blob: 398d165f884e759b3227c076cc98d324985c037d [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
Stephen Smalley7efbb602017-08-17 13:32:36 -04006 * Authors: Stephen Smalley, <sds@tycho.nsa.gov>
Eric Paris828dfe12008-04-17 13:17:49 -04007 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070010 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
Eric Paris2069f452008-07-04 09:47:13 +100012 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070014 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
Eric Paris828dfe12008-04-17 13:17:49 -040015 * <dgoeddel@trustedcs.com>
Paul Mooreed6d76e2009-08-28 18:12:49 -040016 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
Paul Moore82c21bf2011-08-01 11:10:33 +000017 * Paul Moore <paul@paul-moore.com>
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +090018 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
Eric Paris828dfe12008-04-17 13:17:49 -040019 * Yuichi Nakamura <ynakam@hitachisoft.jp>
Daniel Jurgens3a976fa2017-05-19 15:48:56 +030020 * Copyright (C) 2016 Mellanox Technologies
Linus Torvalds1da177e2005-04-16 15:20:36 -070021 *
22 * This program is free software; you can redistribute it and/or modify
23 * it under the terms of the GNU General Public License version 2,
Eric Paris828dfe12008-04-17 13:17:49 -040024 * as published by the Free Software Foundation.
Linus Torvalds1da177e2005-04-16 15:20:36 -070025 */
26
Linus Torvalds1da177e2005-04-16 15:20:36 -070027#include <linux/init.h>
Eric Paris0b24dcb2011-02-25 15:39:20 -050028#include <linux/kd.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070029#include <linux/kernel.h>
Roland McGrath0d094ef2008-07-25 19:45:49 -070030#include <linux/tracehook.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070031#include <linux/errno.h>
Ingo Molnar3f07c012017-02-08 18:51:30 +010032#include <linux/sched/signal.h>
Ingo Molnar29930022017-02-08 18:51:36 +010033#include <linux/sched/task.h>
Casey Schaufler3c4ed7b2015-05-02 15:10:46 -070034#include <linux/lsm_hooks.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070035#include <linux/xattr.h>
36#include <linux/capability.h>
37#include <linux/unistd.h>
38#include <linux/mm.h>
39#include <linux/mman.h>
40#include <linux/slab.h>
41#include <linux/pagemap.h>
Eric Paris0b24dcb2011-02-25 15:39:20 -050042#include <linux/proc_fs.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070043#include <linux/swap.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070044#include <linux/spinlock.h>
45#include <linux/syscalls.h>
Eric Paris2a7dba32011-02-01 11:05:39 -050046#include <linux/dcache.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070047#include <linux/file.h>
Al Viro9f3acc32008-04-24 07:44:08 -040048#include <linux/fdtable.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070049#include <linux/namei.h>
50#include <linux/mount.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070051#include <linux/netfilter_ipv4.h>
52#include <linux/netfilter_ipv6.h>
53#include <linux/tty.h>
54#include <net/icmp.h>
Stephen Hemminger227b60f2007-10-10 17:30:46 -070055#include <net/ip.h> /* for local_port_range[] */
Linus Torvalds1da177e2005-04-16 15:20:36 -070056#include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
Paul Moore47180062013-12-04 16:10:45 -050057#include <net/inet_connection_sock.h>
Paul Moore220deb92008-01-29 08:38:23 -050058#include <net/net_namespace.h>
Paul Moored621d352008-01-29 08:43:36 -050059#include <net/netlabel.h>
Eric Parisf5269712008-05-14 11:27:45 -040060#include <linux/uaccess.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070061#include <asm/ioctls.h>
Arun Sharma600634972011-07-26 16:09:06 -070062#include <linux/atomic.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070063#include <linux/bitops.h>
64#include <linux/interrupt.h>
65#include <linux/netdevice.h> /* for network interface checks */
Hong zhi guo77954982013-03-27 06:49:35 +000066#include <net/netlink.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070067#include <linux/tcp.h>
68#include <linux/udp.h>
James Morris2ee92d42006-11-13 16:09:01 -080069#include <linux/dccp.h>
Richard Hainesd4529302018-02-13 20:57:18 +000070#include <linux/sctp.h>
71#include <net/sctp/structs.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070072#include <linux/quota.h>
73#include <linux/un.h> /* for Unix socket types */
74#include <net/af_unix.h> /* for Unix socket types */
75#include <linux/parser.h>
76#include <linux/nfs_mount.h>
77#include <net/ipv6.h>
78#include <linux/hugetlb.h>
79#include <linux/personality.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070080#include <linux/audit.h>
Eric Paris6931dfc2005-06-30 02:58:51 -070081#include <linux/string.h>
Catherine Zhang877ce7c2006-06-29 12:27:47 -070082#include <linux/selinux.h>
Eric Paris23970742006-09-25 23:32:01 -070083#include <linux/mutex.h>
Frank Mayharf06febc2008-09-12 09:54:39 -070084#include <linux/posix-timers.h>
Kees Cook00234592010-02-03 15:36:43 -080085#include <linux/syslog.h>
Serge E. Hallyn34867402011-03-23 16:43:17 -070086#include <linux/user_namespace.h>
Paul Gortmaker44fc7ea2011-05-26 20:52:10 -040087#include <linux/export.h>
Al Viro40401532012-02-13 03:58:52 +000088#include <linux/msg.h>
89#include <linux/shm.h>
Chenbo Fengec27c352017-10-18 13:00:25 -070090#include <linux/bpf.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070091
92#include "avc.h"
93#include "objsec.h"
94#include "netif.h"
Paul Moore224dfbd2008-01-29 08:38:13 -050095#include "netnode.h"
Paul Moore3e1121722008-04-10 10:48:14 -040096#include "netport.h"
Daniel Jurgens409dcf32017-05-19 15:48:59 +030097#include "ibpkey.h"
Trent Jaegerd28d1e02005-12-13 23:12:40 -080098#include "xfrm.h"
Paul Moorec60475b2007-02-28 15:14:23 -050099#include "netlabel.h"
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +0200100#include "audit.h"
James Morris7b98a582011-08-30 12:52:32 +1000101#include "avc_ss.h"
Linus Torvalds1da177e2005-04-16 15:20:36 -0700102
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500103struct selinux_state selinux_state;
104
Paul Moored621d352008-01-29 08:43:36 -0500105/* SECMARK reference count */
James Morris56a4ca92011-08-17 11:08:43 +1000106static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
Paul Moored621d352008-01-29 08:43:36 -0500107
Linus Torvalds1da177e2005-04-16 15:20:36 -0700108#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500109static int selinux_enforcing_boot;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700110
111static int __init enforcing_setup(char *str)
112{
Eric Parisf5269712008-05-14 11:27:45 -0400113 unsigned long enforcing;
Jingoo Han29707b22014-02-05 15:13:14 +0900114 if (!kstrtoul(str, 0, &enforcing))
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500115 selinux_enforcing_boot = enforcing ? 1 : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700116 return 1;
117}
118__setup("enforcing=", enforcing_setup);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500119#else
120#define selinux_enforcing_boot 1
Linus Torvalds1da177e2005-04-16 15:20:36 -0700121#endif
122
123#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
124int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
125
126static int __init selinux_enabled_setup(char *str)
127{
Eric Parisf5269712008-05-14 11:27:45 -0400128 unsigned long enabled;
Jingoo Han29707b22014-02-05 15:13:14 +0900129 if (!kstrtoul(str, 0, &enabled))
Eric Parisf5269712008-05-14 11:27:45 -0400130 selinux_enabled = enabled ? 1 : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700131 return 1;
132}
133__setup("selinux=", selinux_enabled_setup);
Stephen Smalley30d55282006-05-03 10:52:36 -0400134#else
135int selinux_enabled = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700136#endif
137
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500138static unsigned int selinux_checkreqprot_boot =
139 CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
140
141static int __init checkreqprot_setup(char *str)
142{
143 unsigned long checkreqprot;
144
145 if (!kstrtoul(str, 0, &checkreqprot))
146 selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
147 return 1;
148}
149__setup("checkreqprot=", checkreqprot_setup);
150
Christoph Lametere18b8902006-12-06 20:33:20 -0800151static struct kmem_cache *sel_inode_cache;
Sangwoo63205652015-10-21 17:44:30 -0400152static struct kmem_cache *file_security_cache;
James Morris7cae7e22006-03-22 00:09:22 -0800153
Paul Moored621d352008-01-29 08:43:36 -0500154/**
155 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
156 *
157 * Description:
158 * This function checks the SECMARK reference counter to see if any SECMARK
159 * targets are currently configured, if the reference counter is greater than
160 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
Chris PeBenito2be4d742013-05-03 09:05:39 -0400161 * enabled, false (0) if SECMARK is disabled. If the always_check_network
162 * policy capability is enabled, SECMARK is always considered enabled.
Paul Moored621d352008-01-29 08:43:36 -0500163 *
164 */
165static int selinux_secmark_enabled(void)
166{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500167 return (selinux_policycap_alwaysnetwork() ||
168 atomic_read(&selinux_secmark_refcount));
Chris PeBenito2be4d742013-05-03 09:05:39 -0400169}
170
171/**
172 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
173 *
174 * Description:
175 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
176 * (1) if any are enabled or false (0) if neither are enabled. If the
177 * always_check_network policy capability is enabled, peer labeling
178 * is always considered enabled.
179 *
180 */
181static int selinux_peerlbl_enabled(void)
182{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500183 return (selinux_policycap_alwaysnetwork() ||
184 netlbl_enabled() || selinux_xfrm_enabled());
Paul Moored621d352008-01-29 08:43:36 -0500185}
186
Paul Moore615e51f2014-06-26 14:33:56 -0400187static int selinux_netcache_avc_callback(u32 event)
188{
189 if (event == AVC_CALLBACK_RESET) {
190 sel_netif_flush();
191 sel_netnode_flush();
192 sel_netport_flush();
193 synchronize_net();
194 }
195 return 0;
196}
197
Daniel Jurgens8f408ab2017-05-19 15:48:53 +0300198static int selinux_lsm_notifier_avc_callback(u32 event)
199{
Daniel Jurgens409dcf32017-05-19 15:48:59 +0300200 if (event == AVC_CALLBACK_RESET) {
201 sel_ib_pkey_flush();
Daniel Jurgens8f408ab2017-05-19 15:48:53 +0300202 call_lsm_notifier(LSM_POLICY_CHANGE, NULL);
Daniel Jurgens409dcf32017-05-19 15:48:59 +0300203 }
Daniel Jurgens8f408ab2017-05-19 15:48:53 +0300204
205 return 0;
206}
207
David Howellsd84f4f92008-11-14 10:39:23 +1100208/*
209 * initialise the security for the init task
210 */
211static void cred_init_security(void)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700212{
David Howells3b11a1d2008-11-14 10:39:26 +1100213 struct cred *cred = (struct cred *) current->real_cred;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700214 struct task_security_struct *tsec;
215
James Morris89d155e2005-10-30 14:59:21 -0800216 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700217 if (!tsec)
David Howellsd84f4f92008-11-14 10:39:23 +1100218 panic("SELinux: Failed to initialize initial task.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -0700219
David Howellsd84f4f92008-11-14 10:39:23 +1100220 tsec->osid = tsec->sid = SECINITSID_KERNEL;
David Howellsf1752ee2008-11-14 10:39:17 +1100221 cred->security = tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700222}
223
David Howells275bb412008-11-14 10:39:19 +1100224/*
David Howells88e67f32008-11-14 10:39:21 +1100225 * get the security ID of a set of credentials
226 */
227static inline u32 cred_sid(const struct cred *cred)
228{
229 const struct task_security_struct *tsec;
230
231 tsec = cred->security;
232 return tsec->sid;
233}
234
235/*
David Howells3b11a1d2008-11-14 10:39:26 +1100236 * get the objective security ID of a task
David Howells275bb412008-11-14 10:39:19 +1100237 */
238static inline u32 task_sid(const struct task_struct *task)
239{
David Howells275bb412008-11-14 10:39:19 +1100240 u32 sid;
241
242 rcu_read_lock();
David Howells88e67f32008-11-14 10:39:21 +1100243 sid = cred_sid(__task_cred(task));
David Howells275bb412008-11-14 10:39:19 +1100244 rcu_read_unlock();
245 return sid;
246}
247
David Howells88e67f32008-11-14 10:39:21 +1100248/* Allocate and free functions for each kind of security blob. */
249
Linus Torvalds1da177e2005-04-16 15:20:36 -0700250static int inode_alloc_security(struct inode *inode)
251{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700252 struct inode_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +1100253 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700254
Josef Bacika02fe132008-04-04 09:35:05 +1100255 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700256 if (!isec)
257 return -ENOMEM;
258
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +0100259 spin_lock_init(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700260 INIT_LIST_HEAD(&isec->list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700261 isec->inode = inode;
262 isec->sid = SECINITSID_UNLABELED;
263 isec->sclass = SECCLASS_FILE;
David Howells275bb412008-11-14 10:39:19 +1100264 isec->task_sid = sid;
Andreas Gruenbacher42059112016-11-10 22:18:27 +0100265 isec->initialized = LABEL_INVALID;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700266 inode->i_security = isec;
267
268 return 0;
269}
270
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500271static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
272
273/*
274 * Try reloading inode security labels that have been marked as invalid. The
275 * @may_sleep parameter indicates when sleeping and thus reloading labels is
Andreas Gruenbacher42059112016-11-10 22:18:27 +0100276 * allowed; when set to false, returns -ECHILD when the label is
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500277 * invalid. The @opt_dentry parameter should be set to a dentry of the inode;
278 * when no dentry is available, set it to NULL instead.
279 */
280static int __inode_security_revalidate(struct inode *inode,
281 struct dentry *opt_dentry,
282 bool may_sleep)
283{
284 struct inode_security_struct *isec = inode->i_security;
285
286 might_sleep_if(may_sleep);
287
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500288 if (selinux_state.initialized &&
289 isec->initialized != LABEL_INITIALIZED) {
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500290 if (!may_sleep)
291 return -ECHILD;
292
293 /*
294 * Try reloading the inode security label. This will fail if
295 * @opt_dentry is NULL and no dentry for this inode can be
296 * found; in that case, continue using the old label.
297 */
298 inode_doinit_with_dentry(inode, opt_dentry);
299 }
300 return 0;
301}
302
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500303static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
304{
305 return inode->i_security;
306}
307
308static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
309{
310 int error;
311
312 error = __inode_security_revalidate(inode, NULL, !rcu);
313 if (error)
314 return ERR_PTR(error);
315 return inode->i_security;
316}
317
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500318/*
319 * Get the security label of an inode.
320 */
321static struct inode_security_struct *inode_security(struct inode *inode)
322{
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500323 __inode_security_revalidate(inode, NULL, true);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500324 return inode->i_security;
325}
326
Paul Moore2c971652016-04-19 16:36:28 -0400327static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
328{
329 struct inode *inode = d_backing_inode(dentry);
330
331 return inode->i_security;
332}
333
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500334/*
335 * Get the security label of a dentry's backing inode.
336 */
337static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
338{
339 struct inode *inode = d_backing_inode(dentry);
340
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500341 __inode_security_revalidate(inode, dentry, true);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500342 return inode->i_security;
343}
344
Steven Rostedt3dc91d42014-01-09 21:46:34 -0500345static void inode_free_rcu(struct rcu_head *head)
346{
347 struct inode_security_struct *isec;
348
349 isec = container_of(head, struct inode_security_struct, rcu);
350 kmem_cache_free(sel_inode_cache, isec);
351}
352
Linus Torvalds1da177e2005-04-16 15:20:36 -0700353static void inode_free_security(struct inode *inode)
354{
355 struct inode_security_struct *isec = inode->i_security;
356 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
357
Waiman Long9629d042015-07-10 17:19:56 -0400358 /*
359 * As not all inode security structures are in a list, we check for
360 * empty list outside of the lock to make sure that we won't waste
361 * time taking a lock doing nothing.
362 *
363 * The list_del_init() function can be safely called more than once.
364 * It should not be possible for this function to be called with
365 * concurrent list_add(), but for better safety against future changes
366 * in the code, we use list_empty_careful() here.
367 */
368 if (!list_empty_careful(&isec->list)) {
369 spin_lock(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700370 list_del_init(&isec->list);
Waiman Long9629d042015-07-10 17:19:56 -0400371 spin_unlock(&sbsec->isec_lock);
372 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700373
Steven Rostedt3dc91d42014-01-09 21:46:34 -0500374 /*
375 * The inode may still be referenced in a path walk and
376 * a call to selinux_inode_permission() can be made
377 * after inode_free_security() is called. Ideally, the VFS
378 * wouldn't do this, but fixing that is a much harder
379 * job. For now, simply free the i_security via RCU, and
380 * leave the current inode->i_security pointer intact.
381 * The inode will be freed after the RCU grace period too.
382 */
383 call_rcu(&isec->rcu, inode_free_rcu);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700384}
385
386static int file_alloc_security(struct file *file)
387{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700388 struct file_security_struct *fsec;
David Howells275bb412008-11-14 10:39:19 +1100389 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700390
Sangwoo63205652015-10-21 17:44:30 -0400391 fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700392 if (!fsec)
393 return -ENOMEM;
394
David Howells275bb412008-11-14 10:39:19 +1100395 fsec->sid = sid;
396 fsec->fown_sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700397 file->f_security = fsec;
398
399 return 0;
400}
401
402static void file_free_security(struct file *file)
403{
404 struct file_security_struct *fsec = file->f_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700405 file->f_security = NULL;
Sangwoo63205652015-10-21 17:44:30 -0400406 kmem_cache_free(file_security_cache, fsec);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700407}
408
409static int superblock_alloc_security(struct super_block *sb)
410{
411 struct superblock_security_struct *sbsec;
412
James Morris89d155e2005-10-30 14:59:21 -0800413 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700414 if (!sbsec)
415 return -ENOMEM;
416
Eric Parisbc7e9822006-09-25 23:32:02 -0700417 mutex_init(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700418 INIT_LIST_HEAD(&sbsec->isec_head);
419 spin_lock_init(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700420 sbsec->sb = sb;
421 sbsec->sid = SECINITSID_UNLABELED;
422 sbsec->def_sid = SECINITSID_FILE;
Eric Parisc312feb2006-07-10 04:43:53 -0700423 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700424 sb->s_security = sbsec;
425
426 return 0;
427}
428
429static void superblock_free_security(struct super_block *sb)
430{
431 struct superblock_security_struct *sbsec = sb->s_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700432 sb->s_security = NULL;
433 kfree(sbsec);
434}
435
Linus Torvalds1da177e2005-04-16 15:20:36 -0700436static inline int inode_doinit(struct inode *inode)
437{
438 return inode_doinit_with_dentry(inode, NULL);
439}
440
441enum {
Eric Paris31e87932007-09-19 17:19:12 -0400442 Opt_error = -1,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700443 Opt_context = 1,
444 Opt_fscontext = 2,
Eric Parisc9180a52007-11-30 13:00:35 -0500445 Opt_defcontext = 3,
446 Opt_rootcontext = 4,
David P. Quigley11689d42009-01-16 09:22:03 -0500447 Opt_labelsupport = 5,
Eric Parisd355987f2012-08-24 15:58:53 -0400448 Opt_nextmntopt = 6,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700449};
450
Eric Parisd355987f2012-08-24 15:58:53 -0400451#define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1)
452
Steven Whitehousea447c092008-10-13 10:46:57 +0100453static const match_table_t tokens = {
Eric Paris832cbd92008-04-01 13:24:09 -0400454 {Opt_context, CONTEXT_STR "%s"},
455 {Opt_fscontext, FSCONTEXT_STR "%s"},
456 {Opt_defcontext, DEFCONTEXT_STR "%s"},
457 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
David P. Quigley11689d42009-01-16 09:22:03 -0500458 {Opt_labelsupport, LABELSUPP_STR},
Eric Paris31e87932007-09-19 17:19:12 -0400459 {Opt_error, NULL},
Linus Torvalds1da177e2005-04-16 15:20:36 -0700460};
461
462#define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
463
Eric Parisc312feb2006-07-10 04:43:53 -0700464static int may_context_mount_sb_relabel(u32 sid,
465 struct superblock_security_struct *sbsec,
David Howells275bb412008-11-14 10:39:19 +1100466 const struct cred *cred)
Eric Parisc312feb2006-07-10 04:43:53 -0700467{
David Howells275bb412008-11-14 10:39:19 +1100468 const struct task_security_struct *tsec = cred->security;
Eric Parisc312feb2006-07-10 04:43:53 -0700469 int rc;
470
Stephen Smalley6b6bc622018-03-05 11:47:56 -0500471 rc = avc_has_perm(&selinux_state,
472 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
Eric Parisc312feb2006-07-10 04:43:53 -0700473 FILESYSTEM__RELABELFROM, NULL);
474 if (rc)
475 return rc;
476
Stephen Smalley6b6bc622018-03-05 11:47:56 -0500477 rc = avc_has_perm(&selinux_state,
478 tsec->sid, sid, SECCLASS_FILESYSTEM,
Eric Parisc312feb2006-07-10 04:43:53 -0700479 FILESYSTEM__RELABELTO, NULL);
480 return rc;
481}
482
Eric Paris08089252006-07-10 04:43:55 -0700483static int may_context_mount_inode_relabel(u32 sid,
484 struct superblock_security_struct *sbsec,
David Howells275bb412008-11-14 10:39:19 +1100485 const struct cred *cred)
Eric Paris08089252006-07-10 04:43:55 -0700486{
David Howells275bb412008-11-14 10:39:19 +1100487 const struct task_security_struct *tsec = cred->security;
Eric Paris08089252006-07-10 04:43:55 -0700488 int rc;
Stephen Smalley6b6bc622018-03-05 11:47:56 -0500489 rc = avc_has_perm(&selinux_state,
490 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
Eric Paris08089252006-07-10 04:43:55 -0700491 FILESYSTEM__RELABELFROM, NULL);
492 if (rc)
493 return rc;
494
Stephen Smalley6b6bc622018-03-05 11:47:56 -0500495 rc = avc_has_perm(&selinux_state,
496 sid, sbsec->sid, SECCLASS_FILESYSTEM,
Eric Paris08089252006-07-10 04:43:55 -0700497 FILESYSTEM__ASSOCIATE, NULL);
498 return rc;
499}
500
Eric Parisb43e7252012-10-10 14:27:35 -0400501static int selinux_is_sblabel_mnt(struct super_block *sb)
502{
503 struct superblock_security_struct *sbsec = sb->s_security;
504
Mark Salyzynd5f3a5f2015-02-04 11:34:30 -0500505 return sbsec->behavior == SECURITY_FS_USE_XATTR ||
506 sbsec->behavior == SECURITY_FS_USE_TRANS ||
507 sbsec->behavior == SECURITY_FS_USE_TASK ||
J. Bruce Fields9fc2b4b2015-06-04 15:57:25 -0400508 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
Mark Salyzynd5f3a5f2015-02-04 11:34:30 -0500509 /* Special handling. Genfs but also in-core setxattr handler */
510 !strcmp(sb->s_type->name, "sysfs") ||
511 !strcmp(sb->s_type->name, "pstore") ||
512 !strcmp(sb->s_type->name, "debugfs") ||
Yongqin Liua2c7c6f2017-01-09 10:07:30 -0500513 !strcmp(sb->s_type->name, "tracefs") ||
Stephen Smalley2651225b2017-02-28 10:35:56 -0500514 !strcmp(sb->s_type->name, "rootfs") ||
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500515 (selinux_policycap_cgroupseclabel() &&
Stephen Smalley2651225b2017-02-28 10:35:56 -0500516 (!strcmp(sb->s_type->name, "cgroup") ||
517 !strcmp(sb->s_type->name, "cgroup2")));
Eric Parisb43e7252012-10-10 14:27:35 -0400518}
519
Eric Parisc9180a52007-11-30 13:00:35 -0500520static int sb_finish_set_opts(struct super_block *sb)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700521{
522 struct superblock_security_struct *sbsec = sb->s_security;
523 struct dentry *root = sb->s_root;
David Howellsc6f493d2015-03-17 22:26:22 +0000524 struct inode *root_inode = d_backing_inode(root);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700525 int rc = 0;
526
Linus Torvalds1da177e2005-04-16 15:20:36 -0700527 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
528 /* Make sure that the xattr handler exists and that no
529 error other than -ENODATA is returned by getxattr on
530 the root directory. -ENODATA is ok, as this may be
531 the first boot of the SELinux kernel before we have
532 assigned xattr values to the filesystem. */
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +0200533 if (!(root_inode->i_opflags & IOP_XATTR)) {
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800534 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
535 "xattr support\n", sb->s_id, sb->s_type->name);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700536 rc = -EOPNOTSUPP;
537 goto out;
538 }
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +0200539
540 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700541 if (rc < 0 && rc != -ENODATA) {
542 if (rc == -EOPNOTSUPP)
543 printk(KERN_WARNING "SELinux: (dev %s, type "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800544 "%s) has no security xattr handler\n",
545 sb->s_id, sb->s_type->name);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700546 else
547 printk(KERN_WARNING "SELinux: (dev %s, type "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800548 "%s) getxattr errno %d\n", sb->s_id,
549 sb->s_type->name, -rc);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700550 goto out;
551 }
552 }
553
Eric Pariseadcabc2012-08-24 15:59:14 -0400554 sbsec->flags |= SE_SBINITIALIZED;
Scott Mayhew0b4d3452017-06-05 11:45:04 -0400555
556 /*
557 * Explicitly set or clear SBLABEL_MNT. It's not sufficient to simply
558 * leave the flag untouched because sb_clone_mnt_opts might be handing
559 * us a superblock that needs the flag to be cleared.
560 */
Eric Parisb43e7252012-10-10 14:27:35 -0400561 if (selinux_is_sblabel_mnt(sb))
Eric Paris12f348b2012-10-09 10:56:25 -0400562 sbsec->flags |= SBLABEL_MNT;
Scott Mayhew0b4d3452017-06-05 11:45:04 -0400563 else
564 sbsec->flags &= ~SBLABEL_MNT;
David P. Quigleyddd29ec2009-09-09 14:25:37 -0400565
Linus Torvalds1da177e2005-04-16 15:20:36 -0700566 /* Initialize the root inode. */
Eric Parisc9180a52007-11-30 13:00:35 -0500567 rc = inode_doinit_with_dentry(root_inode, root);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700568
569 /* Initialize any other inodes associated with the superblock, e.g.
570 inodes created prior to initial policy load or inodes created
571 during get_sb by a pseudo filesystem that directly
572 populates itself. */
573 spin_lock(&sbsec->isec_lock);
574next_inode:
575 if (!list_empty(&sbsec->isec_head)) {
576 struct inode_security_struct *isec =
577 list_entry(sbsec->isec_head.next,
Eric Parisc9180a52007-11-30 13:00:35 -0500578 struct inode_security_struct, list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700579 struct inode *inode = isec->inode;
Stephen Smalley923190d2014-10-06 16:32:52 -0400580 list_del_init(&isec->list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700581 spin_unlock(&sbsec->isec_lock);
582 inode = igrab(inode);
583 if (inode) {
Eric Parisc9180a52007-11-30 13:00:35 -0500584 if (!IS_PRIVATE(inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700585 inode_doinit(inode);
586 iput(inode);
587 }
588 spin_lock(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700589 goto next_inode;
590 }
591 spin_unlock(&sbsec->isec_lock);
592out:
Eric Parisc9180a52007-11-30 13:00:35 -0500593 return rc;
594}
595
596/*
597 * This function should allow an FS to ask what it's mount security
598 * options were so it can use those later for submounts, displaying
599 * mount options, or whatever.
600 */
601static int selinux_get_mnt_opts(const struct super_block *sb,
Eric Parise0007522008-03-05 10:31:54 -0500602 struct security_mnt_opts *opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500603{
604 int rc = 0, i;
605 struct superblock_security_struct *sbsec = sb->s_security;
606 char *context = NULL;
607 u32 len;
608 char tmp;
609
Eric Parise0007522008-03-05 10:31:54 -0500610 security_init_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500611
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500612 if (!(sbsec->flags & SE_SBINITIALIZED))
Eric Parisc9180a52007-11-30 13:00:35 -0500613 return -EINVAL;
614
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500615 if (!selinux_state.initialized)
Eric Parisc9180a52007-11-30 13:00:35 -0500616 return -EINVAL;
617
Eric Parisaf8e50c2012-08-24 15:59:00 -0400618 /* make sure we always check enough bits to cover the mask */
619 BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
620
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500621 tmp = sbsec->flags & SE_MNTMASK;
Eric Parisc9180a52007-11-30 13:00:35 -0500622 /* count the number of mount options for this sb */
Eric Parisaf8e50c2012-08-24 15:59:00 -0400623 for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
Eric Parisc9180a52007-11-30 13:00:35 -0500624 if (tmp & 0x01)
Eric Parise0007522008-03-05 10:31:54 -0500625 opts->num_mnt_opts++;
Eric Parisc9180a52007-11-30 13:00:35 -0500626 tmp >>= 1;
627 }
David P. Quigley11689d42009-01-16 09:22:03 -0500628 /* Check if the Label support flag is set */
Eric Paris0b4bdb32013-08-28 13:32:42 -0400629 if (sbsec->flags & SBLABEL_MNT)
David P. Quigley11689d42009-01-16 09:22:03 -0500630 opts->num_mnt_opts++;
Eric Parisc9180a52007-11-30 13:00:35 -0500631
Eric Parise0007522008-03-05 10:31:54 -0500632 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
633 if (!opts->mnt_opts) {
Eric Parisc9180a52007-11-30 13:00:35 -0500634 rc = -ENOMEM;
635 goto out_free;
636 }
637
Eric Parise0007522008-03-05 10:31:54 -0500638 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
639 if (!opts->mnt_opts_flags) {
Eric Parisc9180a52007-11-30 13:00:35 -0500640 rc = -ENOMEM;
641 goto out_free;
642 }
643
644 i = 0;
645 if (sbsec->flags & FSCONTEXT_MNT) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500646 rc = security_sid_to_context(&selinux_state, sbsec->sid,
647 &context, &len);
Eric Parisc9180a52007-11-30 13:00:35 -0500648 if (rc)
649 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500650 opts->mnt_opts[i] = context;
651 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500652 }
653 if (sbsec->flags & CONTEXT_MNT) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500654 rc = security_sid_to_context(&selinux_state,
655 sbsec->mntpoint_sid,
656 &context, &len);
Eric Parisc9180a52007-11-30 13:00:35 -0500657 if (rc)
658 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500659 opts->mnt_opts[i] = context;
660 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500661 }
662 if (sbsec->flags & DEFCONTEXT_MNT) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500663 rc = security_sid_to_context(&selinux_state, sbsec->def_sid,
664 &context, &len);
Eric Parisc9180a52007-11-30 13:00:35 -0500665 if (rc)
666 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500667 opts->mnt_opts[i] = context;
668 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500669 }
670 if (sbsec->flags & ROOTCONTEXT_MNT) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500671 struct dentry *root = sbsec->sb->s_root;
672 struct inode_security_struct *isec = backing_inode_security(root);
Eric Parisc9180a52007-11-30 13:00:35 -0500673
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500674 rc = security_sid_to_context(&selinux_state, isec->sid,
675 &context, &len);
Eric Parisc9180a52007-11-30 13:00:35 -0500676 if (rc)
677 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500678 opts->mnt_opts[i] = context;
679 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500680 }
Eric Paris12f348b2012-10-09 10:56:25 -0400681 if (sbsec->flags & SBLABEL_MNT) {
David P. Quigley11689d42009-01-16 09:22:03 -0500682 opts->mnt_opts[i] = NULL;
Eric Paris12f348b2012-10-09 10:56:25 -0400683 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
David P. Quigley11689d42009-01-16 09:22:03 -0500684 }
Eric Parisc9180a52007-11-30 13:00:35 -0500685
Eric Parise0007522008-03-05 10:31:54 -0500686 BUG_ON(i != opts->num_mnt_opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500687
688 return 0;
689
690out_free:
Eric Parise0007522008-03-05 10:31:54 -0500691 security_free_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500692 return rc;
693}
694
695static int bad_option(struct superblock_security_struct *sbsec, char flag,
696 u32 old_sid, u32 new_sid)
697{
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500698 char mnt_flags = sbsec->flags & SE_MNTMASK;
699
Eric Parisc9180a52007-11-30 13:00:35 -0500700 /* check if the old mount command had the same options */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500701 if (sbsec->flags & SE_SBINITIALIZED)
Eric Parisc9180a52007-11-30 13:00:35 -0500702 if (!(sbsec->flags & flag) ||
703 (old_sid != new_sid))
704 return 1;
705
706 /* check if we were passed the same options twice,
707 * aka someone passed context=a,context=b
708 */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500709 if (!(sbsec->flags & SE_SBINITIALIZED))
710 if (mnt_flags & flag)
Eric Parisc9180a52007-11-30 13:00:35 -0500711 return 1;
712 return 0;
713}
Eric Parise0007522008-03-05 10:31:54 -0500714
Eric Parisc9180a52007-11-30 13:00:35 -0500715/*
716 * Allow filesystems with binary mount data to explicitly set mount point
717 * labeling information.
718 */
Eric Parise0007522008-03-05 10:31:54 -0500719static int selinux_set_mnt_opts(struct super_block *sb,
David Quigley649f6e72013-05-22 12:50:36 -0400720 struct security_mnt_opts *opts,
721 unsigned long kern_flags,
722 unsigned long *set_kern_flags)
Eric Parisc9180a52007-11-30 13:00:35 -0500723{
David Howells275bb412008-11-14 10:39:19 +1100724 const struct cred *cred = current_cred();
Eric Parisc9180a52007-11-30 13:00:35 -0500725 int rc = 0, i;
Eric Parisc9180a52007-11-30 13:00:35 -0500726 struct superblock_security_struct *sbsec = sb->s_security;
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800727 const char *name = sb->s_type->name;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500728 struct dentry *root = sbsec->sb->s_root;
Paul Moore2c971652016-04-19 16:36:28 -0400729 struct inode_security_struct *root_isec;
Eric Parisc9180a52007-11-30 13:00:35 -0500730 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
731 u32 defcontext_sid = 0;
Eric Parise0007522008-03-05 10:31:54 -0500732 char **mount_options = opts->mnt_opts;
733 int *flags = opts->mnt_opts_flags;
734 int num_opts = opts->num_mnt_opts;
Eric Parisc9180a52007-11-30 13:00:35 -0500735
736 mutex_lock(&sbsec->lock);
737
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500738 if (!selinux_state.initialized) {
Eric Parisc9180a52007-11-30 13:00:35 -0500739 if (!num_opts) {
740 /* Defer initialization until selinux_complete_init,
741 after the initial policy is loaded and the security
742 server is ready to handle calls. */
Eric Parisc9180a52007-11-30 13:00:35 -0500743 goto out;
744 }
745 rc = -EINVAL;
Eric Paris744ba352008-04-17 11:52:44 -0400746 printk(KERN_WARNING "SELinux: Unable to set superblock options "
747 "before the security server is initialized\n");
Eric Parisc9180a52007-11-30 13:00:35 -0500748 goto out;
749 }
David Quigley649f6e72013-05-22 12:50:36 -0400750 if (kern_flags && !set_kern_flags) {
751 /* Specifying internal flags without providing a place to
752 * place the results is not allowed */
753 rc = -EINVAL;
754 goto out;
755 }
Eric Parisc9180a52007-11-30 13:00:35 -0500756
757 /*
Eric Parise0007522008-03-05 10:31:54 -0500758 * Binary mount data FS will come through this function twice. Once
759 * from an explicit call and once from the generic calls from the vfs.
760 * Since the generic VFS calls will not contain any security mount data
761 * we need to skip the double mount verification.
762 *
763 * This does open a hole in which we will not notice if the first
764 * mount using this sb set explict options and a second mount using
765 * this sb does not set any security options. (The first options
766 * will be used for both mounts)
767 */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500768 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
Eric Parise0007522008-03-05 10:31:54 -0500769 && (num_opts == 0))
Eric Parisf5269712008-05-14 11:27:45 -0400770 goto out;
Eric Parise0007522008-03-05 10:31:54 -0500771
Paul Moore2c971652016-04-19 16:36:28 -0400772 root_isec = backing_inode_security_novalidate(root);
773
Eric Parise0007522008-03-05 10:31:54 -0500774 /*
Eric Parisc9180a52007-11-30 13:00:35 -0500775 * parse the mount options, check if they are valid sids.
776 * also check if someone is trying to mount the same sb more
777 * than once with different security options.
