptrace_parent_sid();
David Howellsa6f76f22008-11-14 10:39:24 +11002536 if (ptsid != 0) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002537 rc = avc_has_perm(&selinux_state,
2538 ptsid, new_tsec->sid,
David Howellsa6f76f22008-11-14 10:39:24 +11002539 SECCLASS_PROCESS,
2540 PROCESS__PTRACE, NULL);
2541 if (rc)
2542 return -EPERM;
2543 }
2544 }
2545
2546 /* Clear any possibly unsafe personality bits on exec: */
2547 bprm->per_clear |= PER_CLEAR_ON_SETID;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002548
Linus Torvalds1da177e2005-04-16 15:20:36 -07002549 /* Enable secure mode for SIDs transitions unless
2550 the noatsecure permission is granted between
2551 the two SIDs, i.e. ahp returns 0. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002552 rc = avc_has_perm(&selinux_state,
2553 old_tsec->sid, new_tsec->sid,
Kees Cook62874c32017-07-18 15:25:25 -07002554 SECCLASS_PROCESS, PROCESS__NOATSECURE,
2555 NULL);
2556 bprm->secureexec |= !!rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002557 }
2558
Kees Cook62874c32017-07-18 15:25:25 -07002559 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002560}
2561
Al Viroc3c073f2012-08-21 22:32:06 -04002562static int match_file(const void *p, struct file *file, unsigned fd)
2563{
2564 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2565}
2566
Linus Torvalds1da177e2005-04-16 15:20:36 -07002567/* Derived from fs/exec.c:flush_old_files. */
David Howells745ca242008-11-14 10:39:22 +11002568static inline void flush_unauthorized_files(const struct cred *cred,
2569 struct files_struct *files)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002570{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002571 struct file *file, *devnull = NULL;
Stephen Smalleyb20c8122006-09-25 23:32:03 -07002572 struct tty_struct *tty;
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002573 int drop_tty = 0;
Al Viroc3c073f2012-08-21 22:32:06 -04002574 unsigned n;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002575
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002576 tty = get_current_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002577 if (tty) {
Peter Hurley4a510962016-01-09 21:35:23 -08002578 spin_lock(&tty->files_lock);
Eric Paris37dd0bd2008-10-31 17:40:00 -04002579 if (!list_empty(&tty->tty_files)) {
Nick Piggind996b622010-08-18 04:37:36 +10002580 struct tty_file_private *file_priv;
Eric Paris37dd0bd2008-10-31 17:40:00 -04002581
Linus Torvalds1da177e2005-04-16 15:20:36 -07002582 /* Revalidate access to controlling tty.
David Howells13f8e982013-06-13 23:37:55 +01002583 Use file_path_has_perm on the tty path directly
2584 rather than using file_has_perm, as this particular
2585 open file may belong to another process and we are
2586 only interested in the inode-based check here. */
Nick Piggind996b622010-08-18 04:37:36 +10002587 file_priv = list_first_entry(&tty->tty_files,
2588 struct tty_file_private, list);
2589 file = file_priv->file;
David Howells13f8e982013-06-13 23:37:55 +01002590 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002591 drop_tty = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002592 }
Peter Hurley4a510962016-01-09 21:35:23 -08002593 spin_unlock(&tty->files_lock);
Alan Cox452a00d2008-10-13 10:39:13 +01002594 tty_kref_put(tty);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002595 }
Eric W. Biederman98a27ba2007-05-08 00:26:56 -07002596 /* Reset controlling tty. */
2597 if (drop_tty)
2598 no_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002599
2600 /* Revalidate access to inherited open files. */
Al Viroc3c073f2012-08-21 22:32:06 -04002601 n = iterate_fd(files, 0, match_file, cred);
2602 if (!n) /* none found? */
2603 return;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002604
Al Viroc3c073f2012-08-21 22:32:06 -04002605 devnull = dentry_open(&selinux_null, O_RDWR, cred);
Al Viro45525b22012-10-16 13:30:07 -04002606 if (IS_ERR(devnull))
2607 devnull = NULL;
2608 /* replace all the matching ones with this */
2609 do {
2610 replace_fd(n - 1, devnull, 0);
2611 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2612 if (devnull)
Al Viroc3c073f2012-08-21 22:32:06 -04002613 fput(devnull);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002614}
2615
Linus Torvalds1da177e2005-04-16 15:20:36 -07002616/*
David Howellsa6f76f22008-11-14 10:39:24 +11002617 * Prepare a process for imminent new credential changes due to exec
Linus Torvalds1da177e2005-04-16 15:20:36 -07002618 */
David Howellsa6f76f22008-11-14 10:39:24 +11002619static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002620{
David Howellsa6f76f22008-11-14 10:39:24 +11002621 struct task_security_struct *new_tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002622 struct rlimit *rlim, *initrlim;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002623 int rc, i;
2624
David Howellsa6f76f22008-11-14 10:39:24 +11002625 new_tsec = bprm->cred->security;
2626 if (new_tsec->sid == new_tsec->osid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002627 return;
2628
2629 /* Close files for which the new task SID is not authorized. */
David Howellsa6f76f22008-11-14 10:39:24 +11002630 flush_unauthorized_files(bprm->cred, current->files);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002631
David Howellsa6f76f22008-11-14 10:39:24 +11002632 /* Always clear parent death signal on SID transitions. */
2633 current->pdeath_signal = 0;
2634
2635 /* Check whether the new SID can inherit resource limits from the old
2636 * SID. If not, reset all soft limits to the lower of the current
2637 * task's hard limit and the init task's soft limit.
2638 *
2639 * Note that the setting of hard limits (even to lower them) can be
2640 * controlled by the setrlimit check. The inclusion of the init task's
2641 * soft limit into the computation is to avoid resetting soft limits
2642 * higher than the default soft limit for cases where the default is
2643 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2644 */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002645 rc = avc_has_perm(&selinux_state,
2646 new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
David Howellsa6f76f22008-11-14 10:39:24 +11002647 PROCESS__RLIMITINH, NULL);
2648 if (rc) {
Oleg Nesteroveb2d55a2010-06-23 22:43:32 +02002649 /* protect against do_prlimit() */
2650 task_lock(current);
David Howellsa6f76f22008-11-14 10:39:24 +11002651 for (i = 0; i < RLIM_NLIMITS; i++) {
2652 rlim = current->signal->rlim + i;
2653 initrlim = init_task.signal->rlim + i;
2654 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2655 }
Oleg Nesteroveb2d55a2010-06-23 22:43:32 +02002656 task_unlock(current);
Nicolas Pitrebaa73d92016-11-11 00:10:10 -05002657 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2658 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
David Howellsa6f76f22008-11-14 10:39:24 +11002659 }
2660}
2661
2662/*
2663 * Clean up the process immediately after the installation of new credentials
2664 * due to exec
2665 */
2666static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2667{
2668 const struct task_security_struct *tsec = current_security();
2669 struct itimerval itimer;
David Howellsa6f76f22008-11-14 10:39:24 +11002670 u32 osid, sid;
2671 int rc, i;
David Howellsa6f76f22008-11-14 10:39:24 +11002672
David Howellsa6f76f22008-11-14 10:39:24 +11002673 osid = tsec->osid;
2674 sid = tsec->sid;
2675
2676 if (sid == osid)
2677 return;
2678
2679 /* Check whether the new SID can inherit signal state from the old SID.
2680 * If not, clear itimers to avoid subsequent signal generation and
2681 * flush and unblock signals.
2682 *
2683 * This must occur _after_ the task SID has been updated so that any
2684 * kill done after the flush will be checked against the new SID.
2685 */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002686 rc = avc_has_perm(&selinux_state,
2687 osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002688 if (rc) {
Nicolas Pitrebaa73d92016-11-11 00:10:10 -05002689 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) {
2690 memset(&itimer, 0, sizeof itimer);
2691 for (i = 0; i < 3; i++)
2692 do_setitimer(i, &itimer, NULL);
2693 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002694 spin_lock_irq(&current->sighand->siglock);
Oleg Nesterov9e7c8f82015-06-04 16:22:16 -04002695 if (!fatal_signal_pending(current)) {
2696 flush_sigqueue(&current->pending);
2697 flush_sigqueue(&current->signal->shared_pending);
David Howells3bcac022009-04-29 13:45:05 +01002698 flush_signal_handlers(current, 1);
2699 sigemptyset(&current->blocked);
Oleg Nesterov9e7c8f82015-06-04 16:22:16 -04002700 recalc_sigpending();
David Howells3bcac022009-04-29 13:45:05 +01002701 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002702 spin_unlock_irq(&current->sighand->siglock);
2703 }
2704
David Howellsa6f76f22008-11-14 10:39:24 +11002705 /* Wake up the parent if it is waiting so that it can recheck
2706 * wait permission to the new task SID. */
Oleg Nesterovecd6de32009-04-29 16:02:24 +02002707 read_lock(&tasklist_lock);
Oleg Nesterov0b7570e2009-09-23 15:56:46 -07002708 __wake_up_parent(current, current->real_parent);
Oleg Nesterovecd6de32009-04-29 16:02:24 +02002709 read_unlock(&tasklist_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002710}
2711
2712/* superblock security operations */
2713
2714static int selinux_sb_alloc_security(struct super_block *sb)
2715{
2716 return superblock_alloc_security(sb);
2717}
2718
2719static void selinux_sb_free_security(struct super_block *sb)
2720{
2721 superblock_free_security(sb);
2722}
2723
2724static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2725{
2726 if (plen > olen)
2727 return 0;
2728
2729 return !memcmp(prefix, option, plen);
2730}
2731
2732static inline int selinux_option(char *option, int len)
2733{
Eric Paris832cbd92008-04-01 13:24:09 -04002734 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2735 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2736 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
David P. Quigley11689d42009-01-16 09:22:03 -05002737 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2738 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
Linus Torvalds1da177e2005-04-16 15:20:36 -07002739}
2740
2741static inline void take_option(char **to, char *from, int *first, int len)
2742{
2743 if (!*first) {
2744 **to = ',';
2745 *to += 1;
Cory Olmo3528a952006-09-29 01:58:44 -07002746 } else
Linus Torvalds1da177e2005-04-16 15:20:36 -07002747 *first = 0;
2748 memcpy(*to, from, len);
2749 *to += len;
2750}
2751
Eric Paris828dfe12008-04-17 13:17:49 -04002752static inline void take_selinux_option(char **to, char *from, int *first,
2753 int len)
Cory Olmo3528a952006-09-29 01:58:44 -07002754{
2755 int current_size = 0;
2756
2757 if (!*first) {
2758 **to = '|';
2759 *to += 1;
Eric Paris828dfe12008-04-17 13:17:49 -04002760 } else
Cory Olmo3528a952006-09-29 01:58:44 -07002761 *first = 0;
2762
2763 while (current_size < len) {
2764 if (*from != '"') {
2765 **to = *from;
2766 *to += 1;
2767 }
2768 from += 1;
2769 current_size += 1;
2770 }
2771}
2772
Eric Parise0007522008-03-05 10:31:54 -05002773static int selinux_sb_copy_data(char *orig, char *copy)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002774{
2775 int fnosec, fsec, rc = 0;
2776 char *in_save, *in_curr, *in_end;
2777 char *sec_curr, *nosec_save, *nosec;
Cory Olmo3528a952006-09-29 01:58:44 -07002778 int open_quote = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002779
2780 in_curr = orig;
2781 sec_curr = copy;
2782
Linus Torvalds1da177e2005-04-16 15:20:36 -07002783 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2784 if (!nosec) {
2785 rc = -ENOMEM;
2786 goto out;
2787 }
2788
2789 nosec_save = nosec;
2790 fnosec = fsec = 1;
2791 in_save = in_end = orig;
2792
2793 do {
Cory Olmo3528a952006-09-29 01:58:44 -07002794 if (*in_end == '"')
2795 open_quote = !open_quote;
2796 if ((*in_end == ',' && open_quote == 0) ||
2797 *in_end == '\0') {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002798 int len = in_end - in_curr;
2799
2800 if (selinux_option(in_curr, len))
Cory Olmo3528a952006-09-29 01:58:44 -07002801 take_selinux_option(&sec_curr, in_curr, &fsec, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002802 else
2803 take_option(&nosec, in_curr, &fnosec, len);
2804
2805 in_curr = in_end + 1;
2806 }
2807 } while (*in_end++);
2808
Eric Paris6931dfc2005-06-30 02:58:51 -07002809 strcpy(in_save, nosec_save);
Gerald Schaeferda3caa22005-06-21 17:15:18 -07002810 free_page((unsigned long)nosec_save);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002811out:
2812 return rc;
2813}
2814
Al Viroc039bc32018-12-01 23:06:57 -05002815static int selinux_sb_remount(struct super_block *sb,
2816 struct security_mnt_opts *opts)
Eric Paris026eb162011-03-03 16:09:14 -05002817{
Al Viroc039bc32018-12-01 23:06:57 -05002818 int i, *flags;
2819 char **mount_options;
Eric Paris026eb162011-03-03 16:09:14 -05002820 struct superblock_security_struct *sbsec = sb->s_security;
2821
2822 if (!(sbsec->flags & SE_SBINITIALIZED))
2823 return 0;
2824
Al Viroc039bc32018-12-01 23:06:57 -05002825 mount_options = opts->mnt_opts;
2826 flags = opts->mnt_opts_flags;
Eric Paris026eb162011-03-03 16:09:14 -05002827
Al Viroc039bc32018-12-01 23:06:57 -05002828 for (i = 0; i < opts->num_mnt_opts; i++) {
Eric Paris026eb162011-03-03 16:09:14 -05002829 u32 sid;
Al Viroc039bc32018-12-01 23:06:57 -05002830 int rc;
Eric Paris026eb162011-03-03 16:09:14 -05002831
Eric Paris12f348b2012-10-09 10:56:25 -04002832 if (flags[i] == SBLABEL_MNT)
Eric Paris026eb162011-03-03 16:09:14 -05002833 continue;
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002834 rc = security_context_str_to_sid(&selinux_state,
2835 mount_options[i], &sid,
2836 GFP_KERNEL);
Eric Paris026eb162011-03-03 16:09:14 -05002837 if (rc) {
peter enderborgc103a912018-06-12 10:09:03 +02002838 pr_warn("SELinux: security_context_str_to_sid"
Linus Torvalds29b1deb2013-12-15 11:17:45 -08002839 "(%s) failed for (dev %s, type %s) errno=%d\n",
2840 mount_options[i], sb->s_id, sb->s_type->name, rc);
Al Viroc039bc32018-12-01 23:06:57 -05002841 return rc;
Eric Paris026eb162011-03-03 16:09:14 -05002842 }
Eric Paris026eb162011-03-03 16:09:14 -05002843 switch (flags[i]) {
2844 case FSCONTEXT_MNT:
2845 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2846 goto out_bad_option;
2847 break;
2848 case CONTEXT_MNT:
2849 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2850 goto out_bad_option;
2851 break;
2852 case ROOTCONTEXT_MNT: {
2853 struct inode_security_struct *root_isec;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002854 root_isec = backing_inode_security(sb->s_root);
Eric Paris026eb162011-03-03 16:09:14 -05002855
2856 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2857 goto out_bad_option;
2858 break;
2859 }
2860 case DEFCONTEXT_MNT:
2861 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2862 goto out_bad_option;
2863 break;
2864 default:
Al Viroc039bc32018-12-01 23:06:57 -05002865 return -EINVAL;
Eric Paris026eb162011-03-03 16:09:14 -05002866 }
2867 }
Al Viroc039bc32018-12-01 23:06:57 -05002868 return 0;
Eric Paris026eb162011-03-03 16:09:14 -05002869
Eric Paris026eb162011-03-03 16:09:14 -05002870out_bad_option:
peter enderborgc103a912018-06-12 10:09:03 +02002871 pr_warn("SELinux: unable to change security options "
Linus Torvalds29b1deb2013-12-15 11:17:45 -08002872 "during remount (dev %s, type=%s)\n", sb->s_id,
2873 sb->s_type->name);
Al Viroc039bc32018-12-01 23:06:57 -05002874 return -EINVAL;
Eric Paris026eb162011-03-03 16:09:14 -05002875}
2876
Al Viroa10d7c22018-12-05 11:58:35 -05002877static int selinux_sb_kern_mount(struct super_block *sb)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002878{
David Howells88e67f32008-11-14 10:39:21 +11002879 const struct cred *cred = current_cred();
Thomas Liu2bf49692009-07-14 12:14:09 -04002880 struct common_audit_data ad;
James Morris74192242008-12-19 11:41:10 +11002881
Eric Paris50c205f2012-04-04 15:01:43 -04002882 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04002883 ad.u.dentry = sb->s_root;
David Howells88e67f32008-11-14 10:39:21 +11002884 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002885}
2886
David Howells726c3342006-06-23 02:02:58 -07002887static int selinux_sb_statfs(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002888{
David Howells88e67f32008-11-14 10:39:21 +11002889 const struct cred *cred = current_cred();
Thomas Liu2bf49692009-07-14 12:14:09 -04002890 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002891
Eric Paris50c205f2012-04-04 15:01:43 -04002892 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04002893 ad.u.dentry = dentry->d_sb->s_root;
David Howells88e67f32008-11-14 10:39:21 +11002894 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002895}
2896
Al Viro808d4e32012-10-11 11:42:01 -04002897static int selinux_mount(const char *dev_name,
Al Viro8a04c432016-03-25 14:52:53 -04002898 const struct path *path,
Al Viro808d4e32012-10-11 11:42:01 -04002899 const char *type,
Eric Paris828dfe12008-04-17 13:17:49 -04002900 unsigned long flags,
2901 void *data)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002902{
David Howells88e67f32008-11-14 10:39:21 +11002903 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002904
2905 if (flags & MS_REMOUNT)
Al Virod8c95842011-12-07 18:16:57 -05002906 return superblock_has_perm(cred, path->dentry->d_sb,
Eric Paris828dfe12008-04-17 13:17:49 -04002907 FILESYSTEM__REMOUNT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002908 else
Eric Paris2875fa02011-04-28 16:04:24 -04002909 return path_has_perm(cred, path, FILE__MOUNTON);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002910}
2911
2912static int selinux_umount(struct vfsmount *mnt, int flags)
2913{
David Howells88e67f32008-11-14 10:39:21 +11002914 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002915
David Howells88e67f32008-11-14 10:39:21 +11002916 return superblock_has_perm(cred, mnt->mnt_sb,
Eric Paris828dfe12008-04-17 13:17:49 -04002917 FILESYSTEM__UNMOUNT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002918}
2919
2920/* inode security operations */
2921
2922static int selinux_inode_alloc_security(struct inode *inode)
2923{
2924 return inode_alloc_security(inode);
2925}
2926
2927static void selinux_inode_free_security(struct inode *inode)
2928{
2929 inode_free_security(inode);
2930}
2931
David Quigleyd47be3d2013-05-22 12:50:34 -04002932static int selinux_dentry_init_security(struct dentry *dentry, int mode,
Al Viro4f3ccd72016-07-20 16:06:15 -04002933 const struct qstr *name, void **ctx,
David Quigleyd47be3d2013-05-22 12:50:34 -04002934 u32 *ctxlen)
2935{
David Quigleyd47be3d2013-05-22 12:50:34 -04002936 u32 newsid;
2937 int rc;
2938
Vivek Goyalc957f6d2016-07-13 10:44:51 -04002939 rc = selinux_determine_inode_label(current_security(),
2940 d_inode(dentry->d_parent), name,
David Howellsc3c188b2015-07-10 17:19:58 -04002941 inode_mode_to_security_class(mode),
2942 &newsid);
2943 if (rc)
2944 return rc;
David Quigleyd47be3d2013-05-22 12:50:34 -04002945
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002946 return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
2947 ctxlen);
David Quigleyd47be3d2013-05-22 12:50:34 -04002948}
2949
Vivek Goyala518b0a2016-07-13 10:44:53 -04002950static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2951 struct qstr *name,
2952 const struct cred *old,
2953 struct cred *new)
2954{
2955 u32 newsid;
2956 int rc;
2957 struct task_security_struct *tsec;
2958
2959 rc = selinux_determine_inode_label(old->security,
2960 d_inode(dentry->d_parent), name,
2961 inode_mode_to_security_class(mode),
2962 &newsid);
2963 if (rc)
2964 return rc;
2965
2966 tsec = new->security;
2967 tsec->create_sid = newsid;
2968 return 0;
2969}
2970
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002971static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
Tetsuo Handa95489062013-07-25 05:44:02 +09002972 const struct qstr *qstr,
2973 const char **name,
Eric Paris2a7dba32011-02-01 11:05:39 -05002974 void **value, size_t *len)
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002975{
Paul Moore5fb49872010-04-22 14:46:19 -04002976 const struct task_security_struct *tsec = current_security();
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002977 struct superblock_security_struct *sbsec;
Corentin LABBEc0d4f462017-10-04 20:32:17 +02002978 u32 newsid, clen;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002979 int rc;
Tetsuo Handa95489062013-07-25 05:44:02 +09002980 char *context;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002981
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002982 sbsec = dir->i_sb->s_security;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002983
David Howells275bb412008-11-14 10:39:19 +11002984 newsid = tsec->create_sid;
2985
Vivek Goyalc957f6d2016-07-13 10:44:51 -04002986 rc = selinux_determine_inode_label(current_security(),
David Howellsc3c188b2015-07-10 17:19:58 -04002987 dir, qstr,
2988 inode_mode_to_security_class(inode->i_mode),
2989 &newsid);
2990 if (rc)
2991 return rc;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002992
Eric Paris296fddf2006-09-25 23:32:00 -07002993 /* Possibly defer initialization to selinux_complete_init. */
David P. Quigley0d90a7e2009-01-16 09:22:02 -05002994 if (sbsec->flags & SE_SBINITIALIZED) {
Eric Paris296fddf2006-09-25 23:32:00 -07002995 struct inode_security_struct *isec = inode->i_security;
2996 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2997 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05002998 isec->initialized = LABEL_INITIALIZED;
Eric Paris296fddf2006-09-25 23:32:00 -07002999 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003000
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003001 if (!selinux_state.initialized || !(sbsec->flags & SBLABEL_MNT))
Stephen Smalley25a74f32005-11-08 21:34:33 -08003002 return -EOPNOTSUPP;
3003
Tetsuo Handa95489062013-07-25 05:44:02 +09003004 if (name)
3005 *name = XATTR_SELINUX_SUFFIX;
Stephen Smalley570bc1c2005-09-09 13:01:43 -07003006
3007 if (value && len) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003008 rc = security_sid_to_context_force(&selinux_state, newsid,
3009 &context, &clen);
Tetsuo Handa95489062013-07-25 05:44:02 +09003010 if (rc)
Stephen Smalley570bc1c2005-09-09 13:01:43 -07003011 return rc;
Stephen Smalley570bc1c2005-09-09 13:01:43 -07003012 *value = context;
3013 *len = clen;
3014 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003015
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003016 return 0;
3017}
3018
Al Viro4acdaf22011-07-26 01:42:34 -04003019static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003020{
3021 return may_create(dir, dentry, SECCLASS_FILE);
3022}
3023
Linus Torvalds1da177e2005-04-16 15:20:36 -07003024static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
3025{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003026 return may_link(dir, old_dentry, MAY_LINK);
3027}
3028
Linus Torvalds1da177e2005-04-16 15:20:36 -07003029static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
3030{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003031 return may_link(dir, dentry, MAY_UNLINK);
3032}
3033
3034static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
3035{
3036 return may_create(dir, dentry, SECCLASS_LNK_FILE);
3037}
3038
Al Viro18bb1db2011-07-26 01:41:39 -04003039static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003040{
3041 return may_create(dir, dentry, SECCLASS_DIR);
3042}
3043
Linus Torvalds1da177e2005-04-16 15:20:36 -07003044static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
3045{
3046 return may_link(dir, dentry, MAY_RMDIR);
3047}
3048
Al Viro1a67aaf2011-07-26 01:52:52 -04003049static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003050{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003051 return may_create(dir, dentry, inode_mode_to_security_class(mode));
3052}
3053
Linus Torvalds1da177e2005-04-16 15:20:36 -07003054static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
Eric Paris828dfe12008-04-17 13:17:49 -04003055 struct inode *new_inode, struct dentry *new_dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003056{
3057 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
3058}
3059
Linus Torvalds1da177e2005-04-16 15:20:36 -07003060static int selinux_inode_readlink(struct dentry *dentry)
3061{
David Howells88e67f32008-11-14 10:39:21 +11003062 const struct cred *cred = current_cred();
3063
Eric Paris2875fa02011-04-28 16:04:24 -04003064 return dentry_has_perm(cred, dentry, FILE__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003065}
3066
NeilBrownbda0be72015-03-23 13:37:39 +11003067static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
3068 bool rcu)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003069{
David Howells88e67f32008-11-14 10:39:21 +11003070 const struct cred *cred = current_cred();
NeilBrownbda0be72015-03-23 13:37:39 +11003071 struct common_audit_data ad;
3072 struct inode_security_struct *isec;
3073 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003074
NeilBrownbda0be72015-03-23 13:37:39 +11003075 validate_creds(cred);
3076
3077 ad.type = LSM_AUDIT_DATA_DENTRY;
3078 ad.u.dentry = dentry;
3079 sid = cred_sid(cred);
