blob: 627f291fb6c1b6273d4a46ee65ad8b4cc936f126 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
Eric Paris828dfe12008-04-17 13:17:49 -04007 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070010 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
Eric Paris2069f452008-07-04 09:47:13 +100012 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070014 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
Eric Paris828dfe12008-04-17 13:17:49 -040015 * <dgoeddel@trustedcs.com>
Paul Mooreed6d76e2009-08-28 18:12:49 -040016 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
Paul Moore82c21bf2011-08-01 11:10:33 +000017 * Paul Moore <paul@paul-moore.com>
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +090018 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
Eric Paris828dfe12008-04-17 13:17:49 -040019 * Yuichi Nakamura <ynakam@hitachisoft.jp>
Linus Torvalds1da177e2005-04-16 15:20:36 -070020 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
Eric Paris828dfe12008-04-17 13:17:49 -040023 * as published by the Free Software Foundation.
Linus Torvalds1da177e2005-04-16 15:20:36 -070024 */
25
Linus Torvalds1da177e2005-04-16 15:20:36 -070026#include <linux/init.h>
Eric Paris0b24dcb2011-02-25 15:39:20 -050027#include <linux/kd.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070028#include <linux/kernel.h>
Roland McGrath0d094ef2008-07-25 19:45:49 -070029#include <linux/tracehook.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070030#include <linux/errno.h>
Ingo Molnar3f07c012017-02-08 18:51:30 +010031#include <linux/sched/signal.h>
Ingo Molnar29930022017-02-08 18:51:36 +010032#include <linux/sched/task.h>
Casey Schaufler3c4ed7b2015-05-02 15:10:46 -070033#include <linux/lsm_hooks.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070034#include <linux/xattr.h>
35#include <linux/capability.h>
36#include <linux/unistd.h>
37#include <linux/mm.h>
38#include <linux/mman.h>
39#include <linux/slab.h>
40#include <linux/pagemap.h>
Eric Paris0b24dcb2011-02-25 15:39:20 -050041#include <linux/proc_fs.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070042#include <linux/swap.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070043#include <linux/spinlock.h>
44#include <linux/syscalls.h>
Eric Paris2a7dba32011-02-01 11:05:39 -050045#include <linux/dcache.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070046#include <linux/file.h>
Al Viro9f3acc32008-04-24 07:44:08 -040047#include <linux/fdtable.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070048#include <linux/namei.h>
49#include <linux/mount.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070050#include <linux/netfilter_ipv4.h>
51#include <linux/netfilter_ipv6.h>
52#include <linux/tty.h>
53#include <net/icmp.h>
Stephen Hemminger227b60f2007-10-10 17:30:46 -070054#include <net/ip.h> /* for local_port_range[] */
Linus Torvalds1da177e2005-04-16 15:20:36 -070055#include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
Paul Moore47180062013-12-04 16:10:45 -050056#include <net/inet_connection_sock.h>
Paul Moore220deb92008-01-29 08:38:23 -050057#include <net/net_namespace.h>
Paul Moored621d352008-01-29 08:43:36 -050058#include <net/netlabel.h>
Eric Parisf5269712008-05-14 11:27:45 -040059#include <linux/uaccess.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070060#include <asm/ioctls.h>
Arun Sharma600634972011-07-26 16:09:06 -070061#include <linux/atomic.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070062#include <linux/bitops.h>
63#include <linux/interrupt.h>
64#include <linux/netdevice.h> /* for network interface checks */
Hong zhi guo77954982013-03-27 06:49:35 +000065#include <net/netlink.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070066#include <linux/tcp.h>
67#include <linux/udp.h>
James Morris2ee92d42006-11-13 16:09:01 -080068#include <linux/dccp.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070069#include <linux/quota.h>
70#include <linux/un.h> /* for Unix socket types */
71#include <net/af_unix.h> /* for Unix socket types */
72#include <linux/parser.h>
73#include <linux/nfs_mount.h>
74#include <net/ipv6.h>
75#include <linux/hugetlb.h>
76#include <linux/personality.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070077#include <linux/audit.h>
Eric Paris6931dfc2005-06-30 02:58:51 -070078#include <linux/string.h>
Catherine Zhang877ce7c2006-06-29 12:27:47 -070079#include <linux/selinux.h>
Eric Paris23970742006-09-25 23:32:01 -070080#include <linux/mutex.h>
Frank Mayharf06febc2008-09-12 09:54:39 -070081#include <linux/posix-timers.h>
Kees Cook00234592010-02-03 15:36:43 -080082#include <linux/syslog.h>
Serge E. Hallyn34867402011-03-23 16:43:17 -070083#include <linux/user_namespace.h>
Paul Gortmaker44fc7ea2011-05-26 20:52:10 -040084#include <linux/export.h>
Al Viro40401532012-02-13 03:58:52 +000085#include <linux/msg.h>
86#include <linux/shm.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070087
88#include "avc.h"
89#include "objsec.h"
90#include "netif.h"
Paul Moore224dfbd2008-01-29 08:38:13 -050091#include "netnode.h"
Paul Moore3e1121722008-04-10 10:48:14 -040092#include "netport.h"
Trent Jaegerd28d1e02005-12-13 23:12:40 -080093#include "xfrm.h"
Paul Moorec60475b2007-02-28 15:14:23 -050094#include "netlabel.h"
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +020095#include "audit.h"
James Morris7b98a582011-08-30 12:52:32 +100096#include "avc_ss.h"
Linus Torvalds1da177e2005-04-16 15:20:36 -070097
Paul Moored621d352008-01-29 08:43:36 -050098/* SECMARK reference count */
James Morris56a4ca92011-08-17 11:08:43 +100099static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
Paul Moored621d352008-01-29 08:43:36 -0500100
Linus Torvalds1da177e2005-04-16 15:20:36 -0700101#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
Eric Paris828dfe12008-04-17 13:17:49 -0400102int selinux_enforcing;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700103
104static int __init enforcing_setup(char *str)
105{
Eric Parisf5269712008-05-14 11:27:45 -0400106 unsigned long enforcing;
Jingoo Han29707b22014-02-05 15:13:14 +0900107 if (!kstrtoul(str, 0, &enforcing))
Eric Parisf5269712008-05-14 11:27:45 -0400108 selinux_enforcing = enforcing ? 1 : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700109 return 1;
110}
111__setup("enforcing=", enforcing_setup);
112#endif
113
114#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
115int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
116
117static int __init selinux_enabled_setup(char *str)
118{
Eric Parisf5269712008-05-14 11:27:45 -0400119 unsigned long enabled;
Jingoo Han29707b22014-02-05 15:13:14 +0900120 if (!kstrtoul(str, 0, &enabled))
Eric Parisf5269712008-05-14 11:27:45 -0400121 selinux_enabled = enabled ? 1 : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700122 return 1;
123}
124__setup("selinux=", selinux_enabled_setup);
Stephen Smalley30d55282006-05-03 10:52:36 -0400125#else
126int selinux_enabled = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700127#endif
128
Christoph Lametere18b8902006-12-06 20:33:20 -0800129static struct kmem_cache *sel_inode_cache;
Sangwoo63205652015-10-21 17:44:30 -0400130static struct kmem_cache *file_security_cache;
James Morris7cae7e22006-03-22 00:09:22 -0800131
Paul Moored621d352008-01-29 08:43:36 -0500132/**
133 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
134 *
135 * Description:
136 * This function checks the SECMARK reference counter to see if any SECMARK
137 * targets are currently configured, if the reference counter is greater than
138 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
Chris PeBenito2be4d742013-05-03 09:05:39 -0400139 * enabled, false (0) if SECMARK is disabled. If the always_check_network
140 * policy capability is enabled, SECMARK is always considered enabled.
Paul Moored621d352008-01-29 08:43:36 -0500141 *
142 */
143static int selinux_secmark_enabled(void)
144{
Chris PeBenito2be4d742013-05-03 09:05:39 -0400145 return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
146}
147
148/**
149 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
150 *
151 * Description:
152 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
153 * (1) if any are enabled or false (0) if neither are enabled. If the
154 * always_check_network policy capability is enabled, peer labeling
155 * is always considered enabled.
156 *
157 */
158static int selinux_peerlbl_enabled(void)
159{
160 return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
Paul Moored621d352008-01-29 08:43:36 -0500161}
162
Paul Moore615e51f2014-06-26 14:33:56 -0400163static int selinux_netcache_avc_callback(u32 event)
164{
165 if (event == AVC_CALLBACK_RESET) {
166 sel_netif_flush();
167 sel_netnode_flush();
168 sel_netport_flush();
169 synchronize_net();
170 }
171 return 0;
172}
173
David Howellsd84f4f92008-11-14 10:39:23 +1100174/*
175 * initialise the security for the init task
176 */
177static void cred_init_security(void)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700178{
David Howells3b11a1d2008-11-14 10:39:26 +1100179 struct cred *cred = (struct cred *) current->real_cred;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700180 struct task_security_struct *tsec;
181
James Morris89d155e2005-10-30 14:59:21 -0800182 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700183 if (!tsec)
David Howellsd84f4f92008-11-14 10:39:23 +1100184 panic("SELinux: Failed to initialize initial task.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -0700185
David Howellsd84f4f92008-11-14 10:39:23 +1100186 tsec->osid = tsec->sid = SECINITSID_KERNEL;
David Howellsf1752ee2008-11-14 10:39:17 +1100187 cred->security = tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700188}
189
David Howells275bb412008-11-14 10:39:19 +1100190/*
David Howells88e67f32008-11-14 10:39:21 +1100191 * get the security ID of a set of credentials
192 */
193static inline u32 cred_sid(const struct cred *cred)
194{
195 const struct task_security_struct *tsec;
196
197 tsec = cred->security;
198 return tsec->sid;
199}
200
201/*
David Howells3b11a1d2008-11-14 10:39:26 +1100202 * get the objective security ID of a task
David Howells275bb412008-11-14 10:39:19 +1100203 */
204static inline u32 task_sid(const struct task_struct *task)
205{
David Howells275bb412008-11-14 10:39:19 +1100206 u32 sid;
207
208 rcu_read_lock();
David Howells88e67f32008-11-14 10:39:21 +1100209 sid = cred_sid(__task_cred(task));
David Howells275bb412008-11-14 10:39:19 +1100210 rcu_read_unlock();
211 return sid;
212}
213
David Howells88e67f32008-11-14 10:39:21 +1100214/* Allocate and free functions for each kind of security blob. */
215
Linus Torvalds1da177e2005-04-16 15:20:36 -0700216static int inode_alloc_security(struct inode *inode)
217{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700218 struct inode_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +1100219 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700220
Josef Bacika02fe132008-04-04 09:35:05 +1100221 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700222 if (!isec)
223 return -ENOMEM;
224
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +0100225 spin_lock_init(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700226 INIT_LIST_HEAD(&isec->list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700227 isec->inode = inode;
228 isec->sid = SECINITSID_UNLABELED;
229 isec->sclass = SECCLASS_FILE;
David Howells275bb412008-11-14 10:39:19 +1100230 isec->task_sid = sid;
Andreas Gruenbacher42059112016-11-10 22:18:27 +0100231 isec->initialized = LABEL_INVALID;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700232 inode->i_security = isec;
233
234 return 0;
235}
236
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500237static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
238
239/*
240 * Try reloading inode security labels that have been marked as invalid. The
241 * @may_sleep parameter indicates when sleeping and thus reloading labels is
Andreas Gruenbacher42059112016-11-10 22:18:27 +0100242 * allowed; when set to false, returns -ECHILD when the label is
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500243 * invalid. The @opt_dentry parameter should be set to a dentry of the inode;
244 * when no dentry is available, set it to NULL instead.
245 */
246static int __inode_security_revalidate(struct inode *inode,
247 struct dentry *opt_dentry,
248 bool may_sleep)
249{
250 struct inode_security_struct *isec = inode->i_security;
251
252 might_sleep_if(may_sleep);
253
Paul Moore1ac424762016-04-18 16:41:38 -0400254 if (ss_initialized && isec->initialized != LABEL_INITIALIZED) {
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500255 if (!may_sleep)
256 return -ECHILD;
257
258 /*
259 * Try reloading the inode security label. This will fail if
260 * @opt_dentry is NULL and no dentry for this inode can be
261 * found; in that case, continue using the old label.
262 */
263 inode_doinit_with_dentry(inode, opt_dentry);
264 }
265 return 0;
266}
267
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500268static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
269{
270 return inode->i_security;
271}
272
273static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
274{
275 int error;
276
277 error = __inode_security_revalidate(inode, NULL, !rcu);
278 if (error)
279 return ERR_PTR(error);
280 return inode->i_security;
281}
282
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500283/*
284 * Get the security label of an inode.
285 */
286static struct inode_security_struct *inode_security(struct inode *inode)
287{
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500288 __inode_security_revalidate(inode, NULL, true);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500289 return inode->i_security;
290}
291
Paul Moore2c971652016-04-19 16:36:28 -0400292static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
293{
294 struct inode *inode = d_backing_inode(dentry);
295
296 return inode->i_security;
297}
298
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500299/*
300 * Get the security label of a dentry's backing inode.
301 */
302static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
303{
304 struct inode *inode = d_backing_inode(dentry);
305
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500306 __inode_security_revalidate(inode, dentry, true);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500307 return inode->i_security;
308}
309
Steven Rostedt3dc91d42014-01-09 21:46:34 -0500310static void inode_free_rcu(struct rcu_head *head)
311{
312 struct inode_security_struct *isec;
313
314 isec = container_of(head, struct inode_security_struct, rcu);
315 kmem_cache_free(sel_inode_cache, isec);
316}
317
Linus Torvalds1da177e2005-04-16 15:20:36 -0700318static void inode_free_security(struct inode *inode)
319{
320 struct inode_security_struct *isec = inode->i_security;
321 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
322
Waiman Long9629d042015-07-10 17:19:56 -0400323 /*
324 * As not all inode security structures are in a list, we check for
325 * empty list outside of the lock to make sure that we won't waste
326 * time taking a lock doing nothing.
327 *
328 * The list_del_init() function can be safely called more than once.
329 * It should not be possible for this function to be called with
330 * concurrent list_add(), but for better safety against future changes
331 * in the code, we use list_empty_careful() here.
332 */
333 if (!list_empty_careful(&isec->list)) {
334 spin_lock(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700335 list_del_init(&isec->list);
Waiman Long9629d042015-07-10 17:19:56 -0400336 spin_unlock(&sbsec->isec_lock);
337 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700338
Steven Rostedt3dc91d42014-01-09 21:46:34 -0500339 /*
340 * The inode may still be referenced in a path walk and
341 * a call to selinux_inode_permission() can be made
342 * after inode_free_security() is called. Ideally, the VFS
343 * wouldn't do this, but fixing that is a much harder
344 * job. For now, simply free the i_security via RCU, and
345 * leave the current inode->i_security pointer intact.
346 * The inode will be freed after the RCU grace period too.