778 */
779 for (i = 0; i < num_opts; i++) {
780 u32 sid;
David P. Quigley11689d42009-01-16 09:22:03 -0500781
Eric Paris12f348b2012-10-09 10:56:25 -0400782 if (flags[i] == SBLABEL_MNT)
David P. Quigley11689d42009-01-16 09:22:03 -0500783 continue;
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500784 rc = security_context_str_to_sid(&selinux_state,
785 mount_options[i], &sid,
786 GFP_KERNEL);
Eric Parisc9180a52007-11-30 13:00:35 -0500787 if (rc) {
Rasmus Villemoes44be2f62015-10-21 17:44:25 -0400788 printk(KERN_WARNING "SELinux: security_context_str_to_sid"
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800789 "(%s) failed for (dev %s, type %s) errno=%d\n",
790 mount_options[i], sb->s_id, name, rc);
Eric Parisc9180a52007-11-30 13:00:35 -0500791 goto out;
792 }
793 switch (flags[i]) {
794 case FSCONTEXT_MNT:
795 fscontext_sid = sid;
796
797 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
798 fscontext_sid))
799 goto out_double_mount;
800
801 sbsec->flags |= FSCONTEXT_MNT;
802 break;
803 case CONTEXT_MNT:
804 context_sid = sid;
805
806 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
807 context_sid))
808 goto out_double_mount;
809
810 sbsec->flags |= CONTEXT_MNT;
811 break;
812 case ROOTCONTEXT_MNT:
813 rootcontext_sid = sid;
814
815 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
816 rootcontext_sid))
817 goto out_double_mount;
818
819 sbsec->flags |= ROOTCONTEXT_MNT;
820
821 break;
822 case DEFCONTEXT_MNT:
823 defcontext_sid = sid;
824
825 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
826 defcontext_sid))
827 goto out_double_mount;
828
829 sbsec->flags |= DEFCONTEXT_MNT;
830
831 break;
832 default:
833 rc = -EINVAL;
834 goto out;
835 }
836 }
837
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500838 if (sbsec->flags & SE_SBINITIALIZED) {
Eric Parisc9180a52007-11-30 13:00:35 -0500839 /* previously mounted with options, but not on this attempt? */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500840 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500841 goto out_double_mount;
842 rc = 0;
843 goto out;
844 }
845
James Morris089be432008-07-15 18:32:49 +1000846 if (strcmp(sb->s_type->name, "proc") == 0)
Stephen Smalley134509d2015-06-04 16:22:17 -0400847 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
848
Stephen Smalley8e014722015-06-04 16:22:17 -0400849 if (!strcmp(sb->s_type->name, "debugfs") ||
Jeff Vander Stoep6a391182017-06-20 09:35:33 -0700850 !strcmp(sb->s_type->name, "tracefs") ||
Stephen Smalley8e014722015-06-04 16:22:17 -0400851 !strcmp(sb->s_type->name, "sysfs") ||
Antonio Murdaca901ef842017-02-09 17:02:42 +0100852 !strcmp(sb->s_type->name, "pstore") ||
853 !strcmp(sb->s_type->name, "cgroup") ||
854 !strcmp(sb->s_type->name, "cgroup2"))
Stephen Smalley134509d2015-06-04 16:22:17 -0400855 sbsec->flags |= SE_SBGENFS;
Eric Parisc9180a52007-11-30 13:00:35 -0500856
David Quigleyeb9ae682013-05-22 12:50:37 -0400857 if (!sbsec->behavior) {
858 /*
859 * Determine the labeling behavior to use for this
860 * filesystem type.
861 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500862 rc = security_fs_use(&selinux_state, sb);
David Quigleyeb9ae682013-05-22 12:50:37 -0400863 if (rc) {
864 printk(KERN_WARNING
865 "%s: security_fs_use(%s) returned %d\n",
866 __func__, sb->s_type->name, rc);
867 goto out;
868 }
Eric Parisc9180a52007-11-30 13:00:35 -0500869 }
Seth Forsheeaad82892016-04-26 14:36:20 -0500870
871 /*
Stephen Smalley01593d32017-01-09 10:07:31 -0500872 * If this is a user namespace mount and the filesystem type is not
873 * explicitly whitelisted, then no contexts are allowed on the command
874 * line and security labels must be ignored.
Seth Forsheeaad82892016-04-26 14:36:20 -0500875 */
Stephen Smalley01593d32017-01-09 10:07:31 -0500876 if (sb->s_user_ns != &init_user_ns &&
877 strcmp(sb->s_type->name, "tmpfs") &&
878 strcmp(sb->s_type->name, "ramfs") &&
879 strcmp(sb->s_type->name, "devpts")) {
Seth Forsheeaad82892016-04-26 14:36:20 -0500880 if (context_sid || fscontext_sid || rootcontext_sid ||
881 defcontext_sid) {
882 rc = -EACCES;
883 goto out;
884 }
885 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
886 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500887 rc = security_transition_sid(&selinux_state,
888 current_sid(),
889 current_sid(),
Seth Forsheeaad82892016-04-26 14:36:20 -0500890 SECCLASS_FILE, NULL,
891 &sbsec->mntpoint_sid);
892 if (rc)
893 goto out;
894 }
895 goto out_set_opts;
896 }
897
Eric Parisc9180a52007-11-30 13:00:35 -0500898 /* sets the context of the superblock for the fs being mounted. */
899 if (fscontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100900 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500901 if (rc)
902 goto out;
903
904 sbsec->sid = fscontext_sid;
905 }
906
907 /*
908 * Switch to using mount point labeling behavior.
909 * sets the label used on all file below the mountpoint, and will set
910 * the superblock context if not already set.
911 */
David Quigleyeb9ae682013-05-22 12:50:37 -0400912 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
913 sbsec->behavior = SECURITY_FS_USE_NATIVE;
914 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
915 }
916
Eric Parisc9180a52007-11-30 13:00:35 -0500917 if (context_sid) {
918 if (!fscontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100919 rc = may_context_mount_sb_relabel(context_sid, sbsec,
920 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500921 if (rc)
922 goto out;
923 sbsec->sid = context_sid;
924 } else {
David Howells275bb412008-11-14 10:39:19 +1100925 rc = may_context_mount_inode_relabel(context_sid, sbsec,
926 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500927 if (rc)
928 goto out;
929 }
930 if (!rootcontext_sid)
931 rootcontext_sid = context_sid;
932
933 sbsec->mntpoint_sid = context_sid;
934 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
935 }
936
937 if (rootcontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100938 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
939 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500940 if (rc)
941 goto out;
942
943 root_isec->sid = rootcontext_sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -0500944 root_isec->initialized = LABEL_INITIALIZED;
Eric Parisc9180a52007-11-30 13:00:35 -0500945 }
946
947 if (defcontext_sid) {
David Quigleyeb9ae682013-05-22 12:50:37 -0400948 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
949 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
Eric Parisc9180a52007-11-30 13:00:35 -0500950 rc = -EINVAL;
951 printk(KERN_WARNING "SELinux: defcontext option is "
952 "invalid for this filesystem type\n");
953 goto out;
954 }
955
956 if (defcontext_sid != sbsec->def_sid) {
957 rc = may_context_mount_inode_relabel(defcontext_sid,
David Howells275bb412008-11-14 10:39:19 +1100958 sbsec, cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500959 if (rc)
960 goto out;
961 }
962
963 sbsec->def_sid = defcontext_sid;
964 }
965
Seth Forsheeaad82892016-04-26 14:36:20 -0500966out_set_opts:
Eric Parisc9180a52007-11-30 13:00:35 -0500967 rc = sb_finish_set_opts(sb);
968out:
Eric Parisbc7e9822006-09-25 23:32:02 -0700969 mutex_unlock(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700970 return rc;
Eric Parisc9180a52007-11-30 13:00:35 -0500971out_double_mount:
972 rc = -EINVAL;
973 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800974 "security settings for (dev %s, type %s)\n", sb->s_id, name);
Eric Parisc9180a52007-11-30 13:00:35 -0500975 goto out;
976}
977
Jeff Layton094f7b62013-04-01 08:14:24 -0400978static int selinux_cmp_sb_context(const struct super_block *oldsb,
979 const struct super_block *newsb)
980{
981 struct superblock_security_struct *old = oldsb->s_security;
982 struct superblock_security_struct *new = newsb->s_security;
983 char oldflags = old->flags & SE_MNTMASK;
984 char newflags = new->flags & SE_MNTMASK;
985
986 if (oldflags != newflags)
987 goto mismatch;
988 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
989 goto mismatch;
990 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
991 goto mismatch;
992 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
993 goto mismatch;
994 if (oldflags & ROOTCONTEXT_MNT) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500995 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
996 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
Jeff Layton094f7b62013-04-01 08:14:24 -0400997 if (oldroot->sid != newroot->sid)
998 goto mismatch;
999 }
1000 return 0;
1001mismatch:
1002 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, "
1003 "different security settings for (dev %s, "
1004 "type %s)\n", newsb->s_id, newsb->s_type->name);
1005 return -EBUSY;
1006}
1007
1008static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001009 struct super_block *newsb,
1010 unsigned long kern_flags,
1011 unsigned long *set_kern_flags)
Eric Parisc9180a52007-11-30 13:00:35 -05001012{
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001013 int rc = 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001014 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
1015 struct superblock_security_struct *newsbsec = newsb->s_security;
1016
1017 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
1018 int set_context = (oldsbsec->flags & CONTEXT_MNT);
1019 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
1020
Eric Paris0f5e6422008-04-21 16:24:11 -04001021 /*
1022 * if the parent was able to be mounted it clearly had no special lsm
Al Viroe8c26252010-03-23 06:36:54 -04001023 * mount options. thus we can safely deal with this superblock later
Eric Paris0f5e6422008-04-21 16:24:11 -04001024 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001025 if (!selinux_state.initialized)
Jeff Layton094f7b62013-04-01 08:14:24 -04001026 return 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001027
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001028 /*
1029 * Specifying internal flags without providing a place to
1030 * place the results is not allowed.
1031 */
1032 if (kern_flags && !set_kern_flags)
1033 return -EINVAL;
1034
Eric Parisc9180a52007-11-30 13:00:35 -05001035 /* how can we clone if the old one wasn't set up?? */
David P. Quigley0d90a7e2009-01-16 09:22:02 -05001036 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
Eric Parisc9180a52007-11-30 13:00:35 -05001037
Jeff Layton094f7b62013-04-01 08:14:24 -04001038 /* if fs is reusing a sb, make sure that the contexts match */
David P. Quigley0d90a7e2009-01-16 09:22:02 -05001039 if (newsbsec->flags & SE_SBINITIALIZED)
Jeff Layton094f7b62013-04-01 08:14:24 -04001040 return selinux_cmp_sb_context(oldsb, newsb);
Eric Paris5a552612008-04-09 14:08:35 -04001041
Eric Parisc9180a52007-11-30 13:00:35 -05001042 mutex_lock(&newsbsec->lock);
1043
1044 newsbsec->flags = oldsbsec->flags;
1045
1046 newsbsec->sid = oldsbsec->sid;
1047 newsbsec->def_sid = oldsbsec->def_sid;
1048 newsbsec->behavior = oldsbsec->behavior;
1049
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001050 if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
1051 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001052 rc = security_fs_use(&selinux_state, newsb);
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001053 if (rc)
1054 goto out;
1055 }
1056
1057 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
1058 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
1059 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
1060 }
1061
Eric Parisc9180a52007-11-30 13:00:35 -05001062 if (set_context) {
1063 u32 sid = oldsbsec->mntpoint_sid;
1064
1065 if (!set_fscontext)
1066 newsbsec->sid = sid;
1067 if (!set_rootcontext) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001068 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
Eric Parisc9180a52007-11-30 13:00:35 -05001069 newisec->sid = sid;
1070 }
1071 newsbsec->mntpoint_sid = sid;
1072 }
1073 if (set_rootcontext) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001074 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
1075 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
Eric Parisc9180a52007-11-30 13:00:35 -05001076
1077 newisec->sid = oldisec->sid;
1078 }
1079
1080 sb_finish_set_opts(newsb);
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001081out:
Eric Parisc9180a52007-11-30 13:00:35 -05001082 mutex_unlock(&newsbsec->lock);
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001083 return rc;
Eric Parisc9180a52007-11-30 13:00:35 -05001084}
1085
Adrian Bunk2e1479d2008-03-17 22:29:23 +02001086static int selinux_parse_opts_str(char *options,
1087 struct security_mnt_opts *opts)
Eric Parisc9180a52007-11-30 13:00:35 -05001088{
Eric Parise0007522008-03-05 10:31:54 -05001089 char *p;
Eric Parisc9180a52007-11-30 13:00:35 -05001090 char *context = NULL, *defcontext = NULL;
1091 char *fscontext = NULL, *rootcontext = NULL;
Eric Parise0007522008-03-05 10:31:54 -05001092 int rc, num_mnt_opts = 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001093
Eric Parise0007522008-03-05 10:31:54 -05001094 opts->num_mnt_opts = 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001095
1096 /* Standard string-based options. */
1097 while ((p = strsep(&options, "|")) != NULL) {
1098 int token;
1099 substring_t args[MAX_OPT_ARGS];
1100
1101 if (!*p)
1102 continue;
1103
1104 token = match_token(p, tokens, args);
1105
1106 switch (token) {
1107 case Opt_context:
1108 if (context || defcontext) {
1109 rc = -EINVAL;
1110 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1111 goto out_err;
1112 }
1113 context = match_strdup(&args[0]);
1114 if (!context) {
1115 rc = -ENOMEM;
1116 goto out_err;
1117 }
1118 break;
1119
1120 case Opt_fscontext:
1121 if (fscontext) {
1122 rc = -EINVAL;
1123 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1124 goto out_err;
1125 }
1126 fscontext = match_strdup(&args[0]);
1127 if (!fscontext) {
1128 rc = -ENOMEM;
1129 goto out_err;
1130 }
1131 break;
1132
1133 case Opt_rootcontext:
1134 if (rootcontext) {
1135 rc = -EINVAL;
1136 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1137 goto out_err;
1138 }
1139 rootcontext = match_strdup(&args[0]);
1140 if (!rootcontext) {
1141 rc = -ENOMEM;
1142 goto out_err;
1143 }
1144 break;
1145
1146 case Opt_defcontext:
1147 if (context || defcontext) {
1148 rc = -EINVAL;
1149 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1150 goto out_err;
1151 }
1152 defcontext = match_strdup(&args[0]);
1153 if (!defcontext) {
1154 rc = -ENOMEM;
1155 goto out_err;
1156 }
1157 break;
David P. Quigley11689d42009-01-16 09:22:03 -05001158 case Opt_labelsupport:
1159 break;
Eric Parisc9180a52007-11-30 13:00:35 -05001160 default:
1161 rc = -EINVAL;
1162 printk(KERN_WARNING "SELinux: unknown mount option\n");
1163 goto out_err;
1164
1165 }
1166 }
1167
Eric Parise0007522008-03-05 10:31:54 -05001168 rc = -ENOMEM;
Tetsuo Handa8931c3b2016-11-14 20:16:12 +09001169 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_KERNEL);
Eric Parise0007522008-03-05 10:31:54 -05001170 if (!opts->mnt_opts)
1171 goto out_err;
1172
Tetsuo Handa8931c3b2016-11-14 20:16:12 +09001173 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int),
1174 GFP_KERNEL);
Paul Moore023f1082017-06-07 16:48:19 -04001175 if (!opts->mnt_opts_flags)
Eric Parise0007522008-03-05 10:31:54 -05001176 goto out_err;
Eric Parisc9180a52007-11-30 13:00:35 -05001177
Eric Parise0007522008-03-05 10:31:54 -05001178 if (fscontext) {
1179 opts->mnt_opts[num_mnt_opts] = fscontext;
1180 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1181 }
1182 if (context) {
1183 opts->mnt_opts[num_mnt_opts] = context;
1184 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1185 }
1186 if (rootcontext) {
1187 opts->mnt_opts[num_mnt_opts] = rootcontext;
1188 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1189 }
1190 if (defcontext) {
1191 opts->mnt_opts[num_mnt_opts] = defcontext;
1192 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1193 }
1194
1195 opts->num_mnt_opts = num_mnt_opts;
1196 return 0;
1197
Eric Parisc9180a52007-11-30 13:00:35 -05001198out_err:
Paul Moore023f1082017-06-07 16:48:19 -04001199 security_free_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -05001200 kfree(context);
1201 kfree(defcontext);
1202 kfree(fscontext);
1203 kfree(rootcontext);
1204 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001205}
Eric Parise0007522008-03-05 10:31:54 -05001206/*
1207 * string mount options parsing and call set the sbsec
1208 */
1209static int superblock_doinit(struct super_block *sb, void *data)
1210{
1211 int rc = 0;
1212 char *options = data;
1213 struct security_mnt_opts opts;
1214
1215 security_init_mnt_opts(&opts);
1216
1217 if (!data)
1218 goto out;
1219
1220 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1221
1222 rc = selinux_parse_opts_str(options, &opts);
1223 if (rc)
1224 goto out_err;
1225
1226out:
David Quigley649f6e72013-05-22 12:50:36 -04001227 rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
Eric Parise0007522008-03-05 10:31:54 -05001228
1229out_err:
1230 security_free_mnt_opts(&opts);
1231 return rc;
1232}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001233
Adrian Bunk3583a712008-07-22 20:21:23 +03001234static void selinux_write_opts(struct seq_file *m,
1235 struct security_mnt_opts *opts)
Eric Paris2069f452008-07-04 09:47:13 +10001236{
1237 int i;
1238 char *prefix;
1239
1240 for (i = 0; i < opts->num_mnt_opts; i++) {
David P. Quigley11689d42009-01-16 09:22:03 -05001241 char *has_comma;
1242
1243 if (opts->mnt_opts[i])
1244 has_comma = strchr(opts->mnt_opts[i], ',');
1245 else
1246 has_comma = NULL;
Eric Paris2069f452008-07-04 09:47:13 +10001247
1248 switch (opts->mnt_opts_flags[i]) {
1249 case CONTEXT_MNT:
1250 prefix = CONTEXT_STR;
1251 break;
1252 case FSCONTEXT_MNT:
1253 prefix = FSCONTEXT_STR;
1254 break;
1255 case ROOTCONTEXT_MNT:
1256 prefix = ROOTCONTEXT_STR;
1257 break;
1258 case DEFCONTEXT_MNT:
1259 prefix = DEFCONTEXT_STR;
1260 break;
Eric Paris12f348b2012-10-09 10:56:25 -04001261 case SBLABEL_MNT:
David P. Quigley11689d42009-01-16 09:22:03 -05001262 seq_putc(m, ',');
1263 seq_puts(m, LABELSUPP_STR);
1264 continue;
Eric Paris2069f452008-07-04 09:47:13 +10001265 default:
1266 BUG();
Eric Parisa35c6c832011-04-20 10:21:28 -04001267 return;
Eric Paris2069f452008-07-04 09:47:13 +10001268 };
1269 /* we need a comma before each option */
1270 seq_putc(m, ',');
1271 seq_puts(m, prefix);
1272 if (has_comma)
1273 seq_putc(m, '\"');
Kees Cooka068acf2015-09-04 15:44:57 -07001274 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
Eric Paris2069f452008-07-04 09:47:13 +10001275 if (has_comma)
1276 seq_putc(m, '\"');
1277 }
1278}
1279
1280static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1281{
1282 struct security_mnt_opts opts;
1283 int rc;
1284
1285 rc = selinux_get_mnt_opts(sb, &opts);
Eric Paris383795c2008-07-29 17:07:26 -04001286 if (rc) {
1287 /* before policy load we may get EINVAL, don't show anything */
1288 if (rc == -EINVAL)
1289 rc = 0;
Eric Paris2069f452008-07-04 09:47:13 +10001290 return rc;
Eric Paris383795c2008-07-29 17:07:26 -04001291 }
Eric Paris2069f452008-07-04 09:47:13 +10001292
1293 selinux_write_opts(m, &opts);
1294
1295 security_free_mnt_opts(&opts);
1296
1297 return rc;
1298}
1299
Linus Torvalds1da177e2005-04-16 15:20:36 -07001300static inline u16 inode_mode_to_security_class(umode_t mode)
1301{
1302 switch (mode & S_IFMT) {
1303 case S_IFSOCK:
1304 return SECCLASS_SOCK_FILE;
1305 case S_IFLNK:
1306 return SECCLASS_LNK_FILE;
1307 case S_IFREG:
1308 return SECCLASS_FILE;
1309 case S_IFBLK:
1310 return SECCLASS_BLK_FILE;
1311 case S_IFDIR:
1312 return SECCLASS_DIR;
1313 case S_IFCHR:
1314 return SECCLASS_CHR_FILE;
1315 case S_IFIFO:
1316 return SECCLASS_FIFO_FILE;
1317
1318 }
1319
1320 return SECCLASS_FILE;
1321}
1322
James Morris13402582005-09-30 14:24:34 -04001323static inline int default_protocol_stream(int protocol)
1324{
1325 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1326}
1327
1328static inline int default_protocol_dgram(int protocol)
1329{
1330 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1331}
1332
Linus Torvalds1da177e2005-04-16 15:20:36 -07001333static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1334{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001335 int extsockclass = selinux_policycap_extsockclass();
Stephen Smalleyda69a532017-01-09 10:07:30 -05001336
Linus Torvalds1da177e2005-04-16 15:20:36 -07001337 switch (family) {
1338 case PF_UNIX:
1339 switch (type) {
1340 case SOCK_STREAM:
1341 case SOCK_SEQPACKET:
1342 return SECCLASS_UNIX_STREAM_SOCKET;
1343 case SOCK_DGRAM:
Luis Ressel2a764b52017-07-25 15:13:41 -04001344 case SOCK_RAW:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001345 return SECCLASS_UNIX_DGRAM_SOCKET;
1346 }
1347 break;
1348 case PF_INET:
1349 case PF_INET6:
1350 switch (type) {
1351 case SOCK_STREAM:
Stephen Smalleyda69a532017-01-09 10:07:30 -05001352 case SOCK_SEQPACKET:
James Morris13402582005-09-30 14:24:34 -04001353 if (default_protocol_stream(protocol))
1354 return SECCLASS_TCP_SOCKET;
Stephen Smalleyda69a532017-01-09 10:07:30 -05001355 else if (extsockclass && protocol == IPPROTO_SCTP)
1356 return SECCLASS_SCTP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001357 else
1358 return SECCLASS_RAWIP_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001359 case SOCK_DGRAM:
James Morris13402582005-09-30 14:24:34 -04001360 if (default_protocol_dgram(protocol))
1361 return SECCLASS_UDP_SOCKET;
Stephen Smalleyef379792017-01-09 10:07:31 -05001362 else if (extsockclass && (protocol == IPPROTO_ICMP ||
1363 protocol == IPPROTO_ICMPV6))
Stephen Smalleyda69a532017-01-09 10:07:30 -05001364 return SECCLASS_ICMP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001365 else
1366 return SECCLASS_RAWIP_SOCKET;
James Morris2ee92d42006-11-13 16:09:01 -08001367 case SOCK_DCCP:
1368 return SECCLASS_DCCP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001369 default:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001370 return SECCLASS_RAWIP_SOCKET;
1371 }
1372 break;
1373 case PF_NETLINK:
1374 switch (protocol) {
1375 case NETLINK_ROUTE:
1376 return SECCLASS_NETLINK_ROUTE_SOCKET;
Pavel Emelyanov7f1fb602011-12-06 07:56:43 +00001377 case NETLINK_SOCK_DIAG:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001378 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1379 case NETLINK_NFLOG:
1380 return SECCLASS_NETLINK_NFLOG_SOCKET;
1381 case NETLINK_XFRM:
1382 return SECCLASS_NETLINK_XFRM_SOCKET;
1383 case NETLINK_SELINUX:
1384 return SECCLASS_NETLINK_SELINUX_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001385 case NETLINK_ISCSI:
1386 return SECCLASS_NETLINK_ISCSI_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001387 case NETLINK_AUDIT:
1388 return SECCLASS_NETLINK_AUDIT_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001389 case NETLINK_FIB_LOOKUP:
1390 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1391 case NETLINK_CONNECTOR:
1392 return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1393 case NETLINK_NETFILTER:
1394 return SECCLASS_NETLINK_NETFILTER_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001395 case NETLINK_DNRTMSG:
1396 return SECCLASS_NETLINK_DNRT_SOCKET;
James Morris0c9b7942005-04-16 15:24:13 -07001397 case NETLINK_KOBJECT_UEVENT:
1398 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001399 case NETLINK_GENERIC:
1400 return SECCLASS_NETLINK_GENERIC_SOCKET;
1401 case NETLINK_SCSITRANSPORT:
1402 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1403 case NETLINK_RDMA:
1404 return SECCLASS_NETLINK_RDMA_SOCKET;
1405 case NETLINK_CRYPTO:
1406 return SECCLASS_NETLINK_CRYPTO_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001407 default:
1408 return SECCLASS_NETLINK_SOCKET;
1409 }
1410 case PF_PACKET:
1411 return SECCLASS_PACKET_SOCKET;
1412 case PF_KEY:
1413 return SECCLASS_KEY_SOCKET;
Christopher J. PeBenito3e3ff152006-06-09 00:25:03 -07001414 case PF_APPLETALK:
1415 return SECCLASS_APPLETALK_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001416 }
1417
Stephen Smalleyda69a532017-01-09 10:07:30 -05001418 if (extsockclass) {
1419 switch (family) {
1420 case PF_AX25:
1421 return SECCLASS_AX25_SOCKET;
1422 case PF_IPX:
1423 return SECCLASS_IPX_SOCKET;
1424 case PF_NETROM:
1425 return SECCLASS_NETROM_SOCKET;
Stephen Smalleyda69a532017-01-09 10:07:30 -05001426 case PF_ATMPVC:
1427 return SECCLASS_ATMPVC_SOCKET;
1428 case PF_X25:
1429 return SECCLASS_X25_SOCKET;
1430 case PF_ROSE:
1431 return SECCLASS_ROSE_SOCKET;
1432 case PF_DECnet:
1433 return SECCLASS_DECNET_SOCKET;
1434 case PF_ATMSVC:
1435 return SECCLASS_ATMSVC_SOCKET;
1436 case PF_RDS:
1437 return SECCLASS_RDS_SOCKET;
1438 case PF_IRDA:
1439 return SECCLASS_IRDA_SOCKET;
1440 case PF_PPPOX:
1441 return SECCLASS_PPPOX_SOCKET;
1442 case PF_LLC:
1443 return SECCLASS_LLC_SOCKET;
Stephen Smalleyda69a532017-01-09 10:07:30 -05001444 case PF_CAN:
1445 return SECCLASS_CAN_SOCKET;
1446 case PF_TIPC:
1447 return SECCLASS_TIPC_SOCKET;
1448 case PF_BLUETOOTH:
1449 return SECCLASS_BLUETOOTH_SOCKET;
1450 case PF_IUCV:
1451 return SECCLASS_IUCV_SOCKET;
1452 case PF_RXRPC:
1453 return SECCLASS_RXRPC_SOCKET;
1454 case PF_ISDN:
1455 return SECCLASS_ISDN_SOCKET;
1456 case PF_PHONET:
1457 return SECCLASS_PHONET_SOCKET;
1458 case PF_IEEE802154:
1459 return SECCLASS_IEEE802154_SOCKET;
1460 case PF_CAIF:
1461 return SECCLASS_CAIF_SOCKET;
1462 case PF_ALG:
1463 return SECCLASS_ALG_SOCKET;
1464 case PF_NFC:
1465 return SECCLASS_NFC_SOCKET;
1466 case PF_VSOCK:
1467 return SECCLASS_VSOCK_SOCKET;
1468 case PF_KCM:
1469 return SECCLASS_KCM_SOCKET;
1470 case PF_QIPCRTR:
1471 return SECCLASS_QIPCRTR_SOCKET;
Linus Torvalds3051bf32017-02-22 10:15:09 -08001472 case PF_SMC:
1473 return SECCLASS_SMC_SOCKET;
1474#if PF_MAX > 44
Stephen Smalleyda69a532017-01-09 10:07:30 -05001475#error New address family defined, please update this function.
1476#endif
1477 }
1478 }
1479
Linus Torvalds1da177e2005-04-16 15:20:36 -07001480 return SECCLASS_SOCKET;
1481}
1482
Stephen Smalley134509d2015-06-04 16:22:17 -04001483static int selinux_genfs_get_sid(struct dentry *dentry,
1484 u16 tclass,
1485 u16 flags,
1486 u32 *sid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001487{
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001488 int rc;
Al Virofc640052016-04-10 01:33:30 -04001489 struct super_block *sb = dentry->d_sb;
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001490 char *buffer, *path;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001491
Eric Paris828dfe12008-04-17 13:17:49 -04001492 buffer = (char *)__get_free_page(GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001493 if (!buffer)
1494 return -ENOMEM;
1495
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001496 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1497 if (IS_ERR(path))
1498 rc = PTR_ERR(path);
1499 else {
Stephen Smalley134509d2015-06-04 16:22:17 -04001500 if (flags & SE_SBPROC) {
1501 /* each process gets a /proc/PID/ entry. Strip off the
1502 * PID part to get a valid selinux labeling.
1503 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1504 while (path[1] >= '0' && path[1] <= '9') {
1505 path[1] = '/';
1506 path++;
1507 }
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001508 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001509 rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1510 path, tclass, sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001511 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001512 free_page((unsigned long)buffer);
1513 return rc;
1514}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001515
1516/* The inode's security attributes must be initialized before first use. */
1517static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1518{
1519 struct superblock_security_struct *sbsec = NULL;
1520 struct inode_security_struct *isec = inode->i_security;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001521 u32 task_sid, sid = 0;
1522 u16 sclass;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001523 struct dentry *dentry;
1524#define INITCONTEXTLEN 255
1525 char *context = NULL;
1526 unsigned len = 0;
1527 int rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001528
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05001529 if (isec->initialized == LABEL_INITIALIZED)
Andreas Gruenbacher13457d02016-11-10 22:18:29 +01001530 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001531
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001532 spin_lock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05001533 if (isec->initialized == LABEL_INITIALIZED)
Eric Paris23970742006-09-25 23:32:01 -07001534 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001535
Andreas Gruenbacher13457d02016-11-10 22:18:29 +01001536 if (isec->sclass == SECCLASS_FILE)
1537 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1538
Linus Torvalds1da177e2005-04-16 15:20:36 -07001539 sbsec = inode->i_sb->s_security;
David P. Quigley0d90a7e2009-01-16 09:22:02 -05001540 if (!(sbsec->flags & SE_SBINITIALIZED)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001541 /* Defer initialization until selinux_complete_init,
1542 after the initial policy is loaded and the security
1543 server is ready to handle calls. */
1544 spin_lock(&sbsec->isec_lock);
1545 if (list_empty(&isec->list))
1546 list_add(&isec->list, &sbsec->isec_head);
1547 spin_unlock(&sbsec->isec_lock);
Eric Paris23970742006-09-25 23:32:01 -07001548 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001549 }
1550
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001551 sclass = isec->sclass;
1552 task_sid = isec->task_sid;
1553 sid = isec->sid;
1554 isec->initialized = LABEL_PENDING;
1555 spin_unlock(&isec->lock);
1556
Linus Torvalds1da177e2005-04-16 15:20:36 -07001557 switch (sbsec->behavior) {
David Quigleyeb9ae682013-05-22 12:50:37 -04001558 case SECURITY_FS_USE_NATIVE:
1559 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001560 case SECURITY_FS_USE_XATTR:
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001561 if (!(inode->i_opflags & IOP_XATTR)) {
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001562 sid = sbsec->def_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001563 break;
1564 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001565 /* Need a dentry, since the xattr API requires one.
1566 Life would be simpler if we could just pass the inode. */
1567 if (opt_dentry) {
1568 /* Called from d_instantiate or d_splice_alias. */
1569 dentry = dget(opt_dentry);
1570 } else {
Al Virob1271252018-04-25 10:28:38 -04001571 /*
1572 * Called from selinux_complete_init, try to find a dentry.
1573 * Some filesystems really want a connected one, so try
1574 * that first. We could split SECURITY_FS_USE_XATTR in
1575 * two, depending upon that...
1576 */
Linus Torvalds1da177e2005-04-16 15:20:36 -07001577 dentry = d_find_alias(inode);
Al Virob1271252018-04-25 10:28:38 -04001578 if (!dentry)
1579 dentry = d_find_any_alias(inode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001580 }
1581 if (!dentry) {
Eric Parisdf7f54c2009-03-09 14:35:58 -04001582 /*
1583 * this is can be hit on boot when a file is accessed
1584 * before the policy is loaded. When we load policy we
1585 * may find inodes that have no dentry on the
1586 * sbsec->isec_head list. No reason to complain as these
1587 * will get fixed up the next time we go through
1588 * inode_doinit with a dentry, before these inodes could
1589 * be used again by userspace.
1590 */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001591 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001592 }
1593
1594 len = INITCONTEXTLEN;
Eric Paris4cb912f2009-02-12 14:50:05 -05001595 context = kmalloc(len+1, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001596 if (!context) {
1597 rc = -ENOMEM;
1598 dput(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001599 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001600 }
Eric Paris4cb912f2009-02-12 14:50:05 -05001601 context[len] = '\0';
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001602 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001603 if (rc == -ERANGE) {
James Morris314dabb2009-08-10 22:00:13 +10001604 kfree(context);
1605
Linus Torvalds1da177e2005-04-16 15:20:36 -07001606 /* Need a larger buffer. Query for the right size. */
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001607 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001608 if (rc < 0) {
1609 dput(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001610 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001611 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001612 len = rc;
Eric Paris4cb912f2009-02-12 14:50:05 -05001613 context = kmalloc(len+1, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001614 if (!context) {
1615 rc = -ENOMEM;
1616 dput(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001617 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001618 }
Eric Paris4cb912f2009-02-12 14:50:05 -05001619 context[len] = '\0';
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001620 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001621 }
1622 dput(dentry);
1623 if (rc < 0) {
1624 if (rc != -ENODATA) {
Eric Paris744ba352008-04-17 11:52:44 -04001625 printk(KERN_WARNING "SELinux: %s: getxattr returned "
Harvey Harrisondd6f9532008-03-06 10:03:59 +11001626 "%d for dev=%s ino=%ld\n", __func__,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001627 -rc, inode->i_sb->s_id, inode->i_ino);
1628 kfree(context);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001629 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001630 }
1631 /* Map ENODATA to the default file SID */
1632 sid = sbsec->def_sid;
1633 rc = 0;
1634 } else {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001635 rc = security_context_to_sid_default(&selinux_state,
1636 context, rc, &sid,
Stephen Smalley869ab512008-04-04 08:46:05 -04001637 sbsec->def_sid,
1638 GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001639 if (rc) {
Eric Paris4ba0a8a2009-02-12 15:01:10 -05001640 char *dev = inode->i_sb->s_id;
1641 unsigned long ino = inode->i_ino;
1642
1643 if (rc == -EINVAL) {
1644 if (printk_ratelimit())
1645 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1646 "context=%s. This indicates you may need to relabel the inode or the "
1647 "filesystem in question.\n", ino, dev, context);
1648 } else {
1649 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1650 "returned %d for dev=%s ino=%ld\n",
1651 __func__, context, -rc, dev, ino);
1652 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001653 kfree(context);
1654 /* Leave with the unlabeled SID */
1655 rc = 0;
1656 break;
1657 }
1658 }
1659 kfree(context);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001660 break;
1661 case SECURITY_FS_USE_TASK:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001662 sid = task_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001663 break;
1664 case SECURITY_FS_USE_TRANS:
1665 /* Default to the fs SID. */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001666 sid = sbsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001667
1668 /* Try to obtain a transition SID. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001669 rc = security_transition_sid(&selinux_state, task_sid, sid,
1670 sclass, NULL, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001671 if (rc)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001672 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001673 break;
Eric Parisc312feb2006-07-10 04:43:53 -07001674 case SECURITY_FS_USE_MNTPOINT:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001675 sid = sbsec->mntpoint_sid;
Eric Parisc312feb2006-07-10 04:43:53 -07001676 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001677 default:
Eric Parisc312feb2006-07-10 04:43:53 -07001678 /* Default to the fs superblock SID. */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001679 sid = sbsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001680
Stephen Smalley134509d2015-06-04 16:22:17 -04001681 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
Paul Mooref64410e2014-03-19 16:46:18 -04001682 /* We must have a dentry to determine the label on
1683 * procfs inodes */
Al Virob1271252018-04-25 10:28:38 -04001684 if (opt_dentry) {
Paul Mooref64410e2014-03-19 16:46:18 -04001685 /* Called from d_instantiate or
1686 * d_splice_alias. */
1687 dentry = dget(opt_dentry);
Al Virob1271252018-04-25 10:28:38 -04001688 } else {
Paul Mooref64410e2014-03-19 16:46:18 -04001689 /* Called from selinux_complete_init, try to
Al Virob1271252018-04-25 10:28:38 -04001690 * find a dentry. Some filesystems really want
1691 * a connected one, so try that first.
1692 */
Paul Mooref64410e2014-03-19 16:46:18 -04001693 dentry = d_find_alias(inode);
Al Virob1271252018-04-25 10:28:38 -04001694 if (!dentry)
1695 dentry = d_find_any_alias(inode);
1696 }
Paul Mooref64410e2014-03-19 16:46:18 -04001697 /*
1698 * This can be hit on boot when a file is accessed
1699 * before the policy is loaded. When we load policy we
1700 * may find inodes that have no dentry on the
1701 * sbsec->isec_head list. No reason to complain as
1702 * these will get fixed up the next time we go through
1703 * inode_doinit() with a dentry, before these inodes
1704 * could be used again by userspace.
1705 */
1706 if (!dentry)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001707 goto out;
1708 rc = selinux_genfs_get_sid(dentry, sclass,
Stephen Smalley134509d2015-06-04 16:22:17 -04001709 sbsec->flags, &sid);
Paul Mooref64410e2014-03-19 16:46:18 -04001710 dput(dentry);
1711 if (rc)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001712 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001713 }
1714 break;
1715 }
1716
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001717out:
1718 spin_lock(&isec->lock);
1719 if (isec->initialized == LABEL_PENDING) {
1720 if (!sid || rc) {
1721 isec->initialized = LABEL_INVALID;
1722 goto out_unlock;
1723 }
1724
1725 isec->initialized = LABEL_INITIALIZED;
1726 isec->sid = sid;
1727 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001728
Eric Paris23970742006-09-25 23:32:01 -07001729out_unlock:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001730 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001731 return rc;
1732}
1733
1734/* Convert a Linux signal to an access vector. */
1735static inline u32 signal_to_av(int sig)
1736{
1737 u32 perm = 0;
1738
1739 switch (sig) {
1740 case SIGCHLD:
1741 /* Commonly granted from child to parent. */
1742 perm = PROCESS__SIGCHLD;
1743 break;
1744 case SIGKILL:
1745 /* Cannot be caught or ignored */
1746 perm = PROCESS__SIGKILL;
1747 break;
1748 case SIGSTOP:
1749 /* Cannot be caught or ignored */
1750 perm = PROCESS__SIGSTOP;
1751 break;
1752 default:
1753 /* All other signals. */
1754 perm = PROCESS__SIGNAL;
1755 break;
1756 }
1757
1758 return perm;
1759}
1760
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001761#if CAP_LAST_CAP > 63
1762#error Fix SELinux to handle capabilities > 63.