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05003080 isec = inode_security_rcu(inode, rcu);
3081 if (IS_ERR(isec))
3082 return PTR_ERR(isec);
NeilBrownbda0be72015-03-23 13:37:39 +11003083
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003084 return avc_has_perm_flags(&selinux_state,
3085 sid, isec->sid, isec->sclass, FILE__READ, &ad,
NeilBrownbda0be72015-03-23 13:37:39 +11003086 rcu ? MAY_NOT_BLOCK : 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003087}
3088
Eric Parisd4cf970d2012-04-04 15:01:42 -04003089static noinline int audit_inode_permission(struct inode *inode,
3090 u32 perms, u32 audited, u32 denied,
Stephen Smalley626b9742014-04-29 11:29:04 -07003091 int result,
Eric Parisd4cf970d2012-04-04 15:01:42 -04003092 unsigned flags)
3093{
3094 struct common_audit_data ad;
Eric Parisd4cf970d2012-04-04 15:01:42 -04003095 struct inode_security_struct *isec = inode->i_security;
3096 int rc;
3097
Eric Paris50c205f2012-04-04 15:01:43 -04003098 ad.type = LSM_AUDIT_DATA_INODE;
Eric Parisd4cf970d2012-04-04 15:01:42 -04003099 ad.u.inode = inode;
3100
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003101 rc = slow_avc_audit(&selinux_state,
3102 current_sid(), isec->sid, isec->sclass, perms,
Stephen Smalley626b9742014-04-29 11:29:04 -07003103 audited, denied, result, &ad, flags);
Eric Parisd4cf970d2012-04-04 15:01:42 -04003104 if (rc)
3105 return rc;
3106 return 0;
3107}
3108
Al Viroe74f71e2011-06-20 19:38:15 -04003109static int selinux_inode_permission(struct inode *inode, int mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003110{
David Howells88e67f32008-11-14 10:39:21 +11003111 const struct cred *cred = current_cred();
Eric Parisb782e0a2010-07-23 11:44:03 -04003112 u32 perms;
3113 bool from_access;
Al Virocf1dd1d2011-06-20 19:44:08 -04003114 unsigned flags = mask & MAY_NOT_BLOCK;
Eric Paris2e334052012-04-04 15:01:42 -04003115 struct inode_security_struct *isec;
3116 u32 sid;
3117 struct av_decision avd;
3118 int rc, rc2;
3119 u32 audited, denied;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003120
Eric Parisb782e0a2010-07-23 11:44:03 -04003121 from_access = mask & MAY_ACCESS;
Eric Parisd09ca732010-07-23 11:43:57 -04003122 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3123
Eric Parisb782e0a2010-07-23 11:44:03 -04003124 /* No permission to check. Existence test. */
3125 if (!mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003126 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003127
Eric Paris2e334052012-04-04 15:01:42 -04003128 validate_creds(cred);
Eric Parisb782e0a2010-07-23 11:44:03 -04003129
Eric Paris2e334052012-04-04 15:01:42 -04003130 if (unlikely(IS_PRIVATE(inode)))
3131 return 0;
Eric Parisb782e0a2010-07-23 11:44:03 -04003132
3133 perms = file_mask_to_av(inode->i_mode, mask);
3134
Eric Paris2e334052012-04-04 15:01:42 -04003135 sid = cred_sid(cred);
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05003136 isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3137 if (IS_ERR(isec))
3138 return PTR_ERR(isec);
Eric Paris2e334052012-04-04 15:01:42 -04003139
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003140 rc = avc_has_perm_noaudit(&selinux_state,
3141 sid, isec->sid, isec->sclass, perms, 0, &avd);
Eric Paris2e334052012-04-04 15:01:42 -04003142 audited = avc_audit_required(perms, &avd, rc,
3143 from_access ? FILE__AUDIT_ACCESS : 0,
3144 &denied);
3145 if (likely(!audited))
3146 return rc;
3147
Stephen Smalley626b9742014-04-29 11:29:04 -07003148 rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
Eric Paris2e334052012-04-04 15:01:42 -04003149 if (rc2)
3150 return rc2;
3151 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003152}
3153
3154static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3155{
David Howells88e67f32008-11-14 10:39:21 +11003156 const struct cred *cred = current_cred();
Stephen Smalleyccb54472017-05-12 12:41:24 -04003157 struct inode *inode = d_backing_inode(dentry);
Amerigo Wangbc6a6002009-08-20 19:29:02 -07003158 unsigned int ia_valid = iattr->ia_valid;
Eric Paris95dbf732012-04-04 13:45:34 -04003159 __u32 av = FILE__WRITE;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003160
Amerigo Wangbc6a6002009-08-20 19:29:02 -07003161 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3162 if (ia_valid & ATTR_FORCE) {
3163 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3164 ATTR_FORCE);
3165 if (!ia_valid)
3166 return 0;
3167 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003168
Amerigo Wangbc6a6002009-08-20 19:29:02 -07003169 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3170 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
Eric Paris2875fa02011-04-28 16:04:24 -04003171 return dentry_has_perm(cred, dentry, FILE__SETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003172
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003173 if (selinux_policycap_openperm() &&
Stephen Smalleyccb54472017-05-12 12:41:24 -04003174 inode->i_sb->s_magic != SOCKFS_MAGIC &&
3175 (ia_valid & ATTR_SIZE) &&
3176 !(ia_valid & ATTR_FILE))
Eric Paris95dbf732012-04-04 13:45:34 -04003177 av |= FILE__OPEN;
3178
3179 return dentry_has_perm(cred, dentry, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003180}
3181
Al Viro3f7036a2015-03-08 19:28:30 -04003182static int selinux_inode_getattr(const struct path *path)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003183{
Al Viro3f7036a2015-03-08 19:28:30 -04003184 return path_has_perm(current_cred(), path, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003185}
3186
Stephen Smalleydb590002017-04-20 11:31:30 -04003187static bool has_cap_mac_admin(bool audit)
3188{
3189 const struct cred *cred = current_cred();
3190 int cap_audit = audit ? SECURITY_CAP_AUDIT : SECURITY_CAP_NOAUDIT;
3191
3192 if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, cap_audit))
3193 return false;
3194 if (cred_has_capability(cred, CAP_MAC_ADMIN, cap_audit, true))
3195 return false;
3196 return true;
3197}
3198
David Howells8f0cfa52008-04-29 00:59:41 -07003199static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3200 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003201{
David Howellsc6f493d2015-03-17 22:26:22 +00003202 struct inode *inode = d_backing_inode(dentry);
Paul Moore20cdef82016-04-04 14:14:42 -04003203 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003204 struct superblock_security_struct *sbsec;
Thomas Liu2bf49692009-07-14 12:14:09 -04003205 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11003206 u32 newsid, sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003207 int rc = 0;
3208
Eric W. Biederman6b240302017-10-02 09:38:20 -05003209 if (strcmp(name, XATTR_NAME_SELINUX)) {
3210 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3211 if (rc)
3212 return rc;
3213
3214 /* Not an attribute we recognize, so just check the
3215 ordinary setattr permission. */
3216 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3217 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003218
3219 sbsec = inode->i_sb->s_security;
Eric Paris12f348b2012-10-09 10:56:25 -04003220 if (!(sbsec->flags & SBLABEL_MNT))
Linus Torvalds1da177e2005-04-16 15:20:36 -07003221 return -EOPNOTSUPP;
3222
Serge E. Hallyn2e149672011-03-23 16:43:26 -07003223 if (!inode_owner_or_capable(inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -07003224 return -EPERM;
3225
Eric Paris50c205f2012-04-04 15:01:43 -04003226 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04003227 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003228
Paul Moore20cdef82016-04-04 14:14:42 -04003229 isec = backing_inode_security(dentry);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003230 rc = avc_has_perm(&selinux_state,
3231 sid, isec->sid, isec->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003232 FILE__RELABELFROM, &ad);
3233 if (rc)
3234 return rc;
3235
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003236 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3237 GFP_KERNEL);
Stephen Smalley12b29f32008-05-07 13:03:20 -04003238 if (rc == -EINVAL) {
Stephen Smalleydb590002017-04-20 11:31:30 -04003239 if (!has_cap_mac_admin(true)) {
Eric Parisd6ea83e2012-04-04 13:45:49 -04003240 struct audit_buffer *ab;
3241 size_t audit_size;
Eric Parisd6ea83e2012-04-04 13:45:49 -04003242
3243 /* We strip a nul only if it is at the end, otherwise the
3244 * context contains a nul and we should audit that */
Al Viroe3fea3f2012-06-09 08:15:16 +01003245 if (value) {
Colin Ian Kingadd24372017-10-14 13:46:55 +01003246 const char *str = value;
3247
Al Viroe3fea3f2012-06-09 08:15:16 +01003248 if (str[size - 1] == '\0')
3249 audit_size = size - 1;
3250 else
3251 audit_size = size;
3252 } else {
Al Viroe3fea3f2012-06-09 08:15:16 +01003253 audit_size = 0;
3254 }
Richard Guy Briggscdfb6b32018-05-12 21:58:20 -04003255 ab = audit_log_start(audit_context(),
3256 GFP_ATOMIC, AUDIT_SELINUX_ERR);
Eric Parisd6ea83e2012-04-04 13:45:49 -04003257 audit_log_format(ab, "op=setxattr invalid_context=");
3258 audit_log_n_untrustedstring(ab, value, audit_size);
3259 audit_log_end(ab);
3260
Stephen Smalley12b29f32008-05-07 13:03:20 -04003261 return rc;
Eric Parisd6ea83e2012-04-04 13:45:49 -04003262 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003263 rc = security_context_to_sid_force(&selinux_state, value,
3264 size, &newsid);
Stephen Smalley12b29f32008-05-07 13:03:20 -04003265 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003266 if (rc)
3267 return rc;
3268
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003269 rc = avc_has_perm(&selinux_state,
3270 sid, newsid, isec->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003271 FILE__RELABELTO, &ad);
3272 if (rc)
3273 return rc;
3274
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003275 rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3276 sid, isec->sclass);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003277 if (rc)
3278 return rc;
3279
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003280 return avc_has_perm(&selinux_state,
3281 newsid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003282 sbsec->sid,
3283 SECCLASS_FILESYSTEM,
3284 FILESYSTEM__ASSOCIATE,
3285 &ad);
3286}
3287
David Howells8f0cfa52008-04-29 00:59:41 -07003288static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
Eric Parisf5269712008-05-14 11:27:45 -04003289 const void *value, size_t size,
David Howells8f0cfa52008-04-29 00:59:41 -07003290 int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003291{
David Howellsc6f493d2015-03-17 22:26:22 +00003292 struct inode *inode = d_backing_inode(dentry);
Paul Moore20cdef82016-04-04 14:14:42 -04003293 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003294 u32 newsid;
3295 int rc;
3296
3297 if (strcmp(name, XATTR_NAME_SELINUX)) {
3298 /* Not an attribute we recognize, so nothing to do. */
3299 return;
3300 }
3301
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003302 rc = security_context_to_sid_force(&selinux_state, value, size,
3303 &newsid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003304 if (rc) {
peter enderborgc103a912018-06-12 10:09:03 +02003305 pr_err("SELinux: unable to map context to SID"
Stephen Smalley12b29f32008-05-07 13:03:20 -04003306 "for (%s, %lu), rc=%d\n",
3307 inode->i_sb->s_id, inode->i_ino, -rc);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003308 return;
3309 }
3310
Paul Moore20cdef82016-04-04 14:14:42 -04003311 isec = backing_inode_security(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003312 spin_lock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003313 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003314 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05003315 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003316 spin_unlock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003317
Linus Torvalds1da177e2005-04-16 15:20:36 -07003318 return;
3319}
3320
David Howells8f0cfa52008-04-29 00:59:41 -07003321static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003322{
David Howells88e67f32008-11-14 10:39:21 +11003323 const struct cred *cred = current_cred();
3324
Eric Paris2875fa02011-04-28 16:04:24 -04003325 return dentry_has_perm(cred, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003326}
3327
Eric Paris828dfe12008-04-17 13:17:49 -04003328static int selinux_inode_listxattr(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003329{
David Howells88e67f32008-11-14 10:39:21 +11003330 const struct cred *cred = current_cred();
3331
Eric Paris2875fa02011-04-28 16:04:24 -04003332 return dentry_has_perm(cred, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003333}
3334
David Howells8f0cfa52008-04-29 00:59:41 -07003335static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003336{
Eric W. Biederman6b240302017-10-02 09:38:20 -05003337 if (strcmp(name, XATTR_NAME_SELINUX)) {
3338 int rc = cap_inode_removexattr(dentry, name);
3339 if (rc)
3340 return rc;
3341
3342 /* Not an attribute we recognize, so just check the
3343 ordinary setattr permission. */
3344 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3345 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003346
3347 /* No one is allowed to remove a SELinux security label.
3348 You can change the label, but all data must be labeled. */
3349 return -EACCES;
3350}
3351
James Morrisd381d8a2005-10-30 14:59:22 -08003352/*
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003353 * Copy the inode security context value to the user.
James Morrisd381d8a2005-10-30 14:59:22 -08003354 *
3355 * Permission check is handled by selinux_inode_getxattr hook.
3356 */
Andreas Gruenbacherea861df2015-12-24 11:09:39 -05003357static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003358{
David P. Quigley42492592008-02-04 22:29:39 -08003359 u32 size;
3360 int error;
3361 char *context = NULL;
Paul Moore20cdef82016-04-04 14:14:42 -04003362 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003363
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00003364 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3365 return -EOPNOTSUPP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003366
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003367 /*
3368 * If the caller has CAP_MAC_ADMIN, then get the raw context
3369 * value even if it is not defined by current policy; otherwise,
3370 * use the in-core value under current policy.
3371 * Use the non-auditing forms of the permission checks since
3372 * getxattr may be called by unprivileged processes commonly
3373 * and lack of permission just means that we fall back to the
3374 * in-core context value, not a denial.
3375 */
Paul Moore20cdef82016-04-04 14:14:42 -04003376 isec = inode_security(inode);
Stephen Smalleydb590002017-04-20 11:31:30 -04003377 if (has_cap_mac_admin(false))
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003378 error = security_sid_to_context_force(&selinux_state,
3379 isec->sid, &context,
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003380 &size);
3381 else
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003382 error = security_sid_to_context(&selinux_state, isec->sid,
3383 &context, &size);
David P. Quigley42492592008-02-04 22:29:39 -08003384 if (error)
3385 return error;
3386 error = size;
3387 if (alloc) {
3388 *buffer = context;
3389 goto out_nofree;
3390 }
3391 kfree(context);
3392out_nofree:
3393 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003394}
3395
3396static int selinux_inode_setsecurity(struct inode *inode, const char *name,
Eric Paris828dfe12008-04-17 13:17:49 -04003397 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003398{
Paul Moore2c971652016-04-19 16:36:28 -04003399 struct inode_security_struct *isec = inode_security_novalidate(inode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003400 u32 newsid;
3401 int rc;
3402
3403 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3404 return -EOPNOTSUPP;
3405
3406 if (!value || !size)
3407 return -EACCES;
3408
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003409 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3410 GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003411 if (rc)
3412 return rc;
3413
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003414 spin_lock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003415 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003416 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05003417 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003418 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003419 return 0;
3420}
3421
3422static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3423{
3424 const int len = sizeof(XATTR_NAME_SELINUX);
3425 if (buffer && len <= buffer_size)
3426 memcpy(buffer, XATTR_NAME_SELINUX, len);
3427 return len;
3428}
3429
Andreas Gruenbacherd6335d72015-12-24 11:09:39 -05003430static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02003431{
Andreas Gruenbachere817c2f2016-02-18 12:04:08 +01003432 struct inode_security_struct *isec = inode_security_novalidate(inode);
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02003433 *secid = isec->sid;
3434}
3435
Vivek Goyal56909eb2016-07-13 10:44:48 -04003436static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3437{
3438 u32 sid;
3439 struct task_security_struct *tsec;
3440 struct cred *new_creds = *new;
3441
3442 if (new_creds == NULL) {
3443 new_creds = prepare_creds();
3444 if (!new_creds)
3445 return -ENOMEM;
3446 }
3447
3448 tsec = new_creds->security;
3449 /* Get label from overlay inode and set it in create_sid */
3450 selinux_inode_getsecid(d_inode(src), &sid);
3451 tsec->create_sid = sid;
3452 *new = new_creds;
3453 return 0;
3454}
3455
Vivek Goyal19472b62016-07-13 10:44:50 -04003456static int selinux_inode_copy_up_xattr(const char *name)
3457{
3458 /* The copy_up hook above sets the initial context on an inode, but we
3459 * don't then want to overwrite it by blindly copying all the lower
3460 * xattrs up. Instead, we have to filter out SELinux-related xattrs.
3461 */
3462 if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3463 return 1; /* Discard */
3464 /*
3465 * Any other attribute apart from SELINUX is not claimed, supported
3466 * by selinux.
3467 */
3468 return -EOPNOTSUPP;
3469}
3470
Linus Torvalds1da177e2005-04-16 15:20:36 -07003471/* file security operations */
3472
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003473static int selinux_revalidate_file_permission(struct file *file, int mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003474{
David Howells88e67f32008-11-14 10:39:21 +11003475 const struct cred *cred = current_cred();
Al Viro496ad9a2013-01-23 17:07:38 -05003476 struct inode *inode = file_inode(file);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003477
Linus Torvalds1da177e2005-04-16 15:20:36 -07003478 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3479 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3480 mask |= MAY_APPEND;
3481
Paul Moore389fb8002009-03-27 17:10:34 -04003482 return file_has_perm(cred, file,
3483 file_mask_to_av(inode->i_mode, mask));
Linus Torvalds1da177e2005-04-16 15:20:36 -07003484}
3485
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003486static int selinux_file_permission(struct file *file, int mask)
3487{
Al Viro496ad9a2013-01-23 17:07:38 -05003488 struct inode *inode = file_inode(file);
Stephen Smalley20dda182009-06-22 14:54:53 -04003489 struct file_security_struct *fsec = file->f_security;
Andreas Gruenbacherb1973672016-01-05 23:12:33 +01003490 struct inode_security_struct *isec;
Stephen Smalley20dda182009-06-22 14:54:53 -04003491 u32 sid = current_sid();
3492
Paul Moore389fb8002009-03-27 17:10:34 -04003493 if (!mask)
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003494 /* No permission to check. Existence test. */
3495 return 0;
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003496
Andreas Gruenbacherb1973672016-01-05 23:12:33 +01003497 isec = inode_security(inode);
Stephen Smalley20dda182009-06-22 14:54:53 -04003498 if (sid == fsec->sid && fsec->isid == isec->sid &&
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003499 fsec->pseqno == avc_policy_seqno(&selinux_state))
Eric Paris83d49852012-04-04 13:45:40 -04003500 /* No change since file_open check. */
Stephen Smalley20dda182009-06-22 14:54:53 -04003501 return 0;
3502
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003503 return selinux_revalidate_file_permission(file, mask);
3504}
3505
Linus Torvalds1da177e2005-04-16 15:20:36 -07003506static int selinux_file_alloc_security(struct file *file)
3507{
3508 return file_alloc_security(file);
3509}
3510
3511static void selinux_file_free_security(struct file *file)
3512{
3513 file_free_security(file);
3514}
3515
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003516/*
3517 * Check whether a task has the ioctl permission and cmd
3518 * operation to an inode.
3519 */
Geliang Tang1d2a1682015-10-21 17:44:27 -04003520static int ioctl_has_perm(const struct cred *cred, struct file *file,
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003521 u32 requested, u16 cmd)
3522{
3523 struct common_audit_data ad;
3524 struct file_security_struct *fsec = file->f_security;
3525 struct inode *inode = file_inode(file);
Paul Moore20cdef82016-04-04 14:14:42 -04003526 struct inode_security_struct *isec;
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003527 struct lsm_ioctlop_audit ioctl;
3528 u32 ssid = cred_sid(cred);
3529 int rc;
3530 u8 driver = cmd >> 8;
3531 u8 xperm = cmd & 0xff;
3532
3533 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3534 ad.u.op = &ioctl;
3535 ad.u.op->cmd = cmd;
3536 ad.u.op->path = file->f_path;
3537
3538 if (ssid != fsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003539 rc = avc_has_perm(&selinux_state,
3540 ssid, fsec->sid,
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003541 SECCLASS_FD,
3542 FD__USE,
3543 &ad);
3544 if (rc)
3545 goto out;
3546 }
3547
3548 if (unlikely(IS_PRIVATE(inode)))
3549 return 0;
3550
Paul Moore20cdef82016-04-04 14:14:42 -04003551 isec = inode_security(inode);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003552 rc = avc_has_extended_perms(&selinux_state,
3553 ssid, isec->sid, isec->sclass,
3554 requested, driver, xperm, &ad);
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003555out:
3556 return rc;
3557}
3558
Linus Torvalds1da177e2005-04-16 15:20:36 -07003559static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3560 unsigned long arg)
3561{
David Howells88e67f32008-11-14 10:39:21 +11003562 const struct cred *cred = current_cred();
Eric Paris0b24dcb2011-02-25 15:39:20 -05003563 int error = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003564
Eric Paris0b24dcb2011-02-25 15:39:20 -05003565 switch (cmd) {
3566 case FIONREAD:
3567 /* fall through */
3568 case FIBMAP:
3569 /* fall through */
3570 case FIGETBSZ:
3571 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003572 case FS_IOC_GETFLAGS:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003573 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003574 case FS_IOC_GETVERSION:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003575 error = file_has_perm(cred, file, FILE__GETATTR);
3576 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003577
Al Viro2f99c362012-03-23 16:04:05 -04003578 case FS_IOC_SETFLAGS:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003579 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003580 case FS_IOC_SETVERSION:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003581 error = file_has_perm(cred, file, FILE__SETATTR);
3582 break;
3583
3584 /* sys_ioctl() checks */
3585 case FIONBIO:
3586 /* fall through */
3587 case FIOASYNC:
3588 error = file_has_perm(cred, file, 0);
3589 break;
3590
3591 case KDSKBENT:
3592 case KDSKBSENT:
Eric Paris6a9de492012-01-03 12:25:14 -05003593 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04003594 SECURITY_CAP_AUDIT, true);
Eric Paris0b24dcb2011-02-25 15:39:20 -05003595 break;
3596
3597 /* default case assumes that the command will go
3598 * to the file's ioctl() function.
3599 */
3600 default:
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003601 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
Eric Paris0b24dcb2011-02-25 15:39:20 -05003602 }
3603 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003604}
3605
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003606static int default_noexec;
3607
Linus Torvalds1da177e2005-04-16 15:20:36 -07003608static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3609{
David Howells88e67f32008-11-14 10:39:21 +11003610 const struct cred *cred = current_cred();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003611 u32 sid = cred_sid(cred);
David Howellsd84f4f92008-11-14 10:39:23 +11003612 int rc = 0;
David Howells88e67f32008-11-14 10:39:21 +11003613
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003614 if (default_noexec &&
Stephen Smalley892e8ca2015-07-10 09:40:59 -04003615 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3616 (!shared && (prot & PROT_WRITE)))) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07003617 /*
3618 * We are making executable an anonymous mapping or a
3619 * private file mapping that will also be writable.
3620 * This has an additional check.