347 */
348 call_rcu(&isec->rcu, inode_free_rcu);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700349}
350
351static int file_alloc_security(struct file *file)
352{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700353 struct file_security_struct *fsec;
David Howells275bb412008-11-14 10:39:19 +1100354 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700355
Sangwoo63205652015-10-21 17:44:30 -0400356 fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700357 if (!fsec)
358 return -ENOMEM;
359
David Howells275bb412008-11-14 10:39:19 +1100360 fsec->sid = sid;
361 fsec->fown_sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700362 file->f_security = fsec;
363
364 return 0;
365}
366
367static void file_free_security(struct file *file)
368{
369 struct file_security_struct *fsec = file->f_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700370 file->f_security = NULL;
Sangwoo63205652015-10-21 17:44:30 -0400371 kmem_cache_free(file_security_cache, fsec);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700372}
373
374static int superblock_alloc_security(struct super_block *sb)
375{
376 struct superblock_security_struct *sbsec;
377
James Morris89d155e2005-10-30 14:59:21 -0800378 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700379 if (!sbsec)
380 return -ENOMEM;
381
Eric Parisbc7e9822006-09-25 23:32:02 -0700382 mutex_init(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700383 INIT_LIST_HEAD(&sbsec->isec_head);
384 spin_lock_init(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700385 sbsec->sb = sb;
386 sbsec->sid = SECINITSID_UNLABELED;
387 sbsec->def_sid = SECINITSID_FILE;
Eric Parisc312feb2006-07-10 04:43:53 -0700388 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700389 sb->s_security = sbsec;
390
391 return 0;
392}
393
394static void superblock_free_security(struct super_block *sb)
395{
396 struct superblock_security_struct *sbsec = sb->s_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700397 sb->s_security = NULL;
398 kfree(sbsec);
399}
400
Linus Torvalds1da177e2005-04-16 15:20:36 -0700401/* The file system's label must be initialized prior to use. */
402
David Quigleyeb9ae682013-05-22 12:50:37 -0400403static const char *labeling_behaviors[7] = {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700404 "uses xattr",
405 "uses transition SIDs",
406 "uses task SIDs",
407 "uses genfs_contexts",
408 "not configured for labeling",
409 "uses mountpoint labeling",
David Quigleyeb9ae682013-05-22 12:50:37 -0400410 "uses native labeling",
Linus Torvalds1da177e2005-04-16 15:20:36 -0700411};
412
Linus Torvalds1da177e2005-04-16 15:20:36 -0700413static inline int inode_doinit(struct inode *inode)
414{
415 return inode_doinit_with_dentry(inode, NULL);
416}
417
418enum {
Eric Paris31e87932007-09-19 17:19:12 -0400419 Opt_error = -1,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700420 Opt_context = 1,
421 Opt_fscontext = 2,
Eric Parisc9180a52007-11-30 13:00:35 -0500422 Opt_defcontext = 3,
423 Opt_rootcontext = 4,
David P. Quigley11689d42009-01-16 09:22:03 -0500424 Opt_labelsupport = 5,
Eric Parisd355987f2012-08-24 15:58:53 -0400425 Opt_nextmntopt = 6,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700426};
427
Eric Parisd355987f2012-08-24 15:58:53 -0400428#define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1)
429
Steven Whitehousea447c092008-10-13 10:46:57 +0100430static const match_table_t tokens = {
Eric Paris832cbd92008-04-01 13:24:09 -0400431 {Opt_context, CONTEXT_STR "%s"},
432 {Opt_fscontext, FSCONTEXT_STR "%s"},
433 {Opt_defcontext, DEFCONTEXT_STR "%s"},
434 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
David P. Quigley11689d42009-01-16 09:22:03 -0500435 {Opt_labelsupport, LABELSUPP_STR},
Eric Paris31e87932007-09-19 17:19:12 -0400436 {Opt_error, NULL},
Linus Torvalds1da177e2005-04-16 15:20:36 -0700437};
438
439#define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
440
Eric Parisc312feb2006-07-10 04:43:53 -0700441static int may_context_mount_sb_relabel(u32 sid,
442 struct superblock_security_struct *sbsec,
David Howells275bb412008-11-14 10:39:19 +1100443 const struct cred *cred)
Eric Parisc312feb2006-07-10 04:43:53 -0700444{
David Howells275bb412008-11-14 10:39:19 +1100445 const struct task_security_struct *tsec = cred->security;
Eric Parisc312feb2006-07-10 04:43:53 -0700446 int rc;
447
448 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
449 FILESYSTEM__RELABELFROM, NULL);
450 if (rc)
451 return rc;
452
453 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
454 FILESYSTEM__RELABELTO, NULL);
455 return rc;
456}
457
Eric Paris08089252006-07-10 04:43:55 -0700458static int may_context_mount_inode_relabel(u32 sid,
459 struct superblock_security_struct *sbsec,
David Howells275bb412008-11-14 10:39:19 +1100460 const struct cred *cred)
Eric Paris08089252006-07-10 04:43:55 -0700461{
David Howells275bb412008-11-14 10:39:19 +1100462 const struct task_security_struct *tsec = cred->security;
Eric Paris08089252006-07-10 04:43:55 -0700463 int rc;
464 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
465 FILESYSTEM__RELABELFROM, NULL);
466 if (rc)
467 return rc;
468
469 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
470 FILESYSTEM__ASSOCIATE, NULL);
471 return rc;
472}
473
Eric Parisb43e7252012-10-10 14:27:35 -0400474static int selinux_is_sblabel_mnt(struct super_block *sb)
475{
476 struct superblock_security_struct *sbsec = sb->s_security;
477
Mark Salyzynd5f3a5f2015-02-04 11:34:30 -0500478 return sbsec->behavior == SECURITY_FS_USE_XATTR ||
479 sbsec->behavior == SECURITY_FS_USE_TRANS ||
480 sbsec->behavior == SECURITY_FS_USE_TASK ||
J. Bruce Fields9fc2b4b2015-06-04 15:57:25 -0400481 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
Mark Salyzynd5f3a5f2015-02-04 11:34:30 -0500482 /* Special handling. Genfs but also in-core setxattr handler */
483 !strcmp(sb->s_type->name, "sysfs") ||
484 !strcmp(sb->s_type->name, "pstore") ||
485 !strcmp(sb->s_type->name, "debugfs") ||
Yongqin Liua2c7c6f2017-01-09 10:07:30 -0500486 !strcmp(sb->s_type->name, "tracefs") ||
Stephen Smalley2651225b2017-02-28 10:35:56 -0500487 !strcmp(sb->s_type->name, "rootfs") ||
488 (selinux_policycap_cgroupseclabel &&
489 (!strcmp(sb->s_type->name, "cgroup") ||
490 !strcmp(sb->s_type->name, "cgroup2")));
Eric Parisb43e7252012-10-10 14:27:35 -0400491}
492
Eric Parisc9180a52007-11-30 13:00:35 -0500493static int sb_finish_set_opts(struct super_block *sb)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700494{
495 struct superblock_security_struct *sbsec = sb->s_security;
496 struct dentry *root = sb->s_root;
David Howellsc6f493d2015-03-17 22:26:22 +0000497 struct inode *root_inode = d_backing_inode(root);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700498 int rc = 0;
499
Linus Torvalds1da177e2005-04-16 15:20:36 -0700500 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
501 /* Make sure that the xattr handler exists and that no
502 error other than -ENODATA is returned by getxattr on
503 the root directory. -ENODATA is ok, as this may be
504 the first boot of the SELinux kernel before we have
505 assigned xattr values to the filesystem. */
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +0200506 if (!(root_inode->i_opflags & IOP_XATTR)) {
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800507 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
508 "xattr support\n", sb->s_id, sb->s_type->name);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700509 rc = -EOPNOTSUPP;
510 goto out;
511 }
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +0200512
513 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700514 if (rc < 0 && rc != -ENODATA) {
515 if (rc == -EOPNOTSUPP)
516 printk(KERN_WARNING "SELinux: (dev %s, type "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800517 "%s) has no security xattr handler\n",
518 sb->s_id, sb->s_type->name);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700519 else
520 printk(KERN_WARNING "SELinux: (dev %s, type "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800521 "%s) getxattr errno %d\n", sb->s_id,
522 sb->s_type->name, -rc);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700523 goto out;
524 }
525 }
526
Eric Parisc9180a52007-11-30 13:00:35 -0500527 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800528 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
529 sb->s_id, sb->s_type->name);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700530
Eric Pariseadcabc2012-08-24 15:59:14 -0400531 sbsec->flags |= SE_SBINITIALIZED;
Eric Parisb43e7252012-10-10 14:27:35 -0400532 if (selinux_is_sblabel_mnt(sb))
Eric Paris12f348b2012-10-09 10:56:25 -0400533 sbsec->flags |= SBLABEL_MNT;
David P. Quigleyddd29ec2009-09-09 14:25:37 -0400534
Linus Torvalds1da177e2005-04-16 15:20:36 -0700535 /* Initialize the root inode. */
Eric Parisc9180a52007-11-30 13:00:35 -0500536 rc = inode_doinit_with_dentry(root_inode, root);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700537
538 /* Initialize any other inodes associated with the superblock, e.g.
539 inodes created prior to initial policy load or inodes created
540 during get_sb by a pseudo filesystem that directly
541 populates itself. */
542 spin_lock(&sbsec->isec_lock);
543next_inode:
544 if (!list_empty(&sbsec->isec_head)) {
545 struct inode_security_struct *isec =
546 list_entry(sbsec->isec_head.next,
Eric Parisc9180a52007-11-30 13:00:35 -0500547 struct inode_security_struct, list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700548 struct inode *inode = isec->inode;
Stephen Smalley923190d2014-10-06 16:32:52 -0400549 list_del_init(&isec->list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700550 spin_unlock(&sbsec->isec_lock);
551 inode = igrab(inode);
552 if (inode) {
Eric Parisc9180a52007-11-30 13:00:35 -0500553 if (!IS_PRIVATE(inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700554 inode_doinit(inode);
555 iput(inode);
556 }
557 spin_lock(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700558 goto next_inode;
559 }
560 spin_unlock(&sbsec->isec_lock);
561out:
Eric Parisc9180a52007-11-30 13:00:35 -0500562 return rc;
563}
564
565/*
566 * This function should allow an FS to ask what it's mount security
567 * options were so it can use those later for submounts, displaying
568 * mount options, or whatever.
569 */
570static int selinux_get_mnt_opts(const struct super_block *sb,
Eric Parise0007522008-03-05 10:31:54 -0500571 struct security_mnt_opts *opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500572{
573 int rc = 0, i;
574 struct superblock_security_struct *sbsec = sb->s_security;
575 char *context = NULL;
576 u32 len;
577 char tmp;
578
Eric Parise0007522008-03-05 10:31:54 -0500579 security_init_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500580
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500581 if (!(sbsec->flags & SE_SBINITIALIZED))
Eric Parisc9180a52007-11-30 13:00:35 -0500582 return -EINVAL;
583
584 if (!ss_initialized)
585 return -EINVAL;
586
Eric Parisaf8e50c2012-08-24 15:59:00 -0400587 /* make sure we always check enough bits to cover the mask */
588 BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
589
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500590 tmp = sbsec->flags & SE_MNTMASK;
Eric Parisc9180a52007-11-30 13:00:35 -0500591 /* count the number of mount options for this sb */
Eric Parisaf8e50c2012-08-24 15:59:00 -0400592 for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
Eric Parisc9180a52007-11-30 13:00:35 -0500593 if (tmp & 0x01)
Eric Parise0007522008-03-05 10:31:54 -0500594 opts->num_mnt_opts++;
Eric Parisc9180a52007-11-30 13:00:35 -0500595 tmp >>= 1;
596 }
David P. Quigley11689d42009-01-16 09:22:03 -0500597 /* Check if the Label support flag is set */
Eric Paris0b4bdb32013-08-28 13:32:42 -0400598 if (sbsec->flags & SBLABEL_MNT)
David P. Quigley11689d42009-01-16 09:22:03 -0500599 opts->num_mnt_opts++;
Eric Parisc9180a52007-11-30 13:00:35 -0500600
Eric Parise0007522008-03-05 10:31:54 -0500601 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
602 if (!opts->mnt_opts) {
Eric Parisc9180a52007-11-30 13:00:35 -0500603 rc = -ENOMEM;
604 goto out_free;
605 }
606
Eric Parise0007522008-03-05 10:31:54 -0500607 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
608 if (!opts->mnt_opts_flags) {
Eric Parisc9180a52007-11-30 13:00:35 -0500609 rc = -ENOMEM;
610 goto out_free;
611 }
612
613 i = 0;
614 if (sbsec->flags & FSCONTEXT_MNT) {
615 rc = security_sid_to_context(sbsec->sid, &context, &len);
616 if (rc)
617 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500618 opts->mnt_opts[i] = context;
619 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500620 }
621 if (sbsec->flags & CONTEXT_MNT) {
622 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
623 if (rc)
624 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500625 opts->mnt_opts[i] = context;
626 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500627 }
628 if (sbsec->flags & DEFCONTEXT_MNT) {
629 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
630 if (rc)
631 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500632 opts->mnt_opts[i] = context;
633 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500634 }
635 if (sbsec->flags & ROOTCONTEXT_MNT) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500636 struct dentry *root = sbsec->sb->s_root;
637 struct inode_security_struct *isec = backing_inode_security(root);
Eric Parisc9180a52007-11-30 13:00:35 -0500638
639 rc = security_sid_to_context(isec->sid, &context, &len);
640 if (rc)
641 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500642 opts->mnt_opts[i] = context;
643 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500644 }
Eric Paris12f348b2012-10-09 10:56:25 -0400645 if (sbsec->flags & SBLABEL_MNT) {
David P. Quigley11689d42009-01-16 09:22:03 -0500646 opts->mnt_opts[i] = NULL;
Eric Paris12f348b2012-10-09 10:56:25 -0400647 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
David P. Quigley11689d42009-01-16 09:22:03 -0500648 }
Eric Parisc9180a52007-11-30 13:00:35 -0500649
Eric Parise0007522008-03-05 10:31:54 -0500650 BUG_ON(i != opts->num_mnt_opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500651
652 return 0;
653
654out_free:
Eric Parise0007522008-03-05 10:31:54 -0500655 security_free_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500656 return rc;
657}
658
659static int bad_option(struct superblock_security_struct *sbsec, char flag,
660 u32 old_sid, u32 new_sid)
661{
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500662 char mnt_flags = sbsec->flags & SE_MNTMASK;
663
Eric Parisc9180a52007-11-30 13:00:35 -0500664 /* check if the old mount command had the same options */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500665 if (sbsec->flags & SE_SBINITIALIZED)
Eric Parisc9180a52007-11-30 13:00:35 -0500666 if (!(sbsec->flags & flag) ||
667 (old_sid != new_sid))
668 return 1;
669
670 /* check if we were passed the same options twice,
671 * aka someone passed context=a,context=b
672 */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500673 if (!(sbsec->flags & SE_SBINITIALIZED))
674 if (mnt_flags & flag)
Eric Parisc9180a52007-11-30 13:00:35 -0500675 return 1;
676 return 0;
677}
Eric Parise0007522008-03-05 10:31:54 -0500678
Eric Parisc9180a52007-11-30 13:00:35 -0500679/*
680 * Allow filesystems with binary mount data to explicitly set mount point
681 * labeling information.
682 */
Eric Parise0007522008-03-05 10:31:54 -0500683static int selinux_set_mnt_opts(struct super_block *sb,
David Quigley649f6e72013-05-22 12:50:36 -0400684 struct security_mnt_opts *opts,
685 unsigned long kern_flags,
686 unsigned long *set_kern_flags)
Eric Parisc9180a52007-11-30 13:00:35 -0500687{
David Howells275bb412008-11-14 10:39:19 +1100688 const struct cred *cred = current_cred();
Eric Parisc9180a52007-11-30 13:00:35 -0500689 int rc = 0, i;
Eric Parisc9180a52007-11-30 13:00:35 -0500690 struct superblock_security_struct *sbsec = sb->s_security;
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800691 const char *name = sb->s_type->name;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500692 struct dentry *root = sbsec->sb->s_root;
Paul Moore2c971652016-04-19 16:36:28 -0400693 struct inode_security_struct *root_isec;
Eric Parisc9180a52007-11-30 13:00:35 -0500694 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
695 u32 defcontext_sid = 0;
Eric Parise0007522008-03-05 10:31:54 -0500696 char **mount_options = opts->mnt_opts;
697 int *flags = opts->mnt_opts_flags;
698 int num_opts = opts->num_mnt_opts;
Eric Parisc9180a52007-11-30 13:00:35 -0500699
700 mutex_lock(&sbsec->lock);
701
702 if (!ss_initialized) {
703 if (!num_opts) {
704 /* Defer initialization until selinux_complete_init,
705 after the initial policy is loaded and the security
706 server is ready to handle calls. */
Eric Parisc9180a52007-11-30 13:00:35 -0500707 goto out;
708 }
709 rc = -EINVAL;
Eric Paris744ba352008-04-17 11:52:44 -0400710 printk(KERN_WARNING "SELinux: Unable to set superblock options "
711 "before the security server is initialized\n");
Eric Parisc9180a52007-11-30 13:00:35 -0500712 goto out;
713 }
David Quigley649f6e72013-05-22 12:50:36 -0400714 if (kern_flags && !set_kern_flags) {
715 /* Specifying internal flags without providing a place to
716 * place the results is not allowed */
717 rc = -EINVAL;
718 goto out;
719 }
Eric Parisc9180a52007-11-30 13:00:35 -0500720
721 /*
Eric Parise0007522008-03-05 10:31:54 -0500722 * Binary mount data FS will come through this function twice. Once
723 * from an explicit call and once from the generic calls from the vfs.
724 * Since the generic VFS calls will not contain any security mount data
725 * we need to skip the double mount verification.
726 *
727 * This does open a hole in which we will not notice if the first
728 * mount using this sb set explict options and a second mount using
729 * this sb does not set any security options. (The first options
730 * will be used for both mounts)
731 */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500732 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
Eric Parise0007522008-03-05 10:31:54 -0500733 && (num_opts == 0))
Eric Parisf5269712008-05-14 11:27:45 -0400734 goto out;
Eric Parise0007522008-03-05 10:31:54 -0500735
Paul Moore2c971652016-04-19 16:36:28 -0400736 root_isec = backing_inode_security_novalidate(root);
737
Eric Parise0007522008-03-05 10:31:54 -0500738 /*
Eric Parisc9180a52007-11-30 13:00:35 -0500739 * parse the mount options, check if they are valid sids.
740 * also check if someone is trying to mount the same sb more
741 * than once with different security options.