1763#endif
1764
Linus Torvalds1da177e2005-04-16 15:20:36 -07001765/* Check whether a task is allowed to use a capability. */
Eric Paris6a9de492012-01-03 12:25:14 -05001766static int cred_has_capability(const struct cred *cred,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001767 int cap, int audit, bool initns)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001768{
Thomas Liu2bf49692009-07-14 12:14:09 -04001769 struct common_audit_data ad;
Eric Paris06112162008-11-11 22:02:50 +11001770 struct av_decision avd;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001771 u16 sclass;
David Howells3699c532009-01-06 22:27:01 +00001772 u32 sid = cred_sid(cred);
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001773 u32 av = CAP_TO_MASK(cap);
Eric Paris06112162008-11-11 22:02:50 +11001774 int rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001775
Eric Paris50c205f2012-04-04 15:01:43 -04001776 ad.type = LSM_AUDIT_DATA_CAP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001777 ad.u.cap = cap;
1778
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001779 switch (CAP_TO_INDEX(cap)) {
1780 case 0:
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001781 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001782 break;
1783 case 1:
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001784 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001785 break;
1786 default:
1787 printk(KERN_ERR
1788 "SELinux: out of range capability %d\n", cap);
1789 BUG();
Eric Parisa35c6c832011-04-20 10:21:28 -04001790 return -EINVAL;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001791 }
Eric Paris06112162008-11-11 22:02:50 +11001792
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001793 rc = avc_has_perm_noaudit(&selinux_state,
1794 sid, sid, sclass, av, 0, &avd);
Eric Paris9ade0cf2011-04-25 16:26:29 -04001795 if (audit == SECURITY_CAP_AUDIT) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001796 int rc2 = avc_audit(&selinux_state,
1797 sid, sid, sclass, av, &avd, rc, &ad, 0);
Eric Paris9ade0cf2011-04-25 16:26:29 -04001798 if (rc2)
1799 return rc2;
1800 }
Eric Paris06112162008-11-11 22:02:50 +11001801 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001802}
1803
Linus Torvalds1da177e2005-04-16 15:20:36 -07001804/* Check whether a task has a particular permission to an inode.
1805 The 'adp' parameter is optional and allows other audit
1806 data to be passed (e.g. the dentry). */
David Howells88e67f32008-11-14 10:39:21 +11001807static int inode_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001808 struct inode *inode,
1809 u32 perms,
Linus Torvalds19e49832013-10-04 12:54:11 -07001810 struct common_audit_data *adp)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001811{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001812 struct inode_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +11001813 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001814
David Howellse0e81732009-09-02 09:13:40 +01001815 validate_creds(cred);
1816
Eric Paris828dfe12008-04-17 13:17:49 -04001817 if (unlikely(IS_PRIVATE(inode)))
Stephen Smalleybbaca6c2007-02-14 00:34:16 -08001818 return 0;
1819
David Howells88e67f32008-11-14 10:39:21 +11001820 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001821 isec = inode->i_security;
1822
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001823 return avc_has_perm(&selinux_state,
1824 sid, isec->sid, isec->sclass, perms, adp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001825}
1826
1827/* Same as inode_has_perm, but pass explicit audit data containing
1828 the dentry to help the auditing code to more easily generate the
1829 pathname if needed. */
David Howells88e67f32008-11-14 10:39:21 +11001830static inline int dentry_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001831 struct dentry *dentry,
1832 u32 av)
1833{
David Howellsc6f493d2015-03-17 22:26:22 +00001834 struct inode *inode = d_backing_inode(dentry);
Thomas Liu2bf49692009-07-14 12:14:09 -04001835 struct common_audit_data ad;
David Howells88e67f32008-11-14 10:39:21 +11001836
Eric Paris50c205f2012-04-04 15:01:43 -04001837 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Paris2875fa02011-04-28 16:04:24 -04001838 ad.u.dentry = dentry;
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05001839 __inode_security_revalidate(inode, dentry, true);
Linus Torvalds19e49832013-10-04 12:54:11 -07001840 return inode_has_perm(cred, inode, av, &ad);
Eric Paris2875fa02011-04-28 16:04:24 -04001841}
1842
1843/* Same as inode_has_perm, but pass explicit audit data containing
1844 the path to help the auditing code to more easily generate the
1845 pathname if needed. */
1846static inline int path_has_perm(const struct cred *cred,
Al Viro3f7036a2015-03-08 19:28:30 -04001847 const struct path *path,
Eric Paris2875fa02011-04-28 16:04:24 -04001848 u32 av)
1849{
David Howellsc6f493d2015-03-17 22:26:22 +00001850 struct inode *inode = d_backing_inode(path->dentry);
Eric Paris2875fa02011-04-28 16:04:24 -04001851 struct common_audit_data ad;
1852
Eric Paris50c205f2012-04-04 15:01:43 -04001853 ad.type = LSM_AUDIT_DATA_PATH;
Eric Paris2875fa02011-04-28 16:04:24 -04001854 ad.u.path = *path;
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05001855 __inode_security_revalidate(inode, path->dentry, true);
Linus Torvalds19e49832013-10-04 12:54:11 -07001856 return inode_has_perm(cred, inode, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001857}
1858
David Howells13f8e982013-06-13 23:37:55 +01001859/* Same as path_has_perm, but uses the inode from the file struct. */
1860static inline int file_path_has_perm(const struct cred *cred,
1861 struct file *file,
1862 u32 av)
1863{
1864 struct common_audit_data ad;
1865
Vivek Goyal43af5de2016-09-09 11:37:49 -04001866 ad.type = LSM_AUDIT_DATA_FILE;
1867 ad.u.file = file;
Linus Torvalds19e49832013-10-04 12:54:11 -07001868 return inode_has_perm(cred, file_inode(file), av, &ad);
David Howells13f8e982013-06-13 23:37:55 +01001869}
1870
Chenbo Fengf66e4482017-10-18 13:00:26 -07001871#ifdef CONFIG_BPF_SYSCALL
1872static int bpf_fd_pass(struct file *file, u32 sid);
1873#endif
1874
Linus Torvalds1da177e2005-04-16 15:20:36 -07001875/* Check whether a task can use an open file descriptor to
1876 access an inode in a given way. Check access to the
1877 descriptor itself, and then use dentry_has_perm to
1878 check a particular permission to the file.
1879 Access to the descriptor is implicitly granted if it
1880 has the same SID as the process. If av is zero, then
1881 access to the file is not checked, e.g. for cases
1882 where only the descriptor is affected like seek. */
David Howells88e67f32008-11-14 10:39:21 +11001883static int file_has_perm(const struct cred *cred,
1884 struct file *file,
1885 u32 av)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001886{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001887 struct file_security_struct *fsec = file->f_security;
Al Viro496ad9a2013-01-23 17:07:38 -05001888 struct inode *inode = file_inode(file);
Thomas Liu2bf49692009-07-14 12:14:09 -04001889 struct common_audit_data ad;
David Howells88e67f32008-11-14 10:39:21 +11001890 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001891 int rc;
1892
Vivek Goyal43af5de2016-09-09 11:37:49 -04001893 ad.type = LSM_AUDIT_DATA_FILE;
1894 ad.u.file = file;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001895
David Howells275bb412008-11-14 10:39:19 +11001896 if (sid != fsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001897 rc = avc_has_perm(&selinux_state,
1898 sid, fsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001899 SECCLASS_FD,
1900 FD__USE,
1901 &ad);
1902 if (rc)
David Howells88e67f32008-11-14 10:39:21 +11001903 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001904 }
1905
Chenbo Fengf66e4482017-10-18 13:00:26 -07001906#ifdef CONFIG_BPF_SYSCALL
1907 rc = bpf_fd_pass(file, cred_sid(cred));
1908 if (rc)
1909 return rc;
1910#endif
1911
Linus Torvalds1da177e2005-04-16 15:20:36 -07001912 /* av is zero if only checking access to the descriptor. */
David Howells88e67f32008-11-14 10:39:21 +11001913 rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001914 if (av)
Linus Torvalds19e49832013-10-04 12:54:11 -07001915 rc = inode_has_perm(cred, inode, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001916
David Howells88e67f32008-11-14 10:39:21 +11001917out:
1918 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001919}
1920
David Howellsc3c188b2015-07-10 17:19:58 -04001921/*
1922 * Determine the label for an inode that might be unioned.
1923 */
Vivek Goyalc957f6d2016-07-13 10:44:51 -04001924static int
1925selinux_determine_inode_label(const struct task_security_struct *tsec,
1926 struct inode *dir,
1927 const struct qstr *name, u16 tclass,
1928 u32 *_new_isid)
David Howellsc3c188b2015-07-10 17:19:58 -04001929{
1930 const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
David Howellsc3c188b2015-07-10 17:19:58 -04001931
1932 if ((sbsec->flags & SE_SBINITIALIZED) &&
1933 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1934 *_new_isid = sbsec->mntpoint_sid;
1935 } else if ((sbsec->flags & SBLABEL_MNT) &&
1936 tsec->create_sid) {
1937 *_new_isid = tsec->create_sid;
1938 } else {
Paul Moore20cdef82016-04-04 14:14:42 -04001939 const struct inode_security_struct *dsec = inode_security(dir);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001940 return security_transition_sid(&selinux_state, tsec->sid,
1941 dsec->sid, tclass,
David Howellsc3c188b2015-07-10 17:19:58 -04001942 name, _new_isid);
1943 }
1944
1945 return 0;
1946}
1947
Linus Torvalds1da177e2005-04-16 15:20:36 -07001948/* Check whether a task can create a file. */
1949static int may_create(struct inode *dir,
1950 struct dentry *dentry,
1951 u16 tclass)
1952{
Paul Moore5fb49872010-04-22 14:46:19 -04001953 const struct task_security_struct *tsec = current_security();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001954 struct inode_security_struct *dsec;
1955 struct superblock_security_struct *sbsec;
David Howells275bb412008-11-14 10:39:19 +11001956 u32 sid, newsid;
Thomas Liu2bf49692009-07-14 12:14:09 -04001957 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001958 int rc;
1959
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001960 dsec = inode_security(dir);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001961 sbsec = dir->i_sb->s_security;
1962
David Howells275bb412008-11-14 10:39:19 +11001963 sid = tsec->sid;
David Howells275bb412008-11-14 10:39:19 +11001964
Eric Paris50c205f2012-04-04 15:01:43 -04001965 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04001966 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001967
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001968 rc = avc_has_perm(&selinux_state,
1969 sid, dsec->sid, SECCLASS_DIR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001970 DIR__ADD_NAME | DIR__SEARCH,
1971 &ad);
1972 if (rc)
1973 return rc;
1974
Vivek Goyalc957f6d2016-07-13 10:44:51 -04001975 rc = selinux_determine_inode_label(current_security(), dir,
1976 &dentry->d_name, tclass, &newsid);
David Howellsc3c188b2015-07-10 17:19:58 -04001977 if (rc)
1978 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001979
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001980 rc = avc_has_perm(&selinux_state,
1981 sid, newsid, tclass, FILE__CREATE, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001982 if (rc)
1983 return rc;
1984
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001985 return avc_has_perm(&selinux_state,
1986 newsid, sbsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001987 SECCLASS_FILESYSTEM,
1988 FILESYSTEM__ASSOCIATE, &ad);
1989}
1990
Eric Paris828dfe12008-04-17 13:17:49 -04001991#define MAY_LINK 0
1992#define MAY_UNLINK 1
1993#define MAY_RMDIR 2
Linus Torvalds1da177e2005-04-16 15:20:36 -07001994
1995/* Check whether a task can link, unlink, or rmdir a file/directory. */
1996static int may_link(struct inode *dir,
1997 struct dentry *dentry,
1998 int kind)
1999
2000{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002001 struct inode_security_struct *dsec, *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04002002 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11002003 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002004 u32 av;
2005 int rc;
2006
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002007 dsec = inode_security(dir);
2008 isec = backing_inode_security(dentry);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002009
Eric Paris50c205f2012-04-04 15:01:43 -04002010 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04002011 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002012
2013 av = DIR__SEARCH;
2014 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002015 rc = avc_has_perm(&selinux_state,
2016 sid, dsec->sid, SECCLASS_DIR, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002017 if (rc)
2018 return rc;
2019
2020 switch (kind) {
2021 case MAY_LINK:
2022 av = FILE__LINK;
2023 break;
2024 case MAY_UNLINK:
2025 av = FILE__UNLINK;
2026 break;
2027 case MAY_RMDIR:
2028 av = DIR__RMDIR;
2029 break;
2030 default:
Eric Paris744ba352008-04-17 11:52:44 -04002031 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
2032 __func__, kind);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002033 return 0;
2034 }
2035
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002036 rc = avc_has_perm(&selinux_state,
2037 sid, isec->sid, isec->sclass, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002038 return rc;
2039}
2040
2041static inline int may_rename(struct inode *old_dir,
2042 struct dentry *old_dentry,
2043 struct inode *new_dir,
2044 struct dentry *new_dentry)
2045{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002046 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04002047 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11002048 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002049 u32 av;
2050 int old_is_dir, new_is_dir;
2051 int rc;
2052
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002053 old_dsec = inode_security(old_dir);
2054 old_isec = backing_inode_security(old_dentry);
David Howellse36cb0b2015-01-29 12:02:35 +00002055 old_is_dir = d_is_dir(old_dentry);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002056 new_dsec = inode_security(new_dir);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002057
Eric Paris50c205f2012-04-04 15:01:43 -04002058 ad.type = LSM_AUDIT_DATA_DENTRY;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002059
Eric Parisa2694342011-04-25 13:10:27 -04002060 ad.u.dentry = old_dentry;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002061 rc = avc_has_perm(&selinux_state,
2062 sid, old_dsec->sid, SECCLASS_DIR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002063 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
2064 if (rc)
2065 return rc;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002066 rc = avc_has_perm(&selinux_state,
2067 sid, old_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002068 old_isec->sclass, FILE__RENAME, &ad);
2069 if (rc)
2070 return rc;
2071 if (old_is_dir && new_dir != old_dir) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002072 rc = avc_has_perm(&selinux_state,
2073 sid, old_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002074 old_isec->sclass, DIR__REPARENT, &ad);
2075 if (rc)
2076 return rc;
2077 }
2078
Eric Parisa2694342011-04-25 13:10:27 -04002079 ad.u.dentry = new_dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002080 av = DIR__ADD_NAME | DIR__SEARCH;
David Howells2c616d42015-01-29 12:02:33 +00002081 if (d_is_positive(new_dentry))
Linus Torvalds1da177e2005-04-16 15:20:36 -07002082 av |= DIR__REMOVE_NAME;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002083 rc = avc_has_perm(&selinux_state,
2084 sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002085 if (rc)
2086 return rc;
David Howells2c616d42015-01-29 12:02:33 +00002087 if (d_is_positive(new_dentry)) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002088 new_isec = backing_inode_security(new_dentry);
David Howellse36cb0b2015-01-29 12:02:35 +00002089 new_is_dir = d_is_dir(new_dentry);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002090 rc = avc_has_perm(&selinux_state,
2091 sid, new_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002092 new_isec->sclass,
2093 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
2094 if (rc)
2095 return rc;
2096 }
2097
2098 return 0;
2099}
2100
2101/* Check whether a task can perform a filesystem operation. */
David Howells88e67f32008-11-14 10:39:21 +11002102static int superblock_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002103 struct super_block *sb,
2104 u32 perms,
Thomas Liu2bf49692009-07-14 12:14:09 -04002105 struct common_audit_data *ad)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002106{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002107 struct superblock_security_struct *sbsec;
David Howells88e67f32008-11-14 10:39:21 +11002108 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002109
Linus Torvalds1da177e2005-04-16 15:20:36 -07002110 sbsec = sb->s_security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002111 return avc_has_perm(&selinux_state,
2112 sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002113}
2114
2115/* Convert a Linux mode and permission mask to an access vector. */
2116static inline u32 file_mask_to_av(int mode, int mask)
2117{
2118 u32 av = 0;
2119
Al Virodba19c62011-07-25 20:49:29 -04002120 if (!S_ISDIR(mode)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002121 if (mask & MAY_EXEC)
2122 av |= FILE__EXECUTE;
2123 if (mask & MAY_READ)
2124 av |= FILE__READ;
2125
2126 if (mask & MAY_APPEND)
2127 av |= FILE__APPEND;
2128 else if (mask & MAY_WRITE)
2129 av |= FILE__WRITE;
2130
2131 } else {
2132 if (mask & MAY_EXEC)
2133 av |= DIR__SEARCH;
2134 if (mask & MAY_WRITE)
2135 av |= DIR__WRITE;
2136 if (mask & MAY_READ)
2137 av |= DIR__READ;
2138 }
2139
2140 return av;
2141}
2142
2143/* Convert a Linux file to an access vector. */
2144static inline u32 file_to_av(struct file *file)
2145{
2146 u32 av = 0;
2147
2148 if (file->f_mode & FMODE_READ)
2149 av |= FILE__READ;
2150 if (file->f_mode & FMODE_WRITE) {
2151 if (file->f_flags & O_APPEND)
2152 av |= FILE__APPEND;
2153 else
2154 av |= FILE__WRITE;
2155 }
Stephen Smalley0794c662008-03-17 08:55:18 -04002156 if (!av) {
2157 /*
2158 * Special file opened with flags 3 for ioctl-only use.
2159 */
2160 av = FILE__IOCTL;
2161 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002162
2163 return av;
2164}
2165
Eric Paris8b6a5a32008-10-29 17:06:46 -04002166/*
2167 * Convert a file to an access vector and include the correct open
2168 * open permission.
2169 */
2170static inline u32 open_file_to_av(struct file *file)
2171{
2172 u32 av = file_to_av(file);
Stephen Smalleyccb54472017-05-12 12:41:24 -04002173 struct inode *inode = file_inode(file);
Eric Paris8b6a5a32008-10-29 17:06:46 -04002174
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002175 if (selinux_policycap_openperm() &&
2176 inode->i_sb->s_magic != SOCKFS_MAGIC)
Eric Paris49b7b8d2010-07-23 11:44:09 -04002177 av |= FILE__OPEN;
2178
Eric Paris8b6a5a32008-10-29 17:06:46 -04002179 return av;
2180}
2181
Linus Torvalds1da177e2005-04-16 15:20:36 -07002182/* Hook functions begin here. */
2183
Stephen Smalley79af7302015-01-21 10:54:10 -05002184static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2185{
2186 u32 mysid = current_sid();
2187 u32 mgrsid = task_sid(mgr);
2188
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002189 return avc_has_perm(&selinux_state,
2190 mysid, mgrsid, SECCLASS_BINDER,
Stephen Smalley79af7302015-01-21 10:54:10 -05002191 BINDER__SET_CONTEXT_MGR, NULL);
2192}
2193
2194static int selinux_binder_transaction(struct task_struct *from,
2195 struct task_struct *to)
2196{
2197 u32 mysid = current_sid();
2198 u32 fromsid = task_sid(from);
2199 u32 tosid = task_sid(to);
2200 int rc;
2201
2202 if (mysid != fromsid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002203 rc = avc_has_perm(&selinux_state,
2204 mysid, fromsid, SECCLASS_BINDER,
Stephen Smalley79af7302015-01-21 10:54:10 -05002205 BINDER__IMPERSONATE, NULL);
2206 if (rc)
2207 return rc;
2208 }
2209
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002210 return avc_has_perm(&selinux_state,
2211 fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
Stephen Smalley79af7302015-01-21 10:54:10 -05002212 NULL);
2213}
2214
2215static int selinux_binder_transfer_binder(struct task_struct *from,
2216 struct task_struct *to)
2217{
2218 u32 fromsid = task_sid(from);
2219 u32 tosid = task_sid(to);
2220
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002221 return avc_has_perm(&selinux_state,
2222 fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
Stephen Smalley79af7302015-01-21 10:54:10 -05002223 NULL);
2224}
2225
2226static int selinux_binder_transfer_file(struct task_struct *from,
2227 struct task_struct *to,
2228 struct file *file)
2229{
2230 u32 sid = task_sid(to);
2231 struct file_security_struct *fsec = file->f_security;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002232 struct dentry *dentry = file->f_path.dentry;
Paul Moore20cdef82016-04-04 14:14:42 -04002233 struct inode_security_struct *isec;
Stephen Smalley79af7302015-01-21 10:54:10 -05002234 struct common_audit_data ad;
2235 int rc;
2236
2237 ad.type = LSM_AUDIT_DATA_PATH;
2238 ad.u.path = file->f_path;
2239
2240 if (sid != fsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002241 rc = avc_has_perm(&selinux_state,
2242 sid, fsec->sid,
Stephen Smalley79af7302015-01-21 10:54:10 -05002243 SECCLASS_FD,
2244 FD__USE,
2245 &ad);
2246 if (rc)
2247 return rc;
2248 }
2249
Chenbo Fengf66e4482017-10-18 13:00:26 -07002250#ifdef CONFIG_BPF_SYSCALL
2251 rc = bpf_fd_pass(file, sid);
2252 if (rc)
2253 return rc;
2254#endif
2255
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002256 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
Stephen Smalley79af7302015-01-21 10:54:10 -05002257 return 0;
2258
Paul Moore20cdef82016-04-04 14:14:42 -04002259 isec = backing_inode_security(dentry);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002260 return avc_has_perm(&selinux_state,
2261 sid, isec->sid, isec->sclass, file_to_av(file),
Stephen Smalley79af7302015-01-21 10:54:10 -05002262 &ad);
2263}
2264
Ingo Molnar9e488582009-05-07 19:26:19 +10002265static int selinux_ptrace_access_check(struct task_struct *child,
David Howells5cd9c582008-08-14 11:37:28 +01002266 unsigned int mode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002267{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002268 u32 sid = current_sid();
2269 u32 csid = task_sid(child);
Stephen Smalley006ebb42008-05-19 08:32:49 -04002270
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002271 if (mode & PTRACE_MODE_READ)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002272 return avc_has_perm(&selinux_state,
2273 sid, csid, SECCLASS_FILE, FILE__READ, NULL);
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002274
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002275 return avc_has_perm(&selinux_state,
2276 sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
David Howells5cd9c582008-08-14 11:37:28 +01002277}
2278
2279static int selinux_ptrace_traceme(struct task_struct *parent)
2280{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002281 return avc_has_perm(&selinux_state,
2282 task_sid(parent), current_sid(), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002283 PROCESS__PTRACE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002284}
2285
2286static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
Eric Paris828dfe12008-04-17 13:17:49 -04002287 kernel_cap_t *inheritable, kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002288{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002289 return avc_has_perm(&selinux_state,
2290 current_sid(), task_sid(target), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002291 PROCESS__GETCAP, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002292}
2293
David Howellsd84f4f92008-11-14 10:39:23 +11002294static int selinux_capset(struct cred *new, const struct cred *old,
2295 const kernel_cap_t *effective,
2296 const kernel_cap_t *inheritable,
2297 const kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002298{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002299 return avc_has_perm(&selinux_state,
2300 cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002301 PROCESS__SETCAP, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002302}
2303
James Morris5626d3e2009-01-30 10:05:06 +11002304/*
2305 * (This comment used to live with the selinux_task_setuid hook,
2306 * which was removed).
2307 *
2308 * Since setuid only affects the current process, and since the SELinux
2309 * controls are not based on the Linux identity attributes, SELinux does not
2310 * need to control this operation. However, SELinux does control the use of
2311 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2312 */
2313
Eric Paris6a9de492012-01-03 12:25:14 -05002314static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2315 int cap, int audit)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002316{
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04002317 return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002318}
2319
Linus Torvalds1da177e2005-04-16 15:20:36 -07002320static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2321{
David Howells88e67f32008-11-14 10:39:21 +11002322 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002323 int rc = 0;
2324
2325 if (!sb)
2326 return 0;
2327
2328 switch (cmds) {
Eric Paris828dfe12008-04-17 13:17:49 -04002329 case Q_SYNC:
2330 case Q_QUOTAON:
2331 case Q_QUOTAOFF:
2332 case Q_SETINFO:
2333 case Q_SETQUOTA:
David Howells88e67f32008-11-14 10:39:21 +11002334 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04002335 break;
2336 case Q_GETFMT:
2337 case Q_GETINFO:
2338 case Q_GETQUOTA:
David Howells88e67f32008-11-14 10:39:21 +11002339 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04002340 break;
2341 default:
2342 rc = 0; /* let the kernel handle invalid cmds */
2343 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002344 }
2345 return rc;
2346}
2347
2348static int selinux_quota_on(struct dentry *dentry)
2349{
David Howells88e67f32008-11-14 10:39:21 +11002350 const struct cred *cred = current_cred();
2351
Eric Paris2875fa02011-04-28 16:04:24 -04002352 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002353}
2354
Eric Paris12b30522010-11-15 18:36:29 -05002355static int selinux_syslog(int type)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002356{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002357 switch (type) {
Kees Cookd78ca3c2010-02-03 15:37:13 -08002358 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2359 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002360 return avc_has_perm(&selinux_state,
2361 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002362 SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
Kees Cookd78ca3c2010-02-03 15:37:13 -08002363 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2364 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2365 /* Set level of messages printed to console */
2366 case SYSLOG_ACTION_CONSOLE_LEVEL:
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002367 return avc_has_perm(&selinux_state,
2368 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002369 SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2370 NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002371 }
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002372 /* All other syslog types */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002373 return avc_has_perm(&selinux_state,
2374 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002375 SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002376}
2377
2378/*
2379 * Check that a process has enough memory to allocate a new virtual
2380 * mapping. 0 means there is enough memory for the allocation to
2381 * succeed and -ENOMEM implies there is not.
2382 *
Linus Torvalds1da177e2005-04-16 15:20:36 -07002383 * Do not audit the selinux permission check, as this is applied to all
2384 * processes that allocate mappings.
2385 */
Alan Cox34b4e4a2007-08-22 14:01:28 -07002386static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002387{
2388 int rc, cap_sys_admin = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002389
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07002390 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04002391 SECURITY_CAP_NOAUDIT, true);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002392 if (rc == 0)
2393 cap_sys_admin = 1;
2394
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07002395 return cap_sys_admin;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002396}
2397
2398/* binprm security operations */
2399
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002400static u32 ptrace_parent_sid(void)
Paul Moore0c6181c2016-03-30 21:41:21 -04002401{
2402 u32 sid = 0;
2403 struct task_struct *tracer;
2404
2405 rcu_read_lock();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002406 tracer = ptrace_parent(current);
Paul Moore0c6181c2016-03-30 21:41:21 -04002407 if (tracer)
2408 sid = task_sid(tracer);
2409 rcu_read_unlock();
2410
2411 return sid;
2412}
2413
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002414static int check_nnp_nosuid(const struct linux_binprm *bprm,
2415 const struct task_security_struct *old_tsec,
2416 const struct task_security_struct *new_tsec)
2417{
2418 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
Andy Lutomirski380cf5b2016-06-23 16:41:05 -05002419 int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002420 int rc;
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002421 u32 av;
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002422
2423 if (!nnp && !nosuid)
2424 return 0; /* neither NNP nor nosuid */
2425
2426 if (new_tsec->sid == old_tsec->sid)
2427 return 0; /* No change in credentials */
2428
2429 /*
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002430 * If the policy enables the nnp_nosuid_transition policy capability,
2431 * then we permit transitions under NNP or nosuid if the
2432 * policy allows the corresponding permission between
2433 * the old and new contexts.
2434 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002435 if (selinux_policycap_nnp_nosuid_transition()) {
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002436 av = 0;
2437 if (nnp)
2438 av |= PROCESS2__NNP_TRANSITION;
2439 if (nosuid)
2440 av |= PROCESS2__NOSUID_TRANSITION;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002441 rc = avc_has_perm(&selinux_state,
2442 old_tsec->sid, new_tsec->sid,
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002443 SECCLASS_PROCESS2, av, NULL);
2444 if (!rc)
2445 return 0;
2446 }
2447
2448 /*
2449 * We also permit NNP or nosuid transitions to bounded SIDs,
2450 * i.e. SIDs that are guaranteed to only be allowed a subset
2451 * of the permissions of the current SID.
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002452 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002453 rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2454 new_tsec->sid);
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002455 if (!rc)
2456 return 0;
2457
2458 /*
2459 * On failure, preserve the errno values for NNP vs nosuid.
2460 * NNP: Operation not permitted for caller.
2461 * nosuid: Permission denied to file.
2462 */
2463 if (nnp)
2464 return -EPERM;
2465 return -EACCES;
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002466}
2467
David Howellsa6f76f22008-11-14 10:39:24 +11002468static int selinux_bprm_set_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002469{
David Howellsa6f76f22008-11-14 10:39:24 +11002470 const struct task_security_struct *old_tsec;
2471 struct task_security_struct *new_tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002472 struct inode_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04002473 struct common_audit_data ad;
Al Viro496ad9a2013-01-23 17:07:38 -05002474 struct inode *inode = file_inode(bprm->file);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002475 int rc;
2476
David Howellsa6f76f22008-11-14 10:39:24 +11002477 /* SELinux context only depends on initial program or script and not
2478 * the script interpreter */
Kees Cookddb4a142017-07-18 15:25:23 -07002479 if (bprm->called_set_creds)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002480 return 0;
2481
David Howellsa6f76f22008-11-14 10:39:24 +11002482 old_tsec = current_security();
2483 new_tsec = bprm->cred->security;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002484 isec = inode_security(inode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002485
2486 /* Default to the current task SID. */
David Howellsa6f76f22008-11-14 10:39:24 +11002487 new_tsec->sid = old_tsec->sid;
2488 new_tsec->osid = old_tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002489
Michael LeMay28eba5b2006-06-27 02:53:42 -07002490 /* Reset fs, key, and sock SIDs on execve. */
David Howellsa6f76f22008-11-14 10:39:24 +11002491 new_tsec->create_sid = 0;
2492 new_tsec->keycreate_sid = 0;
2493 new_tsec->sockcreate_sid = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002494
David Howellsa6f76f22008-11-14 10:39:24 +11002495 if (old_tsec->exec_sid) {
2496 new_tsec->sid = old_tsec->exec_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002497 /* Reset exec SID on execve. */
David Howellsa6f76f22008-11-14 10:39:24 +11002498 new_tsec->exec_sid = 0;
Andy Lutomirski259e5e62012-04-12 16:47:50 -05002499
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002500 /* Fail on NNP or nosuid if not an allowed transition. */
2501 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2502 if (rc)
2503 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002504 } else {
2505 /* Check for a default transition on this program. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002506 rc = security_transition_sid(&selinux_state, old_tsec->sid,
2507 isec->sid, SECCLASS_PROCESS, NULL,
Eric Paris652bb9b2011-02-01 11:05:40 -05002508 &new_tsec->sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002509 if (rc)
2510 return rc;
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002511
2512 /*
2513 * Fallback to old SID on NNP or nosuid if not an allowed
2514 * transition.
2515 */
2516 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2517 if (rc)
2518 new_tsec->sid = old_tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002519 }
2520
Vivek Goyal43af5de2016-09-09 11:37:49 -04002521 ad.type = LSM_AUDIT_DATA_FILE;
2522 ad.u.file = bprm->file;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002523
David Howellsa6f76f22008-11-14 10:39:24 +11002524 if (new_tsec->sid == old_tsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002525 rc = avc_has_perm(&selinux_state,
2526 old_tsec->sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002527 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2528 if (rc)
2529 return rc;
2530 } else {
2531 /* Check permissions for the transition. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002532 rc = avc_has_perm(&selinux_state,
2533 old_tsec->sid, new_tsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002534 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2535 if (rc)
2536 return rc;
2537
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002538 rc = avc_has_perm(&selinux_state,
2539 new_tsec->sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002540 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2541 if (rc)
2542 return rc;
2543
David Howellsa6f76f22008-11-14 10:39:24 +11002544 /* Check for shared state */
2545 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002546 rc = avc_has_perm(&selinux_state,
2547 old_tsec->sid, new_tsec->sid,
David Howellsa6f76f22008-11-14 10:39:24 +11002548 SECCLASS_PROCESS, PROCESS__SHARE,
2549 NULL);
2550 if (rc)
2551 return -EPERM;
2552 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002553
David Howellsa6f76f22008-11-14 10:39:24 +11002554 /* Make sure that anyone attempting to ptrace over a task that
2555 * changes its SID has the appropriate permit */
Eric W. Biederman9227dd22017-01-23 17:26:31 +13002556 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002557 u32 ptsid = ptrace_parent_sid();
David Howellsa6f76f22008-11-14 10:39:24 +11002558 if (ptsid != 0) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002559 rc = avc_has_perm(&selinux_state,
2560 ptsid, new_tsec->sid,
David Howellsa6f76f22008-11-14 10:39:24 +11002561 SECCLASS_PROCESS,
2562 PROCESS__PTRACE, NULL);
2563 if (rc)
2564 return -EPERM;
2565 }
2566 }
2567
2568 /* Clear any possibly unsafe personality bits on exec: */
2569 bprm->per_clear |= PER_CLEAR_ON_SETID;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002570
Linus Torvalds1da177e2005-04-16 15:20:36 -07002571 /* Enable secure mode for SIDs transitions unless
2572 the noatsecure permission is granted between
2573 the two SIDs, i.e. ahp returns 0. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002574 rc = avc_has_perm(&selinux_state,
2575 old_tsec->sid, new_tsec->sid,
Kees Cook62874c32017-07-18 15:25:25 -07002576 SECCLASS_PROCESS, PROCESS__NOATSECURE,
2577 NULL);
2578 bprm->secureexec |= !!rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002579 }
2580
Kees Cook62874c32017-07-18 15:25:25 -07002581 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002582}
2583
Al Viroc3c073f2012-08-21 22:32:06 -04002584static int match_file(const void *p, struct file *file, unsigned fd)
2585{
2586 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2587}
2588
Linus Torvalds1da177e2005-04-16 15:20:36 -07002589/* Derived from fs/exec.c:flush_old_files. */
David Howells745ca242008-11-14 10:39:22 +11002590static inline void flush_unauthorized_files(const struct cred *cred,
2591 struct files_struct *files)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002592{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002593 struct file *file, *devnull = NULL;
Stephen Smalleyb20c8122006-09-25 23:32:03 -07002594 struct tty_struct *tty;
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002595 int drop_tty = 0;
Al Viroc3c073f2012-08-21 22:32:06 -04002596 unsigned n;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002597
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002598 tty = get_current_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002599 if (tty) {
Peter Hurley4a510962016-01-09 21:35:23 -08002600 spin_lock(&tty->files_lock);
Eric Paris37dd0bd2008-10-31 17:40:00 -04002601 if (!list_empty(&tty->tty_files)) {
Nick Piggind996b622010-08-18 04:37:36 +10002602 struct tty_file_private *file_priv;
Eric Paris37dd0bd2008-10-31 17:40:00 -04002603
Linus Torvalds1da177e2005-04-16 15:20:36 -07002604 /* Revalidate access to controlling tty.
David Howells13f8e982013-06-13 23:37:55 +01002605 Use file_path_has_perm on the tty path directly
2606 rather than using file_has_perm, as this particular
2607 open file may belong to another process and we are
2608 only interested in the inode-based check here. */
Nick Piggind996b622010-08-18 04:37:36 +10002609 file_priv = list_first_entry(&tty->tty_files,
2610 struct tty_file_private, list);
2611 file = file_priv->file;
David Howells13f8e982013-06-13 23:37:55 +01002612 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002613 drop_tty = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002614 }
Peter Hurley4a510962016-01-09 21:35:23 -08002615 spin_unlock(&tty->files_lock);
Alan Cox452a00d2008-10-13 10:39:13 +01002616 tty_kref_put(tty);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002617 }
Eric W. Biederman98a27ba2007-05-08 00:26:56 -07002618 /* Reset controlling tty. */
2619 if (drop_tty)
2620 no_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002621
2622 /* Revalidate access to inherited open files. */
Al Viroc3c073f2012-08-21 22:32:06 -04002623 n = iterate_fd(files, 0, match_file, cred);
2624 if (!n) /* none found? */
2625 return;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002626
Al Viroc3c073f2012-08-21 22:32:06 -04002627 devnull = dentry_open(&selinux_null, O_RDWR, cred);
Al Viro45525b22012-10-16 13:30:07 -04002628 if (IS_ERR(devnull))
2629 devnull = NULL;
2630 /* replace all the matching ones with this */
2631 do {
2632 replace_fd(n - 1, devnull, 0);
2633 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2634 if (devnull)
Al Viroc3c073f2012-08-21 22:32:06 -04002635 fput(devnull);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002636}
2637
Linus Torvalds1da177e2005-04-16 15:20:36 -07002638/*
David Howellsa6f76f22008-11-14 10:39:24 +11002639 * Prepare a process for imminent new credential changes due to exec
Linus Torvalds1da177e2005-04-16 15:20:36 -07002640 */
David Howellsa6f76f22008-11-14 10:39:24 +11002641static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002642{
David Howellsa6f76f22008-11-14 10:39:24 +11002643 struct task_security_struct *new_tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002644 struct rlimit *rlim, *initrlim;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002645 int rc, i;
2646
David Howellsa6f76f22008-11-14 10:39:24 +11002647 new_tsec = bprm->cred->security;
2648 if (new_tsec->sid == new_tsec->osid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002649 return;
2650
2651 /* Close files for which the new task SID is not authorized. */
David Howellsa6f76f22008-11-14 10:39:24 +11002652 flush_unauthorized_files(bprm->cred, current->files);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002653
David Howellsa6f76f22008-11-14 10:39:24 +11002654 /* Always clear parent death signal on SID transitions. */
2655 current->pdeath_signal = 0;
2656
2657 /* Check whether the new SID can inherit resource limits from the old
2658 * SID. If not, reset all soft limits to the lower of the current
2659 * task's hard limit and the init task's soft limit.