3621 */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003622 rc = avc_has_perm(&selinux_state,
3623 sid, sid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003624 PROCESS__EXECMEM, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003625 if (rc)
David Howellsd84f4f92008-11-14 10:39:23 +11003626 goto error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003627 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003628
3629 if (file) {
3630 /* read access is always possible with a mapping */
3631 u32 av = FILE__READ;
3632
3633 /* write access only matters if the mapping is shared */
3634 if (shared && (prot & PROT_WRITE))
3635 av |= FILE__WRITE;
3636
3637 if (prot & PROT_EXEC)
3638 av |= FILE__EXECUTE;
3639
David Howells88e67f32008-11-14 10:39:21 +11003640 return file_has_perm(cred, file, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003641 }
David Howellsd84f4f92008-11-14 10:39:23 +11003642
3643error:
3644 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003645}
3646
Al Viroe5467852012-05-30 13:30:51 -04003647static int selinux_mmap_addr(unsigned long addr)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003648{
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07003649 int rc = 0;
Paul Moore98883bf2014-03-19 16:46:11 -04003650
3651 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3652 u32 sid = current_sid();
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003653 rc = avc_has_perm(&selinux_state,
3654 sid, sid, SECCLASS_MEMPROTECT,
Paul Moore98883bf2014-03-19 16:46:11 -04003655 MEMPROTECT__MMAP_ZERO, NULL);
3656 }
3657
3658 return rc;
Al Viroe5467852012-05-30 13:30:51 -04003659}
Linus Torvalds1da177e2005-04-16 15:20:36 -07003660
Al Viroe5467852012-05-30 13:30:51 -04003661static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3662 unsigned long prot, unsigned long flags)
3663{
Stephen Smalley3ba4bf52017-05-05 09:14:48 -04003664 struct common_audit_data ad;
3665 int rc;
3666
3667 if (file) {
3668 ad.type = LSM_AUDIT_DATA_FILE;
3669 ad.u.file = file;
3670 rc = inode_has_perm(current_cred(), file_inode(file),
3671 FILE__MAP, &ad);
3672 if (rc)
3673 return rc;
3674 }
3675
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003676 if (selinux_state.checkreqprot)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003677 prot = reqprot;
3678
3679 return file_map_prot_check(file, prot,
3680 (flags & MAP_TYPE) == MAP_SHARED);
3681}
3682
3683static int selinux_file_mprotect(struct vm_area_struct *vma,
3684 unsigned long reqprot,
3685 unsigned long prot)
3686{
David Howells88e67f32008-11-14 10:39:21 +11003687 const struct cred *cred = current_cred();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003688 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003689
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003690 if (selinux_state.checkreqprot)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003691 prot = reqprot;
3692
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003693 if (default_noexec &&
3694 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
James Morrisd541bbe2009-01-29 12:19:51 +11003695 int rc = 0;
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003696 if (vma->vm_start >= vma->vm_mm->start_brk &&
3697 vma->vm_end <= vma->vm_mm->brk) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003698 rc = avc_has_perm(&selinux_state,
3699 sid, sid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003700 PROCESS__EXECHEAP, NULL);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003701 } else if (!vma->vm_file &&
Stephen Smalleyc2316db2016-04-08 13:55:03 -04003702 ((vma->vm_start <= vma->vm_mm->start_stack &&
3703 vma->vm_end >= vma->vm_mm->start_stack) ||
Andy Lutomirskid17af502016-09-30 10:58:58 -07003704 vma_is_stack_for_current(vma))) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003705 rc = avc_has_perm(&selinux_state,
3706 sid, sid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003707 PROCESS__EXECSTACK, NULL);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003708 } else if (vma->vm_file && vma->anon_vma) {
3709 /*
3710 * We are making executable a file mapping that has
3711 * had some COW done. Since pages might have been
3712 * written, check ability to execute the possibly
3713 * modified content. This typically should only
3714 * occur for text relocations.
3715 */
David Howellsd84f4f92008-11-14 10:39:23 +11003716 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003717 }
Lorenzo Hernandez García-Hierro6b992192005-06-25 14:54:34 -07003718 if (rc)
3719 return rc;
3720 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003721
3722 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3723}
3724
3725static int selinux_file_lock(struct file *file, unsigned int cmd)
3726{
David Howells88e67f32008-11-14 10:39:21 +11003727 const struct cred *cred = current_cred();
3728
3729 return file_has_perm(cred, file, FILE__LOCK);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003730}
3731
3732static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3733 unsigned long arg)
3734{
David Howells88e67f32008-11-14 10:39:21 +11003735 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003736 int err = 0;
3737
3738 switch (cmd) {
Eric Paris828dfe12008-04-17 13:17:49 -04003739 case F_SETFL:
Eric Paris828dfe12008-04-17 13:17:49 -04003740 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
David Howells88e67f32008-11-14 10:39:21 +11003741 err = file_has_perm(cred, file, FILE__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003742 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003743 }
3744 /* fall through */
3745 case F_SETOWN:
3746 case F_SETSIG:
3747 case F_GETFL:
3748 case F_GETOWN:
3749 case F_GETSIG:
Cyrill Gorcunov1d151c32012-07-30 14:43:00 -07003750 case F_GETOWNER_UIDS:
Eric Paris828dfe12008-04-17 13:17:49 -04003751 /* Just check FD__USE permission */
David Howells88e67f32008-11-14 10:39:21 +11003752 err = file_has_perm(cred, file, 0);
Eric Paris828dfe12008-04-17 13:17:49 -04003753 break;
3754 case F_GETLK:
3755 case F_SETLK:
3756 case F_SETLKW:
Jeff Layton0d3f7a22014-04-22 08:23:58 -04003757 case F_OFD_GETLK:
3758 case F_OFD_SETLK:
3759 case F_OFD_SETLKW:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003760#if BITS_PER_LONG == 32
Eric Paris828dfe12008-04-17 13:17:49 -04003761 case F_GETLK64:
3762 case F_SETLK64:
3763 case F_SETLKW64:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003764#endif
David Howells88e67f32008-11-14 10:39:21 +11003765 err = file_has_perm(cred, file, FILE__LOCK);
Eric Paris828dfe12008-04-17 13:17:49 -04003766 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003767 }
3768
3769 return err;
3770}
3771
Jeff Laytone0b93ed2014-08-22 11:27:32 -04003772static void selinux_file_set_fowner(struct file *file)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003773{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003774 struct file_security_struct *fsec;
3775
Linus Torvalds1da177e2005-04-16 15:20:36 -07003776 fsec = file->f_security;
David Howells275bb412008-11-14 10:39:19 +11003777 fsec->fown_sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003778}
3779
3780static int selinux_file_send_sigiotask(struct task_struct *tsk,
3781 struct fown_struct *fown, int signum)
3782{
Eric Paris828dfe12008-04-17 13:17:49 -04003783 struct file *file;
Stephen Smalley65c90bc2009-05-04 15:43:18 -04003784 u32 sid = task_sid(tsk);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003785 u32 perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003786 struct file_security_struct *fsec;
3787
3788 /* struct fown_struct is never outside the context of a struct file */
Eric Paris828dfe12008-04-17 13:17:49 -04003789 file = container_of(fown, struct file, f_owner);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003790
Linus Torvalds1da177e2005-04-16 15:20:36 -07003791 fsec = file->f_security;
3792
3793 if (!signum)
3794 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3795 else
3796 perm = signal_to_av(signum);
3797
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003798 return avc_has_perm(&selinux_state,
3799 fsec->fown_sid, sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003800 SECCLASS_PROCESS, perm, NULL);
3801}
3802
3803static int selinux_file_receive(struct file *file)
3804{
David Howells88e67f32008-11-14 10:39:21 +11003805 const struct cred *cred = current_cred();
3806
3807 return file_has_perm(cred, file, file_to_av(file));
Linus Torvalds1da177e2005-04-16 15:20:36 -07003808}
3809
Al Viro94817692018-07-10 14:13:18 -04003810static int selinux_file_open(struct file *file)
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003811{
3812 struct file_security_struct *fsec;
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003813 struct inode_security_struct *isec;
David Howellsd84f4f92008-11-14 10:39:23 +11003814
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003815 fsec = file->f_security;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05003816 isec = inode_security(file_inode(file));
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003817 /*
3818 * Save inode label and policy sequence number
3819 * at open-time so that selinux_file_permission
3820 * can determine whether revalidation is necessary.
3821 * Task label is already saved in the file security
3822 * struct as its SID.
3823 */
3824 fsec->isid = isec->sid;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003825 fsec->pseqno = avc_policy_seqno(&selinux_state);
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003826 /*
3827 * Since the inode label or policy seqno may have changed
3828 * between the selinux_inode_permission check and the saving
3829 * of state above, recheck that access is still permitted.
3830 * Otherwise, access might never be revalidated against the
3831 * new inode label or new policy.
3832 * This check is not redundant - do not remove.
3833 */
Al Viro94817692018-07-10 14:13:18 -04003834 return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003835}
3836
Linus Torvalds1da177e2005-04-16 15:20:36 -07003837/* task security operations */
3838
Tetsuo Handaa79be232017-03-28 23:08:45 +09003839static int selinux_task_alloc(struct task_struct *task,
3840 unsigned long clone_flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003841{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003842 u32 sid = current_sid();
3843
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003844 return avc_has_perm(&selinux_state,
3845 sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003846}
3847
David Howellsf1752ee2008-11-14 10:39:17 +11003848/*
David Howellsee18d642009-09-02 09:14:21 +01003849 * allocate the SELinux part of blank credentials
3850 */
3851static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3852{
3853 struct task_security_struct *tsec;
3854
3855 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3856 if (!tsec)
3857 return -ENOMEM;
3858
3859 cred->security = tsec;
3860 return 0;
3861}
3862
3863/*
David Howellsf1752ee2008-11-14 10:39:17 +11003864 * detach and free the LSM part of a set of credentials
3865 */
3866static void selinux_cred_free(struct cred *cred)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003867{
David Howellsf1752ee2008-11-14 10:39:17 +11003868 struct task_security_struct *tsec = cred->security;
David Howellse0e81732009-09-02 09:13:40 +01003869
Tetsuo Handa2edeaa32011-02-07 13:36:10 +00003870 /*
3871 * cred->security == NULL if security_cred_alloc_blank() or
3872 * security_prepare_creds() returned an error.
3873 */
3874 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
David Howellse0e81732009-09-02 09:13:40 +01003875 cred->security = (void *) 0x7UL;
David Howellsf1752ee2008-11-14 10:39:17 +11003876 kfree(tsec);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003877}
3878
David Howellsd84f4f92008-11-14 10:39:23 +11003879/*
3880 * prepare a new set of credentials for modification
3881 */
3882static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3883 gfp_t gfp)
3884{
3885 const struct task_security_struct *old_tsec;
3886 struct task_security_struct *tsec;
3887
3888 old_tsec = old->security;
3889
3890 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3891 if (!tsec)
3892 return -ENOMEM;
3893
3894 new->security = tsec;
3895 return 0;
3896}
3897
3898/*
David Howellsee18d642009-09-02 09:14:21 +01003899 * transfer the SELinux data to a blank set of creds
3900 */
3901static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3902{
3903 const struct task_security_struct *old_tsec = old->security;
3904 struct task_security_struct *tsec = new->security;
3905
3906 *tsec = *old_tsec;
3907}
3908
Matthew Garrett3ec30112018-01-08 13:36:19 -08003909static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
3910{
3911 *secid = cred_sid(c);
3912}
3913
David Howellsee18d642009-09-02 09:14:21 +01003914/*
David Howells3a3b7ce2008-11-14 10:39:28 +11003915 * set the security data for a kernel service
3916 * - all the creation contexts are set to unlabelled
3917 */
3918static int selinux_kernel_act_as(struct cred *new, u32 secid)
3919{
3920 struct task_security_struct *tsec = new->security;
3921 u32 sid = current_sid();
3922 int ret;
3923
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003924 ret = avc_has_perm(&selinux_state,
3925 sid, secid,
David Howells3a3b7ce2008-11-14 10:39:28 +11003926 SECCLASS_KERNEL_SERVICE,
3927 KERNEL_SERVICE__USE_AS_OVERRIDE,
3928 NULL);
3929 if (ret == 0) {
3930 tsec->sid = secid;
3931 tsec->create_sid = 0;
3932 tsec->keycreate_sid = 0;
3933 tsec->sockcreate_sid = 0;
3934 }
3935 return ret;
3936}
3937
3938/*
3939 * set the file creation context in a security record to the same as the
3940 * objective context of the specified inode
3941 */
3942static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3943{
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05003944 struct inode_security_struct *isec = inode_security(inode);
David Howells3a3b7ce2008-11-14 10:39:28 +11003945 struct task_security_struct *tsec = new->security;
3946 u32 sid = current_sid();
3947 int ret;
3948
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003949 ret = avc_has_perm(&selinux_state,
3950 sid, isec->sid,
David Howells3a3b7ce2008-11-14 10:39:28 +11003951 SECCLASS_KERNEL_SERVICE,
3952 KERNEL_SERVICE__CREATE_FILES_AS,
3953 NULL);
3954
3955 if (ret == 0)
3956 tsec->create_sid = isec->sid;
David Howellsef574712010-02-26 01:56:16 +00003957 return ret;
David Howells3a3b7ce2008-11-14 10:39:28 +11003958}
3959
Eric Parisdd8dbf22009-11-03 16:35:32 +11003960static int selinux_kernel_module_request(char *kmod_name)
Eric Paris25354c42009-08-13 09:45:03 -04003961{
Eric Parisdd8dbf22009-11-03 16:35:32 +11003962 struct common_audit_data ad;
3963
Eric Paris50c205f2012-04-04 15:01:43 -04003964 ad.type = LSM_AUDIT_DATA_KMOD;
Eric Parisdd8dbf22009-11-03 16:35:32 +11003965 ad.u.kmod_name = kmod_name;
3966
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003967 return avc_has_perm(&selinux_state,
3968 current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
Eric Parisdd8dbf22009-11-03 16:35:32 +11003969 SYSTEM__MODULE_REQUEST, &ad);
Eric Paris25354c42009-08-13 09:45:03 -04003970}
3971
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003972static int selinux_kernel_module_from_file(struct file *file)
3973{
3974 struct common_audit_data ad;
3975 struct inode_security_struct *isec;
3976 struct file_security_struct *fsec;
3977 u32 sid = current_sid();
3978 int rc;
3979
3980 /* init_module */
3981 if (file == NULL)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003982 return avc_has_perm(&selinux_state,
3983 sid, sid, SECCLASS_SYSTEM,
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003984 SYSTEM__MODULE_LOAD, NULL);
3985
3986 /* finit_module */
Paul Moore20cdef82016-04-04 14:14:42 -04003987
Vivek Goyal43af5de2016-09-09 11:37:49 -04003988 ad.type = LSM_AUDIT_DATA_FILE;
3989 ad.u.file = file;
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003990
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003991 fsec = file->f_security;
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003992 if (sid != fsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003993 rc = avc_has_perm(&selinux_state,
3994 sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003995 if (rc)
3996 return rc;
3997 }
3998
Paul Moore20cdef82016-04-04 14:14:42 -04003999 isec = inode_security(file_inode(file));
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004000 return avc_has_perm(&selinux_state,
4001 sid, isec->sid, SECCLASS_SYSTEM,
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07004002 SYSTEM__MODULE_LOAD, &ad);
4003}
4004
4005static int selinux_kernel_read_file(struct file *file,
4006 enum kernel_read_file_id id)
4007{
4008 int rc = 0;
4009
4010 switch (id) {
4011 case READING_MODULE:
4012 rc = selinux_kernel_module_from_file(file);
4013 break;
4014 default:
4015 break;
4016 }
4017
4018 return rc;
4019}
4020
Mimi Zoharc77b8cd2018-07-13 14:06:02 -04004021static int selinux_kernel_load_data(enum kernel_load_data_id id)
4022{
4023 int rc = 0;
4024
4025 switch (id) {
4026 case LOADING_MODULE:
4027 rc = selinux_kernel_module_from_file(NULL);
4028 default:
4029 break;
4030 }
4031
4032 return rc;
4033}
4034
Linus Torvalds1da177e2005-04-16 15:20:36 -07004035static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
4036{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004037 return avc_has_perm(&selinux_state,
4038 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004039 PROCESS__SETPGID, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004040}
4041
4042static int selinux_task_getpgid(struct task_struct *p)
4043{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004044 return avc_has_perm(&selinux_state,
4045 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004046 PROCESS__GETPGID, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004047}
4048
4049static int selinux_task_getsid(struct task_struct *p)
4050{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004051 return avc_has_perm(&selinux_state,
4052 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004053 PROCESS__GETSESSION, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004054}
4055
David Quigleyf9008e4c2006-06-30 01:55:46 -07004056static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
4057{
David Howells275bb412008-11-14 10:39:19 +11004058 *secid = task_sid(p);
David Quigleyf9008e4c2006-06-30 01:55:46 -07004059}
4060
Linus Torvalds1da177e2005-04-16 15:20:36 -07004061static int selinux_task_setnice(struct task_struct *p, int nice)
4062{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004063 return avc_has_perm(&selinux_state,
4064 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004065 PROCESS__SETSCHED, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004066}
4067
James Morris03e68062006-06-23 02:03:58 -07004068static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4069{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004070 return avc_has_perm(&selinux_state,
4071 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004072 PROCESS__SETSCHED, NULL);
James Morris03e68062006-06-23 02:03:58 -07004073}
4074
David Quigleya1836a42006-06-30 01:55:49 -07004075static int selinux_task_getioprio(struct task_struct *p)
4076{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004077 return avc_has_perm(&selinux_state,
4078 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004079 PROCESS__GETSCHED, NULL);
David Quigleya1836a42006-06-30 01:55:49 -07004080}
4081
Corentin LABBE42985552017-10-04 20:32:18 +02004082static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4083 unsigned int flags)
Stephen Smalley791ec492017-02-17 07:57:00 -05004084{
4085 u32 av = 0;
4086
Stephen Smalley84e68852017-02-28 09:35:08 -05004087 if (!flags)
4088 return 0;
Stephen Smalley791ec492017-02-17 07:57:00 -05004089 if (flags & LSM_PRLIMIT_WRITE)
4090 av |= PROCESS__SETRLIMIT;
4091 if (flags & LSM_PRLIMIT_READ)
4092 av |= PROCESS__GETRLIMIT;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004093 return avc_has_perm(&selinux_state,
4094 cred_sid(cred), cred_sid(tcred),
Stephen Smalley791ec492017-02-17 07:57:00 -05004095 SECCLASS_PROCESS, av, NULL);
4096}
4097
Jiri Slaby8fd00b42009-08-26 18:41:16 +02004098static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4099 struct rlimit *new_rlim)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004100{
Jiri Slaby8fd00b42009-08-26 18:41:16 +02004101 struct rlimit *old_rlim = p->signal->rlim + resource;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004102
4103 /* Control the ability to change the hard limit (whether
4104 lowering or raising it), so that the hard limit can
4105 later be used as a safe reset point for the soft limit
David Howellsd84f4f92008-11-14 10:39:23 +11004106 upon context transitions. See selinux_bprm_committing_creds. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07004107 if (old_rlim->rlim_max != new_rlim->rlim_max)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004108 return avc_has_perm(&selinux_state,
4109 current_sid(), task_sid(p),
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004110 SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004111
4112 return 0;
4113}
4114
KOSAKI Motohirob0ae1982010-10-15 04:21:18 +09004115static int selinux_task_setscheduler(struct task_struct *p)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004116{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004117 return avc_has_perm(&selinux_state,
4118 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004119 PROCESS__SETSCHED, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004120}
4121
4122static int selinux_task_getscheduler(struct task_struct *p)
4123{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004124 return avc_has_perm(&selinux_state,
4125 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004126 PROCESS__GETSCHED, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004127}
4128
David Quigley35601542006-06-23 02:04:01 -07004129static int selinux_task_movememory(struct task_struct *p)
4130{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004131 return avc_has_perm(&selinux_state,
4132 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004133 PROCESS__SETSCHED, NULL);
David Quigley35601542006-06-23 02:04:01 -07004134}
4135
Eric W. Biedermanae7795b2018-09-25 11:27:20 +02004136static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
Stephen Smalley6b4f3d02017-09-08 12:40:01 -04004137 int sig, const struct cred *cred)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004138{
Stephen Smalley6b4f3d02017-09-08 12:40:01 -04004139 u32 secid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004140 u32 perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004141
Linus Torvalds1da177e2005-04-16 15:20:36 -07004142 if (!sig)
4143 perm = PROCESS__SIGNULL; /* null signal; existence test */
4144 else
4145 perm = signal_to_av(sig);
Stephen Smalley6b4f3d02017-09-08 12:40:01 -04004146 if (!cred)
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004147 secid = current_sid();
Stephen Smalley6b4f3d02017-09-08 12:40:01 -04004148 else
4149 secid = cred_sid(cred);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004150 return avc_has_perm(&selinux_state,
4151 secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004152}
4153
Linus Torvalds1da177e2005-04-16 15:20:36 -07004154static void selinux_task_to_inode(struct task_struct *p,
4155 struct inode *inode)
4156{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004157 struct inode_security_struct *isec = inode->i_security;
David Howells275bb412008-11-14 10:39:19 +11004158 u32 sid = task_sid(p);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004159
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004160 spin_lock(&isec->lock);
Andreas Gruenbacherdb978da2016-11-10 22:18:28 +01004161 isec->sclass = inode_mode_to_security_class(inode->i_mode);
David Howells275bb412008-11-14 10:39:19 +11004162 isec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05004163 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004164 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004165}
4166
Linus Torvalds1da177e2005-04-16 15:20:36 -07004167/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004168static int selinux_parse_skb_ipv4(struct sk_buff *skb,
Thomas Liu2bf49692009-07-14 12:14:09 -04004169 struct common_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004170{
4171 int offset, ihlen, ret = -EINVAL;
4172 struct iphdr _iph, *ih;
4173
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03004174 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004175 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4176 if (ih == NULL)
4177 goto out;
4178
4179 ihlen = ih->ihl * 4;
4180 if (ihlen < sizeof(_iph))
4181 goto out;
4182
Eric Paris48c62af2012-04-02 13:15:44 -04004183 ad->u.net->v4info.saddr = ih->saddr;
4184 ad->u.net->v4info.daddr = ih->daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004185 ret = 0;
4186
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004187 if (proto)
4188 *proto = ih->protocol;
4189
Linus Torvalds1da177e2005-04-16 15:20:36 -07004190 switch (ih->protocol) {
Eric Paris828dfe12008-04-17 13:17:49 -04004191 case IPPROTO_TCP: {
4192 struct tcphdr _tcph, *th;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004193
Eric Paris828dfe12008-04-17 13:17:49 -04004194 if (ntohs(ih->frag_off) & IP_OFFSET)
4195 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004196
4197 offset += ihlen;
4198 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4199 if (th == NULL)
4200 break;
4201
Eric Paris48c62af2012-04-02 13:15:44 -04004202 ad->u.net->sport = th->source;
4203 ad->u.net->dport = th->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004204 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004205 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004206
Eric Paris828dfe12008-04-17 13:17:49 -04004207 case IPPROTO_UDP: {
4208 struct udphdr _udph, *uh;
4209
4210 if (ntohs(ih->frag_off) & IP_OFFSET)
4211 break;
4212
4213 offset += ihlen;
4214 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4215 if (uh == NULL)
4216 break;
4217
Eric Paris48c62af2012-04-02 13:15:44 -04004218 ad->u.net->sport = uh->source;
4219 ad->u.net->dport = uh->dest;
Eric Paris828dfe12008-04-17 13:17:49 -04004220 break;
4221 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004222
James Morris2ee92d42006-11-13 16:09:01 -08004223 case IPPROTO_DCCP: {
4224 struct dccp_hdr _dccph, *dh;
4225
4226 if (ntohs(ih->frag_off) & IP_OFFSET)
4227 break;
4228
4229 offset += ihlen;
4230 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4231 if (dh == NULL)
4232 break;
4233
Eric Paris48c62af2012-04-02 13:15:44 -04004234 ad->u.net->sport = dh->dccph_sport;
4235 ad->u.net->dport = dh->dccph_dport;
James Morris2ee92d42006-11-13 16:09:01 -08004236 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004237 }
James Morris2ee92d42006-11-13 16:09:01 -08004238
Richard Hainesd4529302018-02-13 20:57:18 +00004239#if IS_ENABLED(CONFIG_IP_SCTP)
4240 case IPPROTO_SCTP: {
4241 struct sctphdr _sctph, *sh;
4242
4243 if (ntohs(ih->frag_off) & IP_OFFSET)
4244 break;
4245
4246 offset += ihlen;
4247 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4248 if (sh == NULL)
4249 break;
4250
4251 ad->u.net->sport = sh->source;
4252 ad->u.net->dport = sh->dest;
4253 break;
4254 }
4255#endif
Eric Paris828dfe12008-04-17 13:17:49 -04004256 default:
4257 break;
4258 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004259out:
4260 return ret;
4261}
4262
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04004263#if IS_ENABLED(CONFIG_IPV6)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004264
4265/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004266static int selinux_parse_skb_ipv6(struct sk_buff *skb,
Thomas Liu2bf49692009-07-14 12:14:09 -04004267 struct common_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004268{
4269 u8 nexthdr;
4270 int ret = -EINVAL, offset;
4271 struct ipv6hdr _ipv6h, *ip6;
Jesse Gross75f28112011-11-30 17:05:51 -08004272 __be16 frag_off;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004273
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03004274 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004275 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4276 if (ip6 == NULL)
4277 goto out;
4278
Eric Paris48c62af2012-04-02 13:15:44 -04004279 ad->u.net->v6info.saddr = ip6->saddr;
4280 ad->u.net->v6info.daddr = ip6->daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004281 ret = 0;
4282
4283 nexthdr = ip6->nexthdr;
4284 offset += sizeof(_ipv6h);
Jesse Gross75f28112011-11-30 17:05:51 -08004285 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004286 if (offset < 0)
4287 goto out;
4288
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004289 if (proto)
4290 *proto = nexthdr;
4291
Linus Torvalds1da177e2005-04-16 15:20:36 -07004292 switch (nexthdr) {
4293 case IPPROTO_TCP: {
Eric Paris828dfe12008-04-17 13:17:49 -04004294 struct tcphdr _tcph, *th;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004295
4296 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4297 if (th == NULL)
4298 break;
4299
Eric Paris48c62af2012-04-02 13:15:44 -04004300 ad->u.net->sport = th->source;
4301 ad->u.net->dport = th->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004302 break;
4303 }
4304
4305 case IPPROTO_UDP: {
4306 struct udphdr _udph, *uh;
4307
4308 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4309 if (uh == NULL)
4310 break;
4311
Eric Paris48c62af2012-04-02 13:15:44 -04004312 ad->u.net->sport = uh->source;
4313 ad->u.net->dport = uh->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004314 break;
4315 }
4316
James Morris2ee92d42006-11-13 16:09:01 -08004317 case IPPROTO_DCCP: {
4318 struct dccp_hdr _dccph, *dh;
4319
4320 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4321 if (dh == NULL)
4322 break;
4323
Eric Paris48c62af2012-04-02 13:15:44 -04004324 ad->u.net->sport = dh->dccph_sport;
4325 ad->u.net->dport = dh->dccph_dport;
James Morris2ee92d42006-11-13 16:09:01 -08004326 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004327 }
James Morris2ee92d42006-11-13 16:09:01 -08004328
Richard Hainesd4529302018-02-13 20:57:18 +00004329#if IS_ENABLED(CONFIG_IP_SCTP)
4330 case IPPROTO_SCTP: {
4331 struct sctphdr _sctph, *sh;
4332
4333 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4334 if (sh == NULL)
4335 break;
4336
4337 ad->u.net->sport = sh->source;
4338 ad->u.net->dport = sh->dest;
4339 break;
4340 }
4341#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07004342 /* includes fragments */
4343 default:
4344 break;
4345 }
4346out:
4347 return ret;
4348}
4349
4350#endif /* IPV6 */
4351
Thomas Liu2bf49692009-07-14 12:14:09 -04004352static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
David Howellscf9481e2008-07-27 21:31:07 +10004353 char **_addrp, int src, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004354{
David Howellscf9481e2008-07-27 21:31:07 +10004355 char *addrp;
4356 int ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004357
Eric Paris48c62af2012-04-02 13:15:44 -04004358 switch (ad->u.net->family) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07004359 case PF_INET:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004360 ret = selinux_parse_skb_ipv4(skb, ad, proto);
David Howellscf9481e2008-07-27 21:31:07 +10004361 if (ret)
4362 goto parse_error;
Eric Paris48c62af2012-04-02 13:15:44 -04004363 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4364 &ad->u.net->v4info.daddr);
David Howellscf9481e2008-07-27 21:31:07 +10004365 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004366
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04004367#if IS_ENABLED(CONFIG_IPV6)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004368 case PF_INET6:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004369 ret = selinux_parse_skb_ipv6(skb, ad, proto);
David Howellscf9481e2008-07-27 21:31:07 +10004370 if (ret)
4371 goto parse_error;
Eric Paris48c62af2012-04-02 13:15:44 -04004372 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4373 &ad->u.net->v6info.daddr);
David Howellscf9481e2008-07-27 21:31:07 +10004374 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004375#endif /* IPV6 */
4376 default:
David Howellscf9481e2008-07-27 21:31:07 +10004377 addrp = NULL;
4378 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004379 }
4380
David Howellscf9481e2008-07-27 21:31:07 +10004381parse_error:
peter enderborgc103a912018-06-12 10:09:03 +02004382 pr_warn(
David Howellscf9481e2008-07-27 21:31:07 +10004383 "SELinux: failure in selinux_parse_skb(),"
4384 " unable to parse packet\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07004385 return ret;
David Howellscf9481e2008-07-27 21:31:07 +10004386
4387okay:
4388 if (_addrp)
4389 *_addrp = addrp;
4390 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004391}
4392
Paul Moore4f6a9932007-03-01 14:35:22 -05004393/**
Paul Moore220deb92008-01-29 08:38:23 -05004394 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
Paul Moore4f6a9932007-03-01 14:35:22 -05004395 * @skb: the packet
Paul Moore75e22912008-01-29 08:38:04 -05004396 * @family: protocol family
Paul Moore220deb92008-01-29 08:38:23 -05004397 * @sid: the packet's peer label SID
Paul Moore4f6a9932007-03-01 14:35:22 -05004398 *
4399 * Description:
Paul Moore220deb92008-01-29 08:38:23 -05004400 * Check the various different forms of network peer labeling and determine
4401 * the peer label/SID for the packet; most of the magic actually occurs in
4402 * the security server function security_net_peersid_cmp(). The function
4403 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4404 * or -EACCES if @sid is invalid due to inconsistencies with the different
4405 * peer labels.