742 */
743 for (i = 0; i < num_opts; i++) {
744 u32 sid;
David P. Quigley11689d42009-01-16 09:22:03 -0500745
Eric Paris12f348b2012-10-09 10:56:25 -0400746 if (flags[i] == SBLABEL_MNT)
David P. Quigley11689d42009-01-16 09:22:03 -0500747 continue;
Rasmus Villemoes44be2f62015-10-21 17:44:25 -0400748 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
Eric Parisc9180a52007-11-30 13:00:35 -0500749 if (rc) {
Rasmus Villemoes44be2f62015-10-21 17:44:25 -0400750 printk(KERN_WARNING "SELinux: security_context_str_to_sid"
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800751 "(%s) failed for (dev %s, type %s) errno=%d\n",
752 mount_options[i], sb->s_id, name, rc);
Eric Parisc9180a52007-11-30 13:00:35 -0500753 goto out;
754 }
755 switch (flags[i]) {
756 case FSCONTEXT_MNT:
757 fscontext_sid = sid;
758
759 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
760 fscontext_sid))
761 goto out_double_mount;
762
763 sbsec->flags |= FSCONTEXT_MNT;
764 break;
765 case CONTEXT_MNT:
766 context_sid = sid;
767
768 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
769 context_sid))
770 goto out_double_mount;
771
772 sbsec->flags |= CONTEXT_MNT;
773 break;
774 case ROOTCONTEXT_MNT:
775 rootcontext_sid = sid;
776
777 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
778 rootcontext_sid))
779 goto out_double_mount;
780
781 sbsec->flags |= ROOTCONTEXT_MNT;
782
783 break;
784 case DEFCONTEXT_MNT:
785 defcontext_sid = sid;
786
787 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
788 defcontext_sid))
789 goto out_double_mount;
790
791 sbsec->flags |= DEFCONTEXT_MNT;
792
793 break;
794 default:
795 rc = -EINVAL;
796 goto out;
797 }
798 }
799
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500800 if (sbsec->flags & SE_SBINITIALIZED) {
Eric Parisc9180a52007-11-30 13:00:35 -0500801 /* previously mounted with options, but not on this attempt? */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500802 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500803 goto out_double_mount;
804 rc = 0;
805 goto out;
806 }
807
James Morris089be432008-07-15 18:32:49 +1000808 if (strcmp(sb->s_type->name, "proc") == 0)
Stephen Smalley134509d2015-06-04 16:22:17 -0400809 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
810
Stephen Smalley8e014722015-06-04 16:22:17 -0400811 if (!strcmp(sb->s_type->name, "debugfs") ||
812 !strcmp(sb->s_type->name, "sysfs") ||
813 !strcmp(sb->s_type->name, "pstore"))
Stephen Smalley134509d2015-06-04 16:22:17 -0400814 sbsec->flags |= SE_SBGENFS;
Eric Parisc9180a52007-11-30 13:00:35 -0500815
David Quigleyeb9ae682013-05-22 12:50:37 -0400816 if (!sbsec->behavior) {
817 /*
818 * Determine the labeling behavior to use for this
819 * filesystem type.
820 */
Paul Moore98f700f2013-09-18 13:52:20 -0400821 rc = security_fs_use(sb);
David Quigleyeb9ae682013-05-22 12:50:37 -0400822 if (rc) {
823 printk(KERN_WARNING
824 "%s: security_fs_use(%s) returned %d\n",
825 __func__, sb->s_type->name, rc);
826 goto out;
827 }
Eric Parisc9180a52007-11-30 13:00:35 -0500828 }
Seth Forsheeaad82892016-04-26 14:36:20 -0500829
830 /*
Stephen Smalley01593d32017-01-09 10:07:31 -0500831 * If this is a user namespace mount and the filesystem type is not
832 * explicitly whitelisted, then no contexts are allowed on the command
833 * line and security labels must be ignored.
Seth Forsheeaad82892016-04-26 14:36:20 -0500834 */
Stephen Smalley01593d32017-01-09 10:07:31 -0500835 if (sb->s_user_ns != &init_user_ns &&
836 strcmp(sb->s_type->name, "tmpfs") &&
837 strcmp(sb->s_type->name, "ramfs") &&
838 strcmp(sb->s_type->name, "devpts")) {
Seth Forsheeaad82892016-04-26 14:36:20 -0500839 if (context_sid || fscontext_sid || rootcontext_sid ||
840 defcontext_sid) {
841 rc = -EACCES;
842 goto out;
843 }
844 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
845 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
846 rc = security_transition_sid(current_sid(), current_sid(),
847 SECCLASS_FILE, NULL,
848 &sbsec->mntpoint_sid);
849 if (rc)
850 goto out;
851 }
852 goto out_set_opts;
853 }
854
Eric Parisc9180a52007-11-30 13:00:35 -0500855 /* sets the context of the superblock for the fs being mounted. */
856 if (fscontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100857 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500858 if (rc)
859 goto out;
860
861 sbsec->sid = fscontext_sid;
862 }
863
864 /*
865 * Switch to using mount point labeling behavior.
866 * sets the label used on all file below the mountpoint, and will set
867 * the superblock context if not already set.
868 */
David Quigleyeb9ae682013-05-22 12:50:37 -0400869 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
870 sbsec->behavior = SECURITY_FS_USE_NATIVE;
871 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
872 }
873
Eric Parisc9180a52007-11-30 13:00:35 -0500874 if (context_sid) {
875 if (!fscontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100876 rc = may_context_mount_sb_relabel(context_sid, sbsec,
877 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500878 if (rc)
879 goto out;
880 sbsec->sid = context_sid;
881 } else {
David Howells275bb412008-11-14 10:39:19 +1100882 rc = may_context_mount_inode_relabel(context_sid, sbsec,
883 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500884 if (rc)
885 goto out;
886 }
887 if (!rootcontext_sid)
888 rootcontext_sid = context_sid;
889
890 sbsec->mntpoint_sid = context_sid;
891 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
892 }
893
894 if (rootcontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100895 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
896 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500897 if (rc)
898 goto out;
899
900 root_isec->sid = rootcontext_sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -0500901 root_isec->initialized = LABEL_INITIALIZED;
Eric Parisc9180a52007-11-30 13:00:35 -0500902 }
903
904 if (defcontext_sid) {
David Quigleyeb9ae682013-05-22 12:50:37 -0400905 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
906 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
Eric Parisc9180a52007-11-30 13:00:35 -0500907 rc = -EINVAL;
908 printk(KERN_WARNING "SELinux: defcontext option is "
909 "invalid for this filesystem type\n");
910 goto out;
911 }
912
913 if (defcontext_sid != sbsec->def_sid) {
914 rc = may_context_mount_inode_relabel(defcontext_sid,
David Howells275bb412008-11-14 10:39:19 +1100915 sbsec, cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500916 if (rc)
917 goto out;
918 }
919
920 sbsec->def_sid = defcontext_sid;
921 }
922
Seth Forsheeaad82892016-04-26 14:36:20 -0500923out_set_opts:
Eric Parisc9180a52007-11-30 13:00:35 -0500924 rc = sb_finish_set_opts(sb);
925out:
Eric Parisbc7e9822006-09-25 23:32:02 -0700926 mutex_unlock(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700927 return rc;
Eric Parisc9180a52007-11-30 13:00:35 -0500928out_double_mount:
929 rc = -EINVAL;
930 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800931 "security settings for (dev %s, type %s)\n", sb->s_id, name);
Eric Parisc9180a52007-11-30 13:00:35 -0500932 goto out;
933}
934
Jeff Layton094f7b62013-04-01 08:14:24 -0400935static int selinux_cmp_sb_context(const struct super_block *oldsb,
936 const struct super_block *newsb)
937{
938 struct superblock_security_struct *old = oldsb->s_security;
939 struct superblock_security_struct *new = newsb->s_security;
940 char oldflags = old->flags & SE_MNTMASK;
941 char newflags = new->flags & SE_MNTMASK;
942
943 if (oldflags != newflags)
944 goto mismatch;
945 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
946 goto mismatch;
947 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
948 goto mismatch;
949 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
950 goto mismatch;
951 if (oldflags & ROOTCONTEXT_MNT) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500952 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
953 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
Jeff Layton094f7b62013-04-01 08:14:24 -0400954 if (oldroot->sid != newroot->sid)
955 goto mismatch;
956 }
957 return 0;
958mismatch:
959 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, "
960 "different security settings for (dev %s, "
961 "type %s)\n", newsb->s_id, newsb->s_type->name);
962 return -EBUSY;
963}
964
965static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
Eric Parisc9180a52007-11-30 13:00:35 -0500966 struct super_block *newsb)
967{
968 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
969 struct superblock_security_struct *newsbsec = newsb->s_security;
970
971 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
972 int set_context = (oldsbsec->flags & CONTEXT_MNT);
973 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
974
Eric Paris0f5e6422008-04-21 16:24:11 -0400975 /*
976 * if the parent was able to be mounted it clearly had no special lsm
Al Viroe8c26252010-03-23 06:36:54 -0400977 * mount options. thus we can safely deal with this superblock later
Eric Paris0f5e6422008-04-21 16:24:11 -0400978 */
Al Viroe8c26252010-03-23 06:36:54 -0400979 if (!ss_initialized)
Jeff Layton094f7b62013-04-01 08:14:24 -0400980 return 0;
Eric Parisc9180a52007-11-30 13:00:35 -0500981
Eric Parisc9180a52007-11-30 13:00:35 -0500982 /* how can we clone if the old one wasn't set up?? */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500983 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
Eric Parisc9180a52007-11-30 13:00:35 -0500984
Jeff Layton094f7b62013-04-01 08:14:24 -0400985 /* if fs is reusing a sb, make sure that the contexts match */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500986 if (newsbsec->flags & SE_SBINITIALIZED)
Jeff Layton094f7b62013-04-01 08:14:24 -0400987 return selinux_cmp_sb_context(oldsb, newsb);
Eric Paris5a552612008-04-09 14:08:35 -0400988
Eric Parisc9180a52007-11-30 13:00:35 -0500989 mutex_lock(&newsbsec->lock);
990
991 newsbsec->flags = oldsbsec->flags;
992
993 newsbsec->sid = oldsbsec->sid;
994 newsbsec->def_sid = oldsbsec->def_sid;
995 newsbsec->behavior = oldsbsec->behavior;
996
997 if (set_context) {
998 u32 sid = oldsbsec->mntpoint_sid;
999
1000 if (!set_fscontext)
1001 newsbsec->sid = sid;
1002 if (!set_rootcontext) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001003 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
Eric Parisc9180a52007-11-30 13:00:35 -05001004 newisec->sid = sid;
1005 }
1006 newsbsec->mntpoint_sid = sid;
1007 }
1008 if (set_rootcontext) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001009 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
1010 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
Eric Parisc9180a52007-11-30 13:00:35 -05001011
1012 newisec->sid = oldisec->sid;
1013 }
1014
1015 sb_finish_set_opts(newsb);
1016 mutex_unlock(&newsbsec->lock);
Jeff Layton094f7b62013-04-01 08:14:24 -04001017 return 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001018}
1019
Adrian Bunk2e1479d2008-03-17 22:29:23 +02001020static int selinux_parse_opts_str(char *options,
1021 struct security_mnt_opts *opts)
Eric Parisc9180a52007-11-30 13:00:35 -05001022{
Eric Parise0007522008-03-05 10:31:54 -05001023 char *p;
Eric Parisc9180a52007-11-30 13:00:35 -05001024 char *context = NULL, *defcontext = NULL;
1025 char *fscontext = NULL, *rootcontext = NULL;
Eric Parise0007522008-03-05 10:31:54 -05001026 int rc, num_mnt_opts = 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001027
Eric Parise0007522008-03-05 10:31:54 -05001028 opts->num_mnt_opts = 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001029
1030 /* Standard string-based options. */
1031 while ((p = strsep(&options, "|")) != NULL) {
1032 int token;
1033 substring_t args[MAX_OPT_ARGS];
1034
1035 if (!*p)
1036 continue;
1037
1038 token = match_token(p, tokens, args);
1039
1040 switch (token) {
1041 case Opt_context:
1042 if (context || defcontext) {
1043 rc = -EINVAL;
1044 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1045 goto out_err;
1046 }
1047 context = match_strdup(&args[0]);
1048 if (!context) {
1049 rc = -ENOMEM;
1050 goto out_err;
1051 }
1052 break;
1053
1054 case Opt_fscontext:
1055 if (fscontext) {
1056 rc = -EINVAL;
1057 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1058 goto out_err;
1059 }
1060 fscontext = match_strdup(&args[0]);
1061 if (!fscontext) {
1062 rc = -ENOMEM;
1063 goto out_err;
1064 }
1065 break;
1066
1067 case Opt_rootcontext:
1068 if (rootcontext) {
1069 rc = -EINVAL;
1070 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1071 goto out_err;
1072 }
1073 rootcontext = match_strdup(&args[0]);
1074 if (!rootcontext) {
1075 rc = -ENOMEM;
1076 goto out_err;
1077 }
1078 break;
1079
1080 case Opt_defcontext:
1081 if (context || defcontext) {
1082 rc = -EINVAL;
1083 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1084 goto out_err;
1085 }
1086 defcontext = match_strdup(&args[0]);
1087 if (!defcontext) {
1088 rc = -ENOMEM;
1089 goto out_err;
1090 }
1091 break;
David P. Quigley11689d42009-01-16 09:22:03 -05001092 case Opt_labelsupport:
1093 break;
Eric Parisc9180a52007-11-30 13:00:35 -05001094 default:
1095 rc = -EINVAL;
1096 printk(KERN_WARNING "SELinux: unknown mount option\n");
1097 goto out_err;
1098
1099 }
1100 }
1101
Eric Parise0007522008-03-05 10:31:54 -05001102 rc = -ENOMEM;
Tetsuo Handa8931c3b2016-11-14 20:16:12 +09001103 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_KERNEL);
Eric Parise0007522008-03-05 10:31:54 -05001104 if (!opts->mnt_opts)
1105 goto out_err;
1106
Tetsuo Handa8931c3b2016-11-14 20:16:12 +09001107 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int),
1108 GFP_KERNEL);
Eric Parise0007522008-03-05 10:31:54 -05001109 if (!opts->mnt_opts_flags) {
1110 kfree(opts->mnt_opts);
1111 goto out_err;
Eric Parisc9180a52007-11-30 13:00:35 -05001112 }
1113
Eric Parise0007522008-03-05 10:31:54 -05001114 if (fscontext) {
1115 opts->mnt_opts[num_mnt_opts] = fscontext;
1116 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1117 }
1118 if (context) {
1119 opts->mnt_opts[num_mnt_opts] = context;
1120 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1121 }
1122 if (rootcontext) {
1123 opts->mnt_opts[num_mnt_opts] = rootcontext;
1124 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1125 }
1126 if (defcontext) {
1127 opts->mnt_opts[num_mnt_opts] = defcontext;
1128 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1129 }
1130
1131 opts->num_mnt_opts = num_mnt_opts;
1132 return 0;
1133
Eric Parisc9180a52007-11-30 13:00:35 -05001134out_err:
1135 kfree(context);
1136 kfree(defcontext);
1137 kfree(fscontext);
1138 kfree(rootcontext);
1139 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001140}
Eric Parise0007522008-03-05 10:31:54 -05001141/*
1142 * string mount options parsing and call set the sbsec
1143 */
1144static int superblock_doinit(struct super_block *sb, void *data)
1145{
1146 int rc = 0;
1147 char *options = data;
1148 struct security_mnt_opts opts;
1149
1150 security_init_mnt_opts(&opts);
1151
1152 if (!data)
1153 goto out;
1154
1155 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1156
1157 rc = selinux_parse_opts_str(options, &opts);
1158 if (rc)
1159 goto out_err;
1160
1161out:
David Quigley649f6e72013-05-22 12:50:36 -04001162 rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
Eric Parise0007522008-03-05 10:31:54 -05001163
1164out_err:
1165 security_free_mnt_opts(&opts);
1166 return rc;
1167}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001168
Adrian Bunk3583a712008-07-22 20:21:23 +03001169static void selinux_write_opts(struct seq_file *m,
1170 struct security_mnt_opts *opts)
Eric Paris2069f452008-07-04 09:47:13 +10001171{
1172 int i;
1173 char *prefix;
1174
1175 for (i = 0; i < opts->num_mnt_opts; i++) {
David P. Quigley11689d42009-01-16 09:22:03 -05001176 char *has_comma;
1177
1178 if (opts->mnt_opts[i])
1179 has_comma = strchr(opts->mnt_opts[i], ',');
1180 else
1181 has_comma = NULL;
Eric Paris2069f452008-07-04 09:47:13 +10001182
1183 switch (opts->mnt_opts_flags[i]) {
1184 case CONTEXT_MNT:
1185 prefix = CONTEXT_STR;
1186 break;
1187 case FSCONTEXT_MNT:
1188 prefix = FSCONTEXT_STR;
1189 break;
1190 case ROOTCONTEXT_MNT:
1191 prefix = ROOTCONTEXT_STR;
1192 break;
1193 case DEFCONTEXT_MNT:
1194 prefix = DEFCONTEXT_STR;
1195 break;
Eric Paris12f348b2012-10-09 10:56:25 -04001196 case SBLABEL_MNT:
David P. Quigley11689d42009-01-16 09:22:03 -05001197 seq_putc(m, ',');
1198 seq_puts(m, LABELSUPP_STR);
1199 continue;
Eric Paris2069f452008-07-04 09:47:13 +10001200 default:
1201 BUG();
Eric Parisa35c6c832011-04-20 10:21:28 -04001202 return;
Eric Paris2069f452008-07-04 09:47:13 +10001203 };
1204 /* we need a comma before each option */
1205 seq_putc(m, ',');
1206 seq_puts(m, prefix);
1207 if (has_comma)
1208 seq_putc(m, '\"');
Kees Cooka068acf2015-09-04 15:44:57 -07001209 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
Eric Paris2069f452008-07-04 09:47:13 +10001210 if (has_comma)
1211 seq_putc(m, '\"');
1212 }
1213}
1214
1215static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1216{
1217 struct security_mnt_opts opts;
1218 int rc;
1219
1220 rc = selinux_get_mnt_opts(sb, &opts);
Eric Paris383795c2008-07-29 17:07:26 -04001221 if (rc) {
1222 /* before policy load we may get EINVAL, don't show anything */
1223 if (rc == -EINVAL)