2660 *
2661 * Note that the setting of hard limits (even to lower them) can be
2662 * controlled by the setrlimit check. The inclusion of the init task's
2663 * soft limit into the computation is to avoid resetting soft limits
2664 * higher than the default soft limit for cases where the default is
2665 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2666 */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002667 rc = avc_has_perm(&selinux_state,
2668 new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
David Howellsa6f76f22008-11-14 10:39:24 +11002669 PROCESS__RLIMITINH, NULL);
2670 if (rc) {
Oleg Nesteroveb2d55a2010-06-23 22:43:32 +02002671 /* protect against do_prlimit() */
2672 task_lock(current);
David Howellsa6f76f22008-11-14 10:39:24 +11002673 for (i = 0; i < RLIM_NLIMITS; i++) {
2674 rlim = current->signal->rlim + i;
2675 initrlim = init_task.signal->rlim + i;
2676 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2677 }
Oleg Nesteroveb2d55a2010-06-23 22:43:32 +02002678 task_unlock(current);
Nicolas Pitrebaa73d92016-11-11 00:10:10 -05002679 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2680 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
David Howellsa6f76f22008-11-14 10:39:24 +11002681 }
2682}
2683
2684/*
2685 * Clean up the process immediately after the installation of new credentials
2686 * due to exec
2687 */
2688static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2689{
2690 const struct task_security_struct *tsec = current_security();
2691 struct itimerval itimer;
David Howellsa6f76f22008-11-14 10:39:24 +11002692 u32 osid, sid;
2693 int rc, i;
David Howellsa6f76f22008-11-14 10:39:24 +11002694
David Howellsa6f76f22008-11-14 10:39:24 +11002695 osid = tsec->osid;
2696 sid = tsec->sid;
2697
2698 if (sid == osid)
2699 return;
2700
2701 /* Check whether the new SID can inherit signal state from the old SID.
2702 * If not, clear itimers to avoid subsequent signal generation and
2703 * flush and unblock signals.
2704 *
2705 * This must occur _after_ the task SID has been updated so that any
2706 * kill done after the flush will be checked against the new SID.
2707 */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002708 rc = avc_has_perm(&selinux_state,
2709 osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002710 if (rc) {
Nicolas Pitrebaa73d92016-11-11 00:10:10 -05002711 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) {
2712 memset(&itimer, 0, sizeof itimer);
2713 for (i = 0; i < 3; i++)
2714 do_setitimer(i, &itimer, NULL);
2715 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002716 spin_lock_irq(&current->sighand->siglock);
Oleg Nesterov9e7c8f82015-06-04 16:22:16 -04002717 if (!fatal_signal_pending(current)) {
2718 flush_sigqueue(&current->pending);
2719 flush_sigqueue(&current->signal->shared_pending);
David Howells3bcac022009-04-29 13:45:05 +01002720 flush_signal_handlers(current, 1);
2721 sigemptyset(&current->blocked);
Oleg Nesterov9e7c8f82015-06-04 16:22:16 -04002722 recalc_sigpending();
David Howells3bcac022009-04-29 13:45:05 +01002723 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002724 spin_unlock_irq(&current->sighand->siglock);
2725 }
2726
David Howellsa6f76f22008-11-14 10:39:24 +11002727 /* Wake up the parent if it is waiting so that it can recheck
2728 * wait permission to the new task SID. */
Oleg Nesterovecd6de32009-04-29 16:02:24 +02002729 read_lock(&tasklist_lock);
Oleg Nesterov0b7570e2009-09-23 15:56:46 -07002730 __wake_up_parent(current, current->real_parent);
Oleg Nesterovecd6de32009-04-29 16:02:24 +02002731 read_unlock(&tasklist_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002732}
2733
2734/* superblock security operations */
2735
2736static int selinux_sb_alloc_security(struct super_block *sb)
2737{
2738 return superblock_alloc_security(sb);
2739}
2740
2741static void selinux_sb_free_security(struct super_block *sb)
2742{
2743 superblock_free_security(sb);
2744}
2745
2746static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2747{
2748 if (plen > olen)
2749 return 0;
2750
2751 return !memcmp(prefix, option, plen);
2752}
2753
2754static inline int selinux_option(char *option, int len)
2755{
Eric Paris832cbd92008-04-01 13:24:09 -04002756 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2757 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2758 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
David P. Quigley11689d42009-01-16 09:22:03 -05002759 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2760 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
Linus Torvalds1da177e2005-04-16 15:20:36 -07002761}
2762
2763static inline void take_option(char **to, char *from, int *first, int len)
2764{
2765 if (!*first) {
2766 **to = ',';
2767 *to += 1;
Cory Olmo3528a952006-09-29 01:58:44 -07002768 } else
Linus Torvalds1da177e2005-04-16 15:20:36 -07002769 *first = 0;
2770 memcpy(*to, from, len);
2771 *to += len;
2772}
2773
Eric Paris828dfe12008-04-17 13:17:49 -04002774static inline void take_selinux_option(char **to, char *from, int *first,
2775 int len)
Cory Olmo3528a952006-09-29 01:58:44 -07002776{
2777 int current_size = 0;
2778
2779 if (!*first) {
2780 **to = '|';
2781 *to += 1;
Eric Paris828dfe12008-04-17 13:17:49 -04002782 } else
Cory Olmo3528a952006-09-29 01:58:44 -07002783 *first = 0;
2784
2785 while (current_size < len) {
2786 if (*from != '"') {
2787 **to = *from;
2788 *to += 1;
2789 }
2790 from += 1;
2791 current_size += 1;
2792 }
2793}
2794
Eric Parise0007522008-03-05 10:31:54 -05002795static int selinux_sb_copy_data(char *orig, char *copy)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002796{
2797 int fnosec, fsec, rc = 0;
2798 char *in_save, *in_curr, *in_end;
2799 char *sec_curr, *nosec_save, *nosec;
Cory Olmo3528a952006-09-29 01:58:44 -07002800 int open_quote = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002801
2802 in_curr = orig;
2803 sec_curr = copy;
2804
Linus Torvalds1da177e2005-04-16 15:20:36 -07002805 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2806 if (!nosec) {
2807 rc = -ENOMEM;
2808 goto out;
2809 }
2810
2811 nosec_save = nosec;
2812 fnosec = fsec = 1;
2813 in_save = in_end = orig;
2814
2815 do {
Cory Olmo3528a952006-09-29 01:58:44 -07002816 if (*in_end == '"')
2817 open_quote = !open_quote;
2818 if ((*in_end == ',' && open_quote == 0) ||
2819 *in_end == '\0') {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002820 int len = in_end - in_curr;
2821
2822 if (selinux_option(in_curr, len))
Cory Olmo3528a952006-09-29 01:58:44 -07002823 take_selinux_option(&sec_curr, in_curr, &fsec, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002824 else
2825 take_option(&nosec, in_curr, &fnosec, len);
2826
2827 in_curr = in_end + 1;
2828 }
2829 } while (*in_end++);
2830
Eric Paris6931dfc2005-06-30 02:58:51 -07002831 strcpy(in_save, nosec_save);
Gerald Schaeferda3caa22005-06-21 17:15:18 -07002832 free_page((unsigned long)nosec_save);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002833out:
2834 return rc;
2835}
2836
Eric Paris026eb162011-03-03 16:09:14 -05002837static int selinux_sb_remount(struct super_block *sb, void *data)
2838{
2839 int rc, i, *flags;
2840 struct security_mnt_opts opts;
2841 char *secdata, **mount_options;
2842 struct superblock_security_struct *sbsec = sb->s_security;
2843
2844 if (!(sbsec->flags & SE_SBINITIALIZED))
2845 return 0;
2846
2847 if (!data)
2848 return 0;
2849
2850 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2851 return 0;
2852
2853 security_init_mnt_opts(&opts);
2854 secdata = alloc_secdata();
2855 if (!secdata)
2856 return -ENOMEM;
2857 rc = selinux_sb_copy_data(data, secdata);
2858 if (rc)
2859 goto out_free_secdata;
2860
2861 rc = selinux_parse_opts_str(secdata, &opts);
2862 if (rc)
2863 goto out_free_secdata;
2864
2865 mount_options = opts.mnt_opts;
2866 flags = opts.mnt_opts_flags;
2867
2868 for (i = 0; i < opts.num_mnt_opts; i++) {
2869 u32 sid;
Eric Paris026eb162011-03-03 16:09:14 -05002870
Eric Paris12f348b2012-10-09 10:56:25 -04002871 if (flags[i] == SBLABEL_MNT)
Eric Paris026eb162011-03-03 16:09:14 -05002872 continue;
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002873 rc = security_context_str_to_sid(&selinux_state,
2874 mount_options[i], &sid,
2875 GFP_KERNEL);
Eric Paris026eb162011-03-03 16:09:14 -05002876 if (rc) {
Rasmus Villemoes44be2f62015-10-21 17:44:25 -04002877 printk(KERN_WARNING "SELinux: security_context_str_to_sid"
Linus Torvalds29b1deb2013-12-15 11:17:45 -08002878 "(%s) failed for (dev %s, type %s) errno=%d\n",
2879 mount_options[i], sb->s_id, sb->s_type->name, rc);
Eric Paris026eb162011-03-03 16:09:14 -05002880 goto out_free_opts;
2881 }
2882 rc = -EINVAL;
2883 switch (flags[i]) {
2884 case FSCONTEXT_MNT:
2885 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2886 goto out_bad_option;
2887 break;
2888 case CONTEXT_MNT:
2889 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2890 goto out_bad_option;
2891 break;
2892 case ROOTCONTEXT_MNT: {
2893 struct inode_security_struct *root_isec;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002894 root_isec = backing_inode_security(sb->s_root);
Eric Paris026eb162011-03-03 16:09:14 -05002895
2896 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2897 goto out_bad_option;
2898 break;
2899 }
2900 case DEFCONTEXT_MNT:
2901 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2902 goto out_bad_option;
2903 break;
2904 default:
2905 goto out_free_opts;
2906 }
2907 }
2908
2909 rc = 0;
2910out_free_opts:
2911 security_free_mnt_opts(&opts);
2912out_free_secdata:
2913 free_secdata(secdata);
2914 return rc;
2915out_bad_option:
2916 printk(KERN_WARNING "SELinux: unable to change security options "
Linus Torvalds29b1deb2013-12-15 11:17:45 -08002917 "during remount (dev %s, type=%s)\n", sb->s_id,
2918 sb->s_type->name);
Eric Paris026eb162011-03-03 16:09:14 -05002919 goto out_free_opts;
2920}
2921
James Morris12204e22008-12-19 10:44:42 +11002922static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002923{
David Howells88e67f32008-11-14 10:39:21 +11002924 const struct cred *cred = current_cred();
Thomas Liu2bf49692009-07-14 12:14:09 -04002925 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002926 int rc;
2927
2928 rc = superblock_doinit(sb, data);
2929 if (rc)
2930 return rc;
2931
James Morris74192242008-12-19 11:41:10 +11002932 /* Allow all mounts performed by the kernel */
2933 if (flags & MS_KERNMOUNT)
2934 return 0;
2935
Eric Paris50c205f2012-04-04 15:01:43 -04002936 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04002937 ad.u.dentry = sb->s_root;
David Howells88e67f32008-11-14 10:39:21 +11002938 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002939}
2940
David Howells726c3342006-06-23 02:02:58 -07002941static int selinux_sb_statfs(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002942{
David Howells88e67f32008-11-14 10:39:21 +11002943 const struct cred *cred = current_cred();
Thomas Liu2bf49692009-07-14 12:14:09 -04002944 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002945
Eric Paris50c205f2012-04-04 15:01:43 -04002946 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04002947 ad.u.dentry = dentry->d_sb->s_root;
David Howells88e67f32008-11-14 10:39:21 +11002948 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002949}
2950
Al Viro808d4e32012-10-11 11:42:01 -04002951static int selinux_mount(const char *dev_name,
Al Viro8a04c432016-03-25 14:52:53 -04002952 const struct path *path,
Al Viro808d4e32012-10-11 11:42:01 -04002953 const char *type,
Eric Paris828dfe12008-04-17 13:17:49 -04002954 unsigned long flags,
2955 void *data)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002956{
David Howells88e67f32008-11-14 10:39:21 +11002957 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002958
2959 if (flags & MS_REMOUNT)
Al Virod8c95842011-12-07 18:16:57 -05002960 return superblock_has_perm(cred, path->dentry->d_sb,
Eric Paris828dfe12008-04-17 13:17:49 -04002961 FILESYSTEM__REMOUNT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002962 else
Eric Paris2875fa02011-04-28 16:04:24 -04002963 return path_has_perm(cred, path, FILE__MOUNTON);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002964}
2965
2966static int selinux_umount(struct vfsmount *mnt, int flags)
2967{
David Howells88e67f32008-11-14 10:39:21 +11002968 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002969
David Howells88e67f32008-11-14 10:39:21 +11002970 return superblock_has_perm(cred, mnt->mnt_sb,
Eric Paris828dfe12008-04-17 13:17:49 -04002971 FILESYSTEM__UNMOUNT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002972}
2973
2974/* inode security operations */
2975
2976static int selinux_inode_alloc_security(struct inode *inode)
2977{
2978 return inode_alloc_security(inode);
2979}
2980
2981static void selinux_inode_free_security(struct inode *inode)
2982{
2983 inode_free_security(inode);
2984}
2985
David Quigleyd47be3d2013-05-22 12:50:34 -04002986static int selinux_dentry_init_security(struct dentry *dentry, int mode,
Al Viro4f3ccd72016-07-20 16:06:15 -04002987 const struct qstr *name, void **ctx,
David Quigleyd47be3d2013-05-22 12:50:34 -04002988 u32 *ctxlen)
2989{
David Quigleyd47be3d2013-05-22 12:50:34 -04002990 u32 newsid;
2991 int rc;
2992
Vivek Goyalc957f6d2016-07-13 10:44:51 -04002993 rc = selinux_determine_inode_label(current_security(),
2994 d_inode(dentry->d_parent), name,
David Howellsc3c188b2015-07-10 17:19:58 -04002995 inode_mode_to_security_class(mode),
2996 &newsid);
2997 if (rc)
2998 return rc;
David Quigleyd47be3d2013-05-22 12:50:34 -04002999
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003000 return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
3001 ctxlen);
David Quigleyd47be3d2013-05-22 12:50:34 -04003002}
3003
Vivek Goyala518b0a2016-07-13 10:44:53 -04003004static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
3005 struct qstr *name,
3006 const struct cred *old,
3007 struct cred *new)
3008{
3009 u32 newsid;
3010 int rc;
3011 struct task_security_struct *tsec;
3012
3013 rc = selinux_determine_inode_label(old->security,
3014 d_inode(dentry->d_parent), name,
3015 inode_mode_to_security_class(mode),
3016 &newsid);
3017 if (rc)
3018 return rc;
3019
3020 tsec = new->security;
3021 tsec->create_sid = newsid;
3022 return 0;
3023}
3024
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003025static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
Tetsuo Handa95489062013-07-25 05:44:02 +09003026 const struct qstr *qstr,
3027 const char **name,
Eric Paris2a7dba32011-02-01 11:05:39 -05003028 void **value, size_t *len)
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003029{
Paul Moore5fb49872010-04-22 14:46:19 -04003030 const struct task_security_struct *tsec = current_security();
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003031 struct superblock_security_struct *sbsec;
Corentin LABBEc0d4f462017-10-04 20:32:17 +02003032 u32 newsid, clen;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003033 int rc;
Tetsuo Handa95489062013-07-25 05:44:02 +09003034 char *context;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003035
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003036 sbsec = dir->i_sb->s_security;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003037
David Howells275bb412008-11-14 10:39:19 +11003038 newsid = tsec->create_sid;
3039
Vivek Goyalc957f6d2016-07-13 10:44:51 -04003040 rc = selinux_determine_inode_label(current_security(),
David Howellsc3c188b2015-07-10 17:19:58 -04003041 dir, qstr,
3042 inode_mode_to_security_class(inode->i_mode),
3043 &newsid);
3044 if (rc)
3045 return rc;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003046
Eric Paris296fddf2006-09-25 23:32:00 -07003047 /* Possibly defer initialization to selinux_complete_init. */
David P. Quigley0d90a7e2009-01-16 09:22:02 -05003048 if (sbsec->flags & SE_SBINITIALIZED) {
Eric Paris296fddf2006-09-25 23:32:00 -07003049 struct inode_security_struct *isec = inode->i_security;
3050 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3051 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05003052 isec->initialized = LABEL_INITIALIZED;
Eric Paris296fddf2006-09-25 23:32:00 -07003053 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003054
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003055 if (!selinux_state.initialized || !(sbsec->flags & SBLABEL_MNT))
Stephen Smalley25a74f32005-11-08 21:34:33 -08003056 return -EOPNOTSUPP;
3057
Tetsuo Handa95489062013-07-25 05:44:02 +09003058 if (name)
3059 *name = XATTR_SELINUX_SUFFIX;
Stephen Smalley570bc1c2005-09-09 13:01:43 -07003060
3061 if (value && len) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003062 rc = security_sid_to_context_force(&selinux_state, newsid,
3063 &context, &clen);
Tetsuo Handa95489062013-07-25 05:44:02 +09003064 if (rc)
Stephen Smalley570bc1c2005-09-09 13:01:43 -07003065 return rc;
Stephen Smalley570bc1c2005-09-09 13:01:43 -07003066 *value = context;
3067 *len = clen;
3068 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003069
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003070 return 0;
3071}
3072
Al Viro4acdaf22011-07-26 01:42:34 -04003073static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003074{
3075 return may_create(dir, dentry, SECCLASS_FILE);
3076}
3077
Linus Torvalds1da177e2005-04-16 15:20:36 -07003078static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
3079{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003080 return may_link(dir, old_dentry, MAY_LINK);
3081}
3082
Linus Torvalds1da177e2005-04-16 15:20:36 -07003083static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
3084{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003085 return may_link(dir, dentry, MAY_UNLINK);
3086}
3087
3088static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
3089{
3090 return may_create(dir, dentry, SECCLASS_LNK_FILE);
3091}
3092
Al Viro18bb1db2011-07-26 01:41:39 -04003093static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003094{
3095 return may_create(dir, dentry, SECCLASS_DIR);
3096}
3097
Linus Torvalds1da177e2005-04-16 15:20:36 -07003098static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
3099{
3100 return may_link(dir, dentry, MAY_RMDIR);
3101}
3102
Al Viro1a67aaf2011-07-26 01:52:52 -04003103static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003104{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003105 return may_create(dir, dentry, inode_mode_to_security_class(mode));
3106}
3107
Linus Torvalds1da177e2005-04-16 15:20:36 -07003108static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
Eric Paris828dfe12008-04-17 13:17:49 -04003109 struct inode *new_inode, struct dentry *new_dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003110{
3111 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
3112}
3113
Linus Torvalds1da177e2005-04-16 15:20:36 -07003114static int selinux_inode_readlink(struct dentry *dentry)
3115{
David Howells88e67f32008-11-14 10:39:21 +11003116 const struct cred *cred = current_cred();
3117
Eric Paris2875fa02011-04-28 16:04:24 -04003118 return dentry_has_perm(cred, dentry, FILE__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003119}
3120
NeilBrownbda0be72015-03-23 13:37:39 +11003121static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
3122 bool rcu)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003123{
David Howells88e67f32008-11-14 10:39:21 +11003124 const struct cred *cred = current_cred();
NeilBrownbda0be72015-03-23 13:37:39 +11003125 struct common_audit_data ad;
3126 struct inode_security_struct *isec;
3127 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003128
NeilBrownbda0be72015-03-23 13:37:39 +11003129 validate_creds(cred);
3130
3131 ad.type = LSM_AUDIT_DATA_DENTRY;
3132 ad.u.dentry = dentry;
3133 sid = cred_sid(cred);
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05003134 isec = inode_security_rcu(inode, rcu);
3135 if (IS_ERR(isec))
3136 return PTR_ERR(isec);
NeilBrownbda0be72015-03-23 13:37:39 +11003137
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003138 return avc_has_perm_flags(&selinux_state,
3139 sid, isec->sid, isec->sclass, FILE__READ, &ad,
NeilBrownbda0be72015-03-23 13:37:39 +11003140 rcu ? MAY_NOT_BLOCK : 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003141}
3142
Eric Parisd4cf970d2012-04-04 15:01:42 -04003143static noinline int audit_inode_permission(struct inode *inode,
3144 u32 perms, u32 audited, u32 denied,
Stephen Smalley626b9742014-04-29 11:29:04 -07003145 int result,
Eric Parisd4cf970d2012-04-04 15:01:42 -04003146 unsigned flags)
3147{
3148 struct common_audit_data ad;
Eric Parisd4cf970d2012-04-04 15:01:42 -04003149 struct inode_security_struct *isec = inode->i_security;
3150 int rc;
3151
Eric Paris50c205f2012-04-04 15:01:43 -04003152 ad.type = LSM_AUDIT_DATA_INODE;
Eric Parisd4cf970d2012-04-04 15:01:42 -04003153 ad.u.inode = inode;
3154
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003155 rc = slow_avc_audit(&selinux_state,
3156 current_sid(), isec->sid, isec->sclass, perms,
Stephen Smalley626b9742014-04-29 11:29:04 -07003157 audited, denied, result, &ad, flags);
Eric Parisd4cf970d2012-04-04 15:01:42 -04003158 if (rc)
3159 return rc;
3160 return 0;
3161}
3162
Al Viroe74f71e2011-06-20 19:38:15 -04003163static int selinux_inode_permission(struct inode *inode, int mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003164{
David Howells88e67f32008-11-14 10:39:21 +11003165 const struct cred *cred = current_cred();
Eric Parisb782e0a2010-07-23 11:44:03 -04003166 u32 perms;
3167 bool from_access;
Al Virocf1dd1d2011-06-20 19:44:08 -04003168 unsigned flags = mask & MAY_NOT_BLOCK;
Eric Paris2e334052012-04-04 15:01:42 -04003169 struct inode_security_struct *isec;
3170 u32 sid;
3171 struct av_decision avd;
3172 int rc, rc2;
3173 u32 audited, denied;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003174
Eric Parisb782e0a2010-07-23 11:44:03 -04003175 from_access = mask & MAY_ACCESS;
Eric Parisd09ca732010-07-23 11:43:57 -04003176 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3177
Eric Parisb782e0a2010-07-23 11:44:03 -04003178 /* No permission to check. Existence test. */
3179 if (!mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003180 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003181
Eric Paris2e334052012-04-04 15:01:42 -04003182 validate_creds(cred);
Eric Parisb782e0a2010-07-23 11:44:03 -04003183
Eric Paris2e334052012-04-04 15:01:42 -04003184 if (unlikely(IS_PRIVATE(inode)))
3185 return 0;
Eric Parisb782e0a2010-07-23 11:44:03 -04003186
3187 perms = file_mask_to_av(inode->i_mode, mask);
3188
Eric Paris2e334052012-04-04 15:01:42 -04003189 sid = cred_sid(cred);
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05003190 isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3191 if (IS_ERR(isec))
3192 return PTR_ERR(isec);
Eric Paris2e334052012-04-04 15:01:42 -04003193
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003194 rc = avc_has_perm_noaudit(&selinux_state,
3195 sid, isec->sid, isec->sclass, perms, 0, &avd);
Eric Paris2e334052012-04-04 15:01:42 -04003196 audited = avc_audit_required(perms, &avd, rc,
3197 from_access ? FILE__AUDIT_ACCESS : 0,
3198 &denied);
3199 if (likely(!audited))
3200 return rc;
3201
Stephen Smalley626b9742014-04-29 11:29:04 -07003202 rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
Eric Paris2e334052012-04-04 15:01:42 -04003203 if (rc2)
3204 return rc2;
3205 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003206}
3207
3208static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3209{
David Howells88e67f32008-11-14 10:39:21 +11003210 const struct cred *cred = current_cred();
Stephen Smalleyccb54472017-05-12 12:41:24 -04003211 struct inode *inode = d_backing_inode(dentry);
Amerigo Wangbc6a6002009-08-20 19:29:02 -07003212 unsigned int ia_valid = iattr->ia_valid;
Eric Paris95dbf732012-04-04 13:45:34 -04003213 __u32 av = FILE__WRITE;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003214
Amerigo Wangbc6a6002009-08-20 19:29:02 -07003215 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3216 if (ia_valid & ATTR_FORCE) {
3217 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3218 ATTR_FORCE);
3219 if (!ia_valid)
3220 return 0;
3221 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003222
Amerigo Wangbc6a6002009-08-20 19:29:02 -07003223 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3224 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
Eric Paris2875fa02011-04-28 16:04:24 -04003225 return dentry_has_perm(cred, dentry, FILE__SETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003226
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003227 if (selinux_policycap_openperm() &&
Stephen Smalleyccb54472017-05-12 12:41:24 -04003228 inode->i_sb->s_magic != SOCKFS_MAGIC &&
3229 (ia_valid & ATTR_SIZE) &&
3230 !(ia_valid & ATTR_FILE))
Eric Paris95dbf732012-04-04 13:45:34 -04003231 av |= FILE__OPEN;
3232
3233 return dentry_has_perm(cred, dentry, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003234}
3235
Al Viro3f7036a2015-03-08 19:28:30 -04003236static int selinux_inode_getattr(const struct path *path)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003237{
Al Viro3f7036a2015-03-08 19:28:30 -04003238 return path_has_perm(current_cred(), path, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003239}
3240
Stephen Smalleydb590002017-04-20 11:31:30 -04003241static bool has_cap_mac_admin(bool audit)
3242{
3243 const struct cred *cred = current_cred();
3244 int cap_audit = audit ? SECURITY_CAP_AUDIT : SECURITY_CAP_NOAUDIT;
3245
3246 if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, cap_audit))
3247 return false;
3248 if (cred_has_capability(cred, CAP_MAC_ADMIN, cap_audit, true))
3249 return false;
3250 return true;
3251}
3252
David Howells8f0cfa52008-04-29 00:59:41 -07003253static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3254 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003255{
David Howellsc6f493d2015-03-17 22:26:22 +00003256 struct inode *inode = d_backing_inode(dentry);
Paul Moore20cdef82016-04-04 14:14:42 -04003257 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003258 struct superblock_security_struct *sbsec;
Thomas Liu2bf49692009-07-14 12:14:09 -04003259 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11003260 u32 newsid, sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003261 int rc = 0;
3262
Eric W. Biederman6b240302017-10-02 09:38:20 -05003263 if (strcmp(name, XATTR_NAME_SELINUX)) {
3264 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3265 if (rc)
3266 return rc;
3267
3268 /* Not an attribute we recognize, so just check the
3269 ordinary setattr permission. */
3270 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3271 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003272
3273 sbsec = inode->i_sb->s_security;
Eric Paris12f348b2012-10-09 10:56:25 -04003274 if (!(sbsec->flags & SBLABEL_MNT))
Linus Torvalds1da177e2005-04-16 15:20:36 -07003275 return -EOPNOTSUPP;
3276
Serge E. Hallyn2e149672011-03-23 16:43:26 -07003277 if (!inode_owner_or_capable(inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -07003278 return -EPERM;
3279
Eric Paris50c205f2012-04-04 15:01:43 -04003280 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04003281 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003282
Paul Moore20cdef82016-04-04 14:14:42 -04003283 isec = backing_inode_security(dentry);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003284 rc = avc_has_perm(&selinux_state,
3285 sid, isec->sid, isec->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003286 FILE__RELABELFROM, &ad);
3287 if (rc)
3288 return rc;
3289
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003290 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3291 GFP_KERNEL);
Stephen Smalley12b29f32008-05-07 13:03:20 -04003292 if (rc == -EINVAL) {
Stephen Smalleydb590002017-04-20 11:31:30 -04003293 if (!has_cap_mac_admin(true)) {
Eric Parisd6ea83e2012-04-04 13:45:49 -04003294 struct audit_buffer *ab;
3295 size_t audit_size;
Eric Parisd6ea83e2012-04-04 13:45:49 -04003296
3297 /* We strip a nul only if it is at the end, otherwise the
3298 * context contains a nul and we should audit that */
Al Viroe3fea3f2012-06-09 08:15:16 +01003299 if (value) {
Colin Ian Kingadd24372017-10-14 13:46:55 +01003300 const char *str = value;
3301
Al Viroe3fea3f2012-06-09 08:15:16 +01003302 if (str[size - 1] == '\0')
3303 audit_size = size - 1;
3304 else
3305 audit_size = size;
3306 } else {
Al Viroe3fea3f2012-06-09 08:15:16 +01003307 audit_size = 0;
3308 }
Eric Parisd6ea83e2012-04-04 13:45:49 -04003309 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3310 audit_log_format(ab, "op=setxattr invalid_context=");
3311 audit_log_n_untrustedstring(ab, value, audit_size);
3312 audit_log_end(ab);
3313
Stephen Smalley12b29f32008-05-07 13:03:20 -04003314 return rc;
Eric Parisd6ea83e2012-04-04 13:45:49 -04003315 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003316 rc = security_context_to_sid_force(&selinux_state, value,
3317 size, &newsid);
Stephen Smalley12b29f32008-05-07 13:03:20 -04003318 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003319 if (rc)
3320 return rc;
3321
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003322 rc = avc_has_perm(&selinux_state,
3323 sid, newsid, isec->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003324 FILE__RELABELTO, &ad);
3325 if (rc)
3326 return rc;
3327
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003328 rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3329 sid, isec->sclass);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003330 if (rc)
3331 return rc;
3332
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003333 return avc_has_perm(&selinux_state,
3334 newsid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003335 sbsec->sid,
3336 SECCLASS_FILESYSTEM,
3337 FILESYSTEM__ASSOCIATE,
3338 &ad);
3339}
3340
David Howells8f0cfa52008-04-29 00:59:41 -07003341static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
Eric Parisf5269712008-05-14 11:27:45 -04003342 const void *value, size_t size,
David Howells8f0cfa52008-04-29 00:59:41 -07003343 int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003344{
David Howellsc6f493d2015-03-17 22:26:22 +00003345 struct inode *inode = d_backing_inode(dentry);
Paul Moore20cdef82016-04-04 14:14:42 -04003346 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003347 u32 newsid;
3348 int rc;
3349
3350 if (strcmp(name, XATTR_NAME_SELINUX)) {
3351 /* Not an attribute we recognize, so nothing to do. */
3352 return;
3353 }
3354
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003355 rc = security_context_to_sid_force(&selinux_state, value, size,
3356 &newsid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003357 if (rc) {
Stephen Smalley12b29f32008-05-07 13:03:20 -04003358 printk(KERN_ERR "SELinux: unable to map context to SID"
3359 "for (%s, %lu), rc=%d\n",
3360 inode->i_sb->s_id, inode->i_ino, -rc);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003361 return;
3362 }
3363
Paul Moore20cdef82016-04-04 14:14:42 -04003364 isec = backing_inode_security(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003365 spin_lock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003366 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003367 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05003368 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003369 spin_unlock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003370
Linus Torvalds1da177e2005-04-16 15:20:36 -07003371 return;
3372}
3373
David Howells8f0cfa52008-04-29 00:59:41 -07003374static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003375{
David Howells88e67f32008-11-14 10:39:21 +11003376 const struct cred *cred = current_cred();
3377
Eric Paris2875fa02011-04-28 16:04:24 -04003378 return dentry_has_perm(cred, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003379}
3380
Eric Paris828dfe12008-04-17 13:17:49 -04003381static int selinux_inode_listxattr(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003382{
David Howells88e67f32008-11-14 10:39:21 +11003383 const struct cred *cred = current_cred();
3384
Eric Paris2875fa02011-04-28 16:04:24 -04003385 return dentry_has_perm(cred, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003386}
3387
David Howells8f0cfa52008-04-29 00:59:41 -07003388static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003389{
Eric W. Biederman6b240302017-10-02 09:38:20 -05003390 if (strcmp(name, XATTR_NAME_SELINUX)) {
3391 int rc = cap_inode_removexattr(dentry, name);
3392 if (rc)
3393 return rc;
3394
3395 /* Not an attribute we recognize, so just check the
3396 ordinary setattr permission. */
3397 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3398 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003399
3400 /* No one is allowed to remove a SELinux security label.
3401 You can change the label, but all data must be labeled. */
3402 return -EACCES;
3403}
3404
James Morrisd381d8a2005-10-30 14:59:22 -08003405/*
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003406 * Copy the inode security context value to the user.
James Morrisd381d8a2005-10-30 14:59:22 -08003407 *
3408 * Permission check is handled by selinux_inode_getxattr hook.
3409 */
Andreas Gruenbacherea861df2015-12-24 11:09:39 -05003410static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003411{
David P. Quigley42492592008-02-04 22:29:39 -08003412 u32 size;
3413 int error;
3414 char *context = NULL;
Paul Moore20cdef82016-04-04 14:14:42 -04003415 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003416
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00003417 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3418 return -EOPNOTSUPP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003419
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003420 /*
3421 * If the caller has CAP_MAC_ADMIN, then get the raw context
3422 * value even if it is not defined by current policy; otherwise,
3423 * use the in-core value under current policy.
3424 * Use the non-auditing forms of the permission checks since
3425 * getxattr may be called by unprivileged processes commonly
3426 * and lack of permission just means that we fall back to the
3427 * in-core context value, not a denial.
3428 */
Paul Moore20cdef82016-04-04 14:14:42 -04003429 isec = inode_security(inode);
Stephen Smalleydb590002017-04-20 11:31:30 -04003430 if (has_cap_mac_admin(false))
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003431 error = security_sid_to_context_force(&selinux_state,
3432 isec->sid, &context,
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003433 &size);
3434 else
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003435 error = security_sid_to_context(&selinux_state, isec->sid,
3436 &context, &size);
David P. Quigley42492592008-02-04 22:29:39 -08003437 if (error)
3438 return error;
3439 error = size;
3440 if (alloc) {
3441 *buffer = context;
3442 goto out_nofree;
3443 }
3444 kfree(context);
3445out_nofree:
3446 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003447}
3448
3449static int selinux_inode_setsecurity(struct inode *inode, const char *name,
Eric Paris828dfe12008-04-17 13:17:49 -04003450 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003451{
Paul Moore2c971652016-04-19 16:36:28 -04003452 struct inode_security_struct *isec = inode_security_novalidate(inode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003453 u32 newsid;
3454 int rc;
3455
3456 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3457 return -EOPNOTSUPP;
3458
3459 if (!value || !size)
3460 return -EACCES;
3461
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003462 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3463 GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003464 if (rc)
3465 return rc;
3466
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003467 spin_lock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003468 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003469 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05003470 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003471 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003472 return 0;
3473}
3474
3475static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3476{
3477 const int len = sizeof(XATTR_NAME_SELINUX);
3478 if (buffer && len <= buffer_size)
3479 memcpy(buffer, XATTR_NAME_SELINUX, len);
3480 return len;
3481}
3482
Andreas Gruenbacherd6335d72015-12-24 11:09:39 -05003483static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02003484{
Andreas Gruenbachere817c2f2016-02-18 12:04:08 +01003485 struct inode_security_struct *isec = inode_security_novalidate(inode);
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02003486 *secid = isec->sid;
3487}
3488
Vivek Goyal56909eb2016-07-13 10:44:48 -04003489static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3490{
3491 u32 sid;
3492 struct task_security_struct *tsec;
3493 struct cred *new_creds = *new;
3494
3495 if (new_creds == NULL) {
3496 new_creds = prepare_creds();
3497 if (!new_creds)
3498 return -ENOMEM;
3499 }
3500
3501 tsec = new_creds->security;
3502 /* Get label from overlay inode and set it in create_sid */
3503 selinux_inode_getsecid(d_inode(src), &sid);
3504 tsec->create_sid = sid;
3505 *new = new_creds;
3506 return 0;
3507}
3508
Vivek Goyal19472b62016-07-13 10:44:50 -04003509static int selinux_inode_copy_up_xattr(const char *name)
3510{
3511 /* The copy_up hook above sets the initial context on an inode, but we
3512 * don't then want to overwrite it by blindly copying all the lower
3513 * xattrs up. Instead, we have to filter out SELinux-related xattrs.
3514 */
3515 if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3516 return 1; /* Discard */
3517 /*
3518 * Any other attribute apart from SELINUX is not claimed, supported
3519 * by selinux.