Paul Moore4f6a9932007-03-01 14:35:22 -05004406 *
4407 */
Paul Moore220deb92008-01-29 08:38:23 -05004408static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
Paul Moore4f6a9932007-03-01 14:35:22 -05004409{
Paul Moore71f1cb02008-01-29 08:51:16 -05004410 int err;
Paul Moore4f6a9932007-03-01 14:35:22 -05004411 u32 xfrm_sid;
4412 u32 nlbl_sid;
Paul Moore220deb92008-01-29 08:38:23 -05004413 u32 nlbl_type;
Paul Moore4f6a9932007-03-01 14:35:22 -05004414
Paul Moore817eff72013-12-10 14:57:54 -05004415 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
Paul Moorebed4d7e2013-07-23 17:38:40 -04004416 if (unlikely(err))
4417 return -EACCES;
4418 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4419 if (unlikely(err))
4420 return -EACCES;
Paul Moore220deb92008-01-29 08:38:23 -05004421
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004422 err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4423 nlbl_type, xfrm_sid, sid);
Paul Moore71f1cb02008-01-29 08:51:16 -05004424 if (unlikely(err)) {
peter enderborgc103a912018-06-12 10:09:03 +02004425 pr_warn(
Paul Moore71f1cb02008-01-29 08:51:16 -05004426 "SELinux: failure in selinux_skb_peerlbl_sid(),"
4427 " unable to determine packet's peer label\n");
Paul Moore220deb92008-01-29 08:38:23 -05004428 return -EACCES;
Paul Moore71f1cb02008-01-29 08:51:16 -05004429 }
Paul Moore220deb92008-01-29 08:38:23 -05004430
4431 return 0;
Paul Moore4f6a9932007-03-01 14:35:22 -05004432}
4433
Paul Moore446b8022013-12-04 16:10:51 -05004434/**
4435 * selinux_conn_sid - Determine the child socket label for a connection
4436 * @sk_sid: the parent socket's SID
4437 * @skb_sid: the packet's SID
4438 * @conn_sid: the resulting connection SID
4439 *
4440 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4441 * combined with the MLS information from @skb_sid in order to create
4442 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
4443 * of @sk_sid. Returns zero on success, negative values on failure.
4444 *
4445 */
4446static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4447{
4448 int err = 0;
4449
4450 if (skb_sid != SECSID_NULL)
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004451 err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4452 conn_sid);
Paul Moore446b8022013-12-04 16:10:51 -05004453 else
4454 *conn_sid = sk_sid;
4455
4456 return err;
4457}
4458
Linus Torvalds1da177e2005-04-16 15:20:36 -07004459/* socket security operations */
Paul Moored4f2d972010-04-22 14:46:18 -04004460
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004461static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4462 u16 secclass, u32 *socksid)
Paul Moored4f2d972010-04-22 14:46:18 -04004463{
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004464 if (tsec->sockcreate_sid > SECSID_NULL) {
4465 *socksid = tsec->sockcreate_sid;
4466 return 0;
4467 }
4468
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004469 return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4470 secclass, NULL, socksid);
Paul Moored4f2d972010-04-22 14:46:18 -04004471}
4472
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004473static int sock_has_perm(struct sock *sk, u32 perms)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004474{
Paul Moore253bfae2010-04-22 14:46:19 -04004475 struct sk_security_struct *sksec = sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004476 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004477 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004478
Paul Moore253bfae2010-04-22 14:46:19 -04004479 if (sksec->sid == SECINITSID_KERNEL)
4480 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004481
Eric Paris50c205f2012-04-04 15:01:43 -04004482 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004483 ad.u.net = &net;
4484 ad.u.net->sk = sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004485
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004486 return avc_has_perm(&selinux_state,
4487 current_sid(), sksec->sid, sksec->sclass, perms,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004488 &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004489}
4490
4491static int selinux_socket_create(int family, int type,
4492 int protocol, int kern)
4493{
Paul Moore5fb49872010-04-22 14:46:19 -04004494 const struct task_security_struct *tsec = current_security();
Paul Moored4f2d972010-04-22 14:46:18 -04004495 u32 newsid;
David Howells275bb412008-11-14 10:39:19 +11004496 u16 secclass;
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004497 int rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004498
4499 if (kern)
Paul Moored4f2d972010-04-22 14:46:18 -04004500 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004501
David Howells275bb412008-11-14 10:39:19 +11004502 secclass = socket_type_to_security_class(family, type, protocol);
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004503 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4504 if (rc)
4505 return rc;
4506
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004507 return avc_has_perm(&selinux_state,
4508 tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004509}
4510
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07004511static int selinux_socket_post_create(struct socket *sock, int family,
4512 int type, int protocol, int kern)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004513{
Paul Moore5fb49872010-04-22 14:46:19 -04004514 const struct task_security_struct *tsec = current_security();
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05004515 struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004516 struct sk_security_struct *sksec;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004517 u16 sclass = socket_type_to_security_class(family, type, protocol);
4518 u32 sid = SECINITSID_KERNEL;
David Howells275bb412008-11-14 10:39:19 +11004519 int err = 0;
4520
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004521 if (!kern) {
4522 err = socket_sockcreate_sid(tsec, sclass, &sid);
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004523 if (err)
4524 return err;
4525 }
David Howells275bb412008-11-14 10:39:19 +11004526
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004527 isec->sclass = sclass;
4528 isec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05004529 isec->initialized = LABEL_INITIALIZED;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004530
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004531 if (sock->sk) {
4532 sksec = sock->sk->sk_security;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004533 sksec->sclass = sclass;
4534 sksec->sid = sid;
Richard Hainesd4529302018-02-13 20:57:18 +00004535 /* Allows detection of the first association on this socket */
4536 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4537 sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4538
Paul Moore389fb8002009-03-27 17:10:34 -04004539 err = selinux_netlbl_socket_post_create(sock->sk, family);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004540 }
4541
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07004542 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004543}
4544
David Herrmann0b811db2018-05-04 16:28:21 +02004545static int selinux_socket_socketpair(struct socket *socka,
4546 struct socket *sockb)
4547{
4548 struct sk_security_struct *sksec_a = socka->sk->sk_security;
4549 struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4550
4551 sksec_a->peer_sid = sksec_b->sid;
4552 sksec_b->peer_sid = sksec_a->sid;
4553
4554 return 0;
4555}
4556
Linus Torvalds1da177e2005-04-16 15:20:36 -07004557/* Range of port numbers used to automatically bind.
4558 Need to determine whether we should perform a name_bind
4559 permission check between the socket and the port number. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07004560
4561static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4562{
Paul Moore253bfae2010-04-22 14:46:19 -04004563 struct sock *sk = sock->sk;
Alexey Kodanev0f8db8c2018-05-11 20:15:11 +03004564 struct sk_security_struct *sksec = sk->sk_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004565 u16 family;
4566 int err;
4567
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004568 err = sock_has_perm(sk, SOCKET__BIND);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004569 if (err)
4570 goto out;
4571
Richard Hainesd4529302018-02-13 20:57:18 +00004572 /* If PF_INET or PF_INET6, check name_bind permission for the port. */
Paul Moore253bfae2010-04-22 14:46:19 -04004573 family = sk->sk_family;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004574 if (family == PF_INET || family == PF_INET6) {
4575 char *addrp;
Thomas Liu2bf49692009-07-14 12:14:09 -04004576 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004577 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004578 struct sockaddr_in *addr4 = NULL;
4579 struct sockaddr_in6 *addr6 = NULL;
Alexey Kodanev0f8db8c2018-05-11 20:15:11 +03004580 u16 family_sa = address->sa_family;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004581 unsigned short snum;
James Morrise399f982008-06-12 01:39:58 +10004582 u32 sid, node_perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004583
Richard Hainesd4529302018-02-13 20:57:18 +00004584 /*
4585 * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4586 * that validates multiple binding addresses. Because of this
4587 * need to check address->sa_family as it is possible to have
4588 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4589 */
Alexey Kodanev0f8db8c2018-05-11 20:15:11 +03004590 switch (family_sa) {
4591 case AF_UNSPEC:
Richard Haines68741a8a2018-03-02 19:54:34 +00004592 case AF_INET:
4593 if (addrlen < sizeof(struct sockaddr_in))
4594 return -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004595 addr4 = (struct sockaddr_in *)address;
Alexey Kodanev0f8db8c2018-05-11 20:15:11 +03004596 if (family_sa == AF_UNSPEC) {
4597 /* see __inet_bind(), we only want to allow
4598 * AF_UNSPEC if the address is INADDR_ANY
4599 */
4600 if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4601 goto err_af;
4602 family_sa = AF_INET;
4603 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004604 snum = ntohs(addr4->sin_port);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004605 addrp = (char *)&addr4->sin_addr.s_addr;
Richard Haines68741a8a2018-03-02 19:54:34 +00004606 break;
4607 case AF_INET6:
4608 if (addrlen < SIN6_LEN_RFC2133)
4609 return -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004610 addr6 = (struct sockaddr_in6 *)address;
4611 snum = ntohs(addr6->sin6_port);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004612 addrp = (char *)&addr6->sin6_addr.s6_addr;
Richard Haines68741a8a2018-03-02 19:54:34 +00004613 break;
4614 default:
Alexey Kodanev0f8db8c2018-05-11 20:15:11 +03004615 goto err_af;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004616 }
4617
Alexey Kodanev88b7d372018-05-11 20:15:12 +03004618 ad.type = LSM_AUDIT_DATA_NET;
4619 ad.u.net = &net;
4620 ad.u.net->sport = htons(snum);
4621 ad.u.net->family = family_sa;
4622
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004623 if (snum) {
4624 int low, high;
4625
Eric W. Biederman0bbf87d2013-09-28 14:10:59 -07004626 inet_get_local_port_range(sock_net(sk), &low, &high);
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004627
Krister Johansen4548b682017-01-20 17:49:11 -08004628 if (snum < max(inet_prot_sock(sock_net(sk)), low) ||
4629 snum > high) {
Paul Moore3e1121722008-04-10 10:48:14 -04004630 err = sel_netport_sid(sk->sk_protocol,
4631 snum, &sid);
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004632 if (err)
4633 goto out;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004634 err = avc_has_perm(&selinux_state,
4635 sksec->sid, sid,
Paul Moore253bfae2010-04-22 14:46:19 -04004636 sksec->sclass,
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004637 SOCKET__NAME_BIND, &ad);
4638 if (err)
4639 goto out;
4640 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004641 }
Eric Paris828dfe12008-04-17 13:17:49 -04004642
Paul Moore253bfae2010-04-22 14:46:19 -04004643 switch (sksec->sclass) {
James Morris13402582005-09-30 14:24:34 -04004644 case SECCLASS_TCP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004645 node_perm = TCP_SOCKET__NODE_BIND;
4646 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004647
James Morris13402582005-09-30 14:24:34 -04004648 case SECCLASS_UDP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004649 node_perm = UDP_SOCKET__NODE_BIND;
4650 break;
James Morris2ee92d42006-11-13 16:09:01 -08004651
4652 case SECCLASS_DCCP_SOCKET:
4653 node_perm = DCCP_SOCKET__NODE_BIND;
4654 break;
4655
Richard Hainesd4529302018-02-13 20:57:18 +00004656 case SECCLASS_SCTP_SOCKET:
4657 node_perm = SCTP_SOCKET__NODE_BIND;
4658 break;
4659
Linus Torvalds1da177e2005-04-16 15:20:36 -07004660 default:
4661 node_perm = RAWIP_SOCKET__NODE_BIND;
4662 break;
4663 }
Eric Paris828dfe12008-04-17 13:17:49 -04004664
Alexey Kodanev88b7d372018-05-11 20:15:12 +03004665 err = sel_netnode_sid(addrp, family_sa, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004666 if (err)
4667 goto out;
Eric Paris828dfe12008-04-17 13:17:49 -04004668
Alexey Kodanev0f8db8c2018-05-11 20:15:11 +03004669 if (family_sa == AF_INET)
Eric Paris48c62af2012-04-02 13:15:44 -04004670 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004671 else
Eric Paris48c62af2012-04-02 13:15:44 -04004672 ad.u.net->v6info.saddr = addr6->sin6_addr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004673
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004674 err = avc_has_perm(&selinux_state,
4675 sksec->sid, sid,
Paul Moore253bfae2010-04-22 14:46:19 -04004676 sksec->sclass, node_perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004677 if (err)
4678 goto out;
4679 }
4680out:
4681 return err;
Alexey Kodanev0f8db8c2018-05-11 20:15:11 +03004682err_af:
4683 /* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4684 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4685 return -EINVAL;
4686 return -EAFNOSUPPORT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004687}
4688
Richard Hainesd4529302018-02-13 20:57:18 +00004689/* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
Mauro Carvalho Chehab5fb94e92018-05-08 15:14:57 -03004690 * and sctp_sendmsg(3) as described in Documentation/security/LSM-sctp.rst
Richard Hainesd4529302018-02-13 20:57:18 +00004691 */
4692static int selinux_socket_connect_helper(struct socket *sock,
4693 struct sockaddr *address, int addrlen)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004694{
Paul Moore014ab192008-10-10 10:16:33 -04004695 struct sock *sk = sock->sk;
Paul Moore253bfae2010-04-22 14:46:19 -04004696 struct sk_security_struct *sksec = sk->sk_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004697 int err;
4698
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004699 err = sock_has_perm(sk, SOCKET__CONNECT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004700 if (err)
4701 return err;
4702
4703 /*
Richard Hainesd4529302018-02-13 20:57:18 +00004704 * If a TCP, DCCP or SCTP socket, check name_connect permission
4705 * for the port.
Linus Torvalds1da177e2005-04-16 15:20:36 -07004706 */
Paul Moore253bfae2010-04-22 14:46:19 -04004707 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
Richard Hainesd4529302018-02-13 20:57:18 +00004708 sksec->sclass == SECCLASS_DCCP_SOCKET ||
4709 sksec->sclass == SECCLASS_SCTP_SOCKET) {
Thomas Liu2bf49692009-07-14 12:14:09 -04004710 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004711 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004712 struct sockaddr_in *addr4 = NULL;
4713 struct sockaddr_in6 *addr6 = NULL;
4714 unsigned short snum;
James Morris2ee92d42006-11-13 16:09:01 -08004715 u32 sid, perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004716
Richard Hainesd4529302018-02-13 20:57:18 +00004717 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4718 * that validates multiple connect addresses. Because of this
4719 * need to check address->sa_family as it is possible to have
4720 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4721 */
Richard Haines68741a8a2018-03-02 19:54:34 +00004722 switch (address->sa_family) {
4723 case AF_INET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004724 addr4 = (struct sockaddr_in *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07004725 if (addrlen < sizeof(struct sockaddr_in))
Linus Torvalds1da177e2005-04-16 15:20:36 -07004726 return -EINVAL;
4727 snum = ntohs(addr4->sin_port);
Richard Haines68741a8a2018-03-02 19:54:34 +00004728 break;
4729 case AF_INET6:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004730 addr6 = (struct sockaddr_in6 *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07004731 if (addrlen < SIN6_LEN_RFC2133)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004732 return -EINVAL;
4733 snum = ntohs(addr6->sin6_port);
Richard Haines68741a8a2018-03-02 19:54:34 +00004734 break;
4735 default:
4736 /* Note that SCTP services expect -EINVAL, whereas
4737 * others expect -EAFNOSUPPORT.