1224 rc = 0;
Eric Paris2069f452008-07-04 09:47:13 +10001225 return rc;
Eric Paris383795c2008-07-29 17:07:26 -04001226 }
Eric Paris2069f452008-07-04 09:47:13 +10001227
1228 selinux_write_opts(m, &opts);
1229
1230 security_free_mnt_opts(&opts);
1231
1232 return rc;
1233}
1234
Linus Torvalds1da177e2005-04-16 15:20:36 -07001235static inline u16 inode_mode_to_security_class(umode_t mode)
1236{
1237 switch (mode & S_IFMT) {
1238 case S_IFSOCK:
1239 return SECCLASS_SOCK_FILE;
1240 case S_IFLNK:
1241 return SECCLASS_LNK_FILE;
1242 case S_IFREG:
1243 return SECCLASS_FILE;
1244 case S_IFBLK:
1245 return SECCLASS_BLK_FILE;
1246 case S_IFDIR:
1247 return SECCLASS_DIR;
1248 case S_IFCHR:
1249 return SECCLASS_CHR_FILE;
1250 case S_IFIFO:
1251 return SECCLASS_FIFO_FILE;
1252
1253 }
1254
1255 return SECCLASS_FILE;
1256}
1257
James Morris13402582005-09-30 14:24:34 -04001258static inline int default_protocol_stream(int protocol)
1259{
1260 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1261}
1262
1263static inline int default_protocol_dgram(int protocol)
1264{
1265 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1266}
1267
Linus Torvalds1da177e2005-04-16 15:20:36 -07001268static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1269{
Stephen Smalleyda69a532017-01-09 10:07:30 -05001270 int extsockclass = selinux_policycap_extsockclass;
1271
Linus Torvalds1da177e2005-04-16 15:20:36 -07001272 switch (family) {
1273 case PF_UNIX:
1274 switch (type) {
1275 case SOCK_STREAM:
1276 case SOCK_SEQPACKET:
1277 return SECCLASS_UNIX_STREAM_SOCKET;
1278 case SOCK_DGRAM:
1279 return SECCLASS_UNIX_DGRAM_SOCKET;
1280 }
1281 break;
1282 case PF_INET:
1283 case PF_INET6:
1284 switch (type) {
1285 case SOCK_STREAM:
Stephen Smalleyda69a532017-01-09 10:07:30 -05001286 case SOCK_SEQPACKET:
James Morris13402582005-09-30 14:24:34 -04001287 if (default_protocol_stream(protocol))
1288 return SECCLASS_TCP_SOCKET;
Stephen Smalleyda69a532017-01-09 10:07:30 -05001289 else if (extsockclass && protocol == IPPROTO_SCTP)
1290 return SECCLASS_SCTP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001291 else
1292 return SECCLASS_RAWIP_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001293 case SOCK_DGRAM:
James Morris13402582005-09-30 14:24:34 -04001294 if (default_protocol_dgram(protocol))
1295 return SECCLASS_UDP_SOCKET;
Stephen Smalleyef379792017-01-09 10:07:31 -05001296 else if (extsockclass && (protocol == IPPROTO_ICMP ||
1297 protocol == IPPROTO_ICMPV6))
Stephen Smalleyda69a532017-01-09 10:07:30 -05001298 return SECCLASS_ICMP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001299 else
1300 return SECCLASS_RAWIP_SOCKET;
James Morris2ee92d42006-11-13 16:09:01 -08001301 case SOCK_DCCP:
1302 return SECCLASS_DCCP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001303 default:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001304 return SECCLASS_RAWIP_SOCKET;
1305 }
1306 break;
1307 case PF_NETLINK:
1308 switch (protocol) {
1309 case NETLINK_ROUTE:
1310 return SECCLASS_NETLINK_ROUTE_SOCKET;
Pavel Emelyanov7f1fb602011-12-06 07:56:43 +00001311 case NETLINK_SOCK_DIAG:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001312 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1313 case NETLINK_NFLOG:
1314 return SECCLASS_NETLINK_NFLOG_SOCKET;
1315 case NETLINK_XFRM:
1316 return SECCLASS_NETLINK_XFRM_SOCKET;
1317 case NETLINK_SELINUX:
1318 return SECCLASS_NETLINK_SELINUX_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001319 case NETLINK_ISCSI:
1320 return SECCLASS_NETLINK_ISCSI_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001321 case NETLINK_AUDIT:
1322 return SECCLASS_NETLINK_AUDIT_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001323 case NETLINK_FIB_LOOKUP:
1324 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1325 case NETLINK_CONNECTOR:
1326 return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1327 case NETLINK_NETFILTER:
1328 return SECCLASS_NETLINK_NETFILTER_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001329 case NETLINK_DNRTMSG:
1330 return SECCLASS_NETLINK_DNRT_SOCKET;
James Morris0c9b7942005-04-16 15:24:13 -07001331 case NETLINK_KOBJECT_UEVENT:
1332 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001333 case NETLINK_GENERIC:
1334 return SECCLASS_NETLINK_GENERIC_SOCKET;
1335 case NETLINK_SCSITRANSPORT:
1336 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1337 case NETLINK_RDMA:
1338 return SECCLASS_NETLINK_RDMA_SOCKET;
1339 case NETLINK_CRYPTO:
1340 return SECCLASS_NETLINK_CRYPTO_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001341 default:
1342 return SECCLASS_NETLINK_SOCKET;
1343 }
1344 case PF_PACKET:
1345 return SECCLASS_PACKET_SOCKET;
1346 case PF_KEY:
1347 return SECCLASS_KEY_SOCKET;
Christopher J. PeBenito3e3ff152006-06-09 00:25:03 -07001348 case PF_APPLETALK:
1349 return SECCLASS_APPLETALK_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001350 }
1351
Stephen Smalleyda69a532017-01-09 10:07:30 -05001352 if (extsockclass) {
1353 switch (family) {
1354 case PF_AX25:
1355 return SECCLASS_AX25_SOCKET;
1356 case PF_IPX:
1357 return SECCLASS_IPX_SOCKET;
1358 case PF_NETROM:
1359 return SECCLASS_NETROM_SOCKET;
Stephen Smalleyda69a532017-01-09 10:07:30 -05001360 case PF_ATMPVC:
1361 return SECCLASS_ATMPVC_SOCKET;
1362 case PF_X25:
1363 return SECCLASS_X25_SOCKET;
1364 case PF_ROSE:
1365 return SECCLASS_ROSE_SOCKET;
1366 case PF_DECnet:
1367 return SECCLASS_DECNET_SOCKET;
1368 case PF_ATMSVC:
1369 return SECCLASS_ATMSVC_SOCKET;
1370 case PF_RDS:
1371 return SECCLASS_RDS_SOCKET;
1372 case PF_IRDA:
1373 return SECCLASS_IRDA_SOCKET;
1374 case PF_PPPOX:
1375 return SECCLASS_PPPOX_SOCKET;
1376 case PF_LLC:
1377 return SECCLASS_LLC_SOCKET;
Stephen Smalleyda69a532017-01-09 10:07:30 -05001378 case PF_CAN:
1379 return SECCLASS_CAN_SOCKET;
1380 case PF_TIPC:
1381 return SECCLASS_TIPC_SOCKET;
1382 case PF_BLUETOOTH:
1383 return SECCLASS_BLUETOOTH_SOCKET;
1384 case PF_IUCV:
1385 return SECCLASS_IUCV_SOCKET;
1386 case PF_RXRPC:
1387 return SECCLASS_RXRPC_SOCKET;
1388 case PF_ISDN:
1389 return SECCLASS_ISDN_SOCKET;
1390 case PF_PHONET:
1391 return SECCLASS_PHONET_SOCKET;
1392 case PF_IEEE802154:
1393 return SECCLASS_IEEE802154_SOCKET;
1394 case PF_CAIF:
1395 return SECCLASS_CAIF_SOCKET;
1396 case PF_ALG:
1397 return SECCLASS_ALG_SOCKET;
1398 case PF_NFC:
1399 return SECCLASS_NFC_SOCKET;
1400 case PF_VSOCK:
1401 return SECCLASS_VSOCK_SOCKET;
1402 case PF_KCM:
1403 return SECCLASS_KCM_SOCKET;
1404 case PF_QIPCRTR:
1405 return SECCLASS_QIPCRTR_SOCKET;
Linus Torvalds3051bf32017-02-22 10:15:09 -08001406 case PF_SMC:
1407 return SECCLASS_SMC_SOCKET;
1408#if PF_MAX > 44
Stephen Smalleyda69a532017-01-09 10:07:30 -05001409#error New address family defined, please update this function.
1410#endif
1411 }
1412 }
1413
Linus Torvalds1da177e2005-04-16 15:20:36 -07001414 return SECCLASS_SOCKET;
1415}
1416
Stephen Smalley134509d2015-06-04 16:22:17 -04001417static int selinux_genfs_get_sid(struct dentry *dentry,
1418 u16 tclass,
1419 u16 flags,
1420 u32 *sid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001421{
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001422 int rc;
Al Virofc640052016-04-10 01:33:30 -04001423 struct super_block *sb = dentry->d_sb;
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001424 char *buffer, *path;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001425
Eric Paris828dfe12008-04-17 13:17:49 -04001426 buffer = (char *)__get_free_page(GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001427 if (!buffer)
1428 return -ENOMEM;
1429
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001430 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1431 if (IS_ERR(path))
1432 rc = PTR_ERR(path);
1433 else {
Stephen Smalley134509d2015-06-04 16:22:17 -04001434 if (flags & SE_SBPROC) {
1435 /* each process gets a /proc/PID/ entry. Strip off the
1436 * PID part to get a valid selinux labeling.
1437 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1438 while (path[1] >= '0' && path[1] <= '9') {
1439 path[1] = '/';
1440 path++;
1441 }
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001442 }
Stephen Smalley134509d2015-06-04 16:22:17 -04001443 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001444 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001445 free_page((unsigned long)buffer);
1446 return rc;
1447}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001448
1449/* The inode's security attributes must be initialized before first use. */
1450static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1451{
1452 struct superblock_security_struct *sbsec = NULL;
1453 struct inode_security_struct *isec = inode->i_security;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001454 u32 task_sid, sid = 0;
1455 u16 sclass;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001456 struct dentry *dentry;
1457#define INITCONTEXTLEN 255
1458 char *context = NULL;
1459 unsigned len = 0;
1460 int rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001461
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05001462 if (isec->initialized == LABEL_INITIALIZED)
Andreas Gruenbacher13457d02016-11-10 22:18:29 +01001463 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001464
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001465 spin_lock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05001466 if (isec->initialized == LABEL_INITIALIZED)
Eric Paris23970742006-09-25 23:32:01 -07001467 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001468
Andreas Gruenbacher13457d02016-11-10 22:18:29 +01001469 if (isec->sclass == SECCLASS_FILE)
1470 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1471
Linus Torvalds1da177e2005-04-16 15:20:36 -07001472 sbsec = inode->i_sb->s_security;
David P. Quigley0d90a7e2009-01-16 09:22:02 -05001473 if (!(sbsec->flags & SE_SBINITIALIZED)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001474 /* Defer initialization until selinux_complete_init,
1475 after the initial policy is loaded and the security
1476 server is ready to handle calls. */
1477 spin_lock(&sbsec->isec_lock);
1478 if (list_empty(&isec->list))
1479 list_add(&isec->list, &sbsec->isec_head);
1480 spin_unlock(&sbsec->isec_lock);
Eric Paris23970742006-09-25 23:32:01 -07001481 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001482 }
1483
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001484 sclass = isec->sclass;
1485 task_sid = isec->task_sid;
1486 sid = isec->sid;
1487 isec->initialized = LABEL_PENDING;
1488 spin_unlock(&isec->lock);
1489
Linus Torvalds1da177e2005-04-16 15:20:36 -07001490 switch (sbsec->behavior) {
David Quigleyeb9ae682013-05-22 12:50:37 -04001491 case SECURITY_FS_USE_NATIVE:
1492 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001493 case SECURITY_FS_USE_XATTR:
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001494 if (!(inode->i_opflags & IOP_XATTR)) {
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001495 sid = sbsec->def_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001496 break;
1497 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001498 /* Need a dentry, since the xattr API requires one.
1499 Life would be simpler if we could just pass the inode. */
1500 if (opt_dentry) {
1501 /* Called from d_instantiate or d_splice_alias. */
1502 dentry = dget(opt_dentry);
1503 } else {
1504 /* Called from selinux_complete_init, try to find a dentry. */
1505 dentry = d_find_alias(inode);
1506 }
1507 if (!dentry) {
Eric Parisdf7f54c2009-03-09 14:35:58 -04001508 /*
1509 * this is can be hit on boot when a file is accessed
1510 * before the policy is loaded. When we load policy we
1511 * may find inodes that have no dentry on the
1512 * sbsec->isec_head list. No reason to complain as these
1513 * will get fixed up the next time we go through
1514 * inode_doinit with a dentry, before these inodes could
1515 * be used again by userspace.
1516 */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001517 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001518 }
1519
1520 len = INITCONTEXTLEN;
Eric Paris4cb912f2009-02-12 14:50:05 -05001521 context = kmalloc(len+1, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001522 if (!context) {
1523 rc = -ENOMEM;
1524 dput(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001525 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001526 }
Eric Paris4cb912f2009-02-12 14:50:05 -05001527 context[len] = '\0';
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001528 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001529 if (rc == -ERANGE) {
James Morris314dabb2009-08-10 22:00:13 +10001530 kfree(context);
1531
Linus Torvalds1da177e2005-04-16 15:20:36 -07001532 /* Need a larger buffer. Query for the right size. */
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001533 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001534 if (rc < 0) {
1535 dput(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001536 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001537 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001538 len = rc;
Eric Paris4cb912f2009-02-12 14:50:05 -05001539 context = kmalloc(len+1, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001540 if (!context) {
1541 rc = -ENOMEM;
1542 dput(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001543 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001544 }
Eric Paris4cb912f2009-02-12 14:50:05 -05001545 context[len] = '\0';
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001546 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001547 }
1548 dput(dentry);
1549 if (rc < 0) {
1550 if (rc != -ENODATA) {
Eric Paris744ba352008-04-17 11:52:44 -04001551 printk(KERN_WARNING "SELinux: %s: getxattr returned "
Harvey Harrisondd6f9532008-03-06 10:03:59 +11001552 "%d for dev=%s ino=%ld\n", __func__,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001553 -rc, inode->i_sb->s_id, inode->i_ino);
1554 kfree(context);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001555 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001556 }
1557 /* Map ENODATA to the default file SID */
1558 sid = sbsec->def_sid;
1559 rc = 0;
1560 } else {
James Morrisf5c1d5b2005-07-28 01:07:37 -07001561 rc = security_context_to_sid_default(context, rc, &sid,
Stephen Smalley869ab512008-04-04 08:46:05 -04001562 sbsec->def_sid,
1563 GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001564 if (rc) {
Eric Paris4ba0a8a2009-02-12 15:01:10 -05001565 char *dev = inode->i_sb->s_id;
1566 unsigned long ino = inode->i_ino;
1567
1568 if (rc == -EINVAL) {
1569 if (printk_ratelimit())
1570 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1571 "context=%s. This indicates you may need to relabel the inode or the "
1572 "filesystem in question.\n", ino, dev, context);
1573 } else {
1574 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1575 "returned %d for dev=%s ino=%ld\n",
1576 __func__, context, -rc, dev, ino);
1577 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001578 kfree(context);
1579 /* Leave with the unlabeled SID */
1580 rc = 0;
1581 break;
1582 }
1583 }
1584 kfree(context);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001585 break;
1586 case SECURITY_FS_USE_TASK:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001587 sid = task_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001588 break;
1589 case SECURITY_FS_USE_TRANS:
1590 /* Default to the fs SID. */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001591 sid = sbsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001592
1593 /* Try to obtain a transition SID. */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001594 rc = security_transition_sid(task_sid, sid, sclass, NULL, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001595 if (rc)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001596 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001597 break;
Eric Parisc312feb2006-07-10 04:43:53 -07001598 case SECURITY_FS_USE_MNTPOINT:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001599 sid = sbsec->mntpoint_sid;
Eric Parisc312feb2006-07-10 04:43:53 -07001600 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001601 default:
Eric Parisc312feb2006-07-10 04:43:53 -07001602 /* Default to the fs superblock SID. */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001603 sid = sbsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001604
Stephen Smalley134509d2015-06-04 16:22:17 -04001605 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
Paul Mooref64410e2014-03-19 16:46:18 -04001606 /* We must have a dentry to determine the label on
1607 * procfs inodes */
1608 if (opt_dentry)
1609 /* Called from d_instantiate or
1610 * d_splice_alias. */
1611 dentry = dget(opt_dentry);
1612 else
1613 /* Called from selinux_complete_init, try to
1614 * find a dentry. */
1615 dentry = d_find_alias(inode);
1616 /*
1617 * This can be hit on boot when a file is accessed
1618 * before the policy is loaded. When we load policy we
1619 * may find inodes that have no dentry on the
1620 * sbsec->isec_head list. No reason to complain as
1621 * these will get fixed up the next time we go through
1622 * inode_doinit() with a dentry, before these inodes
1623 * could be used again by userspace.