3520 */
3521 return -EOPNOTSUPP;
3522}
3523
Linus Torvalds1da177e2005-04-16 15:20:36 -07003524/* file security operations */
3525
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003526static int selinux_revalidate_file_permission(struct file *file, int mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003527{
David Howells88e67f32008-11-14 10:39:21 +11003528 const struct cred *cred = current_cred();
Al Viro496ad9a2013-01-23 17:07:38 -05003529 struct inode *inode = file_inode(file);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003530
Linus Torvalds1da177e2005-04-16 15:20:36 -07003531 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3532 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3533 mask |= MAY_APPEND;
3534
Paul Moore389fb8002009-03-27 17:10:34 -04003535 return file_has_perm(cred, file,
3536 file_mask_to_av(inode->i_mode, mask));
Linus Torvalds1da177e2005-04-16 15:20:36 -07003537}
3538
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003539static int selinux_file_permission(struct file *file, int mask)
3540{
Al Viro496ad9a2013-01-23 17:07:38 -05003541 struct inode *inode = file_inode(file);
Stephen Smalley20dda182009-06-22 14:54:53 -04003542 struct file_security_struct *fsec = file->f_security;
Andreas Gruenbacherb1973672016-01-05 23:12:33 +01003543 struct inode_security_struct *isec;
Stephen Smalley20dda182009-06-22 14:54:53 -04003544 u32 sid = current_sid();
3545
Paul Moore389fb8002009-03-27 17:10:34 -04003546 if (!mask)
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003547 /* No permission to check. Existence test. */
3548 return 0;
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003549
Andreas Gruenbacherb1973672016-01-05 23:12:33 +01003550 isec = inode_security(inode);
Stephen Smalley20dda182009-06-22 14:54:53 -04003551 if (sid == fsec->sid && fsec->isid == isec->sid &&
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003552 fsec->pseqno == avc_policy_seqno(&selinux_state))
Eric Paris83d49852012-04-04 13:45:40 -04003553 /* No change since file_open check. */
Stephen Smalley20dda182009-06-22 14:54:53 -04003554 return 0;
3555
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003556 return selinux_revalidate_file_permission(file, mask);
3557}
3558
Linus Torvalds1da177e2005-04-16 15:20:36 -07003559static int selinux_file_alloc_security(struct file *file)
3560{
3561 return file_alloc_security(file);
3562}
3563
3564static void selinux_file_free_security(struct file *file)
3565{
3566 file_free_security(file);
3567}
3568
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003569/*
3570 * Check whether a task has the ioctl permission and cmd
3571 * operation to an inode.
3572 */
Geliang Tang1d2a1682015-10-21 17:44:27 -04003573static int ioctl_has_perm(const struct cred *cred, struct file *file,
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003574 u32 requested, u16 cmd)
3575{
3576 struct common_audit_data ad;
3577 struct file_security_struct *fsec = file->f_security;
3578 struct inode *inode = file_inode(file);
Paul Moore20cdef82016-04-04 14:14:42 -04003579 struct inode_security_struct *isec;
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003580 struct lsm_ioctlop_audit ioctl;
3581 u32 ssid = cred_sid(cred);
3582 int rc;
3583 u8 driver = cmd >> 8;
3584 u8 xperm = cmd & 0xff;
3585
3586 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3587 ad.u.op = &ioctl;
3588 ad.u.op->cmd = cmd;
3589 ad.u.op->path = file->f_path;
3590
3591 if (ssid != fsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003592 rc = avc_has_perm(&selinux_state,
3593 ssid, fsec->sid,
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003594 SECCLASS_FD,
3595 FD__USE,
3596 &ad);
3597 if (rc)
3598 goto out;
3599 }
3600
3601 if (unlikely(IS_PRIVATE(inode)))
3602 return 0;
3603
Paul Moore20cdef82016-04-04 14:14:42 -04003604 isec = inode_security(inode);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003605 rc = avc_has_extended_perms(&selinux_state,
3606 ssid, isec->sid, isec->sclass,
3607 requested, driver, xperm, &ad);
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003608out:
3609 return rc;
3610}
3611
Linus Torvalds1da177e2005-04-16 15:20:36 -07003612static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3613 unsigned long arg)
3614{
David Howells88e67f32008-11-14 10:39:21 +11003615 const struct cred *cred = current_cred();
Eric Paris0b24dcb2011-02-25 15:39:20 -05003616 int error = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003617
Eric Paris0b24dcb2011-02-25 15:39:20 -05003618 switch (cmd) {
3619 case FIONREAD:
3620 /* fall through */
3621 case FIBMAP:
3622 /* fall through */
3623 case FIGETBSZ:
3624 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003625 case FS_IOC_GETFLAGS:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003626 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003627 case FS_IOC_GETVERSION:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003628 error = file_has_perm(cred, file, FILE__GETATTR);
3629 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003630
Al Viro2f99c362012-03-23 16:04:05 -04003631 case FS_IOC_SETFLAGS:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003632 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003633 case FS_IOC_SETVERSION:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003634 error = file_has_perm(cred, file, FILE__SETATTR);
3635 break;
3636
3637 /* sys_ioctl() checks */
3638 case FIONBIO:
3639 /* fall through */
3640 case FIOASYNC:
3641 error = file_has_perm(cred, file, 0);
3642 break;
3643
3644 case KDSKBENT:
3645 case KDSKBSENT:
Eric Paris6a9de492012-01-03 12:25:14 -05003646 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04003647 SECURITY_CAP_AUDIT, true);
Eric Paris0b24dcb2011-02-25 15:39:20 -05003648 break;
3649
3650 /* default case assumes that the command will go
3651 * to the file's ioctl() function.
3652 */
3653 default:
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003654 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
Eric Paris0b24dcb2011-02-25 15:39:20 -05003655 }
3656 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003657}
3658
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003659static int default_noexec;
3660
Linus Torvalds1da177e2005-04-16 15:20:36 -07003661static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3662{
David Howells88e67f32008-11-14 10:39:21 +11003663 const struct cred *cred = current_cred();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003664 u32 sid = cred_sid(cred);
David Howellsd84f4f92008-11-14 10:39:23 +11003665 int rc = 0;
David Howells88e67f32008-11-14 10:39:21 +11003666
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003667 if (default_noexec &&
Stephen Smalley892e8ca2015-07-10 09:40:59 -04003668 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3669 (!shared && (prot & PROT_WRITE)))) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07003670 /*
3671 * We are making executable an anonymous mapping or a
3672 * private file mapping that will also be writable.
3673 * This has an additional check.
3674 */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003675 rc = avc_has_perm(&selinux_state,
3676 sid, sid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003677 PROCESS__EXECMEM, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003678 if (rc)
David Howellsd84f4f92008-11-14 10:39:23 +11003679 goto error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003680 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003681
3682 if (file) {
3683 /* read access is always possible with a mapping */
3684 u32 av = FILE__READ;
3685
3686 /* write access only matters if the mapping is shared */
3687 if (shared && (prot & PROT_WRITE))
3688 av |= FILE__WRITE;
3689
3690 if (prot & PROT_EXEC)
3691 av |= FILE__EXECUTE;
3692
David Howells88e67f32008-11-14 10:39:21 +11003693 return file_has_perm(cred, file, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003694 }
David Howellsd84f4f92008-11-14 10:39:23 +11003695
3696error:
3697 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003698}
3699
Al Viroe5467852012-05-30 13:30:51 -04003700static int selinux_mmap_addr(unsigned long addr)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003701{
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07003702 int rc = 0;
Paul Moore98883bf2014-03-19 16:46:11 -04003703
3704 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3705 u32 sid = current_sid();
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003706 rc = avc_has_perm(&selinux_state,
3707 sid, sid, SECCLASS_MEMPROTECT,
Paul Moore98883bf2014-03-19 16:46:11 -04003708 MEMPROTECT__MMAP_ZERO, NULL);
3709 }
3710
3711 return rc;
Al Viroe5467852012-05-30 13:30:51 -04003712}
Linus Torvalds1da177e2005-04-16 15:20:36 -07003713
Al Viroe5467852012-05-30 13:30:51 -04003714static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3715 unsigned long prot, unsigned long flags)
3716{
Stephen Smalley3ba4bf52017-05-05 09:14:48 -04003717 struct common_audit_data ad;
3718 int rc;
3719
3720 if (file) {
3721 ad.type = LSM_AUDIT_DATA_FILE;
3722 ad.u.file = file;
3723 rc = inode_has_perm(current_cred(), file_inode(file),
3724 FILE__MAP, &ad);
3725 if (rc)
3726 return rc;
3727 }
3728
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003729 if (selinux_state.checkreqprot)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003730 prot = reqprot;
3731
3732 return file_map_prot_check(file, prot,
3733 (flags & MAP_TYPE) == MAP_SHARED);
3734}
3735
3736static int selinux_file_mprotect(struct vm_area_struct *vma,
3737 unsigned long reqprot,
3738 unsigned long prot)
3739{
David Howells88e67f32008-11-14 10:39:21 +11003740 const struct cred *cred = current_cred();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003741 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003742
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003743 if (selinux_state.checkreqprot)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003744 prot = reqprot;
3745
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003746 if (default_noexec &&
3747 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
James Morrisd541bbe2009-01-29 12:19:51 +11003748 int rc = 0;
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003749 if (vma->vm_start >= vma->vm_mm->start_brk &&
3750 vma->vm_end <= vma->vm_mm->brk) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003751 rc = avc_has_perm(&selinux_state,
3752 sid, sid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003753 PROCESS__EXECHEAP, NULL);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003754 } else if (!vma->vm_file &&
Stephen Smalleyc2316db2016-04-08 13:55:03 -04003755 ((vma->vm_start <= vma->vm_mm->start_stack &&
3756 vma->vm_end >= vma->vm_mm->start_stack) ||
Andy Lutomirskid17af502016-09-30 10:58:58 -07003757 vma_is_stack_for_current(vma))) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003758 rc = avc_has_perm(&selinux_state,
3759 sid, sid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003760 PROCESS__EXECSTACK, NULL);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003761 } else if (vma->vm_file && vma->anon_vma) {
3762 /*
3763 * We are making executable a file mapping that has
3764 * had some COW done. Since pages might have been
3765 * written, check ability to execute the possibly
3766 * modified content. This typically should only
3767 * occur for text relocations.
3768 */
David Howellsd84f4f92008-11-14 10:39:23 +11003769 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003770 }
Lorenzo Hernandez García-Hierro6b992192005-06-25 14:54:34 -07003771 if (rc)
3772 return rc;
3773 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003774
3775 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3776}
3777
3778static int selinux_file_lock(struct file *file, unsigned int cmd)
3779{
David Howells88e67f32008-11-14 10:39:21 +11003780 const struct cred *cred = current_cred();
3781
3782 return file_has_perm(cred, file, FILE__LOCK);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003783}
3784
3785static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3786 unsigned long arg)
3787{
David Howells88e67f32008-11-14 10:39:21 +11003788 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003789 int err = 0;
3790
3791 switch (cmd) {
Eric Paris828dfe12008-04-17 13:17:49 -04003792 case F_SETFL:
Eric Paris828dfe12008-04-17 13:17:49 -04003793 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
David Howells88e67f32008-11-14 10:39:21 +11003794 err = file_has_perm(cred, file, FILE__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003795 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003796 }
3797 /* fall through */
3798 case F_SETOWN:
3799 case F_SETSIG:
3800 case F_GETFL:
3801 case F_GETOWN:
3802 case F_GETSIG:
Cyrill Gorcunov1d151c32012-07-30 14:43:00 -07003803 case F_GETOWNER_UIDS:
Eric Paris828dfe12008-04-17 13:17:49 -04003804 /* Just check FD__USE permission */
David Howells88e67f32008-11-14 10:39:21 +11003805 err = file_has_perm(cred, file, 0);
Eric Paris828dfe12008-04-17 13:17:49 -04003806 break;
3807 case F_GETLK:
3808 case F_SETLK:
3809 case F_SETLKW:
Jeff Layton0d3f7a22014-04-22 08:23:58 -04003810 case F_OFD_GETLK:
3811 case F_OFD_SETLK:
3812 case F_OFD_SETLKW:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003813#if BITS_PER_LONG == 32
Eric Paris828dfe12008-04-17 13:17:49 -04003814 case F_GETLK64:
3815 case F_SETLK64:
3816 case F_SETLKW64:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003817#endif
David Howells88e67f32008-11-14 10:39:21 +11003818 err = file_has_perm(cred, file, FILE__LOCK);
Eric Paris828dfe12008-04-17 13:17:49 -04003819 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003820 }
3821
3822 return err;
3823}
3824
Jeff Laytone0b93ed2014-08-22 11:27:32 -04003825static void selinux_file_set_fowner(struct file *file)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003826{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003827 struct file_security_struct *fsec;
3828
Linus Torvalds1da177e2005-04-16 15:20:36 -07003829 fsec = file->f_security;
David Howells275bb412008-11-14 10:39:19 +11003830 fsec->fown_sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003831}
3832
3833static int selinux_file_send_sigiotask(struct task_struct *tsk,
3834 struct fown_struct *fown, int signum)
3835{
Eric Paris828dfe12008-04-17 13:17:49 -04003836 struct file *file;
Stephen Smalley65c90bc2009-05-04 15:43:18 -04003837 u32 sid = task_sid(tsk);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003838 u32 perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003839 struct file_security_struct *fsec;
3840
3841 /* struct fown_struct is never outside the context of a struct file */
Eric Paris828dfe12008-04-17 13:17:49 -04003842 file = container_of(fown, struct file, f_owner);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003843
Linus Torvalds1da177e2005-04-16 15:20:36 -07003844 fsec = file->f_security;
3845
3846 if (!signum)
3847 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3848 else
3849 perm = signal_to_av(signum);
3850
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003851 return avc_has_perm(&selinux_state,
3852 fsec->fown_sid, sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003853 SECCLASS_PROCESS, perm, NULL);
3854}
3855
3856static int selinux_file_receive(struct file *file)
3857{
David Howells88e67f32008-11-14 10:39:21 +11003858 const struct cred *cred = current_cred();
3859
3860 return file_has_perm(cred, file, file_to_av(file));
Linus Torvalds1da177e2005-04-16 15:20:36 -07003861}
3862
Eric Paris83d49852012-04-04 13:45:40 -04003863static int selinux_file_open(struct file *file, const struct cred *cred)
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003864{
3865 struct file_security_struct *fsec;
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003866 struct inode_security_struct *isec;
David Howellsd84f4f92008-11-14 10:39:23 +11003867
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003868 fsec = file->f_security;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05003869 isec = inode_security(file_inode(file));
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003870 /*
3871 * Save inode label and policy sequence number
3872 * at open-time so that selinux_file_permission
3873 * can determine whether revalidation is necessary.
3874 * Task label is already saved in the file security
3875 * struct as its SID.
3876 */
3877 fsec->isid = isec->sid;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003878 fsec->pseqno = avc_policy_seqno(&selinux_state);
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003879 /*
3880 * Since the inode label or policy seqno may have changed
3881 * between the selinux_inode_permission check and the saving
3882 * of state above, recheck that access is still permitted.
3883 * Otherwise, access might never be revalidated against the
3884 * new inode label or new policy.
3885 * This check is not redundant - do not remove.
3886 */
David Howells13f8e982013-06-13 23:37:55 +01003887 return file_path_has_perm(cred, file, open_file_to_av(file));
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003888}
3889
Linus Torvalds1da177e2005-04-16 15:20:36 -07003890/* task security operations */
3891
Tetsuo Handaa79be232017-03-28 23:08:45 +09003892static int selinux_task_alloc(struct task_struct *task,
3893 unsigned long clone_flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003894{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003895 u32 sid = current_sid();
3896
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003897 return avc_has_perm(&selinux_state,
3898 sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003899}
3900
David Howellsf1752ee2008-11-14 10:39:17 +11003901/*
David Howellsee18d642009-09-02 09:14:21 +01003902 * allocate the SELinux part of blank credentials
3903 */
3904static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3905{
3906 struct task_security_struct *tsec;
3907
3908 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3909 if (!tsec)
3910 return -ENOMEM;
3911
3912 cred->security = tsec;
3913 return 0;
3914}
3915
3916/*
David Howellsf1752ee2008-11-14 10:39:17 +11003917 * detach and free the LSM part of a set of credentials
3918 */
3919static void selinux_cred_free(struct cred *cred)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003920{
David Howellsf1752ee2008-11-14 10:39:17 +11003921 struct task_security_struct *tsec = cred->security;
David Howellse0e81732009-09-02 09:13:40 +01003922
Tetsuo Handa2edeaa32011-02-07 13:36:10 +00003923 /*
3924 * cred->security == NULL if security_cred_alloc_blank() or
3925 * security_prepare_creds() returned an error.
3926 */
3927 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
David Howellse0e81732009-09-02 09:13:40 +01003928 cred->security = (void *) 0x7UL;
David Howellsf1752ee2008-11-14 10:39:17 +11003929 kfree(tsec);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003930}
3931
David Howellsd84f4f92008-11-14 10:39:23 +11003932/*
3933 * prepare a new set of credentials for modification
3934 */
3935static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3936 gfp_t gfp)
3937{
3938 const struct task_security_struct *old_tsec;
3939 struct task_security_struct *tsec;
3940
3941 old_tsec = old->security;
3942
3943 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3944 if (!tsec)
3945 return -ENOMEM;
3946
3947 new->security = tsec;
3948 return 0;
3949}
3950
3951/*
David Howellsee18d642009-09-02 09:14:21 +01003952 * transfer the SELinux data to a blank set of creds
3953 */
3954static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3955{
3956 const struct task_security_struct *old_tsec = old->security;
3957 struct task_security_struct *tsec = new->security;
3958
3959 *tsec = *old_tsec;
3960}
3961
Matthew Garrett3ec30112018-01-08 13:36:19 -08003962static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
3963{
3964 *secid = cred_sid(c);
3965}
3966
David Howellsee18d642009-09-02 09:14:21 +01003967/*
David Howells3a3b7ce2008-11-14 10:39:28 +11003968 * set the security data for a kernel service
3969 * - all the creation contexts are set to unlabelled
3970 */
3971static int selinux_kernel_act_as(struct cred *new, u32 secid)
3972{
3973 struct task_security_struct *tsec = new->security;
3974 u32 sid = current_sid();
3975 int ret;
3976
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003977 ret = avc_has_perm(&selinux_state,
3978 sid, secid,
David Howells3a3b7ce2008-11-14 10:39:28 +11003979 SECCLASS_KERNEL_SERVICE,
3980 KERNEL_SERVICE__USE_AS_OVERRIDE,
3981 NULL);
3982 if (ret == 0) {
3983 tsec->sid = secid;
3984 tsec->create_sid = 0;
3985 tsec->keycreate_sid = 0;
3986 tsec->sockcreate_sid = 0;
3987 }
3988 return ret;
3989}
3990
3991/*
3992 * set the file creation context in a security record to the same as the
3993 * objective context of the specified inode
3994 */
3995static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3996{
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05003997 struct inode_security_struct *isec = inode_security(inode);
David Howells3a3b7ce2008-11-14 10:39:28 +11003998 struct task_security_struct *tsec = new->security;
3999 u32 sid = current_sid();
4000 int ret;
4001
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004002 ret = avc_has_perm(&selinux_state,
4003 sid, isec->sid,
David Howells3a3b7ce2008-11-14 10:39:28 +11004004 SECCLASS_KERNEL_SERVICE,
4005 KERNEL_SERVICE__CREATE_FILES_AS,
4006 NULL);
4007
4008 if (ret == 0)
4009 tsec->create_sid = isec->sid;
David Howellsef574712010-02-26 01:56:16 +00004010 return ret;
David Howells3a3b7ce2008-11-14 10:39:28 +11004011}
4012
Eric Parisdd8dbf22009-11-03 16:35:32 +11004013static int selinux_kernel_module_request(char *kmod_name)
Eric Paris25354c42009-08-13 09:45:03 -04004014{
Eric Parisdd8dbf22009-11-03 16:35:32 +11004015 struct common_audit_data ad;
4016
Eric Paris50c205f2012-04-04 15:01:43 -04004017 ad.type = LSM_AUDIT_DATA_KMOD;
Eric Parisdd8dbf22009-11-03 16:35:32 +11004018 ad.u.kmod_name = kmod_name;
4019
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004020 return avc_has_perm(&selinux_state,
4021 current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
Eric Parisdd8dbf22009-11-03 16:35:32 +11004022 SYSTEM__MODULE_REQUEST, &ad);
Eric Paris25354c42009-08-13 09:45:03 -04004023}
4024
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07004025static int selinux_kernel_module_from_file(struct file *file)
4026{
4027 struct common_audit_data ad;
4028 struct inode_security_struct *isec;
4029 struct file_security_struct *fsec;
4030 u32 sid = current_sid();
4031 int rc;
4032
4033 /* init_module */
4034 if (file == NULL)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004035 return avc_has_perm(&selinux_state,
4036 sid, sid, SECCLASS_SYSTEM,
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07004037 SYSTEM__MODULE_LOAD, NULL);
4038
4039 /* finit_module */
Paul Moore20cdef82016-04-04 14:14:42 -04004040
Vivek Goyal43af5de2016-09-09 11:37:49 -04004041 ad.type = LSM_AUDIT_DATA_FILE;
4042 ad.u.file = file;
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07004043
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07004044 fsec = file->f_security;
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07004045 if (sid != fsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004046 rc = avc_has_perm(&selinux_state,
4047 sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07004048 if (rc)
4049 return rc;
4050 }
4051
Paul Moore20cdef82016-04-04 14:14:42 -04004052 isec = inode_security(file_inode(file));
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004053 return avc_has_perm(&selinux_state,
4054 sid, isec->sid, SECCLASS_SYSTEM,
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07004055 SYSTEM__MODULE_LOAD, &ad);
4056}
4057
4058static int selinux_kernel_read_file(struct file *file,
4059 enum kernel_read_file_id id)
4060{
4061 int rc = 0;
4062
4063 switch (id) {
4064 case READING_MODULE:
4065 rc = selinux_kernel_module_from_file(file);
4066 break;
4067 default:
4068 break;
4069 }
4070
4071 return rc;
4072}
4073
Linus Torvalds1da177e2005-04-16 15:20:36 -07004074static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
4075{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004076 return avc_has_perm(&selinux_state,
4077 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004078 PROCESS__SETPGID, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004079}
4080
4081static int selinux_task_getpgid(struct task_struct *p)
4082{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004083 return avc_has_perm(&selinux_state,
4084 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004085 PROCESS__GETPGID, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004086}
4087
4088static int selinux_task_getsid(struct task_struct *p)
4089{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004090 return avc_has_perm(&selinux_state,
4091 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004092 PROCESS__GETSESSION, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004093}
4094
David Quigleyf9008e4c2006-06-30 01:55:46 -07004095static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
4096{
David Howells275bb412008-11-14 10:39:19 +11004097 *secid = task_sid(p);
David Quigleyf9008e4c2006-06-30 01:55:46 -07004098}
4099
Linus Torvalds1da177e2005-04-16 15:20:36 -07004100static int selinux_task_setnice(struct task_struct *p, int nice)
4101{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004102 return avc_has_perm(&selinux_state,
4103 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004104 PROCESS__SETSCHED, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004105}
4106
James Morris03e68062006-06-23 02:03:58 -07004107static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4108{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004109 return avc_has_perm(&selinux_state,
4110 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004111 PROCESS__SETSCHED, NULL);
James Morris03e68062006-06-23 02:03:58 -07004112}
4113
David Quigleya1836a42006-06-30 01:55:49 -07004114static int selinux_task_getioprio(struct task_struct *p)
4115{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004116 return avc_has_perm(&selinux_state,
4117 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004118 PROCESS__GETSCHED, NULL);
David Quigleya1836a42006-06-30 01:55:49 -07004119}
4120
Corentin LABBE42985552017-10-04 20:32:18 +02004121static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4122 unsigned int flags)
Stephen Smalley791ec492017-02-17 07:57:00 -05004123{
4124 u32 av = 0;
4125
Stephen Smalley84e68852017-02-28 09:35:08 -05004126 if (!flags)
4127 return 0;
Stephen Smalley791ec492017-02-17 07:57:00 -05004128 if (flags & LSM_PRLIMIT_WRITE)
4129 av |= PROCESS__SETRLIMIT;
4130 if (flags & LSM_PRLIMIT_READ)
4131 av |= PROCESS__GETRLIMIT;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004132 return avc_has_perm(&selinux_state,
4133 cred_sid(cred), cred_sid(tcred),
Stephen Smalley791ec492017-02-17 07:57:00 -05004134 SECCLASS_PROCESS, av, NULL);
4135}
4136
Jiri Slaby8fd00b42009-08-26 18:41:16 +02004137static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4138 struct rlimit *new_rlim)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004139{
Jiri Slaby8fd00b42009-08-26 18:41:16 +02004140 struct rlimit *old_rlim = p->signal->rlim + resource;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004141
4142 /* Control the ability to change the hard limit (whether
4143 lowering or raising it), so that the hard limit can
4144 later be used as a safe reset point for the soft limit
David Howellsd84f4f92008-11-14 10:39:23 +11004145 upon context transitions. See selinux_bprm_committing_creds. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07004146 if (old_rlim->rlim_max != new_rlim->rlim_max)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004147 return avc_has_perm(&selinux_state,
4148 current_sid(), task_sid(p),
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004149 SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004150
4151 return 0;
4152}
4153
KOSAKI Motohirob0ae1982010-10-15 04:21:18 +09004154static int selinux_task_setscheduler(struct task_struct *p)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004155{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004156 return avc_has_perm(&selinux_state,
4157 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004158 PROCESS__SETSCHED, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004159}
4160
4161static int selinux_task_getscheduler(struct task_struct *p)
4162{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004163 return avc_has_perm(&selinux_state,
4164 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004165 PROCESS__GETSCHED, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004166}
4167
David Quigley35601542006-06-23 02:04:01 -07004168static int selinux_task_movememory(struct task_struct *p)
4169{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004170 return avc_has_perm(&selinux_state,
4171 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004172 PROCESS__SETSCHED, NULL);
David Quigley35601542006-06-23 02:04:01 -07004173}
4174
David Quigleyf9008e4c2006-06-30 01:55:46 -07004175static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
Stephen Smalley6b4f3d02017-09-08 12:40:01 -04004176 int sig, const struct cred *cred)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004177{
Stephen Smalley6b4f3d02017-09-08 12:40:01 -04004178 u32 secid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004179 u32 perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004180
Linus Torvalds1da177e2005-04-16 15:20:36 -07004181 if (!sig)
4182 perm = PROCESS__SIGNULL; /* null signal; existence test */
4183 else
4184 perm = signal_to_av(sig);
Stephen Smalley6b4f3d02017-09-08 12:40:01 -04004185 if (!cred)
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004186 secid = current_sid();
Stephen Smalley6b4f3d02017-09-08 12:40:01 -04004187 else
4188 secid = cred_sid(cred);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004189 return avc_has_perm(&selinux_state,
4190 secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004191}
4192
Linus Torvalds1da177e2005-04-16 15:20:36 -07004193static void selinux_task_to_inode(struct task_struct *p,
4194 struct inode *inode)
4195{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004196 struct inode_security_struct *isec = inode->i_security;
David Howells275bb412008-11-14 10:39:19 +11004197 u32 sid = task_sid(p);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004198
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004199 spin_lock(&isec->lock);
Andreas Gruenbacherdb978da2016-11-10 22:18:28 +01004200 isec->sclass = inode_mode_to_security_class(inode->i_mode);
David Howells275bb412008-11-14 10:39:19 +11004201 isec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05004202 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004203 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004204}
4205
Linus Torvalds1da177e2005-04-16 15:20:36 -07004206/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004207static int selinux_parse_skb_ipv4(struct sk_buff *skb,
Thomas Liu2bf49692009-07-14 12:14:09 -04004208 struct common_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004209{
4210 int offset, ihlen, ret = -EINVAL;
4211 struct iphdr _iph, *ih;
4212
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03004213 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004214 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4215 if (ih == NULL)
4216 goto out;
4217
4218 ihlen = ih->ihl * 4;
4219 if (ihlen < sizeof(_iph))
4220 goto out;
4221
Eric Paris48c62af2012-04-02 13:15:44 -04004222 ad->u.net->v4info.saddr = ih->saddr;
4223 ad->u.net->v4info.daddr = ih->daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004224 ret = 0;
4225
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004226 if (proto)
4227 *proto = ih->protocol;
4228
Linus Torvalds1da177e2005-04-16 15:20:36 -07004229 switch (ih->protocol) {
Eric Paris828dfe12008-04-17 13:17:49 -04004230 case IPPROTO_TCP: {
4231 struct tcphdr _tcph, *th;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004232
Eric Paris828dfe12008-04-17 13:17:49 -04004233 if (ntohs(ih->frag_off) & IP_OFFSET)
4234 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004235
4236 offset += ihlen;
4237 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4238 if (th == NULL)
4239 break;
4240
Eric Paris48c62af2012-04-02 13:15:44 -04004241 ad->u.net->sport = th->source;
4242 ad->u.net->dport = th->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004243 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004244 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004245
Eric Paris828dfe12008-04-17 13:17:49 -04004246 case IPPROTO_UDP: {
4247 struct udphdr _udph, *uh;
4248
4249 if (ntohs(ih->frag_off) & IP_OFFSET)
4250 break;
4251
4252 offset += ihlen;
4253 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4254 if (uh == NULL)
4255 break;
4256
Eric Paris48c62af2012-04-02 13:15:44 -04004257 ad->u.net->sport = uh->source;
4258 ad->u.net->dport = uh->dest;
Eric Paris828dfe12008-04-17 13:17:49 -04004259 break;
4260 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004261
James Morris2ee92d42006-11-13 16:09:01 -08004262 case IPPROTO_DCCP: {
4263 struct dccp_hdr _dccph, *dh;
4264
4265 if (ntohs(ih->frag_off) & IP_OFFSET)
4266 break;
4267
4268 offset += ihlen;
4269 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4270 if (dh == NULL)
4271 break;
4272
Eric Paris48c62af2012-04-02 13:15:44 -04004273 ad->u.net->sport = dh->dccph_sport;
4274 ad->u.net->dport = dh->dccph_dport;
James Morris2ee92d42006-11-13 16:09:01 -08004275 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004276 }
James Morris2ee92d42006-11-13 16:09:01 -08004277
Richard Hainesd4529302018-02-13 20:57:18 +00004278#if IS_ENABLED(CONFIG_IP_SCTP)
4279 case IPPROTO_SCTP: {
4280 struct sctphdr _sctph, *sh;
4281
4282 if (ntohs(ih->frag_off) & IP_OFFSET)
4283 break;
4284
4285 offset += ihlen;
4286 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4287 if (sh == NULL)
4288 break;
4289
4290 ad->u.net->sport = sh->source;
4291 ad->u.net->dport = sh->dest;
4292 break;
4293 }
4294#endif
Eric Paris828dfe12008-04-17 13:17:49 -04004295 default:
4296 break;
4297 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004298out:
4299 return ret;
4300}
4301
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04004302#if IS_ENABLED(CONFIG_IPV6)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004303
4304/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004305static int selinux_parse_skb_ipv6(struct sk_buff *skb,
Thomas Liu2bf49692009-07-14 12:14:09 -04004306 struct common_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004307{
4308 u8 nexthdr;
4309 int ret = -EINVAL, offset;
4310 struct ipv6hdr _ipv6h, *ip6;
Jesse Gross75f28112011-11-30 17:05:51 -08004311 __be16 frag_off;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004312
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03004313 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004314 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4315 if (ip6 == NULL)
4316 goto out;
4317
Eric Paris48c62af2012-04-02 13:15:44 -04004318 ad->u.net->v6info.saddr = ip6->saddr;
4319 ad->u.net->v6info.daddr = ip6->daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004320 ret = 0;
4321
4322 nexthdr = ip6->nexthdr;
4323 offset += sizeof(_ipv6h);
Jesse Gross75f28112011-11-30 17:05:51 -08004324 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004325 if (offset < 0)
4326 goto out;
4327
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004328 if (proto)
4329 *proto = nexthdr;
4330
Linus Torvalds1da177e2005-04-16 15:20:36 -07004331 switch (nexthdr) {
4332 case IPPROTO_TCP: {
Eric Paris828dfe12008-04-17 13:17:49 -04004333 struct tcphdr _tcph, *th;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004334
4335 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4336 if (th == NULL)
4337 break;
4338
Eric Paris48c62af2012-04-02 13:15:44 -04004339 ad->u.net->sport = th->source;
4340 ad->u.net->dport = th->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004341 break;
4342 }
4343
4344 case IPPROTO_UDP: {
4345 struct udphdr _udph, *uh;
4346
4347 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4348 if (uh == NULL)
4349 break;
4350
Eric Paris48c62af2012-04-02 13:15:44 -04004351 ad->u.net->sport = uh->source;
4352 ad->u.net->dport = uh->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004353 break;
4354 }
4355
James Morris2ee92d42006-11-13 16:09:01 -08004356 case IPPROTO_DCCP: {
4357 struct dccp_hdr _dccph, *dh;
4358
4359 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4360 if (dh == NULL)
4361 break;
4362
Eric Paris48c62af2012-04-02 13:15:44 -04004363 ad->u.net->sport = dh->dccph_sport;
4364 ad->u.net->dport = dh->dccph_dport;
James Morris2ee92d42006-11-13 16:09:01 -08004365 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004366 }
James Morris2ee92d42006-11-13 16:09:01 -08004367
Richard Hainesd4529302018-02-13 20:57:18 +00004368#if IS_ENABLED(CONFIG_IP_SCTP)
4369 case IPPROTO_SCTP: {
4370 struct sctphdr _sctph, *sh;
4371
4372 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4373 if (sh == NULL)
4374 break;
4375
4376 ad->u.net->sport = sh->source;
4377 ad->u.net->dport = sh->dest;
4378 break;
4379 }
4380#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07004381 /* includes fragments */
4382 default:
4383 break;
4384 }
4385out:
4386 return ret;
4387}
4388
4389#endif /* IPV6 */
4390
Thomas Liu2bf49692009-07-14 12:14:09 -04004391static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
David Howellscf9481e2008-07-27 21:31:07 +10004392 char **_addrp, int src, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004393{
David Howellscf9481e2008-07-27 21:31:07 +10004394 char *addrp;
4395 int ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004396
Eric Paris48c62af2012-04-02 13:15:44 -04004397 switch (ad->u.net->family) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07004398 case PF_INET:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004399 ret = selinux_parse_skb_ipv4(skb, ad, proto);
David Howellscf9481e2008-07-27 21:31:07 +10004400 if (ret)
4401 goto parse_error;
Eric Paris48c62af2012-04-02 13:15:44 -04004402 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4403 &ad->u.net->v4info.daddr);
David Howellscf9481e2008-07-27 21:31:07 +10004404 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004405
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04004406#if IS_ENABLED(CONFIG_IPV6)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004407 case PF_INET6:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004408 ret = selinux_parse_skb_ipv6(skb, ad, proto);
David Howellscf9481e2008-07-27 21:31:07 +10004409 if (ret)
4410 goto parse_error;
Eric Paris48c62af2012-04-02 13:15:44 -04004411 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4412 &ad->u.net->v6info.daddr);
David Howellscf9481e2008-07-27 21:31:07 +10004413 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004414#endif /* IPV6 */
4415 default:
David Howellscf9481e2008-07-27 21:31:07 +10004416 addrp = NULL;
4417 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004418 }
4419
David Howellscf9481e2008-07-27 21:31:07 +10004420parse_error:
4421 printk(KERN_WARNING
4422 "SELinux: failure in selinux_parse_skb(),"
4423 " unable to parse packet\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07004424 return ret;
David Howellscf9481e2008-07-27 21:31:07 +10004425
4426okay:
4427 if (_addrp)
4428 *_addrp = addrp;
4429 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004430}
4431
Paul Moore4f6a9932007-03-01 14:35:22 -05004432/**
Paul Moore220deb92008-01-29 08:38:23 -05004433 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
Paul Moore4f6a9932007-03-01 14:35:22 -05004434 * @skb: the packet
Paul Moore75e22912008-01-29 08:38:04 -05004435 * @family: protocol family
Paul Moore220deb92008-01-29 08:38:23 -05004436 * @sid: the packet's peer label SID
Paul Moore4f6a9932007-03-01 14:35:22 -05004437 *
4438 * Description:
Paul Moore220deb92008-01-29 08:38:23 -05004439 * Check the various different forms of network peer labeling and determine
4440 * the peer label/SID for the packet; most of the magic actually occurs in
4441 * the security server function security_net_peersid_cmp(). The function
4442 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4443 * or -EACCES if @sid is invalid due to inconsistencies with the different
4444 * peer labels.
Paul Moore4f6a9932007-03-01 14:35:22 -05004445 *
4446 */
Paul Moore220deb92008-01-29 08:38:23 -05004447static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
Paul Moore4f6a9932007-03-01 14:35:22 -05004448{
Paul Moore71f1cb02008-01-29 08:51:16 -05004449 int err;
Paul Moore4f6a9932007-03-01 14:35:22 -05004450 u32 xfrm_sid;
4451 u32 nlbl_sid;
Paul Moore220deb92008-01-29 08:38:23 -05004452 u32 nlbl_type;
Paul Moore4f6a9932007-03-01 14:35:22 -05004453
Paul Moore817eff72013-12-10 14:57:54 -05004454 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
Paul Moorebed4d7e2013-07-23 17:38:40 -04004455 if (unlikely(err))
4456 return -EACCES;
4457 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4458 if (unlikely(err))
4459 return -EACCES;
Paul Moore220deb92008-01-29 08:38:23 -05004460
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004461 err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4462 nlbl_type, xfrm_sid, sid);
Paul Moore71f1cb02008-01-29 08:51:16 -05004463 if (unlikely(err)) {
4464 printk(KERN_WARNING
4465 "SELinux: failure in selinux_skb_peerlbl_sid(),"
4466 " unable to determine packet's peer label\n");
Paul Moore220deb92008-01-29 08:38:23 -05004467 return -EACCES;
Paul Moore71f1cb02008-01-29 08:51:16 -05004468 }
Paul Moore220deb92008-01-29 08:38:23 -05004469
4470 return 0;
Paul Moore4f6a9932007-03-01 14:35:22 -05004471}
4472
Paul Moore446b8022013-12-04 16:10:51 -05004473/**
4474 * selinux_conn_sid - Determine the child socket label for a connection
4475 * @sk_sid: the parent socket's SID
4476 * @skb_sid: the packet's SID
4477 * @conn_sid: the resulting connection SID
4478 *
4479 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4480 * combined with the MLS information from @skb_sid in order to create
4481 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
4482 * of @sk_sid. Returns zero on success, negative values on failure.