4738 */
4739 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4740 return -EINVAL;
4741 else
4742 return -EAFNOSUPPORT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004743 }
4744
Paul Moore3e1121722008-04-10 10:48:14 -04004745 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004746 if (err)
Richard Hainesd4529302018-02-13 20:57:18 +00004747 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004748
Richard Hainesd4529302018-02-13 20:57:18 +00004749 switch (sksec->sclass) {
4750 case SECCLASS_TCP_SOCKET:
4751 perm = TCP_SOCKET__NAME_CONNECT;
4752 break;
4753 case SECCLASS_DCCP_SOCKET:
4754 perm = DCCP_SOCKET__NAME_CONNECT;
4755 break;
4756 case SECCLASS_SCTP_SOCKET:
4757 perm = SCTP_SOCKET__NAME_CONNECT;
4758 break;
4759 }
James Morris2ee92d42006-11-13 16:09:01 -08004760
Eric Paris50c205f2012-04-04 15:01:43 -04004761 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004762 ad.u.net = &net;
4763 ad.u.net->dport = htons(snum);
Alexey Kodanev88b7d372018-05-11 20:15:12 +03004764 ad.u.net->family = address->sa_family;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004765 err = avc_has_perm(&selinux_state,
4766 sksec->sid, sid, sksec->sclass, perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004767 if (err)
Richard Hainesd4529302018-02-13 20:57:18 +00004768 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004769 }
4770
Richard Hainesd4529302018-02-13 20:57:18 +00004771 return 0;
4772}
Paul Moore014ab192008-10-10 10:16:33 -04004773
Richard Hainesd4529302018-02-13 20:57:18 +00004774/* Supports connect(2), see comments in selinux_socket_connect_helper() */
4775static int selinux_socket_connect(struct socket *sock,
4776 struct sockaddr *address, int addrlen)
4777{
4778 int err;
4779 struct sock *sk = sock->sk;
4780
4781 err = selinux_socket_connect_helper(sock, address, addrlen);
4782 if (err)
4783 return err;
4784
4785 return selinux_netlbl_socket_connect(sk, address);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004786}
4787
4788static int selinux_socket_listen(struct socket *sock, int backlog)
4789{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004790 return sock_has_perm(sock->sk, SOCKET__LISTEN);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004791}
4792
4793static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4794{
4795 int err;
4796 struct inode_security_struct *isec;
4797 struct inode_security_struct *newisec;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004798 u16 sclass;
4799 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004800
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004801 err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004802 if (err)
4803 return err;
4804
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05004805 isec = inode_security_novalidate(SOCK_INODE(sock));
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004806 spin_lock(&isec->lock);
4807 sclass = isec->sclass;
4808 sid = isec->sid;
4809 spin_unlock(&isec->lock);
4810
4811 newisec = inode_security_novalidate(SOCK_INODE(newsock));
4812 newisec->sclass = sclass;
4813 newisec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05004814 newisec->initialized = LABEL_INITIALIZED;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004815
4816 return 0;
4817}
4818
4819static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
Eric Paris828dfe12008-04-17 13:17:49 -04004820 int size)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004821{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004822 return sock_has_perm(sock->sk, SOCKET__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004823}
4824
4825static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4826 int size, int flags)
4827{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004828 return sock_has_perm(sock->sk, SOCKET__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004829}
4830
4831static int selinux_socket_getsockname(struct socket *sock)
4832{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004833 return sock_has_perm(sock->sk, SOCKET__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004834}
4835
4836static int selinux_socket_getpeername(struct socket *sock)
4837{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004838 return sock_has_perm(sock->sk, SOCKET__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004839}
4840
Eric Paris828dfe12008-04-17 13:17:49 -04004841static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004842{
Paul Mooref8687af2006-10-30 15:22:15 -08004843 int err;
4844
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004845 err = sock_has_perm(sock->sk, SOCKET__SETOPT);
Paul Mooref8687af2006-10-30 15:22:15 -08004846 if (err)
4847 return err;
4848
4849 return selinux_netlbl_socket_setsockopt(sock, level, optname);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004850}
4851
4852static int selinux_socket_getsockopt(struct socket *sock, int level,
4853 int optname)
4854{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004855 return sock_has_perm(sock->sk, SOCKET__GETOPT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004856}
4857
4858static int selinux_socket_shutdown(struct socket *sock, int how)
4859{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004860 return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004861}
4862
David S. Miller3610cda2011-01-05 15:38:53 -08004863static int selinux_socket_unix_stream_connect(struct sock *sock,
4864 struct sock *other,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004865 struct sock *newsk)
4866{
David S. Miller3610cda2011-01-05 15:38:53 -08004867 struct sk_security_struct *sksec_sock = sock->sk_security;
4868 struct sk_security_struct *sksec_other = other->sk_security;
Paul Moore4d1e2452010-04-22 14:46:18 -04004869 struct sk_security_struct *sksec_new = newsk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004870 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004871 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004872 int err;
4873
Eric Paris50c205f2012-04-04 15:01:43 -04004874 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004875 ad.u.net = &net;
4876 ad.u.net->sk = other;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004877
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004878 err = avc_has_perm(&selinux_state,
4879 sksec_sock->sid, sksec_other->sid,
Paul Moore4d1e2452010-04-22 14:46:18 -04004880 sksec_other->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004881 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4882 if (err)
4883 return err;
4884
Linus Torvalds1da177e2005-04-16 15:20:36 -07004885 /* server child socket */
Paul Moore4d1e2452010-04-22 14:46:18 -04004886 sksec_new->peer_sid = sksec_sock->sid;
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004887 err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
4888 sksec_sock->sid, &sksec_new->sid);
Paul Moore4d1e2452010-04-22 14:46:18 -04004889 if (err)
4890 return err;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004891
Paul Moore4d1e2452010-04-22 14:46:18 -04004892 /* connecting socket */
4893 sksec_sock->peer_sid = sksec_new->sid;
4894
4895 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004896}
4897
4898static int selinux_socket_unix_may_send(struct socket *sock,
4899 struct socket *other)
4900{
Paul Moore253bfae2010-04-22 14:46:19 -04004901 struct sk_security_struct *ssec = sock->sk->sk_security;
4902 struct sk_security_struct *osec = other->sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004903 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004904 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004905
Eric Paris50c205f2012-04-04 15:01:43 -04004906 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004907 ad.u.net = &net;
4908 ad.u.net->sk = other->sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004909
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004910 return avc_has_perm(&selinux_state,
4911 ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
Paul Moore253bfae2010-04-22 14:46:19 -04004912 &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004913}
4914
Paul Moorecbe0d6e2014-09-10 17:09:57 -04004915static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4916 char *addrp, u16 family, u32 peer_sid,
Thomas Liu2bf49692009-07-14 12:14:09 -04004917 struct common_audit_data *ad)
Paul Mooreeffad8d2008-01-29 08:49:27 -05004918{
4919 int err;
4920 u32 if_sid;
4921 u32 node_sid;
4922
Paul Moorecbe0d6e2014-09-10 17:09:57 -04004923 err = sel_netif_sid(ns, ifindex, &if_sid);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004924 if (err)
4925 return err;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004926 err = avc_has_perm(&selinux_state,
4927 peer_sid, if_sid,
Paul Mooreeffad8d2008-01-29 08:49:27 -05004928 SECCLASS_NETIF, NETIF__INGRESS, ad);
4929 if (err)
4930 return err;
4931
4932 err = sel_netnode_sid(addrp, family, &node_sid);
4933 if (err)
4934 return err;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004935 return avc_has_perm(&selinux_state,
4936 peer_sid, node_sid,
Paul Mooreeffad8d2008-01-29 08:49:27 -05004937 SECCLASS_NODE, NODE__RECVFROM, ad);
4938}
4939
Paul Moore220deb92008-01-29 08:38:23 -05004940static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
Paul Moored8395c82008-10-10 10:16:30 -04004941 u16 family)
Paul Moore220deb92008-01-29 08:38:23 -05004942{
Paul Moore277d3422008-12-31 12:54:11 -05004943 int err = 0;
Paul Moore220deb92008-01-29 08:38:23 -05004944 struct sk_security_struct *sksec = sk->sk_security;
Paul Moore220deb92008-01-29 08:38:23 -05004945 u32 sk_sid = sksec->sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04004946 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004947 struct lsm_network_audit net = {0,};
Paul Moored8395c82008-10-10 10:16:30 -04004948 char *addrp;
4949
Eric Paris50c205f2012-04-04 15:01:43 -04004950 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004951 ad.u.net = &net;
4952 ad.u.net->netif = skb->skb_iif;
4953 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04004954 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4955 if (err)
4956 return err;
Paul Moore220deb92008-01-29 08:38:23 -05004957
Paul Moore58bfbb52009-03-27 17:10:41 -04004958 if (selinux_secmark_enabled()) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004959 err = avc_has_perm(&selinux_state,
4960 sk_sid, skb->secmark, SECCLASS_PACKET,
Paul Moored8395c82008-10-10 10:16:30 -04004961 PACKET__RECV, &ad);
Paul Moore58bfbb52009-03-27 17:10:41 -04004962 if (err)
4963 return err;
4964 }
Paul Moore220deb92008-01-29 08:38:23 -05004965
Steffen Klassertb9679a72011-02-23 12:55:21 +01004966 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4967 if (err)
4968 return err;
4969 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004970
James Morris4e5ab4c2006-06-09 00:33:33 -07004971 return err;
4972}
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004973
James Morris4e5ab4c2006-06-09 00:33:33 -07004974static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4975{
Paul Moore220deb92008-01-29 08:38:23 -05004976 int err;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004977 struct sk_security_struct *sksec = sk->sk_security;
Paul Moore220deb92008-01-29 08:38:23 -05004978 u16 family = sk->sk_family;
4979 u32 sk_sid = sksec->sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04004980 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004981 struct lsm_network_audit net = {0,};
Paul Moore220deb92008-01-29 08:38:23 -05004982 char *addrp;
Paul Moored8395c82008-10-10 10:16:30 -04004983 u8 secmark_active;
4984 u8 peerlbl_active;
James Morris4e5ab4c2006-06-09 00:33:33 -07004985
James Morris4e5ab4c2006-06-09 00:33:33 -07004986 if (family != PF_INET && family != PF_INET6)
Paul Moore220deb92008-01-29 08:38:23 -05004987 return 0;
James Morris4e5ab4c2006-06-09 00:33:33 -07004988
4989 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
Al Viro87fcd702006-12-04 22:00:55 +00004990 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
James Morris4e5ab4c2006-06-09 00:33:33 -07004991 family = PF_INET;
4992
Paul Moored8395c82008-10-10 10:16:30 -04004993 /* If any sort of compatibility mode is enabled then handoff processing
4994 * to the selinux_sock_rcv_skb_compat() function to deal with the
4995 * special handling. We do this in an attempt to keep this function
4996 * as fast and as clean as possible. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004997 if (!selinux_policycap_netpeer())
Paul Moored8395c82008-10-10 10:16:30 -04004998 return selinux_sock_rcv_skb_compat(sk, skb, family);
4999
5000 secmark_active = selinux_secmark_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04005001 peerlbl_active = selinux_peerlbl_enabled();
Paul Moored8395c82008-10-10 10:16:30 -04005002 if (!secmark_active && !peerlbl_active)
5003 return 0;
5004
Eric Paris50c205f2012-04-04 15:01:43 -04005005 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005006 ad.u.net = &net;
5007 ad.u.net->netif = skb->skb_iif;
5008 ad.u.net->family = family;
Paul Moore224dfbd2008-01-29 08:38:13 -05005009 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
James Morris4e5ab4c2006-06-09 00:33:33 -07005010 if (err)
Paul Moore220deb92008-01-29 08:38:23 -05005011 return err;
James Morris4e5ab4c2006-06-09 00:33:33 -07005012
Paul Moored8395c82008-10-10 10:16:30 -04005013 if (peerlbl_active) {
Paul Moored621d352008-01-29 08:43:36 -05005014 u32 peer_sid;
5015
5016 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
5017 if (err)
5018 return err;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005019 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
5020 addrp, family, peer_sid, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04005021 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04005022 selinux_netlbl_err(skb, family, err, 0);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005023 return err;
Paul Mooredfaebe92008-10-10 10:16:31 -04005024 }
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005025 err = avc_has_perm(&selinux_state,
5026 sk_sid, peer_sid, SECCLASS_PEER,
Paul Moored621d352008-01-29 08:43:36 -05005027 PEER__RECV, &ad);
Chad Hanson46d01d62013-12-23 17:45:01 -05005028 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04005029 selinux_netlbl_err(skb, family, err, 0);
Chad Hanson46d01d62013-12-23 17:45:01 -05005030 return err;
5031 }
Paul Moored621d352008-01-29 08:43:36 -05005032 }
5033
Paul Moored8395c82008-10-10 10:16:30 -04005034 if (secmark_active) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005035 err = avc_has_perm(&selinux_state,
5036 sk_sid, skb->secmark, SECCLASS_PACKET,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005037 PACKET__RECV, &ad);
5038 if (err)
5039 return err;
5040 }
5041
Paul Moored621d352008-01-29 08:43:36 -05005042 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005043}
5044
Catherine Zhang2c7946a2006-03-20 22:41:23 -08005045static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
5046 int __user *optlen, unsigned len)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005047{
5048 int err = 0;
5049 char *scontext;
5050 u32 scontext_len;
Paul Moore253bfae2010-04-22 14:46:19 -04005051 struct sk_security_struct *sksec = sock->sk->sk_security;
Paul Moore3de4bab2006-11-17 17:38:54 -05005052 u32 peer_sid = SECSID_NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005053
Paul Moore253bfae2010-04-22 14:46:19 -04005054 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
Richard Hainesd4529302018-02-13 20:57:18 +00005055 sksec->sclass == SECCLASS_TCP_SOCKET ||
5056 sksec->sclass == SECCLASS_SCTP_SOCKET)
Eric Parisdd3e7832010-04-07 15:08:46 -04005057 peer_sid = sksec->peer_sid;
Paul Moore253bfae2010-04-22 14:46:19 -04005058 if (peer_sid == SECSID_NULL)
5059 return -ENOPROTOOPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005060
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005061 err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
5062 &scontext_len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005063 if (err)
Paul Moore253bfae2010-04-22 14:46:19 -04005064 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005065
5066 if (scontext_len > len) {
5067 err = -ERANGE;
5068 goto out_len;
5069 }
5070
5071 if (copy_to_user(optval, scontext, scontext_len))
5072 err = -EFAULT;
5073
5074out_len:
5075 if (put_user(scontext_len, optlen))
5076 err = -EFAULT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005077 kfree(scontext);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005078 return err;
5079}
5080
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005081static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
Catherine Zhang2c7946a2006-03-20 22:41:23 -08005082{
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005083 u32 peer_secid = SECSID_NULL;
Paul Moore75e22912008-01-29 08:38:04 -05005084 u16 family;
Paul Moore899134f2016-03-28 15:19:10 -04005085 struct inode_security_struct *isec;
Catherine Zhang877ce7c2006-06-29 12:27:47 -07005086
Paul Mooreaa862902008-10-10 10:16:29 -04005087 if (skb && skb->protocol == htons(ETH_P_IP))
5088 family = PF_INET;
5089 else if (skb && skb->protocol == htons(ETH_P_IPV6))
5090 family = PF_INET6;
5091 else if (sock)
Paul Moore75e22912008-01-29 08:38:04 -05005092 family = sock->sk->sk_family;
Paul Moore75e22912008-01-29 08:38:04 -05005093 else
5094 goto out;
5095
Paul Moore899134f2016-03-28 15:19:10 -04005096 if (sock && family == PF_UNIX) {
5097 isec = inode_security_novalidate(SOCK_INODE(sock));
5098 peer_secid = isec->sid;
5099 } else if (skb)
Paul Moore220deb92008-01-29 08:38:23 -05005100 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
Catherine Zhang2c7946a2006-03-20 22:41:23 -08005101
Paul Moore75e22912008-01-29 08:38:04 -05005102out:
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005103 *secid = peer_secid;
Paul Moore75e22912008-01-29 08:38:04 -05005104 if (peer_secid == SECSID_NULL)
5105 return -EINVAL;
5106 return 0;
Catherine Zhang2c7946a2006-03-20 22:41:23 -08005107}
5108
Al Viro7d877f32005-10-21 03:20:43 -04005109static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005110{
Paul Moore84914b72010-04-22 14:46:18 -04005111 struct sk_security_struct *sksec;
5112
5113 sksec = kzalloc(sizeof(*sksec), priority);
5114 if (!sksec)
5115 return -ENOMEM;
5116
5117 sksec->peer_sid = SECINITSID_UNLABELED;
5118 sksec->sid = SECINITSID_UNLABELED;
Stephen Smalley5dee25d2015-07-10 17:19:57 -04005119 sksec->sclass = SECCLASS_SOCKET;
Paul Moore84914b72010-04-22 14:46:18 -04005120 selinux_netlbl_sk_security_reset(sksec);
5121 sk->sk_security = sksec;
5122
5123 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005124}
5125
5126static void selinux_sk_free_security(struct sock *sk)
5127{
Paul Moore84914b72010-04-22 14:46:18 -04005128 struct sk_security_struct *sksec = sk->sk_security;
5129
5130 sk->sk_security = NULL;
5131 selinux_netlbl_sk_security_free(sksec);
5132 kfree(sksec);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005133}
5134
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005135static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5136{
Eric Parisdd3e7832010-04-07 15:08:46 -04005137 struct sk_security_struct *sksec = sk->sk_security;
5138 struct sk_security_struct *newsksec = newsk->sk_security;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005139
Eric Parisdd3e7832010-04-07 15:08:46 -04005140 newsksec->sid = sksec->sid;
5141 newsksec->peer_sid = sksec->peer_sid;
5142 newsksec->sclass = sksec->sclass;
Paul Moore99f59ed2006-08-29 17:53:48 -07005143
Eric Parisdd3e7832010-04-07 15:08:46 -04005144 selinux_netlbl_sk_security_reset(newsksec);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005145}
5146
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07005147static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005148{
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005149 if (!sk)
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07005150 *secid = SECINITSID_ANY_SOCKET;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005151 else {
5152 struct sk_security_struct *sksec = sk->sk_security;
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005153
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07005154 *secid = sksec->sid;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005155 }
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005156}
5157
Eric Paris828dfe12008-04-17 13:17:49 -04005158static void selinux_sock_graft(struct sock *sk, struct socket *parent)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005159{
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05005160 struct inode_security_struct *isec =
5161 inode_security_novalidate(SOCK_INODE(parent));
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005162 struct sk_security_struct *sksec = sk->sk_security;
5163
Paul Moore2873ead2014-07-28 10:42:48 -04005164 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5165 sk->sk_family == PF_UNIX)
David Woodhouse2148ccc2006-09-29 15:50:25 -07005166 isec->sid = sksec->sid;
Paul Moore220deb92008-01-29 08:38:23 -05005167 sksec->sclass = isec->sclass;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005168}
5169
Richard Hainesd4529302018-02-13 20:57:18 +00005170/* Called whenever SCTP receives an INIT chunk. This happens when an incoming
5171 * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
5172 * already present).
5173 */
5174static int selinux_sctp_assoc_request(struct sctp_endpoint *ep,
5175 struct sk_buff *skb)
5176{
5177 struct sk_security_struct *sksec = ep->base.sk->sk_security;
5178 struct common_audit_data ad;
5179 struct lsm_network_audit net = {0,};
5180 u8 peerlbl_active;
5181 u32 peer_sid = SECINITSID_UNLABELED;
5182 u32 conn_sid;
5183 int err = 0;
5184
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005185 if (!selinux_policycap_extsockclass())
Richard Hainesd4529302018-02-13 20:57:18 +00005186 return 0;
5187
5188 peerlbl_active = selinux_peerlbl_enabled();
5189
5190 if (peerlbl_active) {
5191 /* This will return peer_sid = SECSID_NULL if there are
5192 * no peer labels, see security_net_peersid_resolve().
5193 */
5194 err = selinux_skb_peerlbl_sid(skb, ep->base.sk->sk_family,
5195 &peer_sid);
5196 if (err)
5197 return err;
5198
5199 if (peer_sid == SECSID_NULL)
5200 peer_sid = SECINITSID_UNLABELED;
5201 }
5202
5203 if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5204 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5205
5206 /* Here as first association on socket. As the peer SID
5207 * was allowed by peer recv (and the netif/node checks),
5208 * then it is approved by policy and used as the primary
5209 * peer SID for getpeercon(3).
5210 */
5211 sksec->peer_sid = peer_sid;
5212 } else if (sksec->peer_sid != peer_sid) {
5213 /* Other association peer SIDs are checked to enforce
5214 * consistency among the peer SIDs.
5215 */
5216 ad.type = LSM_AUDIT_DATA_NET;
5217 ad.u.net = &net;
5218 ad.u.net->sk = ep->base.sk;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005219 err = avc_has_perm(&selinux_state,
5220 sksec->peer_sid, peer_sid, sksec->sclass,
Richard Hainesd4529302018-02-13 20:57:18 +00005221 SCTP_SOCKET__ASSOCIATION, &ad);
5222 if (err)
5223 return err;
5224 }
5225
5226 /* Compute the MLS component for the connection and store
5227 * the information in ep. This will be used by SCTP TCP type
5228 * sockets and peeled off connections as they cause a new
5229 * socket to be generated. selinux_sctp_sk_clone() will then
5230 * plug this into the new socket.
5231 */
5232 err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
5233 if (err)
5234 return err;
5235
5236 ep->secid = conn_sid;
5237 ep->peer_secid = peer_sid;
5238
5239 /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5240 return selinux_netlbl_sctp_assoc_request(ep, skb);
5241}
5242
5243/* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5244 * based on their @optname.
5245 */
5246static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5247 struct sockaddr *address,
5248 int addrlen)
5249{
5250 int len, err = 0, walk_size = 0;
5251 void *addr_buf;
5252 struct sockaddr *addr;
5253 struct socket *sock;
5254
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005255 if (!selinux_policycap_extsockclass())
Richard Hainesd4529302018-02-13 20:57:18 +00005256 return 0;
5257
5258 /* Process one or more addresses that may be IPv4 or IPv6 */
5259 sock = sk->sk_socket;
5260 addr_buf = address;
5261
5262 while (walk_size < addrlen) {
5263 addr = addr_buf;
5264 switch (addr->sa_family) {
Alexey Kodanev4152dc92018-05-11 20:15:13 +03005265 case AF_UNSPEC:
Richard Hainesd4529302018-02-13 20:57:18 +00005266 case AF_INET:
5267 len = sizeof(struct sockaddr_in);
5268 break;
5269 case AF_INET6:
5270 len = sizeof(struct sockaddr_in6);
5271 break;
5272 default:
Alexey Kodanev4152dc92018-05-11 20:15:13 +03005273 return -EINVAL;
Richard Hainesd4529302018-02-13 20:57:18 +00005274 }
5275
5276 err = -EINVAL;
5277 switch (optname) {
5278 /* Bind checks */
5279 case SCTP_PRIMARY_ADDR:
5280 case SCTP_SET_PEER_PRIMARY_ADDR:
5281 case SCTP_SOCKOPT_BINDX_ADD:
5282 err = selinux_socket_bind(sock, addr, len);
5283 break;
5284 /* Connect checks */
5285 case SCTP_SOCKOPT_CONNECTX:
5286 case SCTP_PARAM_SET_PRIMARY:
5287 case SCTP_PARAM_ADD_IP:
5288 case SCTP_SENDMSG_CONNECT:
5289 err = selinux_socket_connect_helper(sock, addr, len);
5290 if (err)
5291 return err;
5292
5293 /* As selinux_sctp_bind_connect() is called by the
5294 * SCTP protocol layer, the socket is already locked,
5295 * therefore selinux_netlbl_socket_connect_locked() is
5296 * is called here. The situations handled are:
5297 * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5298 * whenever a new IP address is added or when a new
5299 * primary address is selected.
5300 * Note that an SCTP connect(2) call happens before
5301 * the SCTP protocol layer and is handled via
5302 * selinux_socket_connect().
5303 */
5304 err = selinux_netlbl_socket_connect_locked(sk, addr);
5305 break;
5306 }
5307
5308 if (err)
5309 return err;
5310
5311 addr_buf += len;
5312 walk_size += len;
5313 }
5314
5315 return 0;
5316}
5317
5318/* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5319static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
5320 struct sock *newsk)
5321{
5322 struct sk_security_struct *sksec = sk->sk_security;
5323 struct sk_security_struct *newsksec = newsk->sk_security;
5324
5325 /* If policy does not support SECCLASS_SCTP_SOCKET then call
5326 * the non-sctp clone version.
5327 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005328 if (!selinux_policycap_extsockclass())
Richard Hainesd4529302018-02-13 20:57:18 +00005329 return selinux_sk_clone_security(sk, newsk);
5330
5331 newsksec->sid = ep->secid;
5332 newsksec->peer_sid = ep->peer_secid;
5333 newsksec->sclass = sksec->sclass;
5334 selinux_netlbl_sctp_sk_clone(sk, newsk);
5335}
5336
Adrian Bunk9a673e52006-08-15 00:03:53 -07005337static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
5338 struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005339{
5340 struct sk_security_struct *sksec = sk->sk_security;
5341 int err;
Paul Moore0b1f24e2013-12-03 11:39:13 -05005342 u16 family = req->rsk_ops->family;
Paul Moore446b8022013-12-04 16:10:51 -05005343 u32 connsid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005344 u32 peersid;
5345
Paul Mooreaa862902008-10-10 10:16:29 -04005346 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
Paul Moore220deb92008-01-29 08:38:23 -05005347 if (err)
5348 return err;
Paul Moore446b8022013-12-04 16:10:51 -05005349 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5350 if (err)
5351 return err;
5352 req->secid = connsid;
5353 req->peer_secid = peersid;
Venkat Yekkiralaa51c64f2006-07-27 22:01:34 -07005354
Paul Moore389fb8002009-03-27 17:10:34 -04005355 return selinux_netlbl_inet_conn_request(req, family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005356}
5357
Adrian Bunk9a673e52006-08-15 00:03:53 -07005358static void selinux_inet_csk_clone(struct sock *newsk,
5359 const struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005360{
5361 struct sk_security_struct *newsksec = newsk->sk_security;
5362
5363 newsksec->sid = req->secid;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005364 newsksec->peer_sid = req->peer_secid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005365 /* NOTE: Ideally, we should also get the isec->sid for the
5366 new socket in sync, but we don't have the isec available yet.