1624 */
1625 if (!dentry)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001626 goto out;
1627 rc = selinux_genfs_get_sid(dentry, sclass,
Stephen Smalley134509d2015-06-04 16:22:17 -04001628 sbsec->flags, &sid);
Paul Mooref64410e2014-03-19 16:46:18 -04001629 dput(dentry);
1630 if (rc)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001631 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001632 }
1633 break;
1634 }
1635
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001636out:
1637 spin_lock(&isec->lock);
1638 if (isec->initialized == LABEL_PENDING) {
1639 if (!sid || rc) {
1640 isec->initialized = LABEL_INVALID;
1641 goto out_unlock;
1642 }
1643
1644 isec->initialized = LABEL_INITIALIZED;
1645 isec->sid = sid;
1646 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001647
Eric Paris23970742006-09-25 23:32:01 -07001648out_unlock:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001649 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001650 return rc;
1651}
1652
1653/* Convert a Linux signal to an access vector. */
1654static inline u32 signal_to_av(int sig)
1655{
1656 u32 perm = 0;
1657
1658 switch (sig) {
1659 case SIGCHLD:
1660 /* Commonly granted from child to parent. */
1661 perm = PROCESS__SIGCHLD;
1662 break;
1663 case SIGKILL:
1664 /* Cannot be caught or ignored */
1665 perm = PROCESS__SIGKILL;
1666 break;
1667 case SIGSTOP:
1668 /* Cannot be caught or ignored */
1669 perm = PROCESS__SIGSTOP;
1670 break;
1671 default:
1672 /* All other signals. */
1673 perm = PROCESS__SIGNAL;
1674 break;
1675 }
1676
1677 return perm;
1678}
1679
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001680#if CAP_LAST_CAP > 63
1681#error Fix SELinux to handle capabilities > 63.
1682#endif
1683
Linus Torvalds1da177e2005-04-16 15:20:36 -07001684/* Check whether a task is allowed to use a capability. */
Eric Paris6a9de492012-01-03 12:25:14 -05001685static int cred_has_capability(const struct cred *cred,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001686 int cap, int audit, bool initns)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001687{
Thomas Liu2bf49692009-07-14 12:14:09 -04001688 struct common_audit_data ad;
Eric Paris06112162008-11-11 22:02:50 +11001689 struct av_decision avd;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001690 u16 sclass;
David Howells3699c532009-01-06 22:27:01 +00001691 u32 sid = cred_sid(cred);
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001692 u32 av = CAP_TO_MASK(cap);
Eric Paris06112162008-11-11 22:02:50 +11001693 int rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001694
Eric Paris50c205f2012-04-04 15:01:43 -04001695 ad.type = LSM_AUDIT_DATA_CAP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001696 ad.u.cap = cap;
1697
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001698 switch (CAP_TO_INDEX(cap)) {
1699 case 0:
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001700 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001701 break;
1702 case 1:
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001703 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001704 break;
1705 default:
1706 printk(KERN_ERR
1707 "SELinux: out of range capability %d\n", cap);
1708 BUG();
Eric Parisa35c6c832011-04-20 10:21:28 -04001709 return -EINVAL;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001710 }
Eric Paris06112162008-11-11 22:02:50 +11001711
David Howells275bb412008-11-14 10:39:19 +11001712 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
Eric Paris9ade0cf2011-04-25 16:26:29 -04001713 if (audit == SECURITY_CAP_AUDIT) {
NeilBrown7b20ea22015-03-23 13:37:39 +11001714 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
Eric Paris9ade0cf2011-04-25 16:26:29 -04001715 if (rc2)
1716 return rc2;
1717 }
Eric Paris06112162008-11-11 22:02:50 +11001718 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001719}
1720
Linus Torvalds1da177e2005-04-16 15:20:36 -07001721/* Check whether a task has a particular permission to an inode.
1722 The 'adp' parameter is optional and allows other audit
1723 data to be passed (e.g. the dentry). */
David Howells88e67f32008-11-14 10:39:21 +11001724static int inode_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001725 struct inode *inode,
1726 u32 perms,
Linus Torvalds19e49832013-10-04 12:54:11 -07001727 struct common_audit_data *adp)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001728{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001729 struct inode_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +11001730 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001731
David Howellse0e81732009-09-02 09:13:40 +01001732 validate_creds(cred);
1733
Eric Paris828dfe12008-04-17 13:17:49 -04001734 if (unlikely(IS_PRIVATE(inode)))
Stephen Smalleybbaca6c2007-02-14 00:34:16 -08001735 return 0;
1736
David Howells88e67f32008-11-14 10:39:21 +11001737 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001738 isec = inode->i_security;
1739
Linus Torvalds19e49832013-10-04 12:54:11 -07001740 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001741}
1742
1743/* Same as inode_has_perm, but pass explicit audit data containing
1744 the dentry to help the auditing code to more easily generate the
1745 pathname if needed. */
David Howells88e67f32008-11-14 10:39:21 +11001746static inline int dentry_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001747 struct dentry *dentry,
1748 u32 av)
1749{
David Howellsc6f493d2015-03-17 22:26:22 +00001750 struct inode *inode = d_backing_inode(dentry);
Thomas Liu2bf49692009-07-14 12:14:09 -04001751 struct common_audit_data ad;
David Howells88e67f32008-11-14 10:39:21 +11001752
Eric Paris50c205f2012-04-04 15:01:43 -04001753 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Paris2875fa02011-04-28 16:04:24 -04001754 ad.u.dentry = dentry;
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05001755 __inode_security_revalidate(inode, dentry, true);
Linus Torvalds19e49832013-10-04 12:54:11 -07001756 return inode_has_perm(cred, inode, av, &ad);
Eric Paris2875fa02011-04-28 16:04:24 -04001757}
1758
1759/* Same as inode_has_perm, but pass explicit audit data containing
1760 the path to help the auditing code to more easily generate the
1761 pathname if needed. */
1762static inline int path_has_perm(const struct cred *cred,
Al Viro3f7036a2015-03-08 19:28:30 -04001763 const struct path *path,
Eric Paris2875fa02011-04-28 16:04:24 -04001764 u32 av)
1765{
David Howellsc6f493d2015-03-17 22:26:22 +00001766 struct inode *inode = d_backing_inode(path->dentry);
Eric Paris2875fa02011-04-28 16:04:24 -04001767 struct common_audit_data ad;
1768
Eric Paris50c205f2012-04-04 15:01:43 -04001769 ad.type = LSM_AUDIT_DATA_PATH;
Eric Paris2875fa02011-04-28 16:04:24 -04001770 ad.u.path = *path;
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05001771 __inode_security_revalidate(inode, path->dentry, true);
Linus Torvalds19e49832013-10-04 12:54:11 -07001772 return inode_has_perm(cred, inode, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001773}
1774
David Howells13f8e982013-06-13 23:37:55 +01001775/* Same as path_has_perm, but uses the inode from the file struct. */
1776static inline int file_path_has_perm(const struct cred *cred,
1777 struct file *file,
1778 u32 av)
1779{
1780 struct common_audit_data ad;
1781
Vivek Goyal43af5de2016-09-09 11:37:49 -04001782 ad.type = LSM_AUDIT_DATA_FILE;
1783 ad.u.file = file;
Linus Torvalds19e49832013-10-04 12:54:11 -07001784 return inode_has_perm(cred, file_inode(file), av, &ad);
David Howells13f8e982013-06-13 23:37:55 +01001785}
1786
Linus Torvalds1da177e2005-04-16 15:20:36 -07001787/* Check whether a task can use an open file descriptor to
1788 access an inode in a given way. Check access to the
1789 descriptor itself, and then use dentry_has_perm to
1790 check a particular permission to the file.
1791 Access to the descriptor is implicitly granted if it
1792 has the same SID as the process. If av is zero, then
1793 access to the file is not checked, e.g. for cases
1794 where only the descriptor is affected like seek. */
David Howells88e67f32008-11-14 10:39:21 +11001795static int file_has_perm(const struct cred *cred,
1796 struct file *file,
1797 u32 av)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001798{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001799 struct file_security_struct *fsec = file->f_security;
Al Viro496ad9a2013-01-23 17:07:38 -05001800 struct inode *inode = file_inode(file);
Thomas Liu2bf49692009-07-14 12:14:09 -04001801 struct common_audit_data ad;
David Howells88e67f32008-11-14 10:39:21 +11001802 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001803 int rc;
1804
Vivek Goyal43af5de2016-09-09 11:37:49 -04001805 ad.type = LSM_AUDIT_DATA_FILE;
1806 ad.u.file = file;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001807
David Howells275bb412008-11-14 10:39:19 +11001808 if (sid != fsec->sid) {
1809 rc = avc_has_perm(sid, fsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001810 SECCLASS_FD,
1811 FD__USE,
1812 &ad);
1813 if (rc)
David Howells88e67f32008-11-14 10:39:21 +11001814 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001815 }
1816
1817 /* av is zero if only checking access to the descriptor. */
David Howells88e67f32008-11-14 10:39:21 +11001818 rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001819 if (av)
Linus Torvalds19e49832013-10-04 12:54:11 -07001820 rc = inode_has_perm(cred, inode, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001821
David Howells88e67f32008-11-14 10:39:21 +11001822out:
1823 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001824}
1825
David Howellsc3c188b2015-07-10 17:19:58 -04001826/*
1827 * Determine the label for an inode that might be unioned.
1828 */
Vivek Goyalc957f6d2016-07-13 10:44:51 -04001829static int
1830selinux_determine_inode_label(const struct task_security_struct *tsec,
1831 struct inode *dir,
1832 const struct qstr *name, u16 tclass,
1833 u32 *_new_isid)
David Howellsc3c188b2015-07-10 17:19:58 -04001834{
1835 const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
David Howellsc3c188b2015-07-10 17:19:58 -04001836
1837 if ((sbsec->flags & SE_SBINITIALIZED) &&
1838 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1839 *_new_isid = sbsec->mntpoint_sid;
1840 } else if ((sbsec->flags & SBLABEL_MNT) &&
1841 tsec->create_sid) {
1842 *_new_isid = tsec->create_sid;
1843 } else {
Paul Moore20cdef82016-04-04 14:14:42 -04001844 const struct inode_security_struct *dsec = inode_security(dir);
David Howellsc3c188b2015-07-10 17:19:58 -04001845 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1846 name, _new_isid);
1847 }
1848
1849 return 0;
1850}
1851
Linus Torvalds1da177e2005-04-16 15:20:36 -07001852/* Check whether a task can create a file. */
1853static int may_create(struct inode *dir,
1854 struct dentry *dentry,
1855 u16 tclass)
1856{
Paul Moore5fb49872010-04-22 14:46:19 -04001857 const struct task_security_struct *tsec = current_security();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001858 struct inode_security_struct *dsec;
1859 struct superblock_security_struct *sbsec;
David Howells275bb412008-11-14 10:39:19 +11001860 u32 sid, newsid;
Thomas Liu2bf49692009-07-14 12:14:09 -04001861 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001862 int rc;
1863
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001864 dsec = inode_security(dir);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001865 sbsec = dir->i_sb->s_security;
1866
David Howells275bb412008-11-14 10:39:19 +11001867 sid = tsec->sid;
David Howells275bb412008-11-14 10:39:19 +11001868
Eric Paris50c205f2012-04-04 15:01:43 -04001869 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04001870 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001871
David Howells275bb412008-11-14 10:39:19 +11001872 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001873 DIR__ADD_NAME | DIR__SEARCH,
1874 &ad);
1875 if (rc)
1876 return rc;
1877
Vivek Goyalc957f6d2016-07-13 10:44:51 -04001878 rc = selinux_determine_inode_label(current_security(), dir,
1879 &dentry->d_name, tclass, &newsid);
David Howellsc3c188b2015-07-10 17:19:58 -04001880 if (rc)
1881 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001882
David Howells275bb412008-11-14 10:39:19 +11001883 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001884 if (rc)
1885 return rc;
1886
1887 return avc_has_perm(newsid, sbsec->sid,
1888 SECCLASS_FILESYSTEM,
1889 FILESYSTEM__ASSOCIATE, &ad);
1890}
1891
Eric Paris828dfe12008-04-17 13:17:49 -04001892#define MAY_LINK 0
1893#define MAY_UNLINK 1
1894#define MAY_RMDIR 2
Linus Torvalds1da177e2005-04-16 15:20:36 -07001895
1896/* Check whether a task can link, unlink, or rmdir a file/directory. */
1897static int may_link(struct inode *dir,
1898 struct dentry *dentry,
1899 int kind)
1900
1901{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001902 struct inode_security_struct *dsec, *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04001903 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11001904 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001905 u32 av;
1906 int rc;
1907
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001908 dsec = inode_security(dir);
1909 isec = backing_inode_security(dentry);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001910
Eric Paris50c205f2012-04-04 15:01:43 -04001911 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04001912 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001913
1914 av = DIR__SEARCH;
1915 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
David Howells275bb412008-11-14 10:39:19 +11001916 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001917 if (rc)
1918 return rc;
1919
1920 switch (kind) {
1921 case MAY_LINK:
1922 av = FILE__LINK;
1923 break;
1924 case MAY_UNLINK:
1925 av = FILE__UNLINK;
1926 break;
1927 case MAY_RMDIR:
1928 av = DIR__RMDIR;
1929 break;
1930 default:
Eric Paris744ba352008-04-17 11:52:44 -04001931 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1932 __func__, kind);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001933 return 0;
1934 }
1935
David Howells275bb412008-11-14 10:39:19 +11001936 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001937 return rc;
1938}
1939
1940static inline int may_rename(struct inode *old_dir,
1941 struct dentry *old_dentry,
1942 struct inode *new_dir,
1943 struct dentry *new_dentry)
1944{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001945 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04001946 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11001947 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001948 u32 av;
1949 int old_is_dir, new_is_dir;
1950 int rc;
1951
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001952 old_dsec = inode_security(old_dir);
1953 old_isec = backing_inode_security(old_dentry);
David Howellse36cb0b2015-01-29 12:02:35 +00001954 old_is_dir = d_is_dir(old_dentry);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001955 new_dsec = inode_security(new_dir);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001956
Eric Paris50c205f2012-04-04 15:01:43 -04001957 ad.type = LSM_AUDIT_DATA_DENTRY;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001958
Eric Parisa2694342011-04-25 13:10:27 -04001959 ad.u.dentry = old_dentry;
David Howells275bb412008-11-14 10:39:19 +11001960 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001961 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1962 if (rc)
1963 return rc;
David Howells275bb412008-11-14 10:39:19 +11001964 rc = avc_has_perm(sid, old_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001965 old_isec->sclass, FILE__RENAME, &ad);
1966 if (rc)
1967 return rc;
1968 if (old_is_dir && new_dir != old_dir) {
David Howells275bb412008-11-14 10:39:19 +11001969 rc = avc_has_perm(sid, old_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001970 old_isec->sclass, DIR__REPARENT, &ad);
1971 if (rc)
1972 return rc;
1973 }
1974
Eric Parisa2694342011-04-25 13:10:27 -04001975 ad.u.dentry = new_dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001976 av = DIR__ADD_NAME | DIR__SEARCH;
David Howells2c616d42015-01-29 12:02:33 +00001977 if (d_is_positive(new_dentry))
Linus Torvalds1da177e2005-04-16 15:20:36 -07001978 av |= DIR__REMOVE_NAME;
David Howells275bb412008-11-14 10:39:19 +11001979 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001980 if (rc)
1981 return rc;
David Howells2c616d42015-01-29 12:02:33 +00001982 if (d_is_positive(new_dentry)) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001983 new_isec = backing_inode_security(new_dentry);
David Howellse36cb0b2015-01-29 12:02:35 +00001984 new_is_dir = d_is_dir(new_dentry);
David Howells275bb412008-11-14 10:39:19 +11001985 rc = avc_has_perm(sid, new_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001986 new_isec->sclass,
1987 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1988 if (rc)
1989 return rc;
1990 }
1991
1992 return 0;
1993}
1994
1995/* Check whether a task can perform a filesystem operation. */
David Howells88e67f32008-11-14 10:39:21 +11001996static int superblock_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001997 struct super_block *sb,
1998 u32 perms,
Thomas Liu2bf49692009-07-14 12:14:09 -04001999 struct common_audit_data *ad)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002000{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002001 struct superblock_security_struct *sbsec;
David Howells88e67f32008-11-14 10:39:21 +11002002 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002003
Linus Torvalds1da177e2005-04-16 15:20:36 -07002004 sbsec = sb->s_security;
David Howells275bb412008-11-14 10:39:19 +11002005 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002006}
2007
2008/* Convert a Linux mode and permission mask to an access vector. */
2009static inline u32 file_mask_to_av(int mode, int mask)
2010{
2011 u32 av = 0;
2012
Al Virodba19c62011-07-25 20:49:29 -04002013 if (!S_ISDIR(mode)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002014 if (mask & MAY_EXEC)
2015 av |= FILE__EXECUTE;
2016 if (mask & MAY_READ)
2017 av |= FILE__READ;
2018
2019 if (mask & MAY_APPEND)
2020 av |= FILE__APPEND;
2021 else if (mask & MAY_WRITE)
2022 av |= FILE__WRITE;
2023
2024 } else {
2025 if (mask & MAY_EXEC)
2026 av |= DIR__SEARCH;
2027 if (mask & MAY_WRITE)
2028 av |= DIR__WRITE;
2029 if (mask & MAY_READ)
2030 av |= DIR__READ;
2031 }
2032
2033 return av;
2034}
2035
2036/* Convert a Linux file to an access vector. */
2037static inline u32 file_to_av(struct file *file)
2038{
2039 u32 av = 0;
2040
2041 if (file->f_mode & FMODE_READ)
2042 av |= FILE__READ;
2043 if (file->f_mode & FMODE_WRITE) {
2044 if (file->f_flags & O_APPEND)
2045 av |= FILE__APPEND;
2046 else
2047 av |= FILE__WRITE;
2048 }
Stephen Smalley0794c662008-03-17 08:55:18 -04002049 if (!av) {
2050 /*
2051 * Special file opened with flags 3 for ioctl-only use.