4483 *
4484 */
4485static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4486{
4487 int err = 0;
4488
4489 if (skb_sid != SECSID_NULL)
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004490 err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4491 conn_sid);
Paul Moore446b8022013-12-04 16:10:51 -05004492 else
4493 *conn_sid = sk_sid;
4494
4495 return err;
4496}
4497
Linus Torvalds1da177e2005-04-16 15:20:36 -07004498/* socket security operations */
Paul Moored4f2d972010-04-22 14:46:18 -04004499
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004500static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4501 u16 secclass, u32 *socksid)
Paul Moored4f2d972010-04-22 14:46:18 -04004502{
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004503 if (tsec->sockcreate_sid > SECSID_NULL) {
4504 *socksid = tsec->sockcreate_sid;
4505 return 0;
4506 }
4507
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004508 return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4509 secclass, NULL, socksid);
Paul Moored4f2d972010-04-22 14:46:18 -04004510}
4511
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004512static int sock_has_perm(struct sock *sk, u32 perms)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004513{
Paul Moore253bfae2010-04-22 14:46:19 -04004514 struct sk_security_struct *sksec = sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004515 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004516 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004517
Paul Moore253bfae2010-04-22 14:46:19 -04004518 if (sksec->sid == SECINITSID_KERNEL)
4519 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004520
Eric Paris50c205f2012-04-04 15:01:43 -04004521 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004522 ad.u.net = &net;
4523 ad.u.net->sk = sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004524
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004525 return avc_has_perm(&selinux_state,
4526 current_sid(), sksec->sid, sksec->sclass, perms,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004527 &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004528}
4529
4530static int selinux_socket_create(int family, int type,
4531 int protocol, int kern)
4532{
Paul Moore5fb49872010-04-22 14:46:19 -04004533 const struct task_security_struct *tsec = current_security();
Paul Moored4f2d972010-04-22 14:46:18 -04004534 u32 newsid;
David Howells275bb412008-11-14 10:39:19 +11004535 u16 secclass;
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004536 int rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004537
4538 if (kern)
Paul Moored4f2d972010-04-22 14:46:18 -04004539 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004540
David Howells275bb412008-11-14 10:39:19 +11004541 secclass = socket_type_to_security_class(family, type, protocol);
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004542 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4543 if (rc)
4544 return rc;
4545
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004546 return avc_has_perm(&selinux_state,
4547 tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004548}
4549
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07004550static int selinux_socket_post_create(struct socket *sock, int family,
4551 int type, int protocol, int kern)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004552{
Paul Moore5fb49872010-04-22 14:46:19 -04004553 const struct task_security_struct *tsec = current_security();
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05004554 struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004555 struct sk_security_struct *sksec;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004556 u16 sclass = socket_type_to_security_class(family, type, protocol);
4557 u32 sid = SECINITSID_KERNEL;
David Howells275bb412008-11-14 10:39:19 +11004558 int err = 0;
4559
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004560 if (!kern) {
4561 err = socket_sockcreate_sid(tsec, sclass, &sid);
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004562 if (err)
4563 return err;
4564 }
David Howells275bb412008-11-14 10:39:19 +11004565
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004566 isec->sclass = sclass;
4567 isec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05004568 isec->initialized = LABEL_INITIALIZED;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004569
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004570 if (sock->sk) {
4571 sksec = sock->sk->sk_security;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004572 sksec->sclass = sclass;
4573 sksec->sid = sid;
Richard Hainesd4529302018-02-13 20:57:18 +00004574 /* Allows detection of the first association on this socket */
4575 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4576 sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4577
Paul Moore389fb8002009-03-27 17:10:34 -04004578 err = selinux_netlbl_socket_post_create(sock->sk, family);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004579 }
4580
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07004581 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004582}
4583
4584/* Range of port numbers used to automatically bind.
4585 Need to determine whether we should perform a name_bind
4586 permission check between the socket and the port number. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07004587
4588static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4589{
Paul Moore253bfae2010-04-22 14:46:19 -04004590 struct sock *sk = sock->sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004591 u16 family;
4592 int err;
4593
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004594 err = sock_has_perm(sk, SOCKET__BIND);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004595 if (err)
4596 goto out;
4597
Richard Hainesd4529302018-02-13 20:57:18 +00004598 /* If PF_INET or PF_INET6, check name_bind permission for the port. */
Paul Moore253bfae2010-04-22 14:46:19 -04004599 family = sk->sk_family;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004600 if (family == PF_INET || family == PF_INET6) {
4601 char *addrp;
Paul Moore253bfae2010-04-22 14:46:19 -04004602 struct sk_security_struct *sksec = sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004603 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004604 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004605 struct sockaddr_in *addr4 = NULL;
4606 struct sockaddr_in6 *addr6 = NULL;
4607 unsigned short snum;
James Morrise399f982008-06-12 01:39:58 +10004608 u32 sid, node_perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004609
Richard Hainesd4529302018-02-13 20:57:18 +00004610 /*
4611 * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4612 * that validates multiple binding addresses. Because of this
4613 * need to check address->sa_family as it is possible to have
4614 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4615 */
Richard Haines68741a8a2018-03-02 19:54:34 +00004616 switch (address->sa_family) {
4617 case AF_INET:
4618 if (addrlen < sizeof(struct sockaddr_in))
4619 return -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004620 addr4 = (struct sockaddr_in *)address;
4621 snum = ntohs(addr4->sin_port);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004622 addrp = (char *)&addr4->sin_addr.s_addr;
Richard Haines68741a8a2018-03-02 19:54:34 +00004623 break;
4624 case AF_INET6:
4625 if (addrlen < SIN6_LEN_RFC2133)
4626 return -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004627 addr6 = (struct sockaddr_in6 *)address;
4628 snum = ntohs(addr6->sin6_port);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004629 addrp = (char *)&addr6->sin6_addr.s6_addr;
Richard Haines68741a8a2018-03-02 19:54:34 +00004630 break;
4631 default:
4632 /* Note that SCTP services expect -EINVAL, whereas
4633 * others expect -EAFNOSUPPORT.
4634 */
4635 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4636 return -EINVAL;
4637 else
4638 return -EAFNOSUPPORT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004639 }
4640
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004641 if (snum) {
4642 int low, high;
4643
Eric W. Biederman0bbf87d2013-09-28 14:10:59 -07004644 inet_get_local_port_range(sock_net(sk), &low, &high);
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004645
Krister Johansen4548b682017-01-20 17:49:11 -08004646 if (snum < max(inet_prot_sock(sock_net(sk)), low) ||
4647 snum > high) {
Paul Moore3e1121722008-04-10 10:48:14 -04004648 err = sel_netport_sid(sk->sk_protocol,
4649 snum, &sid);
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004650 if (err)
4651 goto out;
Eric Paris50c205f2012-04-04 15:01:43 -04004652 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004653 ad.u.net = &net;
4654 ad.u.net->sport = htons(snum);
4655 ad.u.net->family = family;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004656 err = avc_has_perm(&selinux_state,
4657 sksec->sid, sid,
Paul Moore253bfae2010-04-22 14:46:19 -04004658 sksec->sclass,
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004659 SOCKET__NAME_BIND, &ad);
4660 if (err)
4661 goto out;
4662 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004663 }
Eric Paris828dfe12008-04-17 13:17:49 -04004664
Paul Moore253bfae2010-04-22 14:46:19 -04004665 switch (sksec->sclass) {
James Morris13402582005-09-30 14:24:34 -04004666 case SECCLASS_TCP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004667 node_perm = TCP_SOCKET__NODE_BIND;
4668 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004669
James Morris13402582005-09-30 14:24:34 -04004670 case SECCLASS_UDP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004671 node_perm = UDP_SOCKET__NODE_BIND;
4672 break;
James Morris2ee92d42006-11-13 16:09:01 -08004673
4674 case SECCLASS_DCCP_SOCKET:
4675 node_perm = DCCP_SOCKET__NODE_BIND;
4676 break;
4677
Richard Hainesd4529302018-02-13 20:57:18 +00004678 case SECCLASS_SCTP_SOCKET:
4679 node_perm = SCTP_SOCKET__NODE_BIND;
4680 break;
4681
Linus Torvalds1da177e2005-04-16 15:20:36 -07004682 default:
4683 node_perm = RAWIP_SOCKET__NODE_BIND;
4684 break;
4685 }
Eric Paris828dfe12008-04-17 13:17:49 -04004686
Paul Moore224dfbd2008-01-29 08:38:13 -05004687 err = sel_netnode_sid(addrp, family, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004688 if (err)
4689 goto out;
Eric Paris828dfe12008-04-17 13:17:49 -04004690
Eric Paris50c205f2012-04-04 15:01:43 -04004691 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004692 ad.u.net = &net;
4693 ad.u.net->sport = htons(snum);
4694 ad.u.net->family = family;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004695
Richard Hainesd4529302018-02-13 20:57:18 +00004696 if (address->sa_family == AF_INET)
Eric Paris48c62af2012-04-02 13:15:44 -04004697 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004698 else
Eric Paris48c62af2012-04-02 13:15:44 -04004699 ad.u.net->v6info.saddr = addr6->sin6_addr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004700
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004701 err = avc_has_perm(&selinux_state,
4702 sksec->sid, sid,
Paul Moore253bfae2010-04-22 14:46:19 -04004703 sksec->sclass, node_perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004704 if (err)
4705 goto out;
4706 }
4707out:
4708 return err;
4709}
4710
Richard Hainesd4529302018-02-13 20:57:18 +00004711/* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4712 * and sctp_sendmsg(3) as described in Documentation/security/LSM-sctp.txt
4713 */
4714static int selinux_socket_connect_helper(struct socket *sock,
4715 struct sockaddr *address, int addrlen)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004716{
Paul Moore014ab192008-10-10 10:16:33 -04004717 struct sock *sk = sock->sk;
Paul Moore253bfae2010-04-22 14:46:19 -04004718 struct sk_security_struct *sksec = sk->sk_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004719 int err;
4720
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004721 err = sock_has_perm(sk, SOCKET__CONNECT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004722 if (err)
4723 return err;
4724
4725 /*
Richard Hainesd4529302018-02-13 20:57:18 +00004726 * If a TCP, DCCP or SCTP socket, check name_connect permission
4727 * for the port.
Linus Torvalds1da177e2005-04-16 15:20:36 -07004728 */
Paul Moore253bfae2010-04-22 14:46:19 -04004729 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
Richard Hainesd4529302018-02-13 20:57:18 +00004730 sksec->sclass == SECCLASS_DCCP_SOCKET ||
4731 sksec->sclass == SECCLASS_SCTP_SOCKET) {
Thomas Liu2bf49692009-07-14 12:14:09 -04004732 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004733 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004734 struct sockaddr_in *addr4 = NULL;
4735 struct sockaddr_in6 *addr6 = NULL;
4736 unsigned short snum;
James Morris2ee92d42006-11-13 16:09:01 -08004737 u32 sid, perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004738
Richard Hainesd4529302018-02-13 20:57:18 +00004739 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4740 * that validates multiple connect addresses. Because of this
4741 * need to check address->sa_family as it is possible to have
4742 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4743 */
Richard Haines68741a8a2018-03-02 19:54:34 +00004744 switch (address->sa_family) {
4745 case AF_INET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004746 addr4 = (struct sockaddr_in *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07004747 if (addrlen < sizeof(struct sockaddr_in))
Linus Torvalds1da177e2005-04-16 15:20:36 -07004748 return -EINVAL;
4749 snum = ntohs(addr4->sin_port);
Richard Haines68741a8a2018-03-02 19:54:34 +00004750 break;
4751 case AF_INET6:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004752 addr6 = (struct sockaddr_in6 *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07004753 if (addrlen < SIN6_LEN_RFC2133)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004754 return -EINVAL;
4755 snum = ntohs(addr6->sin6_port);
Richard Haines68741a8a2018-03-02 19:54:34 +00004756 break;
4757 default:
4758 /* Note that SCTP services expect -EINVAL, whereas
4759 * others expect -EAFNOSUPPORT.
4760 */
4761 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4762 return -EINVAL;
4763 else
4764 return -EAFNOSUPPORT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004765 }
4766
Paul Moore3e1121722008-04-10 10:48:14 -04004767 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004768 if (err)
Richard Hainesd4529302018-02-13 20:57:18 +00004769 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004770
Richard Hainesd4529302018-02-13 20:57:18 +00004771 switch (sksec->sclass) {
4772 case SECCLASS_TCP_SOCKET:
4773 perm = TCP_SOCKET__NAME_CONNECT;
4774 break;
4775 case SECCLASS_DCCP_SOCKET:
4776 perm = DCCP_SOCKET__NAME_CONNECT;
4777 break;
4778 case SECCLASS_SCTP_SOCKET:
4779 perm = SCTP_SOCKET__NAME_CONNECT;
4780 break;
4781 }
James Morris2ee92d42006-11-13 16:09:01 -08004782
Eric Paris50c205f2012-04-04 15:01:43 -04004783 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004784 ad.u.net = &net;
4785 ad.u.net->dport = htons(snum);
4786 ad.u.net->family = sk->sk_family;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004787 err = avc_has_perm(&selinux_state,
4788 sksec->sid, sid, sksec->sclass, perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004789 if (err)
Richard Hainesd4529302018-02-13 20:57:18 +00004790 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004791 }
4792
Richard Hainesd4529302018-02-13 20:57:18 +00004793 return 0;
4794}
Paul Moore014ab192008-10-10 10:16:33 -04004795
Richard Hainesd4529302018-02-13 20:57:18 +00004796/* Supports connect(2), see comments in selinux_socket_connect_helper() */
4797static int selinux_socket_connect(struct socket *sock,
4798 struct sockaddr *address, int addrlen)
4799{
4800 int err;
4801 struct sock *sk = sock->sk;
4802
4803 err = selinux_socket_connect_helper(sock, address, addrlen);
4804 if (err)
4805 return err;
4806
4807 return selinux_netlbl_socket_connect(sk, address);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004808}
4809
4810static int selinux_socket_listen(struct socket *sock, int backlog)
4811{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004812 return sock_has_perm(sock->sk, SOCKET__LISTEN);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004813}
4814
4815static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4816{
4817 int err;
4818 struct inode_security_struct *isec;
4819 struct inode_security_struct *newisec;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004820 u16 sclass;
4821 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004822
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004823 err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004824 if (err)
4825 return err;
4826
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05004827 isec = inode_security_novalidate(SOCK_INODE(sock));
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004828 spin_lock(&isec->lock);
4829 sclass = isec->sclass;
4830 sid = isec->sid;
4831 spin_unlock(&isec->lock);
4832
4833 newisec = inode_security_novalidate(SOCK_INODE(newsock));
4834 newisec->sclass = sclass;
4835 newisec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05004836 newisec->initialized = LABEL_INITIALIZED;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004837
4838 return 0;
4839}
4840
4841static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
Eric Paris828dfe12008-04-17 13:17:49 -04004842 int size)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004843{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004844 return sock_has_perm(sock->sk, SOCKET__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004845}
4846
4847static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4848 int size, int flags)
4849{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004850 return sock_has_perm(sock->sk, SOCKET__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004851}
4852
4853static int selinux_socket_getsockname(struct socket *sock)
4854{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004855 return sock_has_perm(sock->sk, SOCKET__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004856}
4857
4858static int selinux_socket_getpeername(struct socket *sock)
4859{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004860 return sock_has_perm(sock->sk, SOCKET__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004861}
4862
Eric Paris828dfe12008-04-17 13:17:49 -04004863static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004864{
Paul Mooref8687af2006-10-30 15:22:15 -08004865 int err;
4866
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004867 err = sock_has_perm(sock->sk, SOCKET__SETOPT);
Paul Mooref8687af2006-10-30 15:22:15 -08004868 if (err)
4869 return err;
4870
4871 return selinux_netlbl_socket_setsockopt(sock, level, optname);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004872}
4873
4874static int selinux_socket_getsockopt(struct socket *sock, int level,
4875 int optname)
4876{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004877 return sock_has_perm(sock->sk, SOCKET__GETOPT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004878}
4879
4880static int selinux_socket_shutdown(struct socket *sock, int how)
4881{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004882 return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004883}
4884
David S. Miller3610cda2011-01-05 15:38:53 -08004885static int selinux_socket_unix_stream_connect(struct sock *sock,
4886 struct sock *other,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004887 struct sock *newsk)
4888{
David S. Miller3610cda2011-01-05 15:38:53 -08004889 struct sk_security_struct *sksec_sock = sock->sk_security;
4890 struct sk_security_struct *sksec_other = other->sk_security;
Paul Moore4d1e2452010-04-22 14:46:18 -04004891 struct sk_security_struct *sksec_new = newsk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004892 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004893 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004894 int err;
4895
Eric Paris50c205f2012-04-04 15:01:43 -04004896 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004897 ad.u.net = &net;
4898 ad.u.net->sk = other;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004899
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004900 err = avc_has_perm(&selinux_state,
4901 sksec_sock->sid, sksec_other->sid,
Paul Moore4d1e2452010-04-22 14:46:18 -04004902 sksec_other->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004903 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4904 if (err)
4905 return err;
4906
Linus Torvalds1da177e2005-04-16 15:20:36 -07004907 /* server child socket */
Paul Moore4d1e2452010-04-22 14:46:18 -04004908 sksec_new->peer_sid = sksec_sock->sid;
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004909 err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
4910 sksec_sock->sid, &sksec_new->sid);
Paul Moore4d1e2452010-04-22 14:46:18 -04004911 if (err)
4912 return err;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004913
Paul Moore4d1e2452010-04-22 14:46:18 -04004914 /* connecting socket */
4915 sksec_sock->peer_sid = sksec_new->sid;
4916
4917 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004918}
4919
4920static int selinux_socket_unix_may_send(struct socket *sock,
4921 struct socket *other)
4922{
Paul Moore253bfae2010-04-22 14:46:19 -04004923 struct sk_security_struct *ssec = sock->sk->sk_security;
4924 struct sk_security_struct *osec = other->sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004925 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004926 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004927
Eric Paris50c205f2012-04-04 15:01:43 -04004928 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004929 ad.u.net = &net;
4930 ad.u.net->sk = other->sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004931
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004932 return avc_has_perm(&selinux_state,
4933 ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
Paul Moore253bfae2010-04-22 14:46:19 -04004934 &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004935}
4936
Paul Moorecbe0d6e2014-09-10 17:09:57 -04004937static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4938 char *addrp, u16 family, u32 peer_sid,
Thomas Liu2bf49692009-07-14 12:14:09 -04004939 struct common_audit_data *ad)
Paul Mooreeffad8d2008-01-29 08:49:27 -05004940{
4941 int err;
4942 u32 if_sid;
4943 u32 node_sid;
4944
Paul Moorecbe0d6e2014-09-10 17:09:57 -04004945 err = sel_netif_sid(ns, ifindex, &if_sid);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004946 if (err)
4947 return err;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004948 err = avc_has_perm(&selinux_state,
4949 peer_sid, if_sid,
Paul Mooreeffad8d2008-01-29 08:49:27 -05004950 SECCLASS_NETIF, NETIF__INGRESS, ad);
4951 if (err)
4952 return err;
4953
4954 err = sel_netnode_sid(addrp, family, &node_sid);
4955 if (err)
4956 return err;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004957 return avc_has_perm(&selinux_state,
4958 peer_sid, node_sid,
Paul Mooreeffad8d2008-01-29 08:49:27 -05004959 SECCLASS_NODE, NODE__RECVFROM, ad);
4960}
4961
Paul Moore220deb92008-01-29 08:38:23 -05004962static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
Paul Moored8395c82008-10-10 10:16:30 -04004963 u16 family)
Paul Moore220deb92008-01-29 08:38:23 -05004964{
Paul Moore277d3422008-12-31 12:54:11 -05004965 int err = 0;
Paul Moore220deb92008-01-29 08:38:23 -05004966 struct sk_security_struct *sksec = sk->sk_security;
Paul Moore220deb92008-01-29 08:38:23 -05004967 u32 sk_sid = sksec->sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04004968 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004969 struct lsm_network_audit net = {0,};
Paul Moored8395c82008-10-10 10:16:30 -04004970 char *addrp;
4971
Eric Paris50c205f2012-04-04 15:01:43 -04004972 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004973 ad.u.net = &net;
4974 ad.u.net->netif = skb->skb_iif;
4975 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04004976 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4977 if (err)
4978 return err;
Paul Moore220deb92008-01-29 08:38:23 -05004979
Paul Moore58bfbb52009-03-27 17:10:41 -04004980 if (selinux_secmark_enabled()) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004981 err = avc_has_perm(&selinux_state,
4982 sk_sid, skb->secmark, SECCLASS_PACKET,
Paul Moored8395c82008-10-10 10:16:30 -04004983 PACKET__RECV, &ad);
Paul Moore58bfbb52009-03-27 17:10:41 -04004984 if (err)
4985 return err;
4986 }
Paul Moore220deb92008-01-29 08:38:23 -05004987
Steffen Klassertb9679a72011-02-23 12:55:21 +01004988 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4989 if (err)
4990 return err;
4991 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004992
James Morris4e5ab4c2006-06-09 00:33:33 -07004993 return err;
4994}
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004995
James Morris4e5ab4c2006-06-09 00:33:33 -07004996static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4997{
Paul Moore220deb92008-01-29 08:38:23 -05004998 int err;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004999 struct sk_security_struct *sksec = sk->sk_security;
Paul Moore220deb92008-01-29 08:38:23 -05005000 u16 family = sk->sk_family;
5001 u32 sk_sid = sksec->sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04005002 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005003 struct lsm_network_audit net = {0,};
Paul Moore220deb92008-01-29 08:38:23 -05005004 char *addrp;
Paul Moored8395c82008-10-10 10:16:30 -04005005 u8 secmark_active;
5006 u8 peerlbl_active;
James Morris4e5ab4c2006-06-09 00:33:33 -07005007
James Morris4e5ab4c2006-06-09 00:33:33 -07005008 if (family != PF_INET && family != PF_INET6)
Paul Moore220deb92008-01-29 08:38:23 -05005009 return 0;
James Morris4e5ab4c2006-06-09 00:33:33 -07005010
5011 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
Al Viro87fcd702006-12-04 22:00:55 +00005012 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
James Morris4e5ab4c2006-06-09 00:33:33 -07005013 family = PF_INET;
5014
Paul Moored8395c82008-10-10 10:16:30 -04005015 /* If any sort of compatibility mode is enabled then handoff processing
5016 * to the selinux_sock_rcv_skb_compat() function to deal with the
5017 * special handling. We do this in an attempt to keep this function
5018 * as fast and as clean as possible. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005019 if (!selinux_policycap_netpeer())
Paul Moored8395c82008-10-10 10:16:30 -04005020 return selinux_sock_rcv_skb_compat(sk, skb, family);
5021
5022 secmark_active = selinux_secmark_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04005023 peerlbl_active = selinux_peerlbl_enabled();
Paul Moored8395c82008-10-10 10:16:30 -04005024 if (!secmark_active && !peerlbl_active)
5025 return 0;
5026
Eric Paris50c205f2012-04-04 15:01:43 -04005027 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005028 ad.u.net = &net;
5029 ad.u.net->netif = skb->skb_iif;
5030 ad.u.net->family = family;
Paul Moore224dfbd2008-01-29 08:38:13 -05005031 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
James Morris4e5ab4c2006-06-09 00:33:33 -07005032 if (err)
Paul Moore220deb92008-01-29 08:38:23 -05005033 return err;
James Morris4e5ab4c2006-06-09 00:33:33 -07005034
Paul Moored8395c82008-10-10 10:16:30 -04005035 if (peerlbl_active) {
Paul Moored621d352008-01-29 08:43:36 -05005036 u32 peer_sid;
5037
5038 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
5039 if (err)
5040 return err;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005041 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
5042 addrp, family, peer_sid, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04005043 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04005044 selinux_netlbl_err(skb, family, err, 0);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005045 return err;
Paul Mooredfaebe92008-10-10 10:16:31 -04005046 }
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005047 err = avc_has_perm(&selinux_state,
5048 sk_sid, peer_sid, SECCLASS_PEER,
Paul Moored621d352008-01-29 08:43:36 -05005049 PEER__RECV, &ad);
Chad Hanson46d01d62013-12-23 17:45:01 -05005050 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04005051 selinux_netlbl_err(skb, family, err, 0);
Chad Hanson46d01d62013-12-23 17:45:01 -05005052 return err;
5053 }
Paul Moored621d352008-01-29 08:43:36 -05005054 }
5055
Paul Moored8395c82008-10-10 10:16:30 -04005056 if (secmark_active) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005057 err = avc_has_perm(&selinux_state,
5058 sk_sid, skb->secmark, SECCLASS_PACKET,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005059 PACKET__RECV, &ad);
5060 if (err)
5061 return err;
5062 }
5063
Paul Moored621d352008-01-29 08:43:36 -05005064 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005065}
5066
Catherine Zhang2c7946a2006-03-20 22:41:23 -08005067static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
5068 int __user *optlen, unsigned len)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005069{
5070 int err = 0;
5071 char *scontext;
5072 u32 scontext_len;
Paul Moore253bfae2010-04-22 14:46:19 -04005073 struct sk_security_struct *sksec = sock->sk->sk_security;
Paul Moore3de4bab2006-11-17 17:38:54 -05005074 u32 peer_sid = SECSID_NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005075
Paul Moore253bfae2010-04-22 14:46:19 -04005076 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
Richard Hainesd4529302018-02-13 20:57:18 +00005077 sksec->sclass == SECCLASS_TCP_SOCKET ||
5078 sksec->sclass == SECCLASS_SCTP_SOCKET)
Eric Parisdd3e7832010-04-07 15:08:46 -04005079 peer_sid = sksec->peer_sid;
Paul Moore253bfae2010-04-22 14:46:19 -04005080 if (peer_sid == SECSID_NULL)
5081 return -ENOPROTOOPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005082
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005083 err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
5084 &scontext_len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005085 if (err)
Paul Moore253bfae2010-04-22 14:46:19 -04005086 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005087
5088 if (scontext_len > len) {
5089 err = -ERANGE;
5090 goto out_len;
5091 }
5092
5093 if (copy_to_user(optval, scontext, scontext_len))
5094 err = -EFAULT;
5095
5096out_len:
5097 if (put_user(scontext_len, optlen))
5098 err = -EFAULT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005099 kfree(scontext);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005100 return err;
5101}
5102
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005103static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
Catherine Zhang2c7946a2006-03-20 22:41:23 -08005104{
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005105 u32 peer_secid = SECSID_NULL;
Paul Moore75e22912008-01-29 08:38:04 -05005106 u16 family;
Paul Moore899134f2016-03-28 15:19:10 -04005107 struct inode_security_struct *isec;
Catherine Zhang877ce7c2006-06-29 12:27:47 -07005108
Paul Mooreaa862902008-10-10 10:16:29 -04005109 if (skb && skb->protocol == htons(ETH_P_IP))
5110 family = PF_INET;
5111 else if (skb && skb->protocol == htons(ETH_P_IPV6))
5112 family = PF_INET6;
5113 else if (sock)
Paul Moore75e22912008-01-29 08:38:04 -05005114 family = sock->sk->sk_family;
Paul Moore75e22912008-01-29 08:38:04 -05005115 else
5116 goto out;
5117
Paul Moore899134f2016-03-28 15:19:10 -04005118 if (sock && family == PF_UNIX) {
5119 isec = inode_security_novalidate(SOCK_INODE(sock));
5120 peer_secid = isec->sid;
5121 } else if (skb)
Paul Moore220deb92008-01-29 08:38:23 -05005122 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
Catherine Zhang2c7946a2006-03-20 22:41:23 -08005123
Paul Moore75e22912008-01-29 08:38:04 -05005124out:
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005125 *secid = peer_secid;
Paul Moore75e22912008-01-29 08:38:04 -05005126 if (peer_secid == SECSID_NULL)
5127 return -EINVAL;
5128 return 0;
Catherine Zhang2c7946a2006-03-20 22:41:23 -08005129}
5130
Al Viro7d877f32005-10-21 03:20:43 -04005131static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005132{
Paul Moore84914b72010-04-22 14:46:18 -04005133 struct sk_security_struct *sksec;
5134
5135 sksec = kzalloc(sizeof(*sksec), priority);
5136 if (!sksec)
5137 return -ENOMEM;
5138
5139 sksec->peer_sid = SECINITSID_UNLABELED;
5140 sksec->sid = SECINITSID_UNLABELED;
Stephen Smalley5dee25d2015-07-10 17:19:57 -04005141 sksec->sclass = SECCLASS_SOCKET;
Paul Moore84914b72010-04-22 14:46:18 -04005142 selinux_netlbl_sk_security_reset(sksec);
5143 sk->sk_security = sksec;
5144
5145 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005146}
5147
5148static void selinux_sk_free_security(struct sock *sk)
5149{
Paul Moore84914b72010-04-22 14:46:18 -04005150 struct sk_security_struct *sksec = sk->sk_security;
5151
5152 sk->sk_security = NULL;
5153 selinux_netlbl_sk_security_free(sksec);
5154 kfree(sksec);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005155}
5156
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005157static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5158{
Eric Parisdd3e7832010-04-07 15:08:46 -04005159 struct sk_security_struct *sksec = sk->sk_security;
5160 struct sk_security_struct *newsksec = newsk->sk_security;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005161
Eric Parisdd3e7832010-04-07 15:08:46 -04005162 newsksec->sid = sksec->sid;
5163 newsksec->peer_sid = sksec->peer_sid;
5164 newsksec->sclass = sksec->sclass;
Paul Moore99f59ed2006-08-29 17:53:48 -07005165
Eric Parisdd3e7832010-04-07 15:08:46 -04005166 selinux_netlbl_sk_security_reset(newsksec);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005167}
5168
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07005169static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005170{
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005171 if (!sk)
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07005172 *secid = SECINITSID_ANY_SOCKET;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005173 else {
5174 struct sk_security_struct *sksec = sk->sk_security;
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005175
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07005176 *secid = sksec->sid;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005177 }
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005178}
5179
Eric Paris828dfe12008-04-17 13:17:49 -04005180static void selinux_sock_graft(struct sock *sk, struct socket *parent)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005181{
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05005182 struct inode_security_struct *isec =
5183 inode_security_novalidate(SOCK_INODE(parent));
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005184 struct sk_security_struct *sksec = sk->sk_security;
5185
Paul Moore2873ead2014-07-28 10:42:48 -04005186 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5187 sk->sk_family == PF_UNIX)
David Woodhouse2148ccc2006-09-29 15:50:25 -07005188 isec->sid = sksec->sid;
Paul Moore220deb92008-01-29 08:38:23 -05005189 sksec->sclass = isec->sclass;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005190}
5191
Richard Hainesd4529302018-02-13 20:57:18 +00005192/* Called whenever SCTP receives an INIT chunk. This happens when an incoming
5193 * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
5194 * already present).
5195 */
5196static int selinux_sctp_assoc_request(struct sctp_endpoint *ep,
5197 struct sk_buff *skb)
5198{
5199 struct sk_security_struct *sksec = ep->base.sk->sk_security;
5200 struct common_audit_data ad;
5201 struct lsm_network_audit net = {0,};
5202 u8 peerlbl_active;
5203 u32 peer_sid = SECINITSID_UNLABELED;
5204 u32 conn_sid;
5205 int err = 0;
5206
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005207 if (!selinux_policycap_extsockclass())
Richard Hainesd4529302018-02-13 20:57:18 +00005208 return 0;
5209
5210 peerlbl_active = selinux_peerlbl_enabled();
5211
5212 if (peerlbl_active) {
5213 /* This will return peer_sid = SECSID_NULL if there are
5214 * no peer labels, see security_net_peersid_resolve().
5215 */
5216 err = selinux_skb_peerlbl_sid(skb, ep->base.sk->sk_family,
5217 &peer_sid);
5218 if (err)
5219 return err;
5220
5221 if (peer_sid == SECSID_NULL)
5222 peer_sid = SECINITSID_UNLABELED;
5223 }
5224
5225 if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5226 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5227
5228 /* Here as first association on socket. As the peer SID
5229 * was allowed by peer recv (and the netif/node checks),
5230 * then it is approved by policy and used as the primary
5231 * peer SID for getpeercon(3).
5232 */
5233 sksec->peer_sid = peer_sid;
5234 } else if (sksec->peer_sid != peer_sid) {
5235 /* Other association peer SIDs are checked to enforce
5236 * consistency among the peer SIDs.
5237 */
5238 ad.type = LSM_AUDIT_DATA_NET;
5239 ad.u.net = &net;
5240 ad.u.net->sk = ep->base.sk;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005241 err = avc_has_perm(&selinux_state,
5242 sksec->peer_sid, peer_sid, sksec->sclass,
Richard Hainesd4529302018-02-13 20:57:18 +00005243 SCTP_SOCKET__ASSOCIATION, &ad);
5244 if (err)
5245 return err;
5246 }
5247
5248 /* Compute the MLS component for the connection and store
5249 * the information in ep. This will be used by SCTP TCP type
5250 * sockets and peeled off connections as they cause a new
5251 * socket to be generated. selinux_sctp_sk_clone() will then
5252 * plug this into the new socket.
5253 */
5254 err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
5255 if (err)
5256 return err;
5257
5258 ep->secid = conn_sid;
5259 ep->peer_secid = peer_sid;
5260
5261 /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5262 return selinux_netlbl_sctp_assoc_request(ep, skb);
5263}
5264
5265/* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5266 * based on their @optname.
5267 */
5268static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5269 struct sockaddr *address,
5270 int addrlen)
5271{
5272 int len, err = 0, walk_size = 0;
5273 void *addr_buf;
5274 struct sockaddr *addr;
5275 struct socket *sock;
5276
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005277 if (!selinux_policycap_extsockclass())
Richard Hainesd4529302018-02-13 20:57:18 +00005278 return 0;
5279
5280 /* Process one or more addresses that may be IPv4 or IPv6 */
5281 sock = sk->sk_socket;
5282 addr_buf = address;
5283
5284 while (walk_size < addrlen) {
5285 addr = addr_buf;
5286 switch (addr->sa_family) {
5287 case AF_INET:
5288 len = sizeof(struct sockaddr_in);
5289 break;
5290 case AF_INET6:
5291 len = sizeof(struct sockaddr_in6);
5292 break;
5293 default:
5294 return -EAFNOSUPPORT;
5295 }
5296
5297 err = -EINVAL;
5298 switch (optname) {
5299 /* Bind checks */
5300 case SCTP_PRIMARY_ADDR:
5301 case SCTP_SET_PEER_PRIMARY_ADDR:
5302 case SCTP_SOCKOPT_BINDX_ADD:
5303 err = selinux_socket_bind(sock, addr, len);
5304 break;
5305 /* Connect checks */
5306 case SCTP_SOCKOPT_CONNECTX:
5307 case SCTP_PARAM_SET_PRIMARY:
5308 case SCTP_PARAM_ADD_IP:
5309 case SCTP_SENDMSG_CONNECT:
5310 err = selinux_socket_connect_helper(sock, addr, len);
5311 if (err)
5312 return err;
5313
5314 /* As selinux_sctp_bind_connect() is called by the
5315 * SCTP protocol layer, the socket is already locked,
5316 * therefore selinux_netlbl_socket_connect_locked() is
5317 * is called here. The situations handled are:
5318 * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5319 * whenever a new IP address is added or when a new
5320 * primary address is selected.
5321 * Note that an SCTP connect(2) call happens before
5322 * the SCTP protocol layer and is handled via
5323 * selinux_socket_connect().
5324 */
5325 err = selinux_netlbl_socket_connect_locked(sk, addr);
5326 break;
5327 }
5328
5329 if (err)
5330 return err;
5331
5332 addr_buf += len;
5333 walk_size += len;
5334 }
5335
5336 return 0;
5337}
5338
5339/* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5340static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
5341 struct sock *newsk)
5342{
5343 struct sk_security_struct *sksec = sk->sk_security;
5344 struct sk_security_struct *newsksec = newsk->sk_security;
5345
5346 /* If policy does not support SECCLASS_SCTP_SOCKET then call
5347 * the non-sctp clone version.
5348 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005349 if (!selinux_policycap_extsockclass())
Richard Hainesd4529302018-02-13 20:57:18 +00005350 return selinux_sk_clone_security(sk, newsk);
5351
5352 newsksec->sid = ep->secid;
5353 newsksec->peer_sid = ep->peer_secid;
5354 newsksec->sclass = sksec->sclass;
5355 selinux_netlbl_sctp_sk_clone(sk, newsk);
5356}
5357
Adrian Bunk9a673e52006-08-15 00:03:53 -07005358static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
5359 struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005360{
5361 struct sk_security_struct *sksec = sk->sk_security;
5362 int err;
Paul Moore0b1f24e2013-12-03 11:39:13 -05005363 u16 family = req->rsk_ops->family;
Paul Moore446b8022013-12-04 16:10:51 -05005364 u32 connsid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005365 u32 peersid;
5366
Paul Mooreaa862902008-10-10 10:16:29 -04005367 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
Paul Moore220deb92008-01-29 08:38:23 -05005368 if (err)
5369 return err;
Paul Moore446b8022013-12-04 16:10:51 -05005370 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5371 if (err)
5372 return err;
5373 req->secid = connsid;
5374 req->peer_secid = peersid;
Venkat Yekkiralaa51c64f2006-07-27 22:01:34 -07005375
Paul Moore389fb8002009-03-27 17:10:34 -04005376 return selinux_netlbl_inet_conn_request(req, family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005377}
5378
Adrian Bunk9a673e52006-08-15 00:03:53 -07005379static void selinux_inet_csk_clone(struct sock *newsk,
5380 const struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005381{
5382 struct sk_security_struct *newsksec = newsk->sk_security;
5383
5384 newsksec->sid = req->secid;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005385 newsksec->peer_sid = req->peer_secid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005386 /* NOTE: Ideally, we should also get the isec->sid for the
5387 new socket in sync, but we don't have the isec available yet.