5367 So we will wait until sock_graft to do it, by which
5368 time it will have been created and available. */
Paul Moore99f59ed2006-08-29 17:53:48 -07005369
Paul Moore9f2ad662006-11-17 17:38:53 -05005370 /* We don't need to take any sort of lock here as we are the only
5371 * thread with access to newsksec */
Paul Moore389fb8002009-03-27 17:10:34 -04005372 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005373}
5374
Paul Moore014ab192008-10-10 10:16:33 -04005375static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005376{
Paul Mooreaa862902008-10-10 10:16:29 -04005377 u16 family = sk->sk_family;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005378 struct sk_security_struct *sksec = sk->sk_security;
5379
Paul Mooreaa862902008-10-10 10:16:29 -04005380 /* handle mapped IPv4 packets arriving via IPv6 sockets */
5381 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5382 family = PF_INET;
5383
5384 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005385}
5386
Eric Paris2606fd12010-10-13 16:24:41 -04005387static int selinux_secmark_relabel_packet(u32 sid)
5388{
5389 const struct task_security_struct *__tsec;
5390 u32 tsid;
5391
5392 __tsec = current_security();
5393 tsid = __tsec->sid;
5394
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005395 return avc_has_perm(&selinux_state,
5396 tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5397 NULL);
Eric Paris2606fd12010-10-13 16:24:41 -04005398}
5399
5400static void selinux_secmark_refcount_inc(void)
5401{
5402 atomic_inc(&selinux_secmark_refcount);
5403}
5404
5405static void selinux_secmark_refcount_dec(void)
5406{
5407 atomic_dec(&selinux_secmark_refcount);
5408}
5409
Adrian Bunk9a673e52006-08-15 00:03:53 -07005410static void selinux_req_classify_flow(const struct request_sock *req,
5411 struct flowi *fl)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005412{
David S. Miller1d28f422011-03-12 00:29:39 -05005413 fl->flowi_secid = req->secid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005414}
5415
Paul Moore5dbbaf22013-01-14 07:12:19 +00005416static int selinux_tun_dev_alloc_security(void **security)
5417{
5418 struct tun_security_struct *tunsec;
5419
5420 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5421 if (!tunsec)
5422 return -ENOMEM;
5423 tunsec->sid = current_sid();
5424
5425 *security = tunsec;
5426 return 0;
5427}
5428
5429static void selinux_tun_dev_free_security(void *security)
5430{
5431 kfree(security);
5432}
5433
Paul Mooreed6d76e2009-08-28 18:12:49 -04005434static int selinux_tun_dev_create(void)
5435{
5436 u32 sid = current_sid();
5437
5438 /* we aren't taking into account the "sockcreate" SID since the socket
5439 * that is being created here is not a socket in the traditional sense,
5440 * instead it is a private sock, accessible only to the kernel, and
5441 * representing a wide range of network traffic spanning multiple
5442 * connections unlike traditional sockets - check the TUN driver to
5443 * get a better understanding of why this socket is special */
5444
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005445 return avc_has_perm(&selinux_state,
5446 sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
Paul Mooreed6d76e2009-08-28 18:12:49 -04005447 NULL);
5448}
5449
Paul Moore5dbbaf22013-01-14 07:12:19 +00005450static int selinux_tun_dev_attach_queue(void *security)
Paul Mooreed6d76e2009-08-28 18:12:49 -04005451{
Paul Moore5dbbaf22013-01-14 07:12:19 +00005452 struct tun_security_struct *tunsec = security;
5453
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005454 return avc_has_perm(&selinux_state,
5455 current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
Paul Moore5dbbaf22013-01-14 07:12:19 +00005456 TUN_SOCKET__ATTACH_QUEUE, NULL);
5457}
5458
5459static int selinux_tun_dev_attach(struct sock *sk, void *security)
5460{
5461 struct tun_security_struct *tunsec = security;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005462 struct sk_security_struct *sksec = sk->sk_security;
5463
5464 /* we don't currently perform any NetLabel based labeling here and it
5465 * isn't clear that we would want to do so anyway; while we could apply
5466 * labeling without the support of the TUN user the resulting labeled
5467 * traffic from the other end of the connection would almost certainly
5468 * cause confusion to the TUN user that had no idea network labeling
5469 * protocols were being used */
5470
Paul Moore5dbbaf22013-01-14 07:12:19 +00005471 sksec->sid = tunsec->sid;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005472 sksec->sclass = SECCLASS_TUN_SOCKET;
Paul Moore5dbbaf22013-01-14 07:12:19 +00005473
5474 return 0;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005475}
5476
Paul Moore5dbbaf22013-01-14 07:12:19 +00005477static int selinux_tun_dev_open(void *security)
Paul Mooreed6d76e2009-08-28 18:12:49 -04005478{
Paul Moore5dbbaf22013-01-14 07:12:19 +00005479 struct tun_security_struct *tunsec = security;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005480 u32 sid = current_sid();
5481 int err;
5482
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005483 err = avc_has_perm(&selinux_state,
5484 sid, tunsec->sid, SECCLASS_TUN_SOCKET,
Paul Mooreed6d76e2009-08-28 18:12:49 -04005485 TUN_SOCKET__RELABELFROM, NULL);
5486 if (err)
5487 return err;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005488 err = avc_has_perm(&selinux_state,
5489 sid, sid, SECCLASS_TUN_SOCKET,
Paul Mooreed6d76e2009-08-28 18:12:49 -04005490 TUN_SOCKET__RELABELTO, NULL);
5491 if (err)
5492 return err;
Paul Moore5dbbaf22013-01-14 07:12:19 +00005493 tunsec->sid = sid;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005494
5495 return 0;
5496}
5497
Linus Torvalds1da177e2005-04-16 15:20:36 -07005498static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5499{
5500 int err = 0;
5501 u32 perm;
5502 struct nlmsghdr *nlh;
Paul Moore253bfae2010-04-22 14:46:19 -04005503 struct sk_security_struct *sksec = sk->sk_security;
Eric Paris828dfe12008-04-17 13:17:49 -04005504
Hong zhi guo77954982013-03-27 06:49:35 +00005505 if (skb->len < NLMSG_HDRLEN) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005506 err = -EINVAL;
5507 goto out;
5508 }
Arnaldo Carvalho de Melob529ccf2007-04-25 19:08:35 -07005509 nlh = nlmsg_hdr(skb);
Eric Paris828dfe12008-04-17 13:17:49 -04005510
Paul Moore253bfae2010-04-22 14:46:19 -04005511 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005512 if (err) {
5513 if (err == -EINVAL) {
Vladis Dronov76319942015-12-24 11:09:41 -05005514 pr_warn_ratelimited("SELinux: unrecognized netlink"
5515 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5516 " pig=%d comm=%s\n",
Marek Milkoviccded3ff2015-06-04 16:22:16 -04005517 sk->sk_protocol, nlh->nlmsg_type,
Vladis Dronov76319942015-12-24 11:09:41 -05005518 secclass_map[sksec->sclass - 1].name,
5519 task_pid_nr(current), current->comm);
Paul Mooree5a5ca92018-03-01 17:38:30 -05005520 if (!enforcing_enabled(&selinux_state) ||
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005521 security_get_allow_unknown(&selinux_state))
Linus Torvalds1da177e2005-04-16 15:20:36 -07005522 err = 0;
5523 }
5524
5525 /* Ignore */
5526 if (err == -ENOENT)
5527 err = 0;
5528 goto out;
5529 }
5530
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005531 err = sock_has_perm(sk, perm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005532out:
5533 return err;
5534}
5535
5536#ifdef CONFIG_NETFILTER
5537
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005538static unsigned int selinux_ip_forward(struct sk_buff *skb,
5539 const struct net_device *indev,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005540 u16 family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005541{
Paul Mooredfaebe92008-10-10 10:16:31 -04005542 int err;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005543 char *addrp;
5544 u32 peer_sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04005545 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005546 struct lsm_network_audit net = {0,};
Paul Mooreeffad8d2008-01-29 08:49:27 -05005547 u8 secmark_active;
Paul Moore948bf852008-10-10 10:16:32 -04005548 u8 netlbl_active;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005549 u8 peerlbl_active;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005550
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005551 if (!selinux_policycap_netpeer())
Paul Mooreeffad8d2008-01-29 08:49:27 -05005552 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005553
Paul Mooreeffad8d2008-01-29 08:49:27 -05005554 secmark_active = selinux_secmark_enabled();
Paul Moore948bf852008-10-10 10:16:32 -04005555 netlbl_active = netlbl_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04005556 peerlbl_active = selinux_peerlbl_enabled();
Paul Mooreeffad8d2008-01-29 08:49:27 -05005557 if (!secmark_active && !peerlbl_active)
5558 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005559
Paul Moored8395c82008-10-10 10:16:30 -04005560 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5561 return NF_DROP;
5562
Eric Paris50c205f2012-04-04 15:01:43 -04005563 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005564 ad.u.net = &net;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005565 ad.u.net->netif = indev->ifindex;
Eric Paris48c62af2012-04-02 13:15:44 -04005566 ad.u.net->family = family;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005567 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5568 return NF_DROP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005569
Paul Mooredfaebe92008-10-10 10:16:31 -04005570 if (peerlbl_active) {
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005571 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5572 addrp, family, peer_sid, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04005573 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04005574 selinux_netlbl_err(skb, family, err, 1);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005575 return NF_DROP;
Paul Mooredfaebe92008-10-10 10:16:31 -04005576 }
5577 }
Paul Mooreeffad8d2008-01-29 08:49:27 -05005578
5579 if (secmark_active)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005580 if (avc_has_perm(&selinux_state,
5581 peer_sid, skb->secmark,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005582 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5583 return NF_DROP;
5584
Paul Moore948bf852008-10-10 10:16:32 -04005585 if (netlbl_active)
5586 /* we do this in the FORWARD path and not the POST_ROUTING
5587 * path because we want to make sure we apply the necessary
5588 * labeling before IPsec is applied so we can leverage AH
5589 * protection */
5590 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5591 return NF_DROP;
5592
Paul Mooreeffad8d2008-01-29 08:49:27 -05005593 return NF_ACCEPT;
5594}
5595
Eric W. Biederman06198b32015-09-18 14:33:06 -05005596static unsigned int selinux_ipv4_forward(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005597 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005598 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005599{
David S. Miller238e54c2015-04-03 20:32:56 -04005600 return selinux_ip_forward(skb, state->in, PF_INET);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005601}
5602
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005603#if IS_ENABLED(CONFIG_IPV6)
Eric W. Biederman06198b32015-09-18 14:33:06 -05005604static unsigned int selinux_ipv6_forward(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005605 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005606 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005607{
David S. Miller238e54c2015-04-03 20:32:56 -04005608 return selinux_ip_forward(skb, state->in, PF_INET6);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005609}
5610#endif /* IPV6 */
5611
Paul Moore948bf852008-10-10 10:16:32 -04005612static unsigned int selinux_ip_output(struct sk_buff *skb,
5613 u16 family)
5614{
Paul Moore47180062013-12-04 16:10:45 -05005615 struct sock *sk;
Paul Moore948bf852008-10-10 10:16:32 -04005616 u32 sid;
5617
5618 if (!netlbl_enabled())
5619 return NF_ACCEPT;
5620
5621 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5622 * because we want to make sure we apply the necessary labeling
5623 * before IPsec is applied so we can leverage AH protection */
Paul Moore47180062013-12-04 16:10:45 -05005624 sk = skb->sk;
5625 if (sk) {
5626 struct sk_security_struct *sksec;
5627
Eric Dumazete446f9d2015-10-08 05:01:55 -07005628 if (sk_listener(sk))
Paul Moore47180062013-12-04 16:10:45 -05005629 /* if the socket is the listening state then this
5630 * packet is a SYN-ACK packet which means it needs to
5631 * be labeled based on the connection/request_sock and
5632 * not the parent socket. unfortunately, we can't
5633 * lookup the request_sock yet as it isn't queued on
5634 * the parent socket until after the SYN-ACK is sent.
5635 * the "solution" is to simply pass the packet as-is
5636 * as any IP option based labeling should be copied
5637 * from the initial connection request (in the IP
5638 * layer). it is far from ideal, but until we get a
5639 * security label in the packet itself this is the
5640 * best we can do. */
5641 return NF_ACCEPT;
5642
5643 /* standard practice, label using the parent socket */
5644 sksec = sk->sk_security;
Paul Moore948bf852008-10-10 10:16:32 -04005645 sid = sksec->sid;
5646 } else
5647 sid = SECINITSID_KERNEL;
5648 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5649 return NF_DROP;
5650
5651 return NF_ACCEPT;
5652}
5653
Eric W. Biederman06198b32015-09-18 14:33:06 -05005654static unsigned int selinux_ipv4_output(void *priv,
Paul Moore948bf852008-10-10 10:16:32 -04005655 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005656 const struct nf_hook_state *state)
Paul Moore948bf852008-10-10 10:16:32 -04005657{
5658 return selinux_ip_output(skb, PF_INET);
5659}
5660
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005661#if IS_ENABLED(CONFIG_IPV6)
Huw Davies2917f572016-06-27 15:06:15 -04005662static unsigned int selinux_ipv6_output(void *priv,
5663 struct sk_buff *skb,
5664 const struct nf_hook_state *state)
5665{
5666 return selinux_ip_output(skb, PF_INET6);
5667}
5668#endif /* IPV6 */
5669
Paul Mooreeffad8d2008-01-29 08:49:27 -05005670static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5671 int ifindex,
Paul Moored8395c82008-10-10 10:16:30 -04005672 u16 family)
James Morris4e5ab4c2006-06-09 00:33:33 -07005673{
Eric Dumazet54abc682015-11-08 10:54:07 -08005674 struct sock *sk = skb_to_full_sk(skb);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005675 struct sk_security_struct *sksec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005676 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005677 struct lsm_network_audit net = {0,};
Paul Moored8395c82008-10-10 10:16:30 -04005678 char *addrp;
5679 u8 proto;
James Morris4e5ab4c2006-06-09 00:33:33 -07005680
Paul Mooreeffad8d2008-01-29 08:49:27 -05005681 if (sk == NULL)
5682 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005683 sksec = sk->sk_security;
James Morris4e5ab4c2006-06-09 00:33:33 -07005684
Eric Paris50c205f2012-04-04 15:01:43 -04005685 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005686 ad.u.net = &net;
5687 ad.u.net->netif = ifindex;
5688 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04005689 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5690 return NF_DROP;
5691
Paul Moore58bfbb52009-03-27 17:10:41 -04005692 if (selinux_secmark_enabled())
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005693 if (avc_has_perm(&selinux_state,
5694 sksec->sid, skb->secmark,
Paul Moored8395c82008-10-10 10:16:30 -04005695 SECCLASS_PACKET, PACKET__SEND, &ad))
Eric Paris2fe66ec2010-11-23 06:28:08 +00005696 return NF_DROP_ERR(-ECONNREFUSED);
James Morris4e5ab4c2006-06-09 00:33:33 -07005697
Steffen Klassertb9679a72011-02-23 12:55:21 +01005698 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5699 return NF_DROP_ERR(-ECONNREFUSED);
James Morris4e5ab4c2006-06-09 00:33:33 -07005700
Paul Mooreeffad8d2008-01-29 08:49:27 -05005701 return NF_ACCEPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005702}
5703
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005704static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5705 const struct net_device *outdev,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005706 u16 family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005707{
Paul Mooreeffad8d2008-01-29 08:49:27 -05005708 u32 secmark_perm;
5709 u32 peer_sid;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005710 int ifindex = outdev->ifindex;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005711 struct sock *sk;
Thomas Liu2bf49692009-07-14 12:14:09 -04005712 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005713 struct lsm_network_audit net = {0,};
Paul Mooreeffad8d2008-01-29 08:49:27 -05005714 char *addrp;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005715 u8 secmark_active;
5716 u8 peerlbl_active;
5717
Paul Mooreeffad8d2008-01-29 08:49:27 -05005718 /* If any sort of compatibility mode is enabled then handoff processing
5719 * to the selinux_ip_postroute_compat() function to deal with the
5720 * special handling. We do this in an attempt to keep this function
5721 * as fast and as clean as possible. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005722 if (!selinux_policycap_netpeer())
Paul Moored8395c82008-10-10 10:16:30 -04005723 return selinux_ip_postroute_compat(skb, ifindex, family);
Paul Moorec0828e52013-12-10 14:58:01 -05005724
Paul Mooreeffad8d2008-01-29 08:49:27 -05005725 secmark_active = selinux_secmark_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04005726 peerlbl_active = selinux_peerlbl_enabled();
Paul Mooreeffad8d2008-01-29 08:49:27 -05005727 if (!secmark_active && !peerlbl_active)
5728 return NF_ACCEPT;
5729
Eric Dumazet54abc682015-11-08 10:54:07 -08005730 sk = skb_to_full_sk(skb);
Paul Moorec0828e52013-12-10 14:58:01 -05005731
Paul Mooreeffad8d2008-01-29 08:49:27 -05005732#ifdef CONFIG_XFRM
5733 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5734 * packet transformation so allow the packet to pass without any checks
5735 * since we'll have another chance to perform access control checks
5736 * when the packet is on it's final way out.
5737 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
Paul Moorec0828e52013-12-10 14:58:01 -05005738 * is NULL, in this case go ahead and apply access control.
5739 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5740 * TCP listening state we cannot wait until the XFRM processing
5741 * is done as we will miss out on the SA label if we do;
5742 * unfortunately, this means more work, but it is only once per
5743 * connection. */
5744 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
Eric Dumazete446f9d2015-10-08 05:01:55 -07005745 !(sk && sk_listener(sk)))
Paul Mooreeffad8d2008-01-29 08:49:27 -05005746 return NF_ACCEPT;
5747#endif
Paul Mooreeffad8d2008-01-29 08:49:27 -05005748
Paul Moored8395c82008-10-10 10:16:30 -04005749 if (sk == NULL) {
Paul Moore446b8022013-12-04 16:10:51 -05005750 /* Without an associated socket the packet is either coming
5751 * from the kernel or it is being forwarded; check the packet
5752 * to determine which and if the packet is being forwarded
5753 * query the packet directly to determine the security label. */
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005754 if (skb->skb_iif) {
5755 secmark_perm = PACKET__FORWARD_OUT;
Paul Moored8395c82008-10-10 10:16:30 -04005756 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005757 return NF_DROP;
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005758 } else {
5759 secmark_perm = PACKET__SEND;
Paul Moored8395c82008-10-10 10:16:30 -04005760 peer_sid = SECINITSID_KERNEL;
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005761 }
Eric Dumazete446f9d2015-10-08 05:01:55 -07005762 } else if (sk_listener(sk)) {
Paul Moore446b8022013-12-04 16:10:51 -05005763 /* Locally generated packet but the associated socket is in the
5764 * listening state which means this is a SYN-ACK packet. In
5765 * this particular case the correct security label is assigned
5766 * to the connection/request_sock but unfortunately we can't
5767 * query the request_sock as it isn't queued on the parent
5768 * socket until after the SYN-ACK packet is sent; the only
5769 * viable choice is to regenerate the label like we do in
5770 * selinux_inet_conn_request(). See also selinux_ip_output()
5771 * for similar problems. */
5772 u32 skb_sid;
Eric Dumazete446f9d2015-10-08 05:01:55 -07005773 struct sk_security_struct *sksec;
5774
Eric Dumazete446f9d2015-10-08 05:01:55 -07005775 sksec = sk->sk_security;
Paul Moore446b8022013-12-04 16:10:51 -05005776 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5777 return NF_DROP;
Paul Moorec0828e52013-12-10 14:58:01 -05005778 /* At this point, if the returned skb peerlbl is SECSID_NULL
5779 * and the packet has been through at least one XFRM
5780 * transformation then we must be dealing with the "final"
5781 * form of labeled IPsec packet; since we've already applied
5782 * all of our access controls on this packet we can safely
5783 * pass the packet. */
5784 if (skb_sid == SECSID_NULL) {
5785 switch (family) {
5786 case PF_INET:
5787 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5788 return NF_ACCEPT;
5789 break;
5790 case PF_INET6:
5791 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5792 return NF_ACCEPT;
Paul Moorea7a91a12014-09-03 10:51:59 -04005793 break;
Paul Moorec0828e52013-12-10 14:58:01 -05005794 default:
5795 return NF_DROP_ERR(-ECONNREFUSED);
5796 }
5797 }
Paul Moore446b8022013-12-04 16:10:51 -05005798 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5799 return NF_DROP;
5800 secmark_perm = PACKET__SEND;
Paul Moored8395c82008-10-10 10:16:30 -04005801 } else {
Paul Moore446b8022013-12-04 16:10:51 -05005802 /* Locally generated packet, fetch the security label from the
5803 * associated socket. */
Paul Mooreeffad8d2008-01-29 08:49:27 -05005804 struct sk_security_struct *sksec = sk->sk_security;
5805 peer_sid = sksec->sid;
5806 secmark_perm = PACKET__SEND;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005807 }
5808
Eric Paris50c205f2012-04-04 15:01:43 -04005809 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005810 ad.u.net = &net;
5811 ad.u.net->netif = ifindex;
5812 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04005813 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
Eric Paris04f6d702010-11-23 06:28:02 +00005814 return NF_DROP;
Paul Moored8395c82008-10-10 10:16:30 -04005815
Paul Mooreeffad8d2008-01-29 08:49:27 -05005816 if (secmark_active)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005817 if (avc_has_perm(&selinux_state,
5818 peer_sid, skb->secmark,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005819 SECCLASS_PACKET, secmark_perm, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005820 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005821
5822 if (peerlbl_active) {
5823 u32 if_sid;
5824 u32 node_sid;
5825
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005826 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005827 return NF_DROP;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005828 if (avc_has_perm(&selinux_state,
5829 peer_sid, if_sid,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005830 SECCLASS_NETIF, NETIF__EGRESS, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005831 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005832
5833 if (sel_netnode_sid(addrp, family, &node_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005834 return NF_DROP;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005835 if (avc_has_perm(&selinux_state,
5836 peer_sid, node_sid,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005837 SECCLASS_NODE, NODE__SENDTO, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005838 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005839 }
5840
5841 return NF_ACCEPT;
5842}
5843
Eric W. Biederman06198b32015-09-18 14:33:06 -05005844static unsigned int selinux_ipv4_postroute(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005845 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005846 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005847{
David S. Miller238e54c2015-04-03 20:32:56 -04005848 return selinux_ip_postroute(skb, state->out, PF_INET);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005849}
5850
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005851#if IS_ENABLED(CONFIG_IPV6)
Eric W. Biederman06198b32015-09-18 14:33:06 -05005852static unsigned int selinux_ipv6_postroute(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005853 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005854 const struct nf_hook_state *state)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005855{
David S. Miller238e54c2015-04-03 20:32:56 -04005856 return selinux_ip_postroute(skb, state->out, PF_INET6);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005857}
Linus Torvalds1da177e2005-04-16 15:20:36 -07005858#endif /* IPV6 */
5859
5860#endif /* CONFIG_NETFILTER */
5861
Linus Torvalds1da177e2005-04-16 15:20:36 -07005862static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5863{
Stephen Smalley941fc5b2009-10-01 14:48:23 -04005864 return selinux_nlmsg_perm(sk, skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005865}
5866
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005867static int ipc_alloc_security(struct kern_ipc_perm *perm,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005868 u16 sclass)
5869{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005870 struct ipc_security_struct *isec;
5871
James Morris89d155e2005-10-30 14:59:21 -08005872 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005873 if (!isec)
5874 return -ENOMEM;
5875
Linus Torvalds1da177e2005-04-16 15:20:36 -07005876 isec->sclass = sclass;
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005877 isec->sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005878 perm->security = isec;
5879
5880 return 0;
5881}
5882
5883static void ipc_free_security(struct kern_ipc_perm *perm)
5884{
5885 struct ipc_security_struct *isec = perm->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005886 perm->security = NULL;
5887 kfree(isec);
5888}
5889
5890static int msg_msg_alloc_security(struct msg_msg *msg)
5891{
5892 struct msg_security_struct *msec;
5893
James Morris89d155e2005-10-30 14:59:21 -08005894 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005895 if (!msec)
5896 return -ENOMEM;
5897
Linus Torvalds1da177e2005-04-16 15:20:36 -07005898 msec->sid = SECINITSID_UNLABELED;
5899 msg->security = msec;
5900
5901 return 0;
5902}
5903
5904static void msg_msg_free_security(struct msg_msg *msg)
5905{
5906 struct msg_security_struct *msec = msg->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005907
5908 msg->security = NULL;
5909 kfree(msec);
5910}
5911
5912static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
Stephen Smalley6af963f2005-05-01 08:58:39 -07005913 u32 perms)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005914{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005915 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005916 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005917 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005918
Linus Torvalds1da177e2005-04-16 15:20:36 -07005919 isec = ipc_perms->security;
5920
Eric Paris50c205f2012-04-04 15:01:43 -04005921 ad.type = LSM_AUDIT_DATA_IPC;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005922 ad.u.ipc_id = ipc_perms->key;
5923
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005924 return avc_has_perm(&selinux_state,
5925 sid, isec->sid, isec->sclass, perms, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005926}
5927
5928static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5929{
5930 return msg_msg_alloc_security(msg);
5931}
5932
5933static void selinux_msg_msg_free_security(struct msg_msg *msg)
5934{
5935 msg_msg_free_security(msg);
5936}
5937
5938/* message queue security operations */
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005939static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005940{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005941 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005942 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005943 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005944 int rc;
5945
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005946 rc = ipc_alloc_security(msq, SECCLASS_MSGQ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005947 if (rc)
5948 return rc;
5949
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005950 isec = msq->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005951
Eric Paris50c205f2012-04-04 15:01:43 -04005952 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005953 ad.u.ipc_id = msq->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005954
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005955 rc = avc_has_perm(&selinux_state,
5956 sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005957 MSGQ__CREATE, &ad);
5958 if (rc) {
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005959 ipc_free_security(msq);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005960 return rc;
5961 }
5962 return 0;
5963}
5964
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005965static void selinux_msg_queue_free_security(struct kern_ipc_perm *msq)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005966{
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005967 ipc_free_security(msq);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005968}
5969
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005970static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005971{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005972 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005973 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005974 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005975
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005976 isec = msq->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005977
Eric Paris50c205f2012-04-04 15:01:43 -04005978 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005979 ad.u.ipc_id = msq->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005980
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005981 return avc_has_perm(&selinux_state,
5982 sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005983 MSGQ__ASSOCIATE, &ad);
5984}
5985
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005986static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005987{
5988 int err;
5989 int perms;
5990
Eric Paris828dfe12008-04-17 13:17:49 -04005991 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005992 case IPC_INFO:
5993 case MSG_INFO:
5994 /* No specific object, just general system-wide information. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005995 return avc_has_perm(&selinux_state,
5996 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005997 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005998 case IPC_STAT:
5999 case MSG_STAT:
Davidlohr Bueso23c8cec2018-04-10 16:35:30 -07006000 case MSG_STAT_ANY:
Linus Torvalds1da177e2005-04-16 15:20:36 -07006001 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
6002 break;
6003 case IPC_SET:
6004 perms = MSGQ__SETATTR;
6005 break;
6006 case IPC_RMID:
6007 perms = MSGQ__DESTROY;
6008 break;
6009 default:
6010 return 0;
6011 }
6012
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006013 err = ipc_has_perm(msq, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006014 return err;
6015}
6016
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006017static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006018{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006019 struct ipc_security_struct *isec;
6020 struct msg_security_struct *msec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006021 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006022 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006023 int rc;