2052 */
2053 av = FILE__IOCTL;
2054 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002055
2056 return av;
2057}
2058
Eric Paris8b6a5a32008-10-29 17:06:46 -04002059/*
2060 * Convert a file to an access vector and include the correct open
2061 * open permission.
2062 */
2063static inline u32 open_file_to_av(struct file *file)
2064{
2065 u32 av = file_to_av(file);
Stephen Smalleyccb54472017-05-12 12:41:24 -04002066 struct inode *inode = file_inode(file);
Eric Paris8b6a5a32008-10-29 17:06:46 -04002067
Stephen Smalleyccb54472017-05-12 12:41:24 -04002068 if (selinux_policycap_openperm && inode->i_sb->s_magic != SOCKFS_MAGIC)
Eric Paris49b7b8d2010-07-23 11:44:09 -04002069 av |= FILE__OPEN;
2070
Eric Paris8b6a5a32008-10-29 17:06:46 -04002071 return av;
2072}
2073
Linus Torvalds1da177e2005-04-16 15:20:36 -07002074/* Hook functions begin here. */
2075
Stephen Smalley79af7302015-01-21 10:54:10 -05002076static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2077{
2078 u32 mysid = current_sid();
2079 u32 mgrsid = task_sid(mgr);
2080
2081 return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
2082 BINDER__SET_CONTEXT_MGR, NULL);
2083}
2084
2085static int selinux_binder_transaction(struct task_struct *from,
2086 struct task_struct *to)
2087{
2088 u32 mysid = current_sid();
2089 u32 fromsid = task_sid(from);
2090 u32 tosid = task_sid(to);
2091 int rc;
2092
2093 if (mysid != fromsid) {
2094 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
2095 BINDER__IMPERSONATE, NULL);
2096 if (rc)
2097 return rc;
2098 }
2099
2100 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2101 NULL);
2102}
2103
2104static int selinux_binder_transfer_binder(struct task_struct *from,
2105 struct task_struct *to)
2106{
2107 u32 fromsid = task_sid(from);
2108 u32 tosid = task_sid(to);
2109
2110 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2111 NULL);
2112}
2113
2114static int selinux_binder_transfer_file(struct task_struct *from,
2115 struct task_struct *to,
2116 struct file *file)
2117{
2118 u32 sid = task_sid(to);
2119 struct file_security_struct *fsec = file->f_security;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002120 struct dentry *dentry = file->f_path.dentry;
Paul Moore20cdef82016-04-04 14:14:42 -04002121 struct inode_security_struct *isec;
Stephen Smalley79af7302015-01-21 10:54:10 -05002122 struct common_audit_data ad;
2123 int rc;
2124
2125 ad.type = LSM_AUDIT_DATA_PATH;
2126 ad.u.path = file->f_path;
2127
2128 if (sid != fsec->sid) {
2129 rc = avc_has_perm(sid, fsec->sid,
2130 SECCLASS_FD,
2131 FD__USE,
2132 &ad);
2133 if (rc)
2134 return rc;
2135 }
2136
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002137 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
Stephen Smalley79af7302015-01-21 10:54:10 -05002138 return 0;
2139
Paul Moore20cdef82016-04-04 14:14:42 -04002140 isec = backing_inode_security(dentry);
Stephen Smalley79af7302015-01-21 10:54:10 -05002141 return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2142 &ad);
2143}
2144
Ingo Molnar9e488582009-05-07 19:26:19 +10002145static int selinux_ptrace_access_check(struct task_struct *child,
David Howells5cd9c582008-08-14 11:37:28 +01002146 unsigned int mode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002147{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002148 u32 sid = current_sid();
2149 u32 csid = task_sid(child);
Stephen Smalley006ebb42008-05-19 08:32:49 -04002150
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002151 if (mode & PTRACE_MODE_READ)
2152 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2153
2154 return avc_has_perm(sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
David Howells5cd9c582008-08-14 11:37:28 +01002155}
2156
2157static int selinux_ptrace_traceme(struct task_struct *parent)
2158{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002159 return avc_has_perm(task_sid(parent), current_sid(), SECCLASS_PROCESS,
2160 PROCESS__PTRACE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002161}
2162
2163static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
Eric Paris828dfe12008-04-17 13:17:49 -04002164 kernel_cap_t *inheritable, kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002165{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002166 return avc_has_perm(current_sid(), task_sid(target), SECCLASS_PROCESS,
2167 PROCESS__GETCAP, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002168}
2169
David Howellsd84f4f92008-11-14 10:39:23 +11002170static int selinux_capset(struct cred *new, const struct cred *old,
2171 const kernel_cap_t *effective,
2172 const kernel_cap_t *inheritable,
2173 const kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002174{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002175 return avc_has_perm(cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2176 PROCESS__SETCAP, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002177}
2178
James Morris5626d3e2009-01-30 10:05:06 +11002179/*
2180 * (This comment used to live with the selinux_task_setuid hook,
2181 * which was removed).
2182 *
2183 * Since setuid only affects the current process, and since the SELinux
2184 * controls are not based on the Linux identity attributes, SELinux does not
2185 * need to control this operation. However, SELinux does control the use of
2186 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2187 */
2188
Eric Paris6a9de492012-01-03 12:25:14 -05002189static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2190 int cap, int audit)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002191{
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04002192 return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002193}
2194
Linus Torvalds1da177e2005-04-16 15:20:36 -07002195static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2196{
David Howells88e67f32008-11-14 10:39:21 +11002197 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002198 int rc = 0;
2199
2200 if (!sb)
2201 return 0;
2202
2203 switch (cmds) {
Eric Paris828dfe12008-04-17 13:17:49 -04002204 case Q_SYNC:
2205 case Q_QUOTAON:
2206 case Q_QUOTAOFF:
2207 case Q_SETINFO:
2208 case Q_SETQUOTA:
David Howells88e67f32008-11-14 10:39:21 +11002209 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04002210 break;
2211 case Q_GETFMT:
2212 case Q_GETINFO:
2213 case Q_GETQUOTA:
David Howells88e67f32008-11-14 10:39:21 +11002214 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04002215 break;
2216 default:
2217 rc = 0; /* let the kernel handle invalid cmds */
2218 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002219 }
2220 return rc;
2221}
2222
2223static int selinux_quota_on(struct dentry *dentry)
2224{
David Howells88e67f32008-11-14 10:39:21 +11002225 const struct cred *cred = current_cred();
2226
Eric Paris2875fa02011-04-28 16:04:24 -04002227 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002228}
2229
Eric Paris12b30522010-11-15 18:36:29 -05002230static int selinux_syslog(int type)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002231{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002232 switch (type) {
Kees Cookd78ca3c2010-02-03 15:37:13 -08002233 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2234 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002235 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2236 SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
Kees Cookd78ca3c2010-02-03 15:37:13 -08002237 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2238 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2239 /* Set level of messages printed to console */
2240 case SYSLOG_ACTION_CONSOLE_LEVEL:
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002241 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2242 SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2243 NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002244 }
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002245 /* All other syslog types */
2246 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2247 SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002248}
2249
2250/*
2251 * Check that a process has enough memory to allocate a new virtual
2252 * mapping. 0 means there is enough memory for the allocation to
2253 * succeed and -ENOMEM implies there is not.
2254 *
Linus Torvalds1da177e2005-04-16 15:20:36 -07002255 * Do not audit the selinux permission check, as this is applied to all
2256 * processes that allocate mappings.
2257 */
Alan Cox34b4e4a2007-08-22 14:01:28 -07002258static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002259{
2260 int rc, cap_sys_admin = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002261
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07002262 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04002263 SECURITY_CAP_NOAUDIT, true);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002264 if (rc == 0)
2265 cap_sys_admin = 1;
2266
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07002267 return cap_sys_admin;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002268}
2269
2270/* binprm security operations */
2271
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002272static u32 ptrace_parent_sid(void)
Paul Moore0c6181c2016-03-30 21:41:21 -04002273{
2274 u32 sid = 0;
2275 struct task_struct *tracer;
2276
2277 rcu_read_lock();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002278 tracer = ptrace_parent(current);
Paul Moore0c6181c2016-03-30 21:41:21 -04002279 if (tracer)
2280 sid = task_sid(tracer);
2281 rcu_read_unlock();
2282
2283 return sid;
2284}
2285
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002286static int check_nnp_nosuid(const struct linux_binprm *bprm,
2287 const struct task_security_struct *old_tsec,
2288 const struct task_security_struct *new_tsec)
2289{
2290 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
Andy Lutomirski380cf5b2016-06-23 16:41:05 -05002291 int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002292 int rc;
2293
2294 if (!nnp && !nosuid)
2295 return 0; /* neither NNP nor nosuid */
2296
2297 if (new_tsec->sid == old_tsec->sid)
2298 return 0; /* No change in credentials */
2299
2300 /*
2301 * The only transitions we permit under NNP or nosuid
2302 * are transitions to bounded SIDs, i.e. SIDs that are
2303 * guaranteed to only be allowed a subset of the permissions
2304 * of the current SID.
2305 */
2306 rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2307 if (rc) {
2308 /*
2309 * On failure, preserve the errno values for NNP vs nosuid.
2310 * NNP: Operation not permitted for caller.
2311 * nosuid: Permission denied to file.
2312 */
2313 if (nnp)
2314 return -EPERM;
2315 else
2316 return -EACCES;
2317 }
2318 return 0;
2319}
2320
David Howellsa6f76f22008-11-14 10:39:24 +11002321static int selinux_bprm_set_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002322{
David Howellsa6f76f22008-11-14 10:39:24 +11002323 const struct task_security_struct *old_tsec;
2324 struct task_security_struct *new_tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002325 struct inode_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04002326 struct common_audit_data ad;
Al Viro496ad9a2013-01-23 17:07:38 -05002327 struct inode *inode = file_inode(bprm->file);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002328 int rc;
2329
David Howellsa6f76f22008-11-14 10:39:24 +11002330 /* SELinux context only depends on initial program or script and not
2331 * the script interpreter */
2332 if (bprm->cred_prepared)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002333 return 0;
2334
David Howellsa6f76f22008-11-14 10:39:24 +11002335 old_tsec = current_security();
2336 new_tsec = bprm->cred->security;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002337 isec = inode_security(inode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002338
2339 /* Default to the current task SID. */
David Howellsa6f76f22008-11-14 10:39:24 +11002340 new_tsec->sid = old_tsec->sid;
2341 new_tsec->osid = old_tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002342
Michael LeMay28eba5b2006-06-27 02:53:42 -07002343 /* Reset fs, key, and sock SIDs on execve. */
David Howellsa6f76f22008-11-14 10:39:24 +11002344 new_tsec->create_sid = 0;
2345 new_tsec->keycreate_sid = 0;
2346 new_tsec->sockcreate_sid = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002347
David Howellsa6f76f22008-11-14 10:39:24 +11002348 if (old_tsec->exec_sid) {
2349 new_tsec->sid = old_tsec->exec_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002350 /* Reset exec SID on execve. */
David Howellsa6f76f22008-11-14 10:39:24 +11002351 new_tsec->exec_sid = 0;
Andy Lutomirski259e5e62012-04-12 16:47:50 -05002352
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002353 /* Fail on NNP or nosuid if not an allowed transition. */
2354 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2355 if (rc)
2356 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002357 } else {
2358 /* Check for a default transition on this program. */
David Howellsa6f76f22008-11-14 10:39:24 +11002359 rc = security_transition_sid(old_tsec->sid, isec->sid,
Eric Paris652bb9b2011-02-01 11:05:40 -05002360 SECCLASS_PROCESS, NULL,
2361 &new_tsec->sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002362 if (rc)
2363 return rc;
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002364
2365 /*
2366 * Fallback to old SID on NNP or nosuid if not an allowed
2367 * transition.
2368 */
2369 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2370 if (rc)
2371 new_tsec->sid = old_tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002372 }
2373
Vivek Goyal43af5de2016-09-09 11:37:49 -04002374 ad.type = LSM_AUDIT_DATA_FILE;
2375 ad.u.file = bprm->file;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002376
David Howellsa6f76f22008-11-14 10:39:24 +11002377 if (new_tsec->sid == old_tsec->sid) {
2378 rc = avc_has_perm(old_tsec->sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002379 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2380 if (rc)
2381 return rc;
2382 } else {
2383 /* Check permissions for the transition. */
David Howellsa6f76f22008-11-14 10:39:24 +11002384 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002385 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2386 if (rc)
2387 return rc;
2388
David Howellsa6f76f22008-11-14 10:39:24 +11002389 rc = avc_has_perm(new_tsec->sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002390 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2391 if (rc)
2392 return rc;
2393
David Howellsa6f76f22008-11-14 10:39:24 +11002394 /* Check for shared state */
2395 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2396 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2397 SECCLASS_PROCESS, PROCESS__SHARE,
2398 NULL);
2399 if (rc)
2400 return -EPERM;
2401 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002402
David Howellsa6f76f22008-11-14 10:39:24 +11002403 /* Make sure that anyone attempting to ptrace over a task that
2404 * changes its SID has the appropriate permit */
Eric W. Biederman9227dd22017-01-23 17:26:31 +13002405 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002406 u32 ptsid = ptrace_parent_sid();
David Howellsa6f76f22008-11-14 10:39:24 +11002407 if (ptsid != 0) {
2408 rc = avc_has_perm(ptsid, new_tsec->sid,
2409 SECCLASS_PROCESS,
2410 PROCESS__PTRACE, NULL);
2411 if (rc)
2412 return -EPERM;
2413 }
2414 }
2415
2416 /* Clear any possibly unsafe personality bits on exec: */
2417 bprm->per_clear |= PER_CLEAR_ON_SETID;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002418 }
2419
Linus Torvalds1da177e2005-04-16 15:20:36 -07002420 return 0;
2421}
2422
Eric Paris828dfe12008-04-17 13:17:49 -04002423static int selinux_bprm_secureexec(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002424{
Paul Moore5fb49872010-04-22 14:46:19 -04002425 const struct task_security_struct *tsec = current_security();
David Howells275bb412008-11-14 10:39:19 +11002426 u32 sid, osid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002427 int atsecure = 0;
2428
David Howells275bb412008-11-14 10:39:19 +11002429 sid = tsec->sid;
2430 osid = tsec->osid;
2431
2432 if (osid != sid) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002433 /* Enable secure mode for SIDs transitions unless
2434 the noatsecure permission is granted between
2435 the two SIDs, i.e. ahp returns 0. */
David Howells275bb412008-11-14 10:39:19 +11002436 atsecure = avc_has_perm(osid, sid,
David Howellsa6f76f22008-11-14 10:39:24 +11002437 SECCLASS_PROCESS,
2438 PROCESS__NOATSECURE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002439 }
2440
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07002441 return !!atsecure;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002442}
2443
Al Viroc3c073f2012-08-21 22:32:06 -04002444static int match_file(const void *p, struct file *file, unsigned fd)
2445{
2446 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2447}
2448
Linus Torvalds1da177e2005-04-16 15:20:36 -07002449/* Derived from fs/exec.c:flush_old_files. */
David Howells745ca242008-11-14 10:39:22 +11002450static inline void flush_unauthorized_files(const struct cred *cred,
2451 struct files_struct *files)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002452{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002453 struct file *file, *devnull = NULL;
Stephen Smalleyb20c8122006-09-25 23:32:03 -07002454 struct tty_struct *tty;
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002455 int drop_tty = 0;
Al Viroc3c073f2012-08-21 22:32:06 -04002456 unsigned n;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002457
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002458 tty = get_current_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002459 if (tty) {
Peter Hurley4a510962016-01-09 21:35:23 -08002460 spin_lock(&tty->files_lock);
Eric Paris37dd0bd2008-10-31 17:40:00 -04002461 if (!list_empty(&tty->tty_files)) {
Nick Piggind996b622010-08-18 04:37:36 +10002462 struct tty_file_private *file_priv;
Eric Paris37dd0bd2008-10-31 17:40:00 -04002463
Linus Torvalds1da177e2005-04-16 15:20:36 -07002464 /* Revalidate access to controlling tty.