5388 So we will wait until sock_graft to do it, by which
5389 time it will have been created and available. */
Paul Moore99f59ed2006-08-29 17:53:48 -07005390
Paul Moore9f2ad662006-11-17 17:38:53 -05005391 /* We don't need to take any sort of lock here as we are the only
5392 * thread with access to newsksec */
Paul Moore389fb8002009-03-27 17:10:34 -04005393 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005394}
5395
Paul Moore014ab192008-10-10 10:16:33 -04005396static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005397{
Paul Mooreaa862902008-10-10 10:16:29 -04005398 u16 family = sk->sk_family;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005399 struct sk_security_struct *sksec = sk->sk_security;
5400
Paul Mooreaa862902008-10-10 10:16:29 -04005401 /* handle mapped IPv4 packets arriving via IPv6 sockets */
5402 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5403 family = PF_INET;
5404
5405 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005406}
5407
Eric Paris2606fd12010-10-13 16:24:41 -04005408static int selinux_secmark_relabel_packet(u32 sid)
5409{
5410 const struct task_security_struct *__tsec;
5411 u32 tsid;
5412
5413 __tsec = current_security();
5414 tsid = __tsec->sid;
5415
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005416 return avc_has_perm(&selinux_state,
5417 tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5418 NULL);
Eric Paris2606fd12010-10-13 16:24:41 -04005419}
5420
5421static void selinux_secmark_refcount_inc(void)
5422{
5423 atomic_inc(&selinux_secmark_refcount);
5424}
5425
5426static void selinux_secmark_refcount_dec(void)
5427{
5428 atomic_dec(&selinux_secmark_refcount);
5429}
5430
Adrian Bunk9a673e52006-08-15 00:03:53 -07005431static void selinux_req_classify_flow(const struct request_sock *req,
5432 struct flowi *fl)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005433{
David S. Miller1d28f422011-03-12 00:29:39 -05005434 fl->flowi_secid = req->secid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005435}
5436
Paul Moore5dbbaf22013-01-14 07:12:19 +00005437static int selinux_tun_dev_alloc_security(void **security)
5438{
5439 struct tun_security_struct *tunsec;
5440
5441 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5442 if (!tunsec)
5443 return -ENOMEM;
5444 tunsec->sid = current_sid();
5445
5446 *security = tunsec;
5447 return 0;
5448}
5449
5450static void selinux_tun_dev_free_security(void *security)
5451{
5452 kfree(security);
5453}
5454
Paul Mooreed6d76e2009-08-28 18:12:49 -04005455static int selinux_tun_dev_create(void)
5456{
5457 u32 sid = current_sid();
5458
5459 /* we aren't taking into account the "sockcreate" SID since the socket
5460 * that is being created here is not a socket in the traditional sense,
5461 * instead it is a private sock, accessible only to the kernel, and
5462 * representing a wide range of network traffic spanning multiple
5463 * connections unlike traditional sockets - check the TUN driver to
5464 * get a better understanding of why this socket is special */
5465
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005466 return avc_has_perm(&selinux_state,
5467 sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
Paul Mooreed6d76e2009-08-28 18:12:49 -04005468 NULL);
5469}
5470
Paul Moore5dbbaf22013-01-14 07:12:19 +00005471static int selinux_tun_dev_attach_queue(void *security)
Paul Mooreed6d76e2009-08-28 18:12:49 -04005472{
Paul Moore5dbbaf22013-01-14 07:12:19 +00005473 struct tun_security_struct *tunsec = security;
5474
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005475 return avc_has_perm(&selinux_state,
5476 current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
Paul Moore5dbbaf22013-01-14 07:12:19 +00005477 TUN_SOCKET__ATTACH_QUEUE, NULL);
5478}
5479
5480static int selinux_tun_dev_attach(struct sock *sk, void *security)
5481{
5482 struct tun_security_struct *tunsec = security;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005483 struct sk_security_struct *sksec = sk->sk_security;
5484
5485 /* we don't currently perform any NetLabel based labeling here and it
5486 * isn't clear that we would want to do so anyway; while we could apply
5487 * labeling without the support of the TUN user the resulting labeled
5488 * traffic from the other end of the connection would almost certainly
5489 * cause confusion to the TUN user that had no idea network labeling
5490 * protocols were being used */
5491
Paul Moore5dbbaf22013-01-14 07:12:19 +00005492 sksec->sid = tunsec->sid;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005493 sksec->sclass = SECCLASS_TUN_SOCKET;
Paul Moore5dbbaf22013-01-14 07:12:19 +00005494
5495 return 0;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005496}
5497
Paul Moore5dbbaf22013-01-14 07:12:19 +00005498static int selinux_tun_dev_open(void *security)
Paul Mooreed6d76e2009-08-28 18:12:49 -04005499{
Paul Moore5dbbaf22013-01-14 07:12:19 +00005500 struct tun_security_struct *tunsec = security;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005501 u32 sid = current_sid();
5502 int err;
5503
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005504 err = avc_has_perm(&selinux_state,
5505 sid, tunsec->sid, SECCLASS_TUN_SOCKET,
Paul Mooreed6d76e2009-08-28 18:12:49 -04005506 TUN_SOCKET__RELABELFROM, NULL);
5507 if (err)
5508 return err;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005509 err = avc_has_perm(&selinux_state,
5510 sid, sid, SECCLASS_TUN_SOCKET,
Paul Mooreed6d76e2009-08-28 18:12:49 -04005511 TUN_SOCKET__RELABELTO, NULL);
5512 if (err)
5513 return err;
Paul Moore5dbbaf22013-01-14 07:12:19 +00005514 tunsec->sid = sid;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005515
5516 return 0;
5517}
5518
Linus Torvalds1da177e2005-04-16 15:20:36 -07005519static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5520{
5521 int err = 0;
5522 u32 perm;
5523 struct nlmsghdr *nlh;
Paul Moore253bfae2010-04-22 14:46:19 -04005524 struct sk_security_struct *sksec = sk->sk_security;
Eric Paris828dfe12008-04-17 13:17:49 -04005525
Hong zhi guo77954982013-03-27 06:49:35 +00005526 if (skb->len < NLMSG_HDRLEN) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005527 err = -EINVAL;
5528 goto out;
5529 }
Arnaldo Carvalho de Melob529ccf2007-04-25 19:08:35 -07005530 nlh = nlmsg_hdr(skb);
Eric Paris828dfe12008-04-17 13:17:49 -04005531
Paul Moore253bfae2010-04-22 14:46:19 -04005532 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005533 if (err) {
5534 if (err == -EINVAL) {
Vladis Dronov76319942015-12-24 11:09:41 -05005535 pr_warn_ratelimited("SELinux: unrecognized netlink"
5536 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5537 " pig=%d comm=%s\n",
Marek Milkoviccded3ff2015-06-04 16:22:16 -04005538 sk->sk_protocol, nlh->nlmsg_type,
Vladis Dronov76319942015-12-24 11:09:41 -05005539 secclass_map[sksec->sclass - 1].name,
5540 task_pid_nr(current), current->comm);
Paul Mooree5a5ca92018-03-01 17:38:30 -05005541 if (!enforcing_enabled(&selinux_state) ||
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005542 security_get_allow_unknown(&selinux_state))
Linus Torvalds1da177e2005-04-16 15:20:36 -07005543 err = 0;
5544 }
5545
5546 /* Ignore */
5547 if (err == -ENOENT)
5548 err = 0;
5549 goto out;
5550 }
5551
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005552 err = sock_has_perm(sk, perm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005553out:
5554 return err;
5555}
5556
5557#ifdef CONFIG_NETFILTER
5558
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005559static unsigned int selinux_ip_forward(struct sk_buff *skb,
5560 const struct net_device *indev,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005561 u16 family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005562{
Paul Mooredfaebe92008-10-10 10:16:31 -04005563 int err;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005564 char *addrp;
5565 u32 peer_sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04005566 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005567 struct lsm_network_audit net = {0,};
Paul Mooreeffad8d2008-01-29 08:49:27 -05005568 u8 secmark_active;
Paul Moore948bf852008-10-10 10:16:32 -04005569 u8 netlbl_active;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005570 u8 peerlbl_active;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005571
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005572 if (!selinux_policycap_netpeer())
Paul Mooreeffad8d2008-01-29 08:49:27 -05005573 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005574
Paul Mooreeffad8d2008-01-29 08:49:27 -05005575 secmark_active = selinux_secmark_enabled();
Paul Moore948bf852008-10-10 10:16:32 -04005576 netlbl_active = netlbl_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04005577 peerlbl_active = selinux_peerlbl_enabled();
Paul Mooreeffad8d2008-01-29 08:49:27 -05005578 if (!secmark_active && !peerlbl_active)
5579 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005580
Paul Moored8395c82008-10-10 10:16:30 -04005581 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5582 return NF_DROP;
5583
Eric Paris50c205f2012-04-04 15:01:43 -04005584 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005585 ad.u.net = &net;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005586 ad.u.net->netif = indev->ifindex;
Eric Paris48c62af2012-04-02 13:15:44 -04005587 ad.u.net->family = family;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005588 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5589 return NF_DROP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005590
Paul Mooredfaebe92008-10-10 10:16:31 -04005591 if (peerlbl_active) {
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005592 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5593 addrp, family, peer_sid, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04005594 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04005595 selinux_netlbl_err(skb, family, err, 1);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005596 return NF_DROP;
Paul Mooredfaebe92008-10-10 10:16:31 -04005597 }
5598 }
Paul Mooreeffad8d2008-01-29 08:49:27 -05005599
5600 if (secmark_active)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005601 if (avc_has_perm(&selinux_state,
5602 peer_sid, skb->secmark,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005603 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5604 return NF_DROP;
5605
Paul Moore948bf852008-10-10 10:16:32 -04005606 if (netlbl_active)
5607 /* we do this in the FORWARD path and not the POST_ROUTING
5608 * path because we want to make sure we apply the necessary
5609 * labeling before IPsec is applied so we can leverage AH
5610 * protection */
5611 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5612 return NF_DROP;
5613
Paul Mooreeffad8d2008-01-29 08:49:27 -05005614 return NF_ACCEPT;
5615}
5616
Eric W. Biederman06198b32015-09-18 14:33:06 -05005617static unsigned int selinux_ipv4_forward(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005618 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005619 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005620{
David S. Miller238e54c2015-04-03 20:32:56 -04005621 return selinux_ip_forward(skb, state->in, PF_INET);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005622}
5623
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005624#if IS_ENABLED(CONFIG_IPV6)
Eric W. Biederman06198b32015-09-18 14:33:06 -05005625static unsigned int selinux_ipv6_forward(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005626 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005627 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005628{
David S. Miller238e54c2015-04-03 20:32:56 -04005629 return selinux_ip_forward(skb, state->in, PF_INET6);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005630}
5631#endif /* IPV6 */
5632
Paul Moore948bf852008-10-10 10:16:32 -04005633static unsigned int selinux_ip_output(struct sk_buff *skb,
5634 u16 family)
5635{
Paul Moore47180062013-12-04 16:10:45 -05005636 struct sock *sk;
Paul Moore948bf852008-10-10 10:16:32 -04005637 u32 sid;
5638
5639 if (!netlbl_enabled())
5640 return NF_ACCEPT;
5641
5642 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5643 * because we want to make sure we apply the necessary labeling
5644 * before IPsec is applied so we can leverage AH protection */
Paul Moore47180062013-12-04 16:10:45 -05005645 sk = skb->sk;
5646 if (sk) {
5647 struct sk_security_struct *sksec;
5648
Eric Dumazete446f9d2015-10-08 05:01:55 -07005649 if (sk_listener(sk))
Paul Moore47180062013-12-04 16:10:45 -05005650 /* if the socket is the listening state then this
5651 * packet is a SYN-ACK packet which means it needs to
5652 * be labeled based on the connection/request_sock and
5653 * not the parent socket. unfortunately, we can't
5654 * lookup the request_sock yet as it isn't queued on
5655 * the parent socket until after the SYN-ACK is sent.
5656 * the "solution" is to simply pass the packet as-is
5657 * as any IP option based labeling should be copied
5658 * from the initial connection request (in the IP
5659 * layer). it is far from ideal, but until we get a
5660 * security label in the packet itself this is the
5661 * best we can do. */
5662 return NF_ACCEPT;
5663
5664 /* standard practice, label using the parent socket */
5665 sksec = sk->sk_security;
Paul Moore948bf852008-10-10 10:16:32 -04005666 sid = sksec->sid;
5667 } else
5668 sid = SECINITSID_KERNEL;
5669 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5670 return NF_DROP;
5671
5672 return NF_ACCEPT;
5673}
5674
Eric W. Biederman06198b32015-09-18 14:33:06 -05005675static unsigned int selinux_ipv4_output(void *priv,
Paul Moore948bf852008-10-10 10:16:32 -04005676 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005677 const struct nf_hook_state *state)
Paul Moore948bf852008-10-10 10:16:32 -04005678{
5679 return selinux_ip_output(skb, PF_INET);
5680}
5681
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005682#if IS_ENABLED(CONFIG_IPV6)
Huw Davies2917f572016-06-27 15:06:15 -04005683static unsigned int selinux_ipv6_output(void *priv,
5684 struct sk_buff *skb,
5685 const struct nf_hook_state *state)
5686{
5687 return selinux_ip_output(skb, PF_INET6);
5688}
5689#endif /* IPV6 */
5690
Paul Mooreeffad8d2008-01-29 08:49:27 -05005691static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5692 int ifindex,
Paul Moored8395c82008-10-10 10:16:30 -04005693 u16 family)
James Morris4e5ab4c2006-06-09 00:33:33 -07005694{
Eric Dumazet54abc682015-11-08 10:54:07 -08005695 struct sock *sk = skb_to_full_sk(skb);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005696 struct sk_security_struct *sksec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005697 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005698 struct lsm_network_audit net = {0,};
Paul Moored8395c82008-10-10 10:16:30 -04005699 char *addrp;
5700 u8 proto;
James Morris4e5ab4c2006-06-09 00:33:33 -07005701
Paul Mooreeffad8d2008-01-29 08:49:27 -05005702 if (sk == NULL)
5703 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005704 sksec = sk->sk_security;
James Morris4e5ab4c2006-06-09 00:33:33 -07005705
Eric Paris50c205f2012-04-04 15:01:43 -04005706 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005707 ad.u.net = &net;
5708 ad.u.net->netif = ifindex;
5709 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04005710 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5711 return NF_DROP;
5712
Paul Moore58bfbb52009-03-27 17:10:41 -04005713 if (selinux_secmark_enabled())
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005714 if (avc_has_perm(&selinux_state,
5715 sksec->sid, skb->secmark,
Paul Moored8395c82008-10-10 10:16:30 -04005716 SECCLASS_PACKET, PACKET__SEND, &ad))
Eric Paris2fe66ec2010-11-23 06:28:08 +00005717 return NF_DROP_ERR(-ECONNREFUSED);
James Morris4e5ab4c2006-06-09 00:33:33 -07005718
Steffen Klassertb9679a72011-02-23 12:55:21 +01005719 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5720 return NF_DROP_ERR(-ECONNREFUSED);
James Morris4e5ab4c2006-06-09 00:33:33 -07005721
Paul Mooreeffad8d2008-01-29 08:49:27 -05005722 return NF_ACCEPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005723}
5724
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005725static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5726 const struct net_device *outdev,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005727 u16 family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005728{
Paul Mooreeffad8d2008-01-29 08:49:27 -05005729 u32 secmark_perm;
5730 u32 peer_sid;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005731 int ifindex = outdev->ifindex;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005732 struct sock *sk;
Thomas Liu2bf49692009-07-14 12:14:09 -04005733 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005734 struct lsm_network_audit net = {0,};
Paul Mooreeffad8d2008-01-29 08:49:27 -05005735 char *addrp;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005736 u8 secmark_active;
5737 u8 peerlbl_active;
5738
Paul Mooreeffad8d2008-01-29 08:49:27 -05005739 /* If any sort of compatibility mode is enabled then handoff processing
5740 * to the selinux_ip_postroute_compat() function to deal with the
5741 * special handling. We do this in an attempt to keep this function
5742 * as fast and as clean as possible. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005743 if (!selinux_policycap_netpeer())
Paul Moored8395c82008-10-10 10:16:30 -04005744 return selinux_ip_postroute_compat(skb, ifindex, family);
Paul Moorec0828e52013-12-10 14:58:01 -05005745
Paul Mooreeffad8d2008-01-29 08:49:27 -05005746 secmark_active = selinux_secmark_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04005747 peerlbl_active = selinux_peerlbl_enabled();
Paul Mooreeffad8d2008-01-29 08:49:27 -05005748 if (!secmark_active && !peerlbl_active)
5749 return NF_ACCEPT;
5750
Eric Dumazet54abc682015-11-08 10:54:07 -08005751 sk = skb_to_full_sk(skb);
Paul Moorec0828e52013-12-10 14:58:01 -05005752
Paul Mooreeffad8d2008-01-29 08:49:27 -05005753#ifdef CONFIG_XFRM
5754 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5755 * packet transformation so allow the packet to pass without any checks
5756 * since we'll have another chance to perform access control checks
5757 * when the packet is on it's final way out.
5758 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
Paul Moorec0828e52013-12-10 14:58:01 -05005759 * is NULL, in this case go ahead and apply access control.
5760 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5761 * TCP listening state we cannot wait until the XFRM processing
5762 * is done as we will miss out on the SA label if we do;
5763 * unfortunately, this means more work, but it is only once per
5764 * connection. */
5765 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
Eric Dumazete446f9d2015-10-08 05:01:55 -07005766 !(sk && sk_listener(sk)))
Paul Mooreeffad8d2008-01-29 08:49:27 -05005767 return NF_ACCEPT;
5768#endif
Paul Mooreeffad8d2008-01-29 08:49:27 -05005769
Paul Moored8395c82008-10-10 10:16:30 -04005770 if (sk == NULL) {
Paul Moore446b8022013-12-04 16:10:51 -05005771 /* Without an associated socket the packet is either coming
5772 * from the kernel or it is being forwarded; check the packet
5773 * to determine which and if the packet is being forwarded
5774 * query the packet directly to determine the security label. */
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005775 if (skb->skb_iif) {
5776 secmark_perm = PACKET__FORWARD_OUT;
Paul Moored8395c82008-10-10 10:16:30 -04005777 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005778 return NF_DROP;
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005779 } else {
5780 secmark_perm = PACKET__SEND;
Paul Moored8395c82008-10-10 10:16:30 -04005781 peer_sid = SECINITSID_KERNEL;
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005782 }
Eric Dumazete446f9d2015-10-08 05:01:55 -07005783 } else if (sk_listener(sk)) {
Paul Moore446b8022013-12-04 16:10:51 -05005784 /* Locally generated packet but the associated socket is in the
5785 * listening state which means this is a SYN-ACK packet. In
5786 * this particular case the correct security label is assigned
5787 * to the connection/request_sock but unfortunately we can't
5788 * query the request_sock as it isn't queued on the parent
5789 * socket until after the SYN-ACK packet is sent; the only
5790 * viable choice is to regenerate the label like we do in
5791 * selinux_inet_conn_request(). See also selinux_ip_output()
5792 * for similar problems. */
5793 u32 skb_sid;
Eric Dumazete446f9d2015-10-08 05:01:55 -07005794 struct sk_security_struct *sksec;
5795
Eric Dumazete446f9d2015-10-08 05:01:55 -07005796 sksec = sk->sk_security;
Paul Moore446b8022013-12-04 16:10:51 -05005797 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5798 return NF_DROP;
Paul Moorec0828e52013-12-10 14:58:01 -05005799 /* At this point, if the returned skb peerlbl is SECSID_NULL
5800 * and the packet has been through at least one XFRM
5801 * transformation then we must be dealing with the "final"
5802 * form of labeled IPsec packet; since we've already applied
5803 * all of our access controls on this packet we can safely
5804 * pass the packet. */
5805 if (skb_sid == SECSID_NULL) {
5806 switch (family) {
5807 case PF_INET:
5808 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5809 return NF_ACCEPT;
5810 break;
5811 case PF_INET6:
5812 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5813 return NF_ACCEPT;
Paul Moorea7a91a12014-09-03 10:51:59 -04005814 break;
Paul Moorec0828e52013-12-10 14:58:01 -05005815 default:
5816 return NF_DROP_ERR(-ECONNREFUSED);
5817 }
5818 }
Paul Moore446b8022013-12-04 16:10:51 -05005819 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5820 return NF_DROP;
5821 secmark_perm = PACKET__SEND;
Paul Moored8395c82008-10-10 10:16:30 -04005822 } else {
Paul Moore446b8022013-12-04 16:10:51 -05005823 /* Locally generated packet, fetch the security label from the
5824 * associated socket. */
Paul Mooreeffad8d2008-01-29 08:49:27 -05005825 struct sk_security_struct *sksec = sk->sk_security;
5826 peer_sid = sksec->sid;
5827 secmark_perm = PACKET__SEND;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005828 }
5829
Eric Paris50c205f2012-04-04 15:01:43 -04005830 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005831 ad.u.net = &net;
5832 ad.u.net->netif = ifindex;
5833 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04005834 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
Eric Paris04f6d702010-11-23 06:28:02 +00005835 return NF_DROP;
Paul Moored8395c82008-10-10 10:16:30 -04005836
Paul Mooreeffad8d2008-01-29 08:49:27 -05005837 if (secmark_active)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005838 if (avc_has_perm(&selinux_state,
5839 peer_sid, skb->secmark,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005840 SECCLASS_PACKET, secmark_perm, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005841 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005842
5843 if (peerlbl_active) {
5844 u32 if_sid;
5845 u32 node_sid;
5846
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005847 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005848 return NF_DROP;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005849 if (avc_has_perm(&selinux_state,
5850 peer_sid, if_sid,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005851 SECCLASS_NETIF, NETIF__EGRESS, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005852 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005853
5854 if (sel_netnode_sid(addrp, family, &node_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005855 return NF_DROP;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005856 if (avc_has_perm(&selinux_state,
5857 peer_sid, node_sid,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005858 SECCLASS_NODE, NODE__SENDTO, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005859 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005860 }
5861
5862 return NF_ACCEPT;
5863}
5864
Eric W. Biederman06198b32015-09-18 14:33:06 -05005865static unsigned int selinux_ipv4_postroute(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005866 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005867 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005868{
David S. Miller238e54c2015-04-03 20:32:56 -04005869 return selinux_ip_postroute(skb, state->out, PF_INET);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005870}
5871
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005872#if IS_ENABLED(CONFIG_IPV6)
Eric W. Biederman06198b32015-09-18 14:33:06 -05005873static unsigned int selinux_ipv6_postroute(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005874 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005875 const struct nf_hook_state *state)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005876{
David S. Miller238e54c2015-04-03 20:32:56 -04005877 return selinux_ip_postroute(skb, state->out, PF_INET6);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005878}
Linus Torvalds1da177e2005-04-16 15:20:36 -07005879#endif /* IPV6 */
5880
5881#endif /* CONFIG_NETFILTER */
5882
Linus Torvalds1da177e2005-04-16 15:20:36 -07005883static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5884{
Stephen Smalley941fc5b2009-10-01 14:48:23 -04005885 return selinux_nlmsg_perm(sk, skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005886}
5887
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005888static int ipc_alloc_security(struct kern_ipc_perm *perm,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005889 u16 sclass)
5890{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005891 struct ipc_security_struct *isec;
5892
James Morris89d155e2005-10-30 14:59:21 -08005893 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005894 if (!isec)
5895 return -ENOMEM;
5896
Linus Torvalds1da177e2005-04-16 15:20:36 -07005897 isec->sclass = sclass;
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005898 isec->sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005899 perm->security = isec;
5900
5901 return 0;
5902}
5903
5904static void ipc_free_security(struct kern_ipc_perm *perm)
5905{
5906 struct ipc_security_struct *isec = perm->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005907 perm->security = NULL;
5908 kfree(isec);
5909}
5910
5911static int msg_msg_alloc_security(struct msg_msg *msg)
5912{
5913 struct msg_security_struct *msec;
5914
James Morris89d155e2005-10-30 14:59:21 -08005915 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005916 if (!msec)
5917 return -ENOMEM;
5918
Linus Torvalds1da177e2005-04-16 15:20:36 -07005919 msec->sid = SECINITSID_UNLABELED;
5920 msg->security = msec;
5921
5922 return 0;
5923}
5924
5925static void msg_msg_free_security(struct msg_msg *msg)
5926{
5927 struct msg_security_struct *msec = msg->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005928
5929 msg->security = NULL;
5930 kfree(msec);
5931}
5932
5933static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
Stephen Smalley6af963f2005-05-01 08:58:39 -07005934 u32 perms)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005935{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005936 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005937 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005938 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005939
Linus Torvalds1da177e2005-04-16 15:20:36 -07005940 isec = ipc_perms->security;
5941
Eric Paris50c205f2012-04-04 15:01:43 -04005942 ad.type = LSM_AUDIT_DATA_IPC;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005943 ad.u.ipc_id = ipc_perms->key;
5944
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005945 return avc_has_perm(&selinux_state,
5946 sid, isec->sid, isec->sclass, perms, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005947}
5948
5949static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5950{
5951 return msg_msg_alloc_security(msg);
5952}
5953
5954static void selinux_msg_msg_free_security(struct msg_msg *msg)
5955{
5956 msg_msg_free_security(msg);
5957}
5958
5959/* message queue security operations */
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005960static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005961{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005962 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005963 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005964 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005965 int rc;
5966
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005967 rc = ipc_alloc_security(msq, SECCLASS_MSGQ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005968 if (rc)
5969 return rc;
5970
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005971 isec = msq->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005972
Eric Paris50c205f2012-04-04 15:01:43 -04005973 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005974 ad.u.ipc_id = msq->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005975
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005976 rc = avc_has_perm(&selinux_state,
5977 sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005978 MSGQ__CREATE, &ad);
5979 if (rc) {
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005980 ipc_free_security(msq);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005981 return rc;
5982 }
5983 return 0;
5984}
5985
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005986static void selinux_msg_queue_free_security(struct kern_ipc_perm *msq)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005987{
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005988 ipc_free_security(msq);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005989}
5990
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005991static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005992{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005993 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005994 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005995 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005996
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005997 isec = msq->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005998
Eric Paris50c205f2012-04-04 15:01:43 -04005999 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006000 ad.u.ipc_id = msq->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006001
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006002 return avc_has_perm(&selinux_state,
6003 sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006004 MSGQ__ASSOCIATE, &ad);
6005}
6006
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006007static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006008{
6009 int err;
6010 int perms;
6011
Eric Paris828dfe12008-04-17 13:17:49 -04006012 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006013 case IPC_INFO:
6014 case MSG_INFO:
6015 /* No specific object, just general system-wide information. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006016 return avc_has_perm(&selinux_state,
6017 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006018 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006019 case IPC_STAT:
6020 case MSG_STAT:
Davidlohr Bueso23c8cec2018-04-10 16:35:30 -07006021 case MSG_STAT_ANY:
Linus Torvalds1da177e2005-04-16 15:20:36 -07006022 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
6023 break;
6024 case IPC_SET:
6025 perms = MSGQ__SETATTR;
6026 break;
6027 case IPC_RMID:
6028 perms = MSGQ__DESTROY;
6029 break;
6030 default:
6031 return 0;
6032 }
6033
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006034 err = ipc_has_perm(msq, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006035 return err;
6036}
6037
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006038static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006039{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006040 struct ipc_security_struct *isec;
6041 struct msg_security_struct *msec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006042 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006043 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006044 int rc;
6045
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006046 isec = msq->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006047 msec = msg->security;
6048
6049 /*
6050 * First time through, need to assign label to the message
6051 */
6052 if (msec->sid == SECINITSID_UNLABELED) {
6053 /*
6054 * Compute new sid based on current process and
6055 * message queue this message will be stored in
6056 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006057 rc = security_transition_sid(&selinux_state, sid, isec->sid,
6058 SECCLASS_MSG, NULL, &msec->sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006059 if (rc)
6060 return rc;
6061 }
6062
Eric Paris50c205f2012-04-04 15:01:43 -04006063 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006064 ad.u.ipc_id = msq->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006065
6066 /* Can this process write to the queue? */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006067 rc = avc_has_perm(&selinux_state,
6068 sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006069 MSGQ__WRITE, &ad);
6070 if (!rc)
6071 /* Can this process send the message */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006072 rc = avc_has_perm(&selinux_state,
6073 sid, msec->sid, SECCLASS_MSG,
David Howells275bb412008-11-14 10:39:19 +11006074 MSG__SEND, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006075 if (!rc)
6076 /* Can the message be put in the queue? */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006077 rc = avc_has_perm(&selinux_state,
6078 msec->sid, isec->sid, SECCLASS_MSGQ,
David Howells275bb412008-11-14 10:39:19 +11006079 MSGQ__ENQUEUE, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006080
6081 return rc;
6082}
6083
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006084static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006085 struct task_struct *target,
6086 long type, int mode)
6087{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006088 struct ipc_security_struct *isec;
6089 struct msg_security_struct *msec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006090 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006091 u32 sid = task_sid(target);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006092 int rc;
6093
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006094 isec = msq->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006095 msec = msg->security;
6096
Eric Paris50c205f2012-04-04 15:01:43 -04006097 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006098 ad.u.ipc_id = msq->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006099
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006100 rc = avc_has_perm(&selinux_state,
6101 sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006102 SECCLASS_MSGQ, MSGQ__READ, &ad);
6103 if (!rc)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006104 rc = avc_has_perm(&selinux_state,
6105 sid, msec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006106 SECCLASS_MSG, MSG__RECEIVE, &ad);
6107 return rc;
6108}
6109
6110/* Shared Memory security operations */
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006111static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006112{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006113 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006114 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006115 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006116 int rc;
6117
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006118 rc = ipc_alloc_security(shp, SECCLASS_SHM);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006119 if (rc)
6120 return rc;
6121
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006122 isec = shp->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006123
Eric Paris50c205f2012-04-04 15:01:43 -04006124 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006125 ad.u.ipc_id = shp->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006126
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006127 rc = avc_has_perm(&selinux_state,
6128 sid, isec->sid, SECCLASS_SHM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006129 SHM__CREATE, &ad);
6130 if (rc) {
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006131 ipc_free_security(shp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006132 return rc;
6133 }
6134 return 0;
6135}
6136
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006137static void selinux_shm_free_security(struct kern_ipc_perm *shp)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006138{
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006139 ipc_free_security(shp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006140}
6141
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006142static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006143{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006144 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006145 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006146 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006147
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006148 isec = shp->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006149
Eric Paris50c205f2012-04-04 15:01:43 -04006150 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006151 ad.u.ipc_id = shp->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006152
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006153 return avc_has_perm(&selinux_state,
6154 sid, isec->sid, SECCLASS_SHM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006155 SHM__ASSOCIATE, &ad);
6156}
6157
6158/* Note, at this point, shp is locked down */
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006159static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006160{
6161 int perms;
6162 int err;
6163
Eric Paris828dfe12008-04-17 13:17:49 -04006164 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006165 case IPC_INFO:
6166 case SHM_INFO:
6167 /* No specific object, just general system-wide information. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006168 return avc_has_perm(&selinux_state,
6169 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006170 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006171 case IPC_STAT:
6172 case SHM_STAT:
Davidlohr Buesoc21a6972018-04-10 16:35:23 -07006173 case SHM_STAT_ANY:
Linus Torvalds1da177e2005-04-16 15:20:36 -07006174 perms = SHM__GETATTR | SHM__ASSOCIATE;
6175 break;
6176 case IPC_SET:
6177 perms = SHM__SETATTR;
6178 break;
6179 case SHM_LOCK:
6180 case SHM_UNLOCK:
6181 perms = SHM__LOCK;
6182 break;
6183 case IPC_RMID:
6184 perms = SHM__DESTROY;
6185 break;
6186 default:
6187 return 0;
6188 }
6189
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006190 err = ipc_has_perm(shp, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006191 return err;
6192}
6193
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006194static int selinux_shm_shmat(struct kern_ipc_perm *shp,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006195 char __user *shmaddr, int shmflg)
6196{
6197 u32 perms;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006198
6199 if (shmflg & SHM_RDONLY)
6200 perms = SHM__READ;
6201 else
6202 perms = SHM__READ | SHM__WRITE;
6203
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006204 return ipc_has_perm(shp, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006205}
6206
6207/* Semaphore security operations */
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006208static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006209{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006210 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006211 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006212 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006213 int rc;
6214
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006215 rc = ipc_alloc_security(sma, SECCLASS_SEM);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006216 if (rc)
6217 return rc;
6218
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006219 isec = sma->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006220
Eric Paris50c205f2012-04-04 15:01:43 -04006221 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006222 ad.u.ipc_id = sma->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006223
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006224 rc = avc_has_perm(&selinux_state,
6225 sid, isec->sid, SECCLASS_SEM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006226 SEM__CREATE, &ad);
6227 if (rc) {
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006228 ipc_free_security(sma);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006229 return rc;
6230 }
6231 return 0;
6232}
6233
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006234static void selinux_sem_free_security(struct kern_ipc_perm *sma)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006235{
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006236 ipc_free_security(sma);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006237}
6238
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006239static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006240{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006241 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006242 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006243 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006244
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006245 isec = sma->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006246
Eric Paris50c205f2012-04-04 15:01:43 -04006247 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006248 ad.u.ipc_id = sma->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006249
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006250 return avc_has_perm(&selinux_state,
6251 sid, isec->sid, SECCLASS_SEM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006252 SEM__ASSOCIATE, &ad);
6253}
6254
6255/* Note, at this point, sma is locked down */
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006256static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006257{
6258 int err;
6259 u32 perms;
6260
Eric Paris828dfe12008-04-17 13:17:49 -04006261 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006262 case IPC_INFO:
6263 case SEM_INFO:
6264 /* No specific object, just general system-wide information. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006265 return avc_has_perm(&selinux_state,
6266 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006267 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006268 case GETPID:
6269 case GETNCNT:
6270 case GETZCNT:
6271 perms = SEM__GETATTR;
6272 break;
6273 case GETVAL:
6274 case GETALL:
6275 perms = SEM__READ;
6276 break;
6277 case SETVAL:
6278 case SETALL:
6279 perms = SEM__WRITE;
6280 break;
6281 case IPC_RMID:
6282 perms = SEM__DESTROY;
6283 break;
6284 case IPC_SET:
6285 perms = SEM__SETATTR;
6286 break;
6287 case IPC_STAT:
6288 case SEM_STAT:
Davidlohr Buesoa280d6d2018-04-10 16:35:26 -07006289 case SEM_STAT_ANY:
Linus Torvalds1da177e2005-04-16 15:20:36 -07006290 perms = SEM__GETATTR | SEM__ASSOCIATE;
6291 break;
6292 default:
6293 return 0;
6294 }
6295
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006296 err = ipc_has_perm(sma, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006297 return err;
6298}
6299
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006300static int selinux_sem_semop(struct kern_ipc_perm *sma,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006301 struct sembuf *sops, unsigned nsops, int alter)
6302{
6303 u32 perms;
6304
6305 if (alter)
6306 perms = SEM__READ | SEM__WRITE;
6307 else
6308 perms = SEM__READ;
6309
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006310 return ipc_has_perm(sma, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006311}
6312
6313static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6314{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006315 u32 av = 0;
6316
Linus Torvalds1da177e2005-04-16 15:20:36 -07006317 av = 0;
6318 if (flag & S_IRUGO)
6319 av |= IPC__UNIX_READ;
6320 if (flag & S_IWUGO)
6321 av |= IPC__UNIX_WRITE;
6322
6323 if (av == 0)
6324 return 0;
6325
Stephen Smalley6af963f2005-05-01 08:58:39 -07006326 return ipc_has_perm(ipcp, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006327}
6328
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02006329static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6330{
6331 struct ipc_security_struct *isec = ipcp->security;
6332 *secid = isec->sid;
6333}
6334
Eric Paris828dfe12008-04-17 13:17:49 -04006335static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006336{
6337 if (inode)
6338 inode_doinit_with_dentry(inode, dentry);
6339}
6340
6341static int selinux_getprocattr(struct task_struct *p,
Al Viro04ff9702007-03-12 16:17:58 +00006342 char *name, char **value)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006343{
David Howells275bb412008-11-14 10:39:19 +11006344 const struct task_security_struct *__tsec;
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00006345 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006346 int error;
Al Viro04ff9702007-03-12 16:17:58 +00006347 unsigned len;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006348
David Howells275bb412008-11-14 10:39:19 +11006349 rcu_read_lock();
6350 __tsec = __task_cred(p)->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006351
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006352 if (current != p) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006353 error = avc_has_perm(&selinux_state,
6354 current_sid(), __tsec->sid,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006355 SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6356 if (error)
6357 goto bad;
6358 }
6359
Linus Torvalds1da177e2005-04-16 15:20:36 -07006360 if (!strcmp(name, "current"))
David Howells275bb412008-11-14 10:39:19 +11006361 sid = __tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006362 else if (!strcmp(name, "prev"))
David Howells275bb412008-11-14 10:39:19 +11006363 sid = __tsec->osid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006364 else if (!strcmp(name, "exec"))
David Howells275bb412008-11-14 10:39:19 +11006365 sid = __tsec->exec_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006366 else if (!strcmp(name, "fscreate"))
David Howells275bb412008-11-14 10:39:19 +11006367 sid = __tsec->create_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07006368 else if (!strcmp(name, "keycreate"))
David Howells275bb412008-11-14 10:39:19 +11006369 sid = __tsec->keycreate_sid;
Eric Paris42c3e032006-06-26 00:26:03 -07006370 else if (!strcmp(name, "sockcreate"))
David Howells275bb412008-11-14 10:39:19 +11006371 sid = __tsec->sockcreate_sid;
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006372 else {
6373 error = -EINVAL;
6374 goto bad;
6375 }
David Howells275bb412008-11-14 10:39:19 +11006376 rcu_read_unlock();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006377
6378 if (!sid)
6379 return 0;
6380
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006381 error = security_sid_to_context(&selinux_state, sid, value, &len);
Al Viro04ff9702007-03-12 16:17:58 +00006382 if (error)
6383 return error;
6384 return len;
David Howells275bb412008-11-14 10:39:19 +11006385
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006386bad:
David Howells275bb412008-11-14 10:39:19 +11006387 rcu_read_unlock();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006388 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006389}
6390
Stephen Smalleyb21507e2017-01-09 10:07:31 -05006391static int selinux_setprocattr(const char *name, void *value, size_t size)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006392{
6393 struct task_security_struct *tsec;
David Howellsd84f4f92008-11-14 10:39:23 +11006394 struct cred *new;
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006395 u32 mysid = current_sid(), sid = 0, ptsid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006396 int error;
6397 char *str = value;
6398
Linus Torvalds1da177e2005-04-16 15:20:36 -07006399 /*
6400 * Basic control over ability to set these attributes at all.