6024
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006025 isec = msq->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006026 msec = msg->security;
6027
6028 /*
6029 * First time through, need to assign label to the message
6030 */
6031 if (msec->sid == SECINITSID_UNLABELED) {
6032 /*
6033 * Compute new sid based on current process and
6034 * message queue this message will be stored in
6035 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006036 rc = security_transition_sid(&selinux_state, sid, isec->sid,
6037 SECCLASS_MSG, NULL, &msec->sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006038 if (rc)
6039 return rc;
6040 }
6041
Eric Paris50c205f2012-04-04 15:01:43 -04006042 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006043 ad.u.ipc_id = msq->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006044
6045 /* Can this process write to the queue? */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006046 rc = avc_has_perm(&selinux_state,
6047 sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006048 MSGQ__WRITE, &ad);
6049 if (!rc)
6050 /* Can this process send the message */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006051 rc = avc_has_perm(&selinux_state,
6052 sid, msec->sid, SECCLASS_MSG,
David Howells275bb412008-11-14 10:39:19 +11006053 MSG__SEND, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006054 if (!rc)
6055 /* Can the message be put in the queue? */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006056 rc = avc_has_perm(&selinux_state,
6057 msec->sid, isec->sid, SECCLASS_MSGQ,
David Howells275bb412008-11-14 10:39:19 +11006058 MSGQ__ENQUEUE, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006059
6060 return rc;
6061}
6062
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006063static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006064 struct task_struct *target,
6065 long type, int mode)
6066{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006067 struct ipc_security_struct *isec;
6068 struct msg_security_struct *msec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006069 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006070 u32 sid = task_sid(target);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006071 int rc;
6072
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006073 isec = msq->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006074 msec = msg->security;
6075
Eric Paris50c205f2012-04-04 15:01:43 -04006076 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006077 ad.u.ipc_id = msq->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006078
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006079 rc = avc_has_perm(&selinux_state,
6080 sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006081 SECCLASS_MSGQ, MSGQ__READ, &ad);
6082 if (!rc)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006083 rc = avc_has_perm(&selinux_state,
6084 sid, msec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006085 SECCLASS_MSG, MSG__RECEIVE, &ad);
6086 return rc;
6087}
6088
6089/* Shared Memory security operations */
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006090static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006091{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006092 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006093 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006094 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006095 int rc;
6096
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006097 rc = ipc_alloc_security(shp, SECCLASS_SHM);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006098 if (rc)
6099 return rc;
6100
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006101 isec = shp->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006102
Eric Paris50c205f2012-04-04 15:01:43 -04006103 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006104 ad.u.ipc_id = shp->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006105
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006106 rc = avc_has_perm(&selinux_state,
6107 sid, isec->sid, SECCLASS_SHM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006108 SHM__CREATE, &ad);
6109 if (rc) {
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006110 ipc_free_security(shp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006111 return rc;
6112 }
6113 return 0;
6114}
6115
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006116static void selinux_shm_free_security(struct kern_ipc_perm *shp)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006117{
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006118 ipc_free_security(shp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006119}
6120
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006121static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006122{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006123 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006124 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006125 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006126
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006127 isec = shp->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006128
Eric Paris50c205f2012-04-04 15:01:43 -04006129 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006130 ad.u.ipc_id = shp->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006131
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006132 return avc_has_perm(&selinux_state,
6133 sid, isec->sid, SECCLASS_SHM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006134 SHM__ASSOCIATE, &ad);
6135}
6136
6137/* Note, at this point, shp is locked down */
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006138static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006139{
6140 int perms;
6141 int err;
6142
Eric Paris828dfe12008-04-17 13:17:49 -04006143 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006144 case IPC_INFO:
6145 case SHM_INFO:
6146 /* No specific object, just general system-wide information. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006147 return avc_has_perm(&selinux_state,
6148 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006149 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006150 case IPC_STAT:
6151 case SHM_STAT:
Davidlohr Buesoc21a6972018-04-10 16:35:23 -07006152 case SHM_STAT_ANY:
Linus Torvalds1da177e2005-04-16 15:20:36 -07006153 perms = SHM__GETATTR | SHM__ASSOCIATE;
6154 break;
6155 case IPC_SET:
6156 perms = SHM__SETATTR;
6157 break;
6158 case SHM_LOCK:
6159 case SHM_UNLOCK:
6160 perms = SHM__LOCK;
6161 break;
6162 case IPC_RMID:
6163 perms = SHM__DESTROY;
6164 break;
6165 default:
6166 return 0;
6167 }
6168
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006169 err = ipc_has_perm(shp, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006170 return err;
6171}
6172
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006173static int selinux_shm_shmat(struct kern_ipc_perm *shp,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006174 char __user *shmaddr, int shmflg)
6175{
6176 u32 perms;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006177
6178 if (shmflg & SHM_RDONLY)
6179 perms = SHM__READ;
6180 else
6181 perms = SHM__READ | SHM__WRITE;
6182
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006183 return ipc_has_perm(shp, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006184}
6185
6186/* Semaphore security operations */
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006187static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006188{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006189 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006190 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006191 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006192 int rc;
6193
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006194 rc = ipc_alloc_security(sma, SECCLASS_SEM);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006195 if (rc)
6196 return rc;
6197
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006198 isec = sma->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006199
Eric Paris50c205f2012-04-04 15:01:43 -04006200 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006201 ad.u.ipc_id = sma->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006202
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006203 rc = avc_has_perm(&selinux_state,
6204 sid, isec->sid, SECCLASS_SEM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006205 SEM__CREATE, &ad);
6206 if (rc) {
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006207 ipc_free_security(sma);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006208 return rc;
6209 }
6210 return 0;
6211}
6212
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006213static void selinux_sem_free_security(struct kern_ipc_perm *sma)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006214{
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006215 ipc_free_security(sma);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006216}
6217
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006218static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006219{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006220 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006221 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006222 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006223
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006224 isec = sma->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006225
Eric Paris50c205f2012-04-04 15:01:43 -04006226 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006227 ad.u.ipc_id = sma->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006228
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006229 return avc_has_perm(&selinux_state,
6230 sid, isec->sid, SECCLASS_SEM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006231 SEM__ASSOCIATE, &ad);
6232}
6233
6234/* Note, at this point, sma is locked down */
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006235static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006236{
6237 int err;
6238 u32 perms;
6239
Eric Paris828dfe12008-04-17 13:17:49 -04006240 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006241 case IPC_INFO:
6242 case SEM_INFO:
6243 /* No specific object, just general system-wide information. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006244 return avc_has_perm(&selinux_state,
6245 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006246 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006247 case GETPID:
6248 case GETNCNT:
6249 case GETZCNT:
6250 perms = SEM__GETATTR;
6251 break;
6252 case GETVAL:
6253 case GETALL:
6254 perms = SEM__READ;
6255 break;
6256 case SETVAL:
6257 case SETALL:
6258 perms = SEM__WRITE;
6259 break;
6260 case IPC_RMID:
6261 perms = SEM__DESTROY;
6262 break;
6263 case IPC_SET:
6264 perms = SEM__SETATTR;
6265 break;
6266 case IPC_STAT:
6267 case SEM_STAT:
Davidlohr Buesoa280d6d2018-04-10 16:35:26 -07006268 case SEM_STAT_ANY:
Linus Torvalds1da177e2005-04-16 15:20:36 -07006269 perms = SEM__GETATTR | SEM__ASSOCIATE;
6270 break;
6271 default:
6272 return 0;
6273 }
6274
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006275 err = ipc_has_perm(sma, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006276 return err;
6277}
6278
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006279static int selinux_sem_semop(struct kern_ipc_perm *sma,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006280 struct sembuf *sops, unsigned nsops, int alter)
6281{
6282 u32 perms;
6283
6284 if (alter)
6285 perms = SEM__READ | SEM__WRITE;
6286 else
6287 perms = SEM__READ;
6288
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006289 return ipc_has_perm(sma, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006290}
6291
6292static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6293{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006294 u32 av = 0;
6295
Linus Torvalds1da177e2005-04-16 15:20:36 -07006296 av = 0;
6297 if (flag & S_IRUGO)
6298 av |= IPC__UNIX_READ;
6299 if (flag & S_IWUGO)
6300 av |= IPC__UNIX_WRITE;
6301
6302 if (av == 0)
6303 return 0;
6304
Stephen Smalley6af963f2005-05-01 08:58:39 -07006305 return ipc_has_perm(ipcp, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006306}
6307
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02006308static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6309{
6310 struct ipc_security_struct *isec = ipcp->security;
6311 *secid = isec->sid;
6312}
6313
Eric Paris828dfe12008-04-17 13:17:49 -04006314static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006315{
6316 if (inode)
6317 inode_doinit_with_dentry(inode, dentry);
6318}
6319
6320static int selinux_getprocattr(struct task_struct *p,
Al Viro04ff9702007-03-12 16:17:58 +00006321 char *name, char **value)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006322{
David Howells275bb412008-11-14 10:39:19 +11006323 const struct task_security_struct *__tsec;
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00006324 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006325 int error;
Al Viro04ff9702007-03-12 16:17:58 +00006326 unsigned len;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006327
David Howells275bb412008-11-14 10:39:19 +11006328 rcu_read_lock();
6329 __tsec = __task_cred(p)->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006330
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006331 if (current != p) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006332 error = avc_has_perm(&selinux_state,
6333 current_sid(), __tsec->sid,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006334 SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6335 if (error)
6336 goto bad;
6337 }
6338
Linus Torvalds1da177e2005-04-16 15:20:36 -07006339 if (!strcmp(name, "current"))
David Howells275bb412008-11-14 10:39:19 +11006340 sid = __tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006341 else if (!strcmp(name, "prev"))
David Howells275bb412008-11-14 10:39:19 +11006342 sid = __tsec->osid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006343 else if (!strcmp(name, "exec"))
David Howells275bb412008-11-14 10:39:19 +11006344 sid = __tsec->exec_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006345 else if (!strcmp(name, "fscreate"))
David Howells275bb412008-11-14 10:39:19 +11006346 sid = __tsec->create_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07006347 else if (!strcmp(name, "keycreate"))
David Howells275bb412008-11-14 10:39:19 +11006348 sid = __tsec->keycreate_sid;
Eric Paris42c3e032006-06-26 00:26:03 -07006349 else if (!strcmp(name, "sockcreate"))
David Howells275bb412008-11-14 10:39:19 +11006350 sid = __tsec->sockcreate_sid;
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006351 else {
6352 error = -EINVAL;
6353 goto bad;
6354 }
David Howells275bb412008-11-14 10:39:19 +11006355 rcu_read_unlock();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006356
6357 if (!sid)
6358 return 0;
6359
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006360 error = security_sid_to_context(&selinux_state, sid, value, &len);
Al Viro04ff9702007-03-12 16:17:58 +00006361 if (error)
6362 return error;
6363 return len;
David Howells275bb412008-11-14 10:39:19 +11006364
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006365bad:
David Howells275bb412008-11-14 10:39:19 +11006366 rcu_read_unlock();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006367 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006368}
6369
Stephen Smalleyb21507e2017-01-09 10:07:31 -05006370static int selinux_setprocattr(const char *name, void *value, size_t size)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006371{
6372 struct task_security_struct *tsec;
David Howellsd84f4f92008-11-14 10:39:23 +11006373 struct cred *new;
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006374 u32 mysid = current_sid(), sid = 0, ptsid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006375 int error;
6376 char *str = value;
6377
Linus Torvalds1da177e2005-04-16 15:20:36 -07006378 /*
6379 * Basic control over ability to set these attributes at all.
Linus Torvalds1da177e2005-04-16 15:20:36 -07006380 */
6381 if (!strcmp(name, "exec"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006382 error = avc_has_perm(&selinux_state,
6383 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006384 PROCESS__SETEXEC, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006385 else if (!strcmp(name, "fscreate"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006386 error = avc_has_perm(&selinux_state,
6387 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006388 PROCESS__SETFSCREATE, NULL);
Michael LeMay4eb582c2006-06-26 00:24:57 -07006389 else if (!strcmp(name, "keycreate"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006390 error = avc_has_perm(&selinux_state,
6391 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006392 PROCESS__SETKEYCREATE, NULL);
Eric Paris42c3e032006-06-26 00:26:03 -07006393 else if (!strcmp(name, "sockcreate"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006394 error = avc_has_perm(&selinux_state,
6395 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006396 PROCESS__SETSOCKCREATE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006397 else if (!strcmp(name, "current"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006398 error = avc_has_perm(&selinux_state,
6399 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006400 PROCESS__SETCURRENT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006401 else
6402 error = -EINVAL;
6403 if (error)
6404 return error;
6405
6406 /* Obtain a SID for the context, if one was specified. */
Stephen Smalleya050a572017-01-31 11:54:04 -05006407 if (size && str[0] && str[0] != '\n') {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006408 if (str[size-1] == '\n') {
6409 str[size-1] = 0;
6410 size--;
6411 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006412 error = security_context_to_sid(&selinux_state, value, size,
6413 &sid, GFP_KERNEL);
Stephen Smalley12b29f32008-05-07 13:03:20 -04006414 if (error == -EINVAL && !strcmp(name, "fscreate")) {
Stephen Smalleydb590002017-04-20 11:31:30 -04006415 if (!has_cap_mac_admin(true)) {
Eric Parisd6ea83e2012-04-04 13:45:49 -04006416 struct audit_buffer *ab;
6417 size_t audit_size;
6418
6419 /* We strip a nul only if it is at the end, otherwise the
6420 * context contains a nul and we should audit that */
6421 if (str[size - 1] == '\0')
6422 audit_size = size - 1;
6423 else
6424 audit_size = size;
Richard Guy Briggscdfb6b32018-05-12 21:58:20 -04006425 ab = audit_log_start(audit_context(),
6426 GFP_ATOMIC,
6427 AUDIT_SELINUX_ERR);
Eric Parisd6ea83e2012-04-04 13:45:49 -04006428 audit_log_format(ab, "op=fscreate invalid_context=");
6429 audit_log_n_untrustedstring(ab, value, audit_size);
6430 audit_log_end(ab);
6431
Stephen Smalley12b29f32008-05-07 13:03:20 -04006432 return error;
Eric Parisd6ea83e2012-04-04 13:45:49 -04006433 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006434 error = security_context_to_sid_force(
6435 &selinux_state,
6436 value, size, &sid);
Stephen Smalley12b29f32008-05-07 13:03:20 -04006437 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07006438 if (error)
6439 return error;
6440 }
6441
David Howellsd84f4f92008-11-14 10:39:23 +11006442 new = prepare_creds();
6443 if (!new)
6444 return -ENOMEM;
6445
Linus Torvalds1da177e2005-04-16 15:20:36 -07006446 /* Permission checking based on the specified context is
6447 performed during the actual operation (execve,
6448 open/mkdir/...), when we know the full context of the
David Howellsd84f4f92008-11-14 10:39:23 +11006449 operation. See selinux_bprm_set_creds for the execve
Linus Torvalds1da177e2005-04-16 15:20:36 -07006450 checks and may_create for the file creation checks. The
6451 operation will then fail if the context is not permitted. */
David Howellsd84f4f92008-11-14 10:39:23 +11006452 tsec = new->security;
6453 if (!strcmp(name, "exec")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006454 tsec->exec_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006455 } else if (!strcmp(name, "fscreate")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006456 tsec->create_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006457 } else if (!strcmp(name, "keycreate")) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006458 error = avc_has_perm(&selinux_state,
6459 mysid, sid, SECCLASS_KEY, KEY__CREATE,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006460 NULL);
Michael LeMay4eb582c2006-06-26 00:24:57 -07006461 if (error)
David Howellsd84f4f92008-11-14 10:39:23 +11006462 goto abort_change;
Michael LeMay4eb582c2006-06-26 00:24:57 -07006463 tsec->keycreate_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006464 } else if (!strcmp(name, "sockcreate")) {
Eric Paris42c3e032006-06-26 00:26:03 -07006465 tsec->sockcreate_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006466 } else if (!strcmp(name, "current")) {
6467 error = -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006468 if (sid == 0)
David Howellsd84f4f92008-11-14 10:39:23 +11006469 goto abort_change;
KaiGai Koheid9250de2008-08-28 16:35:57 +09006470
David Howellsd84f4f92008-11-14 10:39:23 +11006471 /* Only allow single threaded processes to change context */
6472 error = -EPERM;
Oleg Nesterov5bb459b2009-07-10 03:48:23 +02006473 if (!current_is_single_threaded()) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006474 error = security_bounded_transition(&selinux_state,
6475 tsec->sid, sid);
David Howellsd84f4f92008-11-14 10:39:23 +11006476 if (error)
6477 goto abort_change;
Eric Paris828dfe12008-04-17 13:17:49 -04006478 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07006479
6480 /* Check permissions for the transition. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006481 error = avc_has_perm(&selinux_state,
6482 tsec->sid, sid, SECCLASS_PROCESS,
Eric Paris828dfe12008-04-17 13:17:49 -04006483 PROCESS__DYNTRANSITION, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006484 if (error)
David Howellsd84f4f92008-11-14 10:39:23 +11006485 goto abort_change;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006486
6487 /* Check for ptracing, and update the task SID if ok.
6488 Otherwise, leave SID unchanged and fail. */
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006489 ptsid = ptrace_parent_sid();
Paul Moore0c6181c2016-03-30 21:41:21 -04006490 if (ptsid != 0) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006491 error = avc_has_perm(&selinux_state,
6492 ptsid, sid, SECCLASS_PROCESS,
David Howellsd84f4f92008-11-14 10:39:23 +11006493 PROCESS__PTRACE, NULL);
6494 if (error)
6495 goto abort_change;
6496 }
6497
6498 tsec->sid = sid;
6499 } else {
6500 error = -EINVAL;
6501 goto abort_change;
6502 }
6503
6504 commit_creds(new);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006505 return size;
David Howellsd84f4f92008-11-14 10:39:23 +11006506
6507abort_change:
6508 abort_creds(new);
6509 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006510}
6511
David Quigley746df9b2013-05-22 12:50:35 -04006512static int selinux_ismaclabel(const char *name)
6513{
6514 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6515}
6516
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006517static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6518{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006519 return security_sid_to_context(&selinux_state, secid,
6520 secdata, seclen);
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006521}
6522
David Howells7bf570d2008-04-29 20:52:51 +01006523static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
David Howells63cb3442008-01-15 23:47:35 +00006524{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006525 return security_context_to_sid(&selinux_state, secdata, seclen,
6526 secid, GFP_KERNEL);
David Howells63cb3442008-01-15 23:47:35 +00006527}
6528
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006529static void selinux_release_secctx(char *secdata, u32 seclen)
6530{
Paul Moore088999e2007-08-01 11:12:58 -04006531 kfree(secdata);
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006532}
6533
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006534static void selinux_inode_invalidate_secctx(struct inode *inode)
6535{
6536 struct inode_security_struct *isec = inode->i_security;
6537
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01006538 spin_lock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006539 isec->initialized = LABEL_INVALID;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01006540 spin_unlock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006541}
6542
David P. Quigley1ee65e32009-09-03 14:25:57 -04006543/*
6544 * called with inode->i_mutex locked
6545 */
6546static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6547{
6548 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
6549}
6550
6551/*
6552 * called with inode->i_mutex locked
6553 */
6554static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6555{
6556 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6557}
6558
6559static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6560{
6561 int len = 0;
6562 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6563 ctx, true);
6564 if (len < 0)
6565 return len;
6566 *ctxlen = len;
6567 return 0;
6568}
Michael LeMayd7200242006-06-22 14:47:17 -07006569#ifdef CONFIG_KEYS
6570
David Howellsd84f4f92008-11-14 10:39:23 +11006571static int selinux_key_alloc(struct key *k, const struct cred *cred,
David Howells7e047ef2006-06-26 00:24:50 -07006572 unsigned long flags)
Michael LeMayd7200242006-06-22 14:47:17 -07006573{
David Howellsd84f4f92008-11-14 10:39:23 +11006574 const struct task_security_struct *tsec;
Michael LeMayd7200242006-06-22 14:47:17 -07006575 struct key_security_struct *ksec;
6576
6577 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6578 if (!ksec)
6579 return -ENOMEM;
6580
David Howellsd84f4f92008-11-14 10:39:23 +11006581 tsec = cred->security;
6582 if (tsec->keycreate_sid)
6583 ksec->sid = tsec->keycreate_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07006584 else
David Howellsd84f4f92008-11-14 10:39:23 +11006585 ksec->sid = tsec->sid;
Michael LeMayd7200242006-06-22 14:47:17 -07006586
David Howells275bb412008-11-14 10:39:19 +11006587 k->security = ksec;
Michael LeMayd7200242006-06-22 14:47:17 -07006588 return 0;
6589}
6590
6591static void selinux_key_free(struct key *k)
6592{
6593 struct key_security_struct *ksec = k->security;
6594
6595 k->security = NULL;
6596 kfree(ksec);
6597}
6598
6599static int selinux_key_permission(key_ref_t key_ref,
David Howellsd84f4f92008-11-14 10:39:23 +11006600 const struct cred *cred,
David Howellsf5895942014-03-14 17:44:49 +00006601 unsigned perm)
Michael LeMayd7200242006-06-22 14:47:17 -07006602{
6603 struct key *key;
Michael LeMayd7200242006-06-22 14:47:17 -07006604 struct key_security_struct *ksec;
David Howells275bb412008-11-14 10:39:19 +11006605 u32 sid;
Michael LeMayd7200242006-06-22 14:47:17 -07006606
6607 /* if no specific permissions are requested, we skip the
6608 permission check. No serious, additional covert channels
6609 appear to be created. */
6610 if (perm == 0)
6611 return 0;
6612
David Howellsd84f4f92008-11-14 10:39:23 +11006613 sid = cred_sid(cred);
David Howells275bb412008-11-14 10:39:19 +11006614
6615 key = key_ref_to_ptr(key_ref);
6616 ksec = key->security;
6617
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006618 return avc_has_perm(&selinux_state,
6619 sid, ksec->sid, SECCLASS_KEY, perm, NULL);
Michael LeMayd7200242006-06-22 14:47:17 -07006620}
6621
David Howells70a5bb72008-04-29 01:01:26 -07006622static int selinux_key_getsecurity(struct key *key, char **_buffer)
6623{
6624 struct key_security_struct *ksec = key->security;
6625 char *context = NULL;
6626 unsigned len;
6627 int rc;
6628
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006629 rc = security_sid_to_context(&selinux_state, ksec->sid,
6630 &context, &len);
David Howells70a5bb72008-04-29 01:01:26 -07006631 if (!rc)
6632 rc = len;
6633 *_buffer = context;
6634 return rc;
6635}
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03006636#endif
David Howells70a5bb72008-04-29 01:01:26 -07006637
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03006638#ifdef CONFIG_SECURITY_INFINIBAND
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03006639static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6640{
6641 struct common_audit_data ad;
6642 int err;
6643 u32 sid = 0;
6644 struct ib_security_struct *sec = ib_sec;
6645 struct lsm_ibpkey_audit ibpkey;
6646
Daniel Jurgens409dcf32017-05-19 15:48:59 +03006647 err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03006648 if (err)
6649 return err;
6650
6651 ad.type = LSM_AUDIT_DATA_IBPKEY;
6652 ibpkey.subnet_prefix = subnet_prefix;
6653 ibpkey.pkey = pkey_val;
6654 ad.u.ibpkey = &ibpkey;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006655 return avc_has_perm(&selinux_state,
6656 sec->sid, sid,
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03006657 SECCLASS_INFINIBAND_PKEY,
6658 INFINIBAND_PKEY__ACCESS, &ad);
6659}
6660
Daniel Jurgensab861df2017-05-19 15:48:58 +03006661static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6662 u8 port_num)
6663{
6664 struct common_audit_data ad;
6665 int err;
6666 u32 sid = 0;
6667 struct ib_security_struct *sec = ib_sec;
6668 struct lsm_ibendport_audit ibendport;
6669
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006670 err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6671 &sid);
Daniel Jurgensab861df2017-05-19 15:48:58 +03006672
6673 if (err)
6674 return err;
6675
6676 ad.type = LSM_AUDIT_DATA_IBENDPORT;
6677 strncpy(ibendport.dev_name, dev_name, sizeof(ibendport.dev_name));
6678 ibendport.port = port_num;
6679 ad.u.ibendport = &ibendport;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006680 return avc_has_perm(&selinux_state,
6681 sec->sid, sid,
Daniel Jurgensab861df2017-05-19 15:48:58 +03006682 SECCLASS_INFINIBAND_ENDPORT,
6683 INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6684}
6685
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03006686static int selinux_ib_alloc_security(void **ib_sec)
6687{
6688 struct ib_security_struct *sec;
6689
6690 sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6691 if (!sec)
6692 return -ENOMEM;
6693 sec->sid = current_sid();
6694
6695 *ib_sec = sec;
6696 return 0;
6697}
6698
6699static void selinux_ib_free_security(void *ib_sec)
6700{
6701 kfree(ib_sec);
6702}
Michael LeMayd7200242006-06-22 14:47:17 -07006703#endif
6704
Chenbo Fengec27c352017-10-18 13:00:25 -07006705#ifdef CONFIG_BPF_SYSCALL
6706static int selinux_bpf(int cmd, union bpf_attr *attr,
6707 unsigned int size)
6708{
6709 u32 sid = current_sid();
6710 int ret;
6711
6712 switch (cmd) {
6713 case BPF_MAP_CREATE:
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006714 ret = avc_has_perm(&selinux_state,
6715 sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
Chenbo Fengec27c352017-10-18 13:00:25 -07006716 NULL);
6717 break;
6718 case BPF_PROG_LOAD:
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006719 ret = avc_has_perm(&selinux_state,
6720 sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
Chenbo Fengec27c352017-10-18 13:00:25 -07006721 NULL);
6722 break;
6723 default:
6724 ret = 0;
6725 break;
6726 }
6727
6728 return ret;
6729}
6730
6731static u32 bpf_map_fmode_to_av(fmode_t fmode)
6732{
6733 u32 av = 0;
6734
6735 if (fmode & FMODE_READ)
6736 av |= BPF__MAP_READ;
6737 if (fmode & FMODE_WRITE)
6738 av |= BPF__MAP_WRITE;
6739 return av;
6740}
6741
Chenbo Fengf66e4482017-10-18 13:00:26 -07006742/* This function will check the file pass through unix socket or binder to see
6743 * if it is a bpf related object. And apply correspinding checks on the bpf
6744 * object based on the type. The bpf maps and programs, not like other files and
6745 * socket, are using a shared anonymous inode inside the kernel as their inode.