David Howells13f8e982013-06-13 23:37:55 +01002465 Use file_path_has_perm on the tty path directly
2466 rather than using file_has_perm, as this particular
2467 open file may belong to another process and we are
2468 only interested in the inode-based check here. */
Nick Piggind996b622010-08-18 04:37:36 +10002469 file_priv = list_first_entry(&tty->tty_files,
2470 struct tty_file_private, list);
2471 file = file_priv->file;
David Howells13f8e982013-06-13 23:37:55 +01002472 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002473 drop_tty = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002474 }
Peter Hurley4a510962016-01-09 21:35:23 -08002475 spin_unlock(&tty->files_lock);
Alan Cox452a00d2008-10-13 10:39:13 +01002476 tty_kref_put(tty);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002477 }
Eric W. Biederman98a27ba2007-05-08 00:26:56 -07002478 /* Reset controlling tty. */
2479 if (drop_tty)
2480 no_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002481
2482 /* Revalidate access to inherited open files. */
Al Viroc3c073f2012-08-21 22:32:06 -04002483 n = iterate_fd(files, 0, match_file, cred);
2484 if (!n) /* none found? */
2485 return;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002486
Al Viroc3c073f2012-08-21 22:32:06 -04002487 devnull = dentry_open(&selinux_null, O_RDWR, cred);
Al Viro45525b22012-10-16 13:30:07 -04002488 if (IS_ERR(devnull))
2489 devnull = NULL;
2490 /* replace all the matching ones with this */
2491 do {
2492 replace_fd(n - 1, devnull, 0);
2493 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2494 if (devnull)
Al Viroc3c073f2012-08-21 22:32:06 -04002495 fput(devnull);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002496}
2497
Linus Torvalds1da177e2005-04-16 15:20:36 -07002498/*
David Howellsa6f76f22008-11-14 10:39:24 +11002499 * Prepare a process for imminent new credential changes due to exec
Linus Torvalds1da177e2005-04-16 15:20:36 -07002500 */
David Howellsa6f76f22008-11-14 10:39:24 +11002501static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002502{
David Howellsa6f76f22008-11-14 10:39:24 +11002503 struct task_security_struct *new_tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002504 struct rlimit *rlim, *initrlim;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002505 int rc, i;
2506
David Howellsa6f76f22008-11-14 10:39:24 +11002507 new_tsec = bprm->cred->security;
2508 if (new_tsec->sid == new_tsec->osid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002509 return;
2510
2511 /* Close files for which the new task SID is not authorized. */
David Howellsa6f76f22008-11-14 10:39:24 +11002512 flush_unauthorized_files(bprm->cred, current->files);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002513
David Howellsa6f76f22008-11-14 10:39:24 +11002514 /* Always clear parent death signal on SID transitions. */
2515 current->pdeath_signal = 0;
2516
2517 /* Check whether the new SID can inherit resource limits from the old
2518 * SID. If not, reset all soft limits to the lower of the current
2519 * task's hard limit and the init task's soft limit.
2520 *
2521 * Note that the setting of hard limits (even to lower them) can be
2522 * controlled by the setrlimit check. The inclusion of the init task's
2523 * soft limit into the computation is to avoid resetting soft limits
2524 * higher than the default soft limit for cases where the default is
2525 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2526 */
2527 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2528 PROCESS__RLIMITINH, NULL);
2529 if (rc) {
Oleg Nesteroveb2d55a2010-06-23 22:43:32 +02002530 /* protect against do_prlimit() */
2531 task_lock(current);
David Howellsa6f76f22008-11-14 10:39:24 +11002532 for (i = 0; i < RLIM_NLIMITS; i++) {
2533 rlim = current->signal->rlim + i;
2534 initrlim = init_task.signal->rlim + i;
2535 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2536 }
Oleg Nesteroveb2d55a2010-06-23 22:43:32 +02002537 task_unlock(current);
Nicolas Pitrebaa73d92016-11-11 00:10:10 -05002538 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2539 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
David Howellsa6f76f22008-11-14 10:39:24 +11002540 }
2541}
2542
2543/*
2544 * Clean up the process immediately after the installation of new credentials
2545 * due to exec
2546 */
2547static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2548{
2549 const struct task_security_struct *tsec = current_security();
2550 struct itimerval itimer;
David Howellsa6f76f22008-11-14 10:39:24 +11002551 u32 osid, sid;
2552 int rc, i;
David Howellsa6f76f22008-11-14 10:39:24 +11002553
David Howellsa6f76f22008-11-14 10:39:24 +11002554 osid = tsec->osid;
2555 sid = tsec->sid;
2556
2557 if (sid == osid)
2558 return;
2559
2560 /* Check whether the new SID can inherit signal state from the old SID.
2561 * If not, clear itimers to avoid subsequent signal generation and
2562 * flush and unblock signals.
2563 *
2564 * This must occur _after_ the task SID has been updated so that any
2565 * kill done after the flush will be checked against the new SID.
2566 */
2567 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002568 if (rc) {
Nicolas Pitrebaa73d92016-11-11 00:10:10 -05002569 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) {
2570 memset(&itimer, 0, sizeof itimer);
2571 for (i = 0; i < 3; i++)
2572 do_setitimer(i, &itimer, NULL);
2573 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002574 spin_lock_irq(&current->sighand->siglock);
Oleg Nesterov9e7c8f82015-06-04 16:22:16 -04002575 if (!fatal_signal_pending(current)) {
2576 flush_sigqueue(&current->pending);
2577 flush_sigqueue(&current->signal->shared_pending);
David Howells3bcac022009-04-29 13:45:05 +01002578 flush_signal_handlers(current, 1);
2579 sigemptyset(&current->blocked);
Oleg Nesterov9e7c8f82015-06-04 16:22:16 -04002580 recalc_sigpending();
David Howells3bcac022009-04-29 13:45:05 +01002581 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002582 spin_unlock_irq(&current->sighand->siglock);
2583 }
2584
David Howellsa6f76f22008-11-14 10:39:24 +11002585 /* Wake up the parent if it is waiting so that it can recheck
2586 * wait permission to the new task SID. */
Oleg Nesterovecd6de32009-04-29 16:02:24 +02002587 read_lock(&tasklist_lock);
Oleg Nesterov0b7570e2009-09-23 15:56:46 -07002588 __wake_up_parent(current, current->real_parent);
Oleg Nesterovecd6de32009-04-29 16:02:24 +02002589 read_unlock(&tasklist_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002590}
2591
2592/* superblock security operations */
2593
2594static int selinux_sb_alloc_security(struct super_block *sb)
2595{
2596 return superblock_alloc_security(sb);
2597}
2598
2599static void selinux_sb_free_security(struct super_block *sb)
2600{
2601 superblock_free_security(sb);
2602}
2603
2604static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2605{
2606 if (plen > olen)
2607 return 0;
2608
2609 return !memcmp(prefix, option, plen);
2610}
2611
2612static inline int selinux_option(char *option, int len)
2613{
Eric Paris832cbd92008-04-01 13:24:09 -04002614 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2615 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2616 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
David P. Quigley11689d42009-01-16 09:22:03 -05002617 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2618 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
Linus Torvalds1da177e2005-04-16 15:20:36 -07002619}
2620
2621static inline void take_option(char **to, char *from, int *first, int len)
2622{
2623 if (!*first) {
2624 **to = ',';
2625 *to += 1;
Cory Olmo3528a952006-09-29 01:58:44 -07002626 } else
Linus Torvalds1da177e2005-04-16 15:20:36 -07002627 *first = 0;
2628 memcpy(*to, from, len);
2629 *to += len;
2630}
2631
Eric Paris828dfe12008-04-17 13:17:49 -04002632static inline void take_selinux_option(char **to, char *from, int *first,
2633 int len)
Cory Olmo3528a952006-09-29 01:58:44 -07002634{
2635 int current_size = 0;
2636
2637 if (!*first) {
2638 **to = '|';
2639 *to += 1;
Eric Paris828dfe12008-04-17 13:17:49 -04002640 } else
Cory Olmo3528a952006-09-29 01:58:44 -07002641 *first = 0;
2642
2643 while (current_size < len) {
2644 if (*from != '"') {
2645 **to = *from;
2646 *to += 1;
2647 }
2648 from += 1;
2649 current_size += 1;
2650 }
2651}
2652
Eric Parise0007522008-03-05 10:31:54 -05002653static int selinux_sb_copy_data(char *orig, char *copy)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002654{
2655 int fnosec, fsec, rc = 0;
2656 char *in_save, *in_curr, *in_end;
2657 char *sec_curr, *nosec_save, *nosec;
Cory Olmo3528a952006-09-29 01:58:44 -07002658 int open_quote = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002659
2660 in_curr = orig;
2661 sec_curr = copy;
2662
Linus Torvalds1da177e2005-04-16 15:20:36 -07002663 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2664 if (!nosec) {
2665 rc = -ENOMEM;
2666 goto out;
2667 }
2668
2669 nosec_save = nosec;
2670 fnosec = fsec = 1;
2671 in_save = in_end = orig;
2672
2673 do {
Cory Olmo3528a952006-09-29 01:58:44 -07002674 if (*in_end == '"')
2675 open_quote = !open_quote;
2676 if ((*in_end == ',' && open_quote == 0) ||
2677 *in_end == '\0') {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002678 int len = in_end - in_curr;
2679
2680 if (selinux_option(in_curr, len))
Cory Olmo3528a952006-09-29 01:58:44 -07002681 take_selinux_option(&sec_curr, in_curr, &fsec, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002682 else
2683 take_option(&nosec, in_curr, &fnosec, len);
2684
2685 in_curr = in_end + 1;
2686 }
2687 } while (*in_end++);
2688
Eric Paris6931dfc2005-06-30 02:58:51 -07002689 strcpy(in_save, nosec_save);
Gerald Schaeferda3caa22005-06-21 17:15:18 -07002690 free_page((unsigned long)nosec_save);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002691out:
2692 return rc;
2693}
2694
Eric Paris026eb162011-03-03 16:09:14 -05002695static int selinux_sb_remount(struct super_block *sb, void *data)
2696{
2697 int rc, i, *flags;
2698 struct security_mnt_opts opts;
2699 char *secdata, **mount_options;
2700 struct superblock_security_struct *sbsec = sb->s_security;
2701
2702 if (!(sbsec->flags & SE_SBINITIALIZED))
2703 return 0;
2704
2705 if (!data)
2706 return 0;
2707
2708 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2709 return 0;
2710
2711 security_init_mnt_opts(&opts);
2712 secdata = alloc_secdata();
2713 if (!secdata)
2714 return -ENOMEM;
2715 rc = selinux_sb_copy_data(data, secdata);
2716 if (rc)
2717 goto out_free_secdata;
2718
2719 rc = selinux_parse_opts_str(secdata, &opts);
2720 if (rc)
2721 goto out_free_secdata;
2722
2723 mount_options = opts.mnt_opts;
2724 flags = opts.mnt_opts_flags;
2725
2726 for (i = 0; i < opts.num_mnt_opts; i++) {
2727 u32 sid;
Eric Paris026eb162011-03-03 16:09:14 -05002728
Eric Paris12f348b2012-10-09 10:56:25 -04002729 if (flags[i] == SBLABEL_MNT)
Eric Paris026eb162011-03-03 16:09:14 -05002730 continue;
Rasmus Villemoes44be2f62015-10-21 17:44:25 -04002731 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
Eric Paris026eb162011-03-03 16:09:14 -05002732 if (rc) {
Rasmus Villemoes44be2f62015-10-21 17:44:25 -04002733 printk(KERN_WARNING "SELinux: security_context_str_to_sid"
Linus Torvalds29b1deb2013-12-15 11:17:45 -08002734 "(%s) failed for (dev %s, type %s) errno=%d\n",
2735 mount_options[i], sb->s_id, sb->s_type->name, rc);
Eric Paris026eb162011-03-03 16:09:14 -05002736 goto out_free_opts;
2737 }
2738 rc = -EINVAL;
2739 switch (flags[i]) {
2740 case FSCONTEXT_MNT:
2741 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2742 goto out_bad_option;
2743 break;
2744 case CONTEXT_MNT:
2745 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2746 goto out_bad_option;
2747 break;
2748 case ROOTCONTEXT_MNT: {
2749 struct inode_security_struct *root_isec;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002750 root_isec = backing_inode_security(sb->s_root);
Eric Paris026eb162011-03-03 16:09:14 -05002751
2752 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2753 goto out_bad_option;
2754 break;
2755 }
2756 case DEFCONTEXT_MNT:
2757 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2758 goto out_bad_option;
2759 break;
2760 default:
2761 goto out_free_opts;
2762 }
2763 }
2764
2765 rc = 0;
2766out_free_opts:
2767 security_free_mnt_opts(&opts);
2768out_free_secdata:
2769 free_secdata(secdata);
2770 return rc;
2771out_bad_option:
2772 printk(KERN_WARNING "SELinux: unable to change security options "
Linus Torvalds29b1deb2013-12-15 11:17:45 -08002773 "during remount (dev %s, type=%s)\n", sb->s_id,
2774 sb->s_type->name);
Eric Paris026eb162011-03-03 16:09:14 -05002775 goto out_free_opts;
2776}
2777
James Morris12204e22008-12-19 10:44:42 +11002778static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002779{
David Howells88e67f32008-11-14 10:39:21 +11002780 const struct cred *cred = current_cred();
Thomas Liu2bf49692009-07-14 12:14:09 -04002781 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002782 int rc;
2783
2784 rc = superblock_doinit(sb, data);
2785 if (rc)
2786 return rc;
2787
James Morris74192242008-12-19 11:41:10 +11002788 /* Allow all mounts performed by the kernel */
2789 if (flags & MS_KERNMOUNT)
2790 return 0;
2791
Eric Paris50c205f2012-04-04 15:01:43 -04002792 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04002793 ad.u.dentry = sb->s_root;
David Howells88e67f32008-11-14 10:39:21 +11002794 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002795}
2796
David Howells726c3342006-06-23 02:02:58 -07002797static int selinux_sb_statfs(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002798{
David Howells88e67f32008-11-14 10:39:21 +11002799 const struct cred *cred = current_cred();
Thomas Liu2bf49692009-07-14 12:14:09 -04002800 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002801
Eric Paris50c205f2012-04-04 15:01:43 -04002802 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04002803 ad.u.dentry = dentry->d_sb->s_root;
David Howells88e67f32008-11-14 10:39:21 +11002804 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002805}
2806
Al Viro808d4e32012-10-11 11:42:01 -04002807static int selinux_mount(const char *dev_name,
Al Viro8a04c432016-03-25 14:52:53 -04002808 const struct path *path,
Al Viro808d4e32012-10-11 11:42:01 -04002809 const char *type,
Eric Paris828dfe12008-04-17 13:17:49 -04002810 unsigned long flags,
2811 void *data)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002812{
David Howells88e67f32008-11-14 10:39:21 +11002813 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002814
2815 if (flags & MS_REMOUNT)
Al Virod8c95842011-12-07 18:16:57 -05002816 return superblock_has_perm(cred, path->dentry->d_sb,
Eric Paris828dfe12008-04-17 13:17:49 -04002817 FILESYSTEM__REMOUNT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002818 else
Eric Paris2875fa02011-04-28 16:04:24 -04002819 return path_has_perm(cred, path, FILE__MOUNTON);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002820}
2821
2822static int selinux_umount(struct vfsmount *mnt, int flags)
2823{
David Howells88e67f32008-11-14 10:39:21 +11002824 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002825
David Howells88e67f32008-11-14 10:39:21 +11002826 return superblock_has_perm(cred, mnt->mnt_sb,
Eric Paris828dfe12008-04-17 13:17:49 -04002827 FILESYSTEM__UNMOUNT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002828}
2829
2830/* inode security operations */
2831
2832static int selinux_inode_alloc_security(struct inode *inode)
2833{
2834 return inode_alloc_security(inode);
2835}
2836
2837static void selinux_inode_free_security(struct inode *inode)
2838{
2839 inode_free_security(inode);
2840}
2841
David Quigleyd47be3d2013-05-22 12:50:34 -04002842static int selinux_dentry_init_security(struct dentry *dentry, int mode,
Al Viro4f3ccd72016-07-20 16:06:15 -04002843 const struct qstr *name, void **ctx,
David Quigleyd47be3d2013-05-22 12:50:34 -04002844 u32 *ctxlen)
2845{
David Quigleyd47be3d2013-05-22 12:50:34 -04002846 u32 newsid;
2847 int rc;
2848
Vivek Goyalc957f6d2016-07-13 10:44:51 -04002849 rc = selinux_determine_inode_label(current_security(),
2850 d_inode(dentry->d_parent), name,
David Howellsc3c188b2015-07-10 17:19:58 -04002851 inode_mode_to_security_class(mode),
2852 &newsid);
2853 if (rc)
2854 return rc;
David Quigleyd47be3d2013-05-22 12:50:34 -04002855
2856 return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2857}
2858
Vivek Goyala518b0a2016-07-13 10:44:53 -04002859static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2860 struct qstr *name,
2861 const struct cred *old,
2862 struct cred *new)
2863{
2864 u32 newsid;
2865 int rc;
2866 struct task_security_struct *tsec;
2867
2868 rc = selinux_determine_inode_label(old->security,
2869 d_inode(dentry->d_parent), name,
2870 inode_mode_to_security_class(mode),
2871 &newsid);
2872 if (rc)
2873 return rc;
2874
2875 tsec = new->security;
2876 tsec->create_sid = newsid;
2877 return 0;
2878}
2879
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002880static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
Tetsuo Handa95489062013-07-25 05:44:02 +09002881 const struct qstr *qstr,
2882 const char **name,
Eric Paris2a7dba32011-02-01 11:05:39 -05002883 void **value, size_t *len)
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002884{
Paul Moore5fb49872010-04-22 14:46:19 -04002885 const struct task_security_struct *tsec = current_security();
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002886 struct superblock_security_struct *sbsec;
David Howells275bb412008-11-14 10:39:19 +11002887 u32 sid, newsid, clen;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002888 int rc;