Linus Torvalds1da177e2005-04-16 15:20:36 -07006401 */
6402 if (!strcmp(name, "exec"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006403 error = avc_has_perm(&selinux_state,
6404 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006405 PROCESS__SETEXEC, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006406 else if (!strcmp(name, "fscreate"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006407 error = avc_has_perm(&selinux_state,
6408 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006409 PROCESS__SETFSCREATE, NULL);
Michael LeMay4eb582c2006-06-26 00:24:57 -07006410 else if (!strcmp(name, "keycreate"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006411 error = avc_has_perm(&selinux_state,
6412 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006413 PROCESS__SETKEYCREATE, NULL);
Eric Paris42c3e032006-06-26 00:26:03 -07006414 else if (!strcmp(name, "sockcreate"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006415 error = avc_has_perm(&selinux_state,
6416 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006417 PROCESS__SETSOCKCREATE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006418 else if (!strcmp(name, "current"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006419 error = avc_has_perm(&selinux_state,
6420 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006421 PROCESS__SETCURRENT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006422 else
6423 error = -EINVAL;
6424 if (error)
6425 return error;
6426
6427 /* Obtain a SID for the context, if one was specified. */
Stephen Smalleya050a572017-01-31 11:54:04 -05006428 if (size && str[0] && str[0] != '\n') {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006429 if (str[size-1] == '\n') {
6430 str[size-1] = 0;
6431 size--;
6432 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006433 error = security_context_to_sid(&selinux_state, value, size,
6434 &sid, GFP_KERNEL);
Stephen Smalley12b29f32008-05-07 13:03:20 -04006435 if (error == -EINVAL && !strcmp(name, "fscreate")) {
Stephen Smalleydb590002017-04-20 11:31:30 -04006436 if (!has_cap_mac_admin(true)) {
Eric Parisd6ea83e2012-04-04 13:45:49 -04006437 struct audit_buffer *ab;
6438 size_t audit_size;
6439
6440 /* We strip a nul only if it is at the end, otherwise the
6441 * context contains a nul and we should audit that */
6442 if (str[size - 1] == '\0')
6443 audit_size = size - 1;
6444 else
6445 audit_size = size;
6446 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
6447 audit_log_format(ab, "op=fscreate invalid_context=");
6448 audit_log_n_untrustedstring(ab, value, audit_size);
6449 audit_log_end(ab);
6450
Stephen Smalley12b29f32008-05-07 13:03:20 -04006451 return error;
Eric Parisd6ea83e2012-04-04 13:45:49 -04006452 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006453 error = security_context_to_sid_force(
6454 &selinux_state,
6455 value, size, &sid);
Stephen Smalley12b29f32008-05-07 13:03:20 -04006456 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07006457 if (error)
6458 return error;
6459 }
6460
David Howellsd84f4f92008-11-14 10:39:23 +11006461 new = prepare_creds();
6462 if (!new)
6463 return -ENOMEM;
6464
Linus Torvalds1da177e2005-04-16 15:20:36 -07006465 /* Permission checking based on the specified context is
6466 performed during the actual operation (execve,
6467 open/mkdir/...), when we know the full context of the
David Howellsd84f4f92008-11-14 10:39:23 +11006468 operation. See selinux_bprm_set_creds for the execve
Linus Torvalds1da177e2005-04-16 15:20:36 -07006469 checks and may_create for the file creation checks. The
6470 operation will then fail if the context is not permitted. */
David Howellsd84f4f92008-11-14 10:39:23 +11006471 tsec = new->security;
6472 if (!strcmp(name, "exec")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006473 tsec->exec_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006474 } else if (!strcmp(name, "fscreate")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006475 tsec->create_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006476 } else if (!strcmp(name, "keycreate")) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006477 error = avc_has_perm(&selinux_state,
6478 mysid, sid, SECCLASS_KEY, KEY__CREATE,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006479 NULL);
Michael LeMay4eb582c2006-06-26 00:24:57 -07006480 if (error)
David Howellsd84f4f92008-11-14 10:39:23 +11006481 goto abort_change;
Michael LeMay4eb582c2006-06-26 00:24:57 -07006482 tsec->keycreate_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006483 } else if (!strcmp(name, "sockcreate")) {
Eric Paris42c3e032006-06-26 00:26:03 -07006484 tsec->sockcreate_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006485 } else if (!strcmp(name, "current")) {
6486 error = -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006487 if (sid == 0)
David Howellsd84f4f92008-11-14 10:39:23 +11006488 goto abort_change;
KaiGai Koheid9250de2008-08-28 16:35:57 +09006489
David Howellsd84f4f92008-11-14 10:39:23 +11006490 /* Only allow single threaded processes to change context */
6491 error = -EPERM;
Oleg Nesterov5bb459b2009-07-10 03:48:23 +02006492 if (!current_is_single_threaded()) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006493 error = security_bounded_transition(&selinux_state,
6494 tsec->sid, sid);
David Howellsd84f4f92008-11-14 10:39:23 +11006495 if (error)
6496 goto abort_change;
Eric Paris828dfe12008-04-17 13:17:49 -04006497 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07006498
6499 /* Check permissions for the transition. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006500 error = avc_has_perm(&selinux_state,
6501 tsec->sid, sid, SECCLASS_PROCESS,
Eric Paris828dfe12008-04-17 13:17:49 -04006502 PROCESS__DYNTRANSITION, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006503 if (error)
David Howellsd84f4f92008-11-14 10:39:23 +11006504 goto abort_change;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006505
6506 /* Check for ptracing, and update the task SID if ok.
6507 Otherwise, leave SID unchanged and fail. */
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006508 ptsid = ptrace_parent_sid();
Paul Moore0c6181c2016-03-30 21:41:21 -04006509 if (ptsid != 0) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006510 error = avc_has_perm(&selinux_state,
6511 ptsid, sid, SECCLASS_PROCESS,
David Howellsd84f4f92008-11-14 10:39:23 +11006512 PROCESS__PTRACE, NULL);
6513 if (error)
6514 goto abort_change;
6515 }
6516
6517 tsec->sid = sid;
6518 } else {
6519 error = -EINVAL;
6520 goto abort_change;
6521 }
6522
6523 commit_creds(new);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006524 return size;
David Howellsd84f4f92008-11-14 10:39:23 +11006525
6526abort_change:
6527 abort_creds(new);
6528 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006529}
6530
David Quigley746df9b2013-05-22 12:50:35 -04006531static int selinux_ismaclabel(const char *name)
6532{
6533 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6534}
6535
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006536static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6537{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006538 return security_sid_to_context(&selinux_state, secid,
6539 secdata, seclen);
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006540}
6541
David Howells7bf570d2008-04-29 20:52:51 +01006542static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
David Howells63cb3442008-01-15 23:47:35 +00006543{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006544 return security_context_to_sid(&selinux_state, secdata, seclen,
6545 secid, GFP_KERNEL);
David Howells63cb3442008-01-15 23:47:35 +00006546}
6547
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006548static void selinux_release_secctx(char *secdata, u32 seclen)
6549{
Paul Moore088999e2007-08-01 11:12:58 -04006550 kfree(secdata);
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006551}
6552
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006553static void selinux_inode_invalidate_secctx(struct inode *inode)
6554{
6555 struct inode_security_struct *isec = inode->i_security;
6556
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01006557 spin_lock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006558 isec->initialized = LABEL_INVALID;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01006559 spin_unlock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006560}
6561
David P. Quigley1ee65e32009-09-03 14:25:57 -04006562/*
6563 * called with inode->i_mutex locked
6564 */
6565static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6566{
6567 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
6568}
6569
6570/*
6571 * called with inode->i_mutex locked
6572 */
6573static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6574{
6575 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6576}
6577
6578static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6579{
6580 int len = 0;
6581 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6582 ctx, true);
6583 if (len < 0)
6584 return len;
6585 *ctxlen = len;
6586 return 0;
6587}
Michael LeMayd7200242006-06-22 14:47:17 -07006588#ifdef CONFIG_KEYS
6589
David Howellsd84f4f92008-11-14 10:39:23 +11006590static int selinux_key_alloc(struct key *k, const struct cred *cred,
David Howells7e047ef2006-06-26 00:24:50 -07006591 unsigned long flags)
Michael LeMayd7200242006-06-22 14:47:17 -07006592{
David Howellsd84f4f92008-11-14 10:39:23 +11006593 const struct task_security_struct *tsec;
Michael LeMayd7200242006-06-22 14:47:17 -07006594 struct key_security_struct *ksec;
6595
6596 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6597 if (!ksec)
6598 return -ENOMEM;
6599
David Howellsd84f4f92008-11-14 10:39:23 +11006600 tsec = cred->security;
6601 if (tsec->keycreate_sid)
6602 ksec->sid = tsec->keycreate_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07006603 else
David Howellsd84f4f92008-11-14 10:39:23 +11006604 ksec->sid = tsec->sid;
Michael LeMayd7200242006-06-22 14:47:17 -07006605
David Howells275bb412008-11-14 10:39:19 +11006606 k->security = ksec;
Michael LeMayd7200242006-06-22 14:47:17 -07006607 return 0;
6608}
6609
6610static void selinux_key_free(struct key *k)
6611{
6612 struct key_security_struct *ksec = k->security;
6613
6614 k->security = NULL;
6615 kfree(ksec);
6616}
6617
6618static int selinux_key_permission(key_ref_t key_ref,
David Howellsd84f4f92008-11-14 10:39:23 +11006619 const struct cred *cred,
David Howellsf5895942014-03-14 17:44:49 +00006620 unsigned perm)
Michael LeMayd7200242006-06-22 14:47:17 -07006621{
6622 struct key *key;
Michael LeMayd7200242006-06-22 14:47:17 -07006623 struct key_security_struct *ksec;
David Howells275bb412008-11-14 10:39:19 +11006624 u32 sid;
Michael LeMayd7200242006-06-22 14:47:17 -07006625
6626 /* if no specific permissions are requested, we skip the
6627 permission check. No serious, additional covert channels
6628 appear to be created. */
6629 if (perm == 0)
6630 return 0;
6631
David Howellsd84f4f92008-11-14 10:39:23 +11006632 sid = cred_sid(cred);
David Howells275bb412008-11-14 10:39:19 +11006633
6634 key = key_ref_to_ptr(key_ref);
6635 ksec = key->security;
6636
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006637 return avc_has_perm(&selinux_state,
6638 sid, ksec->sid, SECCLASS_KEY, perm, NULL);
Michael LeMayd7200242006-06-22 14:47:17 -07006639}
6640
David Howells70a5bb72008-04-29 01:01:26 -07006641static int selinux_key_getsecurity(struct key *key, char **_buffer)
6642{
6643 struct key_security_struct *ksec = key->security;
6644 char *context = NULL;
6645 unsigned len;
6646 int rc;
6647
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006648 rc = security_sid_to_context(&selinux_state, ksec->sid,
6649 &context, &len);
David Howells70a5bb72008-04-29 01:01:26 -07006650 if (!rc)
6651 rc = len;
6652 *_buffer = context;
6653 return rc;
6654}
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03006655#endif
David Howells70a5bb72008-04-29 01:01:26 -07006656
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03006657#ifdef CONFIG_SECURITY_INFINIBAND
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03006658static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6659{
6660 struct common_audit_data ad;
6661 int err;
6662 u32 sid = 0;
6663 struct ib_security_struct *sec = ib_sec;
6664 struct lsm_ibpkey_audit ibpkey;
6665
Daniel Jurgens409dcf32017-05-19 15:48:59 +03006666 err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03006667 if (err)
6668 return err;
6669
6670 ad.type = LSM_AUDIT_DATA_IBPKEY;
6671 ibpkey.subnet_prefix = subnet_prefix;
6672 ibpkey.pkey = pkey_val;
6673 ad.u.ibpkey = &ibpkey;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006674 return avc_has_perm(&selinux_state,
6675 sec->sid, sid,
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03006676 SECCLASS_INFINIBAND_PKEY,
6677 INFINIBAND_PKEY__ACCESS, &ad);
6678}
6679
Daniel Jurgensab861df2017-05-19 15:48:58 +03006680static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6681 u8 port_num)
6682{
6683 struct common_audit_data ad;
6684 int err;
6685 u32 sid = 0;
6686 struct ib_security_struct *sec = ib_sec;
6687 struct lsm_ibendport_audit ibendport;
6688
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006689 err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6690 &sid);
Daniel Jurgensab861df2017-05-19 15:48:58 +03006691
6692 if (err)
6693 return err;
6694
6695 ad.type = LSM_AUDIT_DATA_IBENDPORT;
6696 strncpy(ibendport.dev_name, dev_name, sizeof(ibendport.dev_name));
6697 ibendport.port = port_num;
6698 ad.u.ibendport = &ibendport;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006699 return avc_has_perm(&selinux_state,
6700 sec->sid, sid,
Daniel Jurgensab861df2017-05-19 15:48:58 +03006701 SECCLASS_INFINIBAND_ENDPORT,
6702 INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6703}
6704
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03006705static int selinux_ib_alloc_security(void **ib_sec)
6706{
6707 struct ib_security_struct *sec;
6708
6709 sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6710 if (!sec)
6711 return -ENOMEM;
6712 sec->sid = current_sid();
6713
6714 *ib_sec = sec;
6715 return 0;
6716}
6717
6718static void selinux_ib_free_security(void *ib_sec)
6719{
6720 kfree(ib_sec);
6721}
Michael LeMayd7200242006-06-22 14:47:17 -07006722#endif
6723
Chenbo Fengec27c352017-10-18 13:00:25 -07006724#ifdef CONFIG_BPF_SYSCALL
6725static int selinux_bpf(int cmd, union bpf_attr *attr,
6726 unsigned int size)
6727{
6728 u32 sid = current_sid();
6729 int ret;
6730
6731 switch (cmd) {
6732 case BPF_MAP_CREATE:
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006733 ret = avc_has_perm(&selinux_state,
6734 sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
Chenbo Fengec27c352017-10-18 13:00:25 -07006735 NULL);
6736 break;
6737 case BPF_PROG_LOAD:
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006738 ret = avc_has_perm(&selinux_state,
6739 sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
Chenbo Fengec27c352017-10-18 13:00:25 -07006740 NULL);
6741 break;
6742 default:
6743 ret = 0;
6744 break;
6745 }
6746
6747 return ret;
6748}
6749
6750static u32 bpf_map_fmode_to_av(fmode_t fmode)
6751{
6752 u32 av = 0;
6753
6754 if (fmode & FMODE_READ)
6755 av |= BPF__MAP_READ;
6756 if (fmode & FMODE_WRITE)
6757 av |= BPF__MAP_WRITE;
6758 return av;
6759}
6760
Chenbo Fengf66e4482017-10-18 13:00:26 -07006761/* This function will check the file pass through unix socket or binder to see
6762 * if it is a bpf related object. And apply correspinding checks on the bpf
6763 * object based on the type. The bpf maps and programs, not like other files and
6764 * socket, are using a shared anonymous inode inside the kernel as their inode.
6765 * So checking that inode cannot identify if the process have privilege to
6766 * access the bpf object and that's why we have to add this additional check in
6767 * selinux_file_receive and selinux_binder_transfer_files.
6768 */
6769static int bpf_fd_pass(struct file *file, u32 sid)
6770{
6771 struct bpf_security_struct *bpfsec;
6772 struct bpf_prog *prog;
6773 struct bpf_map *map;
6774 int ret;
6775
6776 if (file->f_op == &bpf_map_fops) {
6777 map = file->private_data;
6778 bpfsec = map->security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006779 ret = avc_has_perm(&selinux_state,
6780 sid, bpfsec->sid, SECCLASS_BPF,
Chenbo Fengf66e4482017-10-18 13:00:26 -07006781 bpf_map_fmode_to_av(file->f_mode), NULL);
6782 if (ret)
6783 return ret;
6784 } else if (file->f_op == &bpf_prog_fops) {
6785 prog = file->private_data;
6786 bpfsec = prog->aux->security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006787 ret = avc_has_perm(&selinux_state,
6788 sid, bpfsec->sid, SECCLASS_BPF,
Chenbo Fengf66e4482017-10-18 13:00:26 -07006789 BPF__PROG_RUN, NULL);
6790 if (ret)
6791 return ret;
6792 }
6793 return 0;
6794}
6795
Chenbo Fengec27c352017-10-18 13:00:25 -07006796static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6797{
6798 u32 sid = current_sid();
6799 struct bpf_security_struct *bpfsec;
6800
6801 bpfsec = map->security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006802 return avc_has_perm(&selinux_state,
6803 sid, bpfsec->sid, SECCLASS_BPF,
Chenbo Fengec27c352017-10-18 13:00:25 -07006804 bpf_map_fmode_to_av(fmode), NULL);
6805}
6806
6807static int selinux_bpf_prog(struct bpf_prog *prog)
6808{
6809 u32 sid = current_sid();
6810 struct bpf_security_struct *bpfsec;
6811
6812 bpfsec = prog->aux->security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006813 return avc_has_perm(&selinux_state,
6814 sid, bpfsec->sid, SECCLASS_BPF,
Chenbo Fengec27c352017-10-18 13:00:25 -07006815 BPF__PROG_RUN, NULL);
6816}
6817
6818static int selinux_bpf_map_alloc(struct bpf_map *map)
6819{
6820 struct bpf_security_struct *bpfsec;
6821
6822 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6823 if (!bpfsec)
6824 return -ENOMEM;
6825
6826 bpfsec->sid = current_sid();
6827 map->security = bpfsec;
6828
6829 return 0;
6830}
6831
6832static void selinux_bpf_map_free(struct bpf_map *map)
6833{
6834 struct bpf_security_struct *bpfsec = map->security;
6835
6836 map->security = NULL;
6837 kfree(bpfsec);
6838}
6839
6840static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6841{
6842 struct bpf_security_struct *bpfsec;
6843
6844 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6845 if (!bpfsec)
6846 return -ENOMEM;
6847
6848 bpfsec->sid = current_sid();
6849 aux->security = bpfsec;
6850
6851 return 0;
6852}
6853
6854static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
6855{
6856 struct bpf_security_struct *bpfsec = aux->security;
6857
6858 aux->security = NULL;
6859 kfree(bpfsec);
6860}
6861#endif
6862
James Morrisca97d932017-02-15 00:18:51 +11006863static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
Casey Schauflere20b0432015-05-02 15:11:36 -07006864 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6865 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6866 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6867 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02006868
Casey Schauflere20b0432015-05-02 15:11:36 -07006869 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6870 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6871 LSM_HOOK_INIT(capget, selinux_capget),
6872 LSM_HOOK_INIT(capset, selinux_capset),
6873 LSM_HOOK_INIT(capable, selinux_capable),
6874 LSM_HOOK_INIT(quotactl, selinux_quotactl),
6875 LSM_HOOK_INIT(quota_on, selinux_quota_on),
6876 LSM_HOOK_INIT(syslog, selinux_syslog),
6877 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
Stephen Smalley79af7302015-01-21 10:54:10 -05006878
Casey Schauflere20b0432015-05-02 15:11:36 -07006879 LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006880
Casey Schauflere20b0432015-05-02 15:11:36 -07006881 LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6882 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6883 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006884
Casey Schauflere20b0432015-05-02 15:11:36 -07006885 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6886 LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6887 LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
6888 LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6889 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6890 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6891 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6892 LSM_HOOK_INIT(sb_mount, selinux_mount),
6893 LSM_HOOK_INIT(sb_umount, selinux_umount),
6894 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6895 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6896 LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006897
Casey Schauflere20b0432015-05-02 15:11:36 -07006898 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
Vivek Goyala518b0a2016-07-13 10:44:53 -04006899 LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
Eric Parise0007522008-03-05 10:31:54 -05006900
Casey Schauflere20b0432015-05-02 15:11:36 -07006901 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6902 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6903 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6904 LSM_HOOK_INIT(inode_create, selinux_inode_create),
6905 LSM_HOOK_INIT(inode_link, selinux_inode_link),
6906 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6907 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6908 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6909 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6910 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6911 LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6912 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6913 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6914 LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6915 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6916 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6917 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6918 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6919 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6920 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6921 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6922 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6923 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6924 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6925 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
Vivek Goyal56909eb2016-07-13 10:44:48 -04006926 LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
Vivek Goyal19472b62016-07-13 10:44:50 -04006927 LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006928
Casey Schauflere20b0432015-05-02 15:11:36 -07006929 LSM_HOOK_INIT(file_permission, selinux_file_permission),
6930 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6931 LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
6932 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6933 LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6934 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6935 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6936 LSM_HOOK_INIT(file_lock, selinux_file_lock),
6937 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6938 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6939 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6940 LSM_HOOK_INIT(file_receive, selinux_file_receive),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006941
Casey Schauflere20b0432015-05-02 15:11:36 -07006942 LSM_HOOK_INIT(file_open, selinux_file_open),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006943
Tetsuo Handaa79be232017-03-28 23:08:45 +09006944 LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
Casey Schauflere20b0432015-05-02 15:11:36 -07006945 LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
6946 LSM_HOOK_INIT(cred_free, selinux_cred_free),
6947 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6948 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
Matthew Garrett3ec30112018-01-08 13:36:19 -08006949 LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
Casey Schauflere20b0432015-05-02 15:11:36 -07006950 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6951 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6952 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07006953 LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
Casey Schauflere20b0432015-05-02 15:11:36 -07006954 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6955 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6956 LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6957 LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6958 LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6959 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6960 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
Stephen Smalley791ec492017-02-17 07:57:00 -05006961 LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
Casey Schauflere20b0432015-05-02 15:11:36 -07006962 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6963 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6964 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6965 LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6966 LSM_HOOK_INIT(task_kill, selinux_task_kill),
Casey Schauflere20b0432015-05-02 15:11:36 -07006967 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09006968
Casey Schauflere20b0432015-05-02 15:11:36 -07006969 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6970 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006971
Casey Schauflere20b0432015-05-02 15:11:36 -07006972 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6973 LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006974
Casey Schauflere20b0432015-05-02 15:11:36 -07006975 LSM_HOOK_INIT(msg_queue_alloc_security,
6976 selinux_msg_queue_alloc_security),
6977 LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6978 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6979 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6980 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6981 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006982
Casey Schauflere20b0432015-05-02 15:11:36 -07006983 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6984 LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6985 LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6986 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6987 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006988
Casey Schauflere20b0432015-05-02 15:11:36 -07006989 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6990 LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6991 LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6992 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6993 LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006994
Casey Schauflere20b0432015-05-02 15:11:36 -07006995 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006996
Casey Schauflere20b0432015-05-02 15:11:36 -07006997 LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6998 LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006999
Casey Schauflere20b0432015-05-02 15:11:36 -07007000 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
7001 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
7002 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
7003 LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05007004 LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
Casey Schauflere20b0432015-05-02 15:11:36 -07007005 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
7006 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
7007 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
Linus Torvalds1da177e2005-04-16 15:20:36 -07007008
Casey Schauflere20b0432015-05-02 15:11:36 -07007009 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
7010 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07007011
Casey Schauflere20b0432015-05-02 15:11:36 -07007012 LSM_HOOK_INIT(socket_create, selinux_socket_create),
7013 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
7014 LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
7015 LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
7016 LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
7017 LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
7018 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
7019 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
7020 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
7021 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
7022 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
7023 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
7024 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
7025 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
7026 LSM_HOOK_INIT(socket_getpeersec_stream,
7027 selinux_socket_getpeersec_stream),
7028 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
7029 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
7030 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
7031 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
7032 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
7033 LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
Richard Hainesd4529302018-02-13 20:57:18 +00007034 LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
7035 LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
7036 LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
Casey Schauflere20b0432015-05-02 15:11:36 -07007037 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
7038 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
7039 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
7040 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
7041 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
7042 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
7043 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
7044 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
7045 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
7046 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
7047 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
7048 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
7049 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03007050#ifdef CONFIG_SECURITY_INFINIBAND
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03007051 LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
Daniel Jurgensab861df2017-05-19 15:48:58 +03007052 LSM_HOOK_INIT(ib_endport_manage_subnet,
7053 selinux_ib_endport_manage_subnet),
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03007054 LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
7055 LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
7056#endif
Trent Jaegerd28d1e02005-12-13 23:12:40 -08007057#ifdef CONFIG_SECURITY_NETWORK_XFRM
Casey Schauflere20b0432015-05-02 15:11:36 -07007058 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
7059 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
7060 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
7061 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
7062 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
7063 LSM_HOOK_INIT(xfrm_state_alloc_acquire,
7064 selinux_xfrm_state_alloc_acquire),
7065 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
7066 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
7067 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
7068 LSM_HOOK_INIT(xfrm_state_pol_flow_match,
7069 selinux_xfrm_state_pol_flow_match),
7070 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
Linus Torvalds1da177e2005-04-16 15:20:36 -07007071#endif
Michael LeMayd7200242006-06-22 14:47:17 -07007072
7073#ifdef CONFIG_KEYS
Casey Schauflere20b0432015-05-02 15:11:36 -07007074 LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
7075 LSM_HOOK_INIT(key_free, selinux_key_free),
7076 LSM_HOOK_INIT(key_permission, selinux_key_permission),
7077 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
Michael LeMayd7200242006-06-22 14:47:17 -07007078#endif
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +02007079
7080#ifdef CONFIG_AUDIT
Casey Schauflere20b0432015-05-02 15:11:36 -07007081 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
7082 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
7083 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
7084 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +02007085#endif
Chenbo Fengec27c352017-10-18 13:00:25 -07007086
7087#ifdef CONFIG_BPF_SYSCALL
7088 LSM_HOOK_INIT(bpf, selinux_bpf),
7089 LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
7090 LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
7091 LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
7092 LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
7093 LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
7094 LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
7095#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07007096};
7097
7098static __init int selinux_init(void)
7099{
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07007100 if (!security_module_enable("selinux")) {
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02007101 selinux_enabled = 0;
7102 return 0;
7103 }
7104
Linus Torvalds1da177e2005-04-16 15:20:36 -07007105 if (!selinux_enabled) {
7106 printk(KERN_INFO "SELinux: Disabled at boot.\n");
7107 return 0;
7108 }
7109
7110 printk(KERN_INFO "SELinux: Initializing.\n");
7111
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007112 memset(&selinux_state, 0, sizeof(selinux_state));
Paul Mooree5a5ca92018-03-01 17:38:30 -05007113 enforcing_set(&selinux_state, selinux_enforcing_boot);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007114 selinux_state.checkreqprot = selinux_checkreqprot_boot;
7115 selinux_ss_init(&selinux_state.ss);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05007116 selinux_avc_init(&selinux_state.avc);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007117
Linus Torvalds1da177e2005-04-16 15:20:36 -07007118 /* Set the security state for the initial task. */
David Howellsd84f4f92008-11-14 10:39:23 +11007119 cred_init_security();
Linus Torvalds1da177e2005-04-16 15:20:36 -07007120
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04007121 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
7122
James Morris7cae7e22006-03-22 00:09:22 -08007123 sel_inode_cache = kmem_cache_create("selinux_inode_security",
7124 sizeof(struct inode_security_struct),
Paul Mundt20c2df82007-07-20 10:11:58 +09007125 0, SLAB_PANIC, NULL);
Sangwoo63205652015-10-21 17:44:30 -04007126 file_security_cache = kmem_cache_create("selinux_file_security",
7127 sizeof(struct file_security_struct),
7128 0, SLAB_PANIC, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07007129 avc_init();
7130
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007131 avtab_cache_init();
7132
7133 ebitmap_cache_init();
7134
7135 hashtab_cache_init();
7136
Casey Schauflerd69dece52017-01-18 17:09:05 -08007137 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
Linus Torvalds1da177e2005-04-16 15:20:36 -07007138
Paul Moore615e51f2014-06-26 14:33:56 -04007139 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
7140 panic("SELinux: Unable to register AVC netcache callback\n");
7141
Daniel Jurgens8f408ab2017-05-19 15:48:53 +03007142 if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7143 panic("SELinux: Unable to register AVC LSM notifier callback\n");
7144
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007145 if (selinux_enforcing_boot)
Eric Parisfadcdb42007-02-22 18:11:31 -05007146 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
Eric Paris828dfe12008-04-17 13:17:49 -04007147 else
Eric Parisfadcdb42007-02-22 18:11:31 -05007148 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
Michael LeMayd7200242006-06-22 14:47:17 -07007149
Linus Torvalds1da177e2005-04-16 15:20:36 -07007150 return 0;
7151}
7152
Al Viroe8c26252010-03-23 06:36:54 -04007153static void delayed_superblock_init(struct super_block *sb, void *unused)
7154{
7155 superblock_doinit(sb, NULL);
7156}
7157
Linus Torvalds1da177e2005-04-16 15:20:36 -07007158void selinux_complete_init(void)
7159{
Eric Parisfadcdb42007-02-22 18:11:31 -05007160 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07007161
7162 /* Set up any superblocks initialized prior to the policy load. */
Eric Parisfadcdb42007-02-22 18:11:31 -05007163 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
Al Viroe8c26252010-03-23 06:36:54 -04007164 iterate_supers(delayed_superblock_init, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07007165}
7166
7167/* SELinux requires early initialization in order to label
7168 all processes and objects when they are created. */
7169security_initcall(selinux_init);
7170
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08007171#if defined(CONFIG_NETFILTER)
Linus Torvalds1da177e2005-04-16 15:20:36 -07007172
Florian Westphal591bb2782017-07-26 11:40:52 +02007173static const struct nf_hook_ops selinux_nf_ops[] = {
Paul Mooreeffad8d2008-01-29 08:49:27 -05007174 {
7175 .hook = selinux_ipv4_postroute,
Alban Crequy2597a832012-05-14 03:56:39 +00007176 .pf = NFPROTO_IPV4,
Paul Mooreeffad8d2008-01-29 08:49:27 -05007177 .hooknum = NF_INET_POST_ROUTING,
7178 .priority = NF_IP_PRI_SELINUX_LAST,
7179 },
7180 {
7181 .hook = selinux_ipv4_forward,
Alban Crequy2597a832012-05-14 03:56:39 +00007182 .pf = NFPROTO_IPV4,
Paul Mooreeffad8d2008-01-29 08:49:27 -05007183 .hooknum = NF_INET_FORWARD,
7184 .priority = NF_IP_PRI_SELINUX_FIRST,
Paul Moore948bf852008-10-10 10:16:32 -04007185 },
7186 {
7187 .hook = selinux_ipv4_output,
Alban Crequy2597a832012-05-14 03:56:39 +00007188 .pf = NFPROTO_IPV4,
Paul Moore948bf852008-10-10 10:16:32 -04007189 .hooknum = NF_INET_LOCAL_OUT,
7190 .priority = NF_IP_PRI_SELINUX_FIRST,
Jiri Pirko25db6be2014-09-03 17:42:13 +02007191 },
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04007192#if IS_ENABLED(CONFIG_IPV6)
Paul Mooreeffad8d2008-01-29 08:49:27 -05007193 {
7194 .hook = selinux_ipv6_postroute,
Alban Crequy2597a832012-05-14 03:56:39 +00007195 .pf = NFPROTO_IPV6,
Paul Mooreeffad8d2008-01-29 08:49:27 -05007196 .hooknum = NF_INET_POST_ROUTING,
7197 .priority = NF_IP6_PRI_SELINUX_LAST,
7198 },
7199 {
7200 .hook = selinux_ipv6_forward,
Alban Crequy2597a832012-05-14 03:56:39 +00007201 .pf = NFPROTO_IPV6,
Paul Mooreeffad8d2008-01-29 08:49:27 -05007202 .hooknum = NF_INET_FORWARD,
7203 .priority = NF_IP6_PRI_SELINUX_FIRST,
Jiri Pirko25db6be2014-09-03 17:42:13 +02007204 },
Huw Davies2917f572016-06-27 15:06:15 -04007205 {
7206 .hook = selinux_ipv6_output,
7207 .pf = NFPROTO_IPV6,
7208 .hooknum = NF_INET_LOCAL_OUT,
7209 .priority = NF_IP6_PRI_SELINUX_FIRST,
7210 },
Linus Torvalds1da177e2005-04-16 15:20:36 -07007211#endif /* IPV6 */
Jiri Pirko25db6be2014-09-03 17:42:13 +02007212};
Linus Torvalds1da177e2005-04-16 15:20:36 -07007213
Florian Westphal8e71bf72017-04-21 11:49:09 +02007214static int __net_init selinux_nf_register(struct net *net)
7215{
7216 return nf_register_net_hooks(net, selinux_nf_ops,
7217 ARRAY_SIZE(selinux_nf_ops));
7218}
7219
7220static void __net_exit selinux_nf_unregister(struct net *net)
7221{
7222 nf_unregister_net_hooks(net, selinux_nf_ops,
7223 ARRAY_SIZE(selinux_nf_ops));
7224}
7225
7226static struct pernet_operations selinux_net_ops = {
7227 .init = selinux_nf_register,
7228 .exit = selinux_nf_unregister,
7229};
7230
Linus Torvalds1da177e2005-04-16 15:20:36 -07007231static int __init selinux_nf_ip_init(void)
7232{
Jiri Pirko25db6be2014-09-03 17:42:13 +02007233 int err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07007234
7235 if (!selinux_enabled)
Jiri Pirko25db6be2014-09-03 17:42:13 +02007236 return 0;
Eric Parisfadcdb42007-02-22 18:11:31 -05007237
7238 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
7239
Florian Westphal8e71bf72017-04-21 11:49:09 +02007240 err = register_pernet_subsys(&selinux_net_ops);
Alexey Dobriyan6c5a9d22008-07-26 17:48:15 -07007241 if (err)
Florian Westphal8e71bf72017-04-21 11:49:09 +02007242 panic("SELinux: register_pernet_subsys: error %d\n", err);
Linus Torvalds1da177e2005-04-16 15:20:36 -07007243
Jiri Pirko25db6be2014-09-03 17:42:13 +02007244 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07007245}
Linus Torvalds1da177e2005-04-16 15:20:36 -07007246__initcall(selinux_nf_ip_init);
7247
7248#ifdef CONFIG_SECURITY_SELINUX_DISABLE
7249static void selinux_nf_ip_exit(void)
7250{
Eric Parisfadcdb42007-02-22 18:11:31 -05007251 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07007252
Florian Westphal8e71bf72017-04-21 11:49:09 +02007253 unregister_pernet_subsys(&selinux_net_ops);
Linus Torvalds1da177e2005-04-16 15:20:36 -07007254}
7255#endif
7256
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08007257#else /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07007258
7259#ifdef CONFIG_SECURITY_SELINUX_DISABLE
7260#define selinux_nf_ip_exit()
7261#endif
7262
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08007263#endif /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07007264
7265#ifdef CONFIG_SECURITY_SELINUX_DISABLE
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007266int selinux_disable(struct selinux_state *state)
Linus Torvalds1da177e2005-04-16 15:20:36 -07007267{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007268 if (state->initialized) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07007269 /* Not permitted after initial policy load. */
7270 return -EINVAL;
7271 }
7272
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007273 if (state->disabled) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07007274 /* Only do this once. */
7275 return -EINVAL;
7276 }
7277
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007278 state->disabled = 1;
7279
Linus Torvalds1da177e2005-04-16 15:20:36 -07007280 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
7281
Stephen Smalley30d55282006-05-03 10:52:36 -04007282 selinux_enabled = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07007283
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07007284 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
Linus Torvalds1da177e2005-04-16 15:20:36 -07007285
Eric Parisaf8ff042009-09-20 21:23:01 -04007286 /* Try to destroy the avc node cache */
7287 avc_disable();
7288
Linus Torvalds1da177e2005-04-16 15:20:36 -07007289 /* Unregister netfilter hooks. */
7290 selinux_nf_ip_exit();
7291
7292 /* Unregister selinuxfs. */
7293 exit_sel_fs();
7294
7295 return 0;
7296}
7297#endif