6746 * So checking that inode cannot identify if the process have privilege to
6747 * access the bpf object and that's why we have to add this additional check in
6748 * selinux_file_receive and selinux_binder_transfer_files.
6749 */
6750static int bpf_fd_pass(struct file *file, u32 sid)
6751{
6752 struct bpf_security_struct *bpfsec;
6753 struct bpf_prog *prog;
6754 struct bpf_map *map;
6755 int ret;
6756
6757 if (file->f_op == &bpf_map_fops) {
6758 map = file->private_data;
6759 bpfsec = map->security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006760 ret = avc_has_perm(&selinux_state,
6761 sid, bpfsec->sid, SECCLASS_BPF,
Chenbo Fengf66e4482017-10-18 13:00:26 -07006762 bpf_map_fmode_to_av(file->f_mode), NULL);
6763 if (ret)
6764 return ret;
6765 } else if (file->f_op == &bpf_prog_fops) {
6766 prog = file->private_data;
6767 bpfsec = prog->aux->security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006768 ret = avc_has_perm(&selinux_state,
6769 sid, bpfsec->sid, SECCLASS_BPF,
Chenbo Fengf66e4482017-10-18 13:00:26 -07006770 BPF__PROG_RUN, NULL);
6771 if (ret)
6772 return ret;
6773 }
6774 return 0;
6775}
6776
Chenbo Fengec27c352017-10-18 13:00:25 -07006777static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6778{
6779 u32 sid = current_sid();
6780 struct bpf_security_struct *bpfsec;
6781
6782 bpfsec = map->security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006783 return avc_has_perm(&selinux_state,
6784 sid, bpfsec->sid, SECCLASS_BPF,
Chenbo Fengec27c352017-10-18 13:00:25 -07006785 bpf_map_fmode_to_av(fmode), NULL);
6786}
6787
6788static int selinux_bpf_prog(struct bpf_prog *prog)
6789{
6790 u32 sid = current_sid();
6791 struct bpf_security_struct *bpfsec;
6792
6793 bpfsec = prog->aux->security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006794 return avc_has_perm(&selinux_state,
6795 sid, bpfsec->sid, SECCLASS_BPF,
Chenbo Fengec27c352017-10-18 13:00:25 -07006796 BPF__PROG_RUN, NULL);
6797}
6798
6799static int selinux_bpf_map_alloc(struct bpf_map *map)
6800{
6801 struct bpf_security_struct *bpfsec;
6802
6803 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6804 if (!bpfsec)
6805 return -ENOMEM;
6806
6807 bpfsec->sid = current_sid();
6808 map->security = bpfsec;
6809
6810 return 0;
6811}
6812
6813static void selinux_bpf_map_free(struct bpf_map *map)
6814{
6815 struct bpf_security_struct *bpfsec = map->security;
6816
6817 map->security = NULL;
6818 kfree(bpfsec);
6819}
6820
6821static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6822{
6823 struct bpf_security_struct *bpfsec;
6824
6825 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6826 if (!bpfsec)
6827 return -ENOMEM;
6828
6829 bpfsec->sid = current_sid();
6830 aux->security = bpfsec;
6831
6832 return 0;
6833}
6834
6835static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
6836{
6837 struct bpf_security_struct *bpfsec = aux->security;
6838
6839 aux->security = NULL;
6840 kfree(bpfsec);
6841}
6842#endif
6843
James Morrisca97d932017-02-15 00:18:51 +11006844static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
Casey Schauflere20b0432015-05-02 15:11:36 -07006845 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6846 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6847 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6848 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02006849
Casey Schauflere20b0432015-05-02 15:11:36 -07006850 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6851 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6852 LSM_HOOK_INIT(capget, selinux_capget),
6853 LSM_HOOK_INIT(capset, selinux_capset),
6854 LSM_HOOK_INIT(capable, selinux_capable),
6855 LSM_HOOK_INIT(quotactl, selinux_quotactl),
6856 LSM_HOOK_INIT(quota_on, selinux_quota_on),
6857 LSM_HOOK_INIT(syslog, selinux_syslog),
6858 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
Stephen Smalley79af7302015-01-21 10:54:10 -05006859
Casey Schauflere20b0432015-05-02 15:11:36 -07006860 LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006861
Casey Schauflere20b0432015-05-02 15:11:36 -07006862 LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6863 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6864 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006865
Casey Schauflere20b0432015-05-02 15:11:36 -07006866 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6867 LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6868 LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
6869 LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6870 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6871 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6872 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6873 LSM_HOOK_INIT(sb_mount, selinux_mount),
6874 LSM_HOOK_INIT(sb_umount, selinux_umount),
6875 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6876 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6877 LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006878
Casey Schauflere20b0432015-05-02 15:11:36 -07006879 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
Vivek Goyala518b0a2016-07-13 10:44:53 -04006880 LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
Eric Parise0007522008-03-05 10:31:54 -05006881
Casey Schauflere20b0432015-05-02 15:11:36 -07006882 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6883 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6884 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6885 LSM_HOOK_INIT(inode_create, selinux_inode_create),
6886 LSM_HOOK_INIT(inode_link, selinux_inode_link),
6887 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6888 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6889 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6890 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6891 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6892 LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6893 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6894 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6895 LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6896 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6897 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6898 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6899 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6900 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6901 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6902 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6903 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6904 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6905 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6906 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
Vivek Goyal56909eb2016-07-13 10:44:48 -04006907 LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
Vivek Goyal19472b62016-07-13 10:44:50 -04006908 LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006909
Casey Schauflere20b0432015-05-02 15:11:36 -07006910 LSM_HOOK_INIT(file_permission, selinux_file_permission),
6911 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6912 LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
6913 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6914 LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6915 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6916 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6917 LSM_HOOK_INIT(file_lock, selinux_file_lock),
6918 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6919 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6920 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6921 LSM_HOOK_INIT(file_receive, selinux_file_receive),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006922
Casey Schauflere20b0432015-05-02 15:11:36 -07006923 LSM_HOOK_INIT(file_open, selinux_file_open),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006924
Tetsuo Handaa79be232017-03-28 23:08:45 +09006925 LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
Casey Schauflere20b0432015-05-02 15:11:36 -07006926 LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
6927 LSM_HOOK_INIT(cred_free, selinux_cred_free),
6928 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6929 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
Matthew Garrett3ec30112018-01-08 13:36:19 -08006930 LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
Casey Schauflere20b0432015-05-02 15:11:36 -07006931 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6932 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6933 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
Mimi Zoharc77b8cd2018-07-13 14:06:02 -04006934 LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07006935 LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
Casey Schauflere20b0432015-05-02 15:11:36 -07006936 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6937 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6938 LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6939 LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6940 LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6941 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6942 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
Stephen Smalley791ec492017-02-17 07:57:00 -05006943 LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
Casey Schauflere20b0432015-05-02 15:11:36 -07006944 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6945 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6946 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6947 LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6948 LSM_HOOK_INIT(task_kill, selinux_task_kill),
Casey Schauflere20b0432015-05-02 15:11:36 -07006949 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09006950
Casey Schauflere20b0432015-05-02 15:11:36 -07006951 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6952 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006953
Casey Schauflere20b0432015-05-02 15:11:36 -07006954 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6955 LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006956
Casey Schauflere20b0432015-05-02 15:11:36 -07006957 LSM_HOOK_INIT(msg_queue_alloc_security,
6958 selinux_msg_queue_alloc_security),
6959 LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6960 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6961 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6962 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6963 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006964
Casey Schauflere20b0432015-05-02 15:11:36 -07006965 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6966 LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6967 LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6968 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6969 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006970
Casey Schauflere20b0432015-05-02 15:11:36 -07006971 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6972 LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6973 LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6974 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6975 LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006976
Casey Schauflere20b0432015-05-02 15:11:36 -07006977 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006978
Casey Schauflere20b0432015-05-02 15:11:36 -07006979 LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6980 LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006981
Casey Schauflere20b0432015-05-02 15:11:36 -07006982 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6983 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6984 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6985 LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006986 LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
Casey Schauflere20b0432015-05-02 15:11:36 -07006987 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6988 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6989 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006990
Casey Schauflere20b0432015-05-02 15:11:36 -07006991 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6992 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006993
Casey Schauflere20b0432015-05-02 15:11:36 -07006994 LSM_HOOK_INIT(socket_create, selinux_socket_create),
6995 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
David Herrmann0b811db2018-05-04 16:28:21 +02006996 LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
Casey Schauflere20b0432015-05-02 15:11:36 -07006997 LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6998 LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6999 LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
7000 LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
7001 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
7002 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
7003 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
7004 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
7005 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
7006 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
7007 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
7008 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
7009 LSM_HOOK_INIT(socket_getpeersec_stream,
7010 selinux_socket_getpeersec_stream),
7011 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
7012 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
7013 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
7014 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
7015 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
7016 LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
Richard Hainesd4529302018-02-13 20:57:18 +00007017 LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
7018 LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
7019 LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
Casey Schauflere20b0432015-05-02 15:11:36 -07007020 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
7021 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
7022 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
7023 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
7024 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
7025 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
7026 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
7027 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
7028 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
7029 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
7030 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
7031 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
7032 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03007033#ifdef CONFIG_SECURITY_INFINIBAND
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03007034 LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
Daniel Jurgensab861df2017-05-19 15:48:58 +03007035 LSM_HOOK_INIT(ib_endport_manage_subnet,
7036 selinux_ib_endport_manage_subnet),
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03007037 LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
7038 LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
7039#endif
Trent Jaegerd28d1e02005-12-13 23:12:40 -08007040#ifdef CONFIG_SECURITY_NETWORK_XFRM
Casey Schauflere20b0432015-05-02 15:11:36 -07007041 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
7042 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
7043 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
7044 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
7045 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
7046 LSM_HOOK_INIT(xfrm_state_alloc_acquire,
7047 selinux_xfrm_state_alloc_acquire),
7048 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
7049 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
7050 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
7051 LSM_HOOK_INIT(xfrm_state_pol_flow_match,
7052 selinux_xfrm_state_pol_flow_match),
7053 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
Linus Torvalds1da177e2005-04-16 15:20:36 -07007054#endif
Michael LeMayd7200242006-06-22 14:47:17 -07007055
7056#ifdef CONFIG_KEYS
Casey Schauflere20b0432015-05-02 15:11:36 -07007057 LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
7058 LSM_HOOK_INIT(key_free, selinux_key_free),
7059 LSM_HOOK_INIT(key_permission, selinux_key_permission),
7060 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
Michael LeMayd7200242006-06-22 14:47:17 -07007061#endif
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +02007062
7063#ifdef CONFIG_AUDIT
Casey Schauflere20b0432015-05-02 15:11:36 -07007064 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
7065 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
7066 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
7067 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +02007068#endif
Chenbo Fengec27c352017-10-18 13:00:25 -07007069
7070#ifdef CONFIG_BPF_SYSCALL
7071 LSM_HOOK_INIT(bpf, selinux_bpf),
7072 LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
7073 LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
7074 LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
7075 LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
7076 LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
7077 LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
7078#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07007079};
7080
7081static __init int selinux_init(void)
7082{
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07007083 if (!security_module_enable("selinux")) {
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02007084 selinux_enabled = 0;
7085 return 0;
7086 }
7087
Linus Torvalds1da177e2005-04-16 15:20:36 -07007088 if (!selinux_enabled) {
peter enderborgc103a912018-06-12 10:09:03 +02007089 pr_info("SELinux: Disabled at boot.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07007090 return 0;
7091 }
7092
peter enderborgc103a912018-06-12 10:09:03 +02007093 pr_info("SELinux: Initializing.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07007094
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007095 memset(&selinux_state, 0, sizeof(selinux_state));
Paul Mooree5a5ca92018-03-01 17:38:30 -05007096 enforcing_set(&selinux_state, selinux_enforcing_boot);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007097 selinux_state.checkreqprot = selinux_checkreqprot_boot;
7098 selinux_ss_init(&selinux_state.ss);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05007099 selinux_avc_init(&selinux_state.avc);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007100
Linus Torvalds1da177e2005-04-16 15:20:36 -07007101 /* Set the security state for the initial task. */
David Howellsd84f4f92008-11-14 10:39:23 +11007102 cred_init_security();
Linus Torvalds1da177e2005-04-16 15:20:36 -07007103
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04007104 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
7105
James Morris7cae7e22006-03-22 00:09:22 -08007106 sel_inode_cache = kmem_cache_create("selinux_inode_security",
7107 sizeof(struct inode_security_struct),
Paul Mundt20c2df82007-07-20 10:11:58 +09007108 0, SLAB_PANIC, NULL);
Sangwoo63205652015-10-21 17:44:30 -04007109 file_security_cache = kmem_cache_create("selinux_file_security",
7110 sizeof(struct file_security_struct),
7111 0, SLAB_PANIC, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07007112 avc_init();
7113
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007114 avtab_cache_init();
7115
7116 ebitmap_cache_init();
7117
7118 hashtab_cache_init();
7119
Casey Schauflerd69dece52017-01-18 17:09:05 -08007120 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
Linus Torvalds1da177e2005-04-16 15:20:36 -07007121
Paul Moore615e51f2014-06-26 14:33:56 -04007122 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
7123 panic("SELinux: Unable to register AVC netcache callback\n");
7124
Daniel Jurgens8f408ab2017-05-19 15:48:53 +03007125 if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7126 panic("SELinux: Unable to register AVC LSM notifier callback\n");
7127
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007128 if (selinux_enforcing_boot)
peter enderborgc103a912018-06-12 10:09:03 +02007129 pr_debug("SELinux: Starting in enforcing mode\n");
Eric Paris828dfe12008-04-17 13:17:49 -04007130 else
peter enderborgc103a912018-06-12 10:09:03 +02007131 pr_debug("SELinux: Starting in permissive mode\n");
Michael LeMayd7200242006-06-22 14:47:17 -07007132
Linus Torvalds1da177e2005-04-16 15:20:36 -07007133 return 0;
7134}
7135
Al Viroe8c26252010-03-23 06:36:54 -04007136static void delayed_superblock_init(struct super_block *sb, void *unused)
7137{
Al Viro17f3b552018-11-10 23:46:07 -05007138 struct security_mnt_opts opts;
7139
7140 security_init_mnt_opts(&opts);
7141 selinux_set_mnt_opts(sb, &opts, 0, NULL);
7142 security_free_mnt_opts(&opts);
Al Viroe8c26252010-03-23 06:36:54 -04007143}
7144
Linus Torvalds1da177e2005-04-16 15:20:36 -07007145void selinux_complete_init(void)
7146{
peter enderborgc103a912018-06-12 10:09:03 +02007147 pr_debug("SELinux: Completing initialization.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07007148
7149 /* Set up any superblocks initialized prior to the policy load. */
peter enderborgc103a912018-06-12 10:09:03 +02007150 pr_debug("SELinux: Setting up existing superblocks.\n");
Al Viroe8c26252010-03-23 06:36:54 -04007151 iterate_supers(delayed_superblock_init, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07007152}
7153
7154/* SELinux requires early initialization in order to label
7155 all processes and objects when they are created. */
Kees Cook3d6e5f62018-10-10 17:18:23 -07007156DEFINE_LSM(selinux) = {
Kees Cook07aed2f2018-10-10 17:18:24 -07007157 .name = "selinux",
Kees Cook3d6e5f62018-10-10 17:18:23 -07007158 .init = selinux_init,
7159};
Linus Torvalds1da177e2005-04-16 15:20:36 -07007160
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08007161#if defined(CONFIG_NETFILTER)
Linus Torvalds1da177e2005-04-16 15:20:36 -07007162
Florian Westphal591bb2782017-07-26 11:40:52 +02007163static const struct nf_hook_ops selinux_nf_ops[] = {
Paul Mooreeffad8d2008-01-29 08:49:27 -05007164 {
7165 .hook = selinux_ipv4_postroute,
Alban Crequy2597a832012-05-14 03:56:39 +00007166 .pf = NFPROTO_IPV4,
Paul Mooreeffad8d2008-01-29 08:49:27 -05007167 .hooknum = NF_INET_POST_ROUTING,
7168 .priority = NF_IP_PRI_SELINUX_LAST,
7169 },
7170 {
7171 .hook = selinux_ipv4_forward,
Alban Crequy2597a832012-05-14 03:56:39 +00007172 .pf = NFPROTO_IPV4,
Paul Mooreeffad8d2008-01-29 08:49:27 -05007173 .hooknum = NF_INET_FORWARD,
7174 .priority = NF_IP_PRI_SELINUX_FIRST,
Paul Moore948bf852008-10-10 10:16:32 -04007175 },
7176 {
7177 .hook = selinux_ipv4_output,
Alban Crequy2597a832012-05-14 03:56:39 +00007178 .pf = NFPROTO_IPV4,
Paul Moore948bf852008-10-10 10:16:32 -04007179 .hooknum = NF_INET_LOCAL_OUT,
7180 .priority = NF_IP_PRI_SELINUX_FIRST,
Jiri Pirko25db6be2014-09-03 17:42:13 +02007181 },
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04007182#if IS_ENABLED(CONFIG_IPV6)
Paul Mooreeffad8d2008-01-29 08:49:27 -05007183 {
7184 .hook = selinux_ipv6_postroute,
Alban Crequy2597a832012-05-14 03:56:39 +00007185 .pf = NFPROTO_IPV6,
Paul Mooreeffad8d2008-01-29 08:49:27 -05007186 .hooknum = NF_INET_POST_ROUTING,
7187 .priority = NF_IP6_PRI_SELINUX_LAST,
7188 },
7189 {
7190 .hook = selinux_ipv6_forward,
Alban Crequy2597a832012-05-14 03:56:39 +00007191 .pf = NFPROTO_IPV6,
Paul Mooreeffad8d2008-01-29 08:49:27 -05007192 .hooknum = NF_INET_FORWARD,
7193 .priority = NF_IP6_PRI_SELINUX_FIRST,
Jiri Pirko25db6be2014-09-03 17:42:13 +02007194 },
Huw Davies2917f572016-06-27 15:06:15 -04007195 {
7196 .hook = selinux_ipv6_output,
7197 .pf = NFPROTO_IPV6,
7198 .hooknum = NF_INET_LOCAL_OUT,
7199 .priority = NF_IP6_PRI_SELINUX_FIRST,
7200 },
Linus Torvalds1da177e2005-04-16 15:20:36 -07007201#endif /* IPV6 */
Jiri Pirko25db6be2014-09-03 17:42:13 +02007202};
Linus Torvalds1da177e2005-04-16 15:20:36 -07007203
Florian Westphal8e71bf72017-04-21 11:49:09 +02007204static int __net_init selinux_nf_register(struct net *net)
7205{
7206 return nf_register_net_hooks(net, selinux_nf_ops,
7207 ARRAY_SIZE(selinux_nf_ops));
7208}
7209
7210static void __net_exit selinux_nf_unregister(struct net *net)
7211{
7212 nf_unregister_net_hooks(net, selinux_nf_ops,
7213 ARRAY_SIZE(selinux_nf_ops));
7214}
7215
7216static struct pernet_operations selinux_net_ops = {
7217 .init = selinux_nf_register,
7218 .exit = selinux_nf_unregister,
7219};
7220
Linus Torvalds1da177e2005-04-16 15:20:36 -07007221static int __init selinux_nf_ip_init(void)
7222{
Jiri Pirko25db6be2014-09-03 17:42:13 +02007223 int err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07007224
7225 if (!selinux_enabled)
Jiri Pirko25db6be2014-09-03 17:42:13 +02007226 return 0;
Eric Parisfadcdb42007-02-22 18:11:31 -05007227
peter enderborgc103a912018-06-12 10:09:03 +02007228 pr_debug("SELinux: Registering netfilter hooks\n");
Eric Parisfadcdb42007-02-22 18:11:31 -05007229
Florian Westphal8e71bf72017-04-21 11:49:09 +02007230 err = register_pernet_subsys(&selinux_net_ops);
Alexey Dobriyan6c5a9d22008-07-26 17:48:15 -07007231 if (err)
Florian Westphal8e71bf72017-04-21 11:49:09 +02007232 panic("SELinux: register_pernet_subsys: error %d\n", err);
Linus Torvalds1da177e2005-04-16 15:20:36 -07007233
Jiri Pirko25db6be2014-09-03 17:42:13 +02007234 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07007235}
Linus Torvalds1da177e2005-04-16 15:20:36 -07007236__initcall(selinux_nf_ip_init);
7237
7238#ifdef CONFIG_SECURITY_SELINUX_DISABLE
7239static void selinux_nf_ip_exit(void)
7240{
peter enderborgc103a912018-06-12 10:09:03 +02007241 pr_debug("SELinux: Unregistering netfilter hooks\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07007242
Florian Westphal8e71bf72017-04-21 11:49:09 +02007243 unregister_pernet_subsys(&selinux_net_ops);
Linus Torvalds1da177e2005-04-16 15:20:36 -07007244}
7245#endif
7246
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08007247#else /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07007248
7249#ifdef CONFIG_SECURITY_SELINUX_DISABLE
7250#define selinux_nf_ip_exit()
7251#endif
7252
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08007253#endif /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07007254
7255#ifdef CONFIG_SECURITY_SELINUX_DISABLE
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007256int selinux_disable(struct selinux_state *state)
Linus Torvalds1da177e2005-04-16 15:20:36 -07007257{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007258 if (state->initialized) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07007259 /* Not permitted after initial policy load. */
7260 return -EINVAL;
7261 }
7262
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007263 if (state->disabled) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07007264 /* Only do this once. */
7265 return -EINVAL;
7266 }
7267
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007268 state->disabled = 1;
7269
peter enderborgc103a912018-06-12 10:09:03 +02007270 pr_info("SELinux: Disabled at runtime.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07007271
Stephen Smalley30d55282006-05-03 10:52:36 -04007272 selinux_enabled = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07007273
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07007274 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
Linus Torvalds1da177e2005-04-16 15:20:36 -07007275
Eric Parisaf8ff042009-09-20 21:23:01 -04007276 /* Try to destroy the avc node cache */
7277 avc_disable();
7278
Linus Torvalds1da177e2005-04-16 15:20:36 -07007279 /* Unregister netfilter hooks. */
7280 selinux_nf_ip_exit();
7281
7282 /* Unregister selinuxfs. */
7283 exit_sel_fs();
7284
7285 return 0;
7286}
7287#endif