Tetsuo Handa95489062013-07-25 05:44:02 +09002889 char *context;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002890
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002891 sbsec = dir->i_sb->s_security;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002892
David Howells275bb412008-11-14 10:39:19 +11002893 sid = tsec->sid;
2894 newsid = tsec->create_sid;
2895
Vivek Goyalc957f6d2016-07-13 10:44:51 -04002896 rc = selinux_determine_inode_label(current_security(),
David Howellsc3c188b2015-07-10 17:19:58 -04002897 dir, qstr,
2898 inode_mode_to_security_class(inode->i_mode),
2899 &newsid);
2900 if (rc)
2901 return rc;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002902
Eric Paris296fddf2006-09-25 23:32:00 -07002903 /* Possibly defer initialization to selinux_complete_init. */
David P. Quigley0d90a7e2009-01-16 09:22:02 -05002904 if (sbsec->flags & SE_SBINITIALIZED) {
Eric Paris296fddf2006-09-25 23:32:00 -07002905 struct inode_security_struct *isec = inode->i_security;
2906 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2907 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05002908 isec->initialized = LABEL_INITIALIZED;
Eric Paris296fddf2006-09-25 23:32:00 -07002909 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002910
Eric Paris12f348b2012-10-09 10:56:25 -04002911 if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
Stephen Smalley25a74f32005-11-08 21:34:33 -08002912 return -EOPNOTSUPP;
2913
Tetsuo Handa95489062013-07-25 05:44:02 +09002914 if (name)
2915 *name = XATTR_SELINUX_SUFFIX;
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002916
2917 if (value && len) {
Stephen Smalley12b29f32008-05-07 13:03:20 -04002918 rc = security_sid_to_context_force(newsid, &context, &clen);
Tetsuo Handa95489062013-07-25 05:44:02 +09002919 if (rc)
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002920 return rc;
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002921 *value = context;
2922 *len = clen;
2923 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002924
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002925 return 0;
2926}
2927
Al Viro4acdaf22011-07-26 01:42:34 -04002928static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002929{
2930 return may_create(dir, dentry, SECCLASS_FILE);
2931}
2932
Linus Torvalds1da177e2005-04-16 15:20:36 -07002933static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2934{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002935 return may_link(dir, old_dentry, MAY_LINK);
2936}
2937
Linus Torvalds1da177e2005-04-16 15:20:36 -07002938static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2939{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002940 return may_link(dir, dentry, MAY_UNLINK);
2941}
2942
2943static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2944{
2945 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2946}
2947
Al Viro18bb1db2011-07-26 01:41:39 -04002948static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002949{
2950 return may_create(dir, dentry, SECCLASS_DIR);
2951}
2952
Linus Torvalds1da177e2005-04-16 15:20:36 -07002953static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2954{
2955 return may_link(dir, dentry, MAY_RMDIR);
2956}
2957
Al Viro1a67aaf2011-07-26 01:52:52 -04002958static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002959{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002960 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2961}
2962
Linus Torvalds1da177e2005-04-16 15:20:36 -07002963static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
Eric Paris828dfe12008-04-17 13:17:49 -04002964 struct inode *new_inode, struct dentry *new_dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002965{
2966 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2967}
2968
Linus Torvalds1da177e2005-04-16 15:20:36 -07002969static int selinux_inode_readlink(struct dentry *dentry)
2970{
David Howells88e67f32008-11-14 10:39:21 +11002971 const struct cred *cred = current_cred();
2972
Eric Paris2875fa02011-04-28 16:04:24 -04002973 return dentry_has_perm(cred, dentry, FILE__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002974}
2975
NeilBrownbda0be72015-03-23 13:37:39 +11002976static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2977 bool rcu)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002978{
David Howells88e67f32008-11-14 10:39:21 +11002979 const struct cred *cred = current_cred();
NeilBrownbda0be72015-03-23 13:37:39 +11002980 struct common_audit_data ad;
2981 struct inode_security_struct *isec;
2982 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002983
NeilBrownbda0be72015-03-23 13:37:39 +11002984 validate_creds(cred);
2985
2986 ad.type = LSM_AUDIT_DATA_DENTRY;
2987 ad.u.dentry = dentry;
2988 sid = cred_sid(cred);
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05002989 isec = inode_security_rcu(inode, rcu);
2990 if (IS_ERR(isec))
2991 return PTR_ERR(isec);
NeilBrownbda0be72015-03-23 13:37:39 +11002992
2993 return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2994 rcu ? MAY_NOT_BLOCK : 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002995}
2996
Eric Parisd4cf970d2012-04-04 15:01:42 -04002997static noinline int audit_inode_permission(struct inode *inode,
2998 u32 perms, u32 audited, u32 denied,
Stephen Smalley626b9742014-04-29 11:29:04 -07002999 int result,
Eric Parisd4cf970d2012-04-04 15:01:42 -04003000 unsigned flags)
3001{
3002 struct common_audit_data ad;
Eric Parisd4cf970d2012-04-04 15:01:42 -04003003 struct inode_security_struct *isec = inode->i_security;
3004 int rc;
3005
Eric Paris50c205f2012-04-04 15:01:43 -04003006 ad.type = LSM_AUDIT_DATA_INODE;
Eric Parisd4cf970d2012-04-04 15:01:42 -04003007 ad.u.inode = inode;
3008
3009 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
Stephen Smalley626b9742014-04-29 11:29:04 -07003010 audited, denied, result, &ad, flags);
Eric Parisd4cf970d2012-04-04 15:01:42 -04003011 if (rc)
3012 return rc;
3013 return 0;
3014}
3015
Al Viroe74f71e2011-06-20 19:38:15 -04003016static int selinux_inode_permission(struct inode *inode, int mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003017{
David Howells88e67f32008-11-14 10:39:21 +11003018 const struct cred *cred = current_cred();
Eric Parisb782e0a2010-07-23 11:44:03 -04003019 u32 perms;
3020 bool from_access;
Al Virocf1dd1d2011-06-20 19:44:08 -04003021 unsigned flags = mask & MAY_NOT_BLOCK;
Eric Paris2e334052012-04-04 15:01:42 -04003022 struct inode_security_struct *isec;
3023 u32 sid;
3024 struct av_decision avd;
3025 int rc, rc2;
3026 u32 audited, denied;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003027
Eric Parisb782e0a2010-07-23 11:44:03 -04003028 from_access = mask & MAY_ACCESS;
Eric Parisd09ca732010-07-23 11:43:57 -04003029 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3030
Eric Parisb782e0a2010-07-23 11:44:03 -04003031 /* No permission to check. Existence test. */
3032 if (!mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003033 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003034
Eric Paris2e334052012-04-04 15:01:42 -04003035 validate_creds(cred);
Eric Parisb782e0a2010-07-23 11:44:03 -04003036
Eric Paris2e334052012-04-04 15:01:42 -04003037 if (unlikely(IS_PRIVATE(inode)))
3038 return 0;
Eric Parisb782e0a2010-07-23 11:44:03 -04003039
3040 perms = file_mask_to_av(inode->i_mode, mask);
3041
Eric Paris2e334052012-04-04 15:01:42 -04003042 sid = cred_sid(cred);
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05003043 isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3044 if (IS_ERR(isec))
3045 return PTR_ERR(isec);
Eric Paris2e334052012-04-04 15:01:42 -04003046
3047 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
3048 audited = avc_audit_required(perms, &avd, rc,
3049 from_access ? FILE__AUDIT_ACCESS : 0,
3050 &denied);
3051 if (likely(!audited))
3052 return rc;
3053
Stephen Smalley626b9742014-04-29 11:29:04 -07003054 rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
Eric Paris2e334052012-04-04 15:01:42 -04003055 if (rc2)
3056 return rc2;
3057 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003058}
3059
3060static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3061{
David Howells88e67f32008-11-14 10:39:21 +11003062 const struct cred *cred = current_cred();
Stephen Smalleyccb54472017-05-12 12:41:24 -04003063 struct inode *inode = d_backing_inode(dentry);
Amerigo Wangbc6a6002009-08-20 19:29:02 -07003064 unsigned int ia_valid = iattr->ia_valid;
Eric Paris95dbf732012-04-04 13:45:34 -04003065 __u32 av = FILE__WRITE;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003066
Amerigo Wangbc6a6002009-08-20 19:29:02 -07003067 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3068 if (ia_valid & ATTR_FORCE) {
3069 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3070 ATTR_FORCE);
3071 if (!ia_valid)
3072 return 0;
3073 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003074
Amerigo Wangbc6a6002009-08-20 19:29:02 -07003075 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3076 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
Eric Paris2875fa02011-04-28 16:04:24 -04003077 return dentry_has_perm(cred, dentry, FILE__SETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003078
Stephen Smalleyccb54472017-05-12 12:41:24 -04003079 if (selinux_policycap_openperm &&
3080 inode->i_sb->s_magic != SOCKFS_MAGIC &&
3081 (ia_valid & ATTR_SIZE) &&
3082 !(ia_valid & ATTR_FILE))
Eric Paris95dbf732012-04-04 13:45:34 -04003083 av |= FILE__OPEN;
3084
3085 return dentry_has_perm(cred, dentry, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003086}
3087
Al Viro3f7036a2015-03-08 19:28:30 -04003088static int selinux_inode_getattr(const struct path *path)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003089{
Al Viro3f7036a2015-03-08 19:28:30 -04003090 return path_has_perm(current_cred(), path, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003091}
3092
David Howells8f0cfa52008-04-29 00:59:41 -07003093static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
Serge E. Hallynb5376772007-10-16 23:31:36 -07003094{
David Howells88e67f32008-11-14 10:39:21 +11003095 const struct cred *cred = current_cred();
3096
Serge E. Hallynb5376772007-10-16 23:31:36 -07003097 if (!strncmp(name, XATTR_SECURITY_PREFIX,
3098 sizeof XATTR_SECURITY_PREFIX - 1)) {
3099 if (!strcmp(name, XATTR_NAME_CAPS)) {
3100 if (!capable(CAP_SETFCAP))
3101 return -EPERM;
3102 } else if (!capable(CAP_SYS_ADMIN)) {
3103 /* A different attribute in the security namespace.
3104 Restrict to administrator. */
3105 return -EPERM;
3106 }
3107 }
3108
3109 /* Not an attribute we recognize, so just check the
3110 ordinary setattr permission. */
Eric Paris2875fa02011-04-28 16:04:24 -04003111 return dentry_has_perm(cred, dentry, FILE__SETATTR);
Serge E. Hallynb5376772007-10-16 23:31:36 -07003112}
3113
Stephen Smalleydb590002017-04-20 11:31:30 -04003114static bool has_cap_mac_admin(bool audit)
3115{
3116 const struct cred *cred = current_cred();
3117 int cap_audit = audit ? SECURITY_CAP_AUDIT : SECURITY_CAP_NOAUDIT;
3118
3119 if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, cap_audit))
3120 return false;
3121 if (cred_has_capability(cred, CAP_MAC_ADMIN, cap_audit, true))
3122 return false;
3123 return true;
3124}
3125
David Howells8f0cfa52008-04-29 00:59:41 -07003126static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3127 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003128{
David Howellsc6f493d2015-03-17 22:26:22 +00003129 struct inode *inode = d_backing_inode(dentry);
Paul Moore20cdef82016-04-04 14:14:42 -04003130 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003131 struct superblock_security_struct *sbsec;
Thomas Liu2bf49692009-07-14 12:14:09 -04003132 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11003133 u32 newsid, sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003134 int rc = 0;
3135
Serge E. Hallynb5376772007-10-16 23:31:36 -07003136 if (strcmp(name, XATTR_NAME_SELINUX))
3137 return selinux_inode_setotherxattr(dentry, name);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003138
3139 sbsec = inode->i_sb->s_security;
Eric Paris12f348b2012-10-09 10:56:25 -04003140 if (!(sbsec->flags & SBLABEL_MNT))
Linus Torvalds1da177e2005-04-16 15:20:36 -07003141 return -EOPNOTSUPP;
3142
Serge E. Hallyn2e149672011-03-23 16:43:26 -07003143 if (!inode_owner_or_capable(inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -07003144 return -EPERM;
3145
Eric Paris50c205f2012-04-04 15:01:43 -04003146 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04003147 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003148
Paul Moore20cdef82016-04-04 14:14:42 -04003149 isec = backing_inode_security(dentry);
David Howells275bb412008-11-14 10:39:19 +11003150 rc = avc_has_perm(sid, isec->sid, isec->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003151 FILE__RELABELFROM, &ad);
3152 if (rc)
3153 return rc;
3154
Nikolay Aleksandrov52a4c642014-03-07 12:44:19 +01003155 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
Stephen Smalley12b29f32008-05-07 13:03:20 -04003156 if (rc == -EINVAL) {
Stephen Smalleydb590002017-04-20 11:31:30 -04003157 if (!has_cap_mac_admin(true)) {
Eric Parisd6ea83e2012-04-04 13:45:49 -04003158 struct audit_buffer *ab;
3159 size_t audit_size;
3160 const char *str;
3161
3162 /* We strip a nul only if it is at the end, otherwise the
3163 * context contains a nul and we should audit that */
Al Viroe3fea3f2012-06-09 08:15:16 +01003164 if (value) {
3165 str = value;
3166 if (str[size - 1] == '\0')
3167 audit_size = size - 1;
3168 else
3169 audit_size = size;
3170 } else {
3171 str = "";
3172 audit_size = 0;
3173 }
Eric Parisd6ea83e2012-04-04 13:45:49 -04003174 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3175 audit_log_format(ab, "op=setxattr invalid_context=");
3176 audit_log_n_untrustedstring(ab, value, audit_size);
3177 audit_log_end(ab);
3178
Stephen Smalley12b29f32008-05-07 13:03:20 -04003179 return rc;
Eric Parisd6ea83e2012-04-04 13:45:49 -04003180 }
Stephen Smalley12b29f32008-05-07 13:03:20 -04003181 rc = security_context_to_sid_force(value, size, &newsid);
3182 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003183 if (rc)
3184 return rc;
3185
David Howells275bb412008-11-14 10:39:19 +11003186 rc = avc_has_perm(sid, newsid, isec->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003187 FILE__RELABELTO, &ad);
3188 if (rc)
3189 return rc;
3190
David Howells275bb412008-11-14 10:39:19 +11003191 rc = security_validate_transition(isec->sid, newsid, sid,
Eric Paris828dfe12008-04-17 13:17:49 -04003192 isec->sclass);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003193 if (rc)
3194 return rc;
3195
3196 return avc_has_perm(newsid,
3197 sbsec->sid,
3198 SECCLASS_FILESYSTEM,
3199 FILESYSTEM__ASSOCIATE,
3200 &ad);
3201}
3202
David Howells8f0cfa52008-04-29 00:59:41 -07003203static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
Eric Parisf5269712008-05-14 11:27:45 -04003204 const void *value, size_t size,
David Howells8f0cfa52008-04-29 00:59:41 -07003205 int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003206{
David Howellsc6f493d2015-03-17 22:26:22 +00003207 struct inode *inode = d_backing_inode(dentry);
Paul Moore20cdef82016-04-04 14:14:42 -04003208 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003209 u32 newsid;
3210 int rc;
3211
3212 if (strcmp(name, XATTR_NAME_SELINUX)) {
3213 /* Not an attribute we recognize, so nothing to do. */
3214 return;
3215 }
3216
Stephen Smalley12b29f32008-05-07 13:03:20 -04003217 rc = security_context_to_sid_force(value, size, &newsid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003218 if (rc) {
Stephen Smalley12b29f32008-05-07 13:03:20 -04003219 printk(KERN_ERR "SELinux: unable to map context to SID"
3220 "for (%s, %lu), rc=%d\n",
3221 inode->i_sb->s_id, inode->i_ino, -rc);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003222 return;
3223 }
3224
Paul Moore20cdef82016-04-04 14:14:42 -04003225 isec = backing_inode_security(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003226 spin_lock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003227 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003228 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05003229 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003230 spin_unlock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003231
Linus Torvalds1da177e2005-04-16 15:20:36 -07003232 return;
3233}
3234
David Howells8f0cfa52008-04-29 00:59:41 -07003235static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003236{
David Howells88e67f32008-11-14 10:39:21 +11003237 const struct cred *cred = current_cred();
3238
Eric Paris2875fa02011-04-28 16:04:24 -04003239 return dentry_has_perm(cred, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003240}
3241
Eric Paris828dfe12008-04-17 13:17:49 -04003242static int selinux_inode_listxattr(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003243{
David Howells88e67f32008-11-14 10:39:21 +11003244 const struct cred *cred = current_cred();
3245
Eric Paris2875fa02011-04-28 16:04:24 -04003246 return dentry_has_perm(cred, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003247}
3248
David Howells8f0cfa52008-04-29 00:59:41 -07003249static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003250{
Serge E. Hallynb5376772007-10-16 23:31:36 -07003251 if (strcmp(name, XATTR_NAME_SELINUX))
3252 return selinux_inode_setotherxattr(dentry, name);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003253
3254 /* No one is allowed to remove a SELinux security label.
3255 You can change the label, but all data must be labeled. */
3256 return -EACCES;
3257}
3258
James Morrisd381d8a2005-10-30 14:59:22 -08003259/*
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003260 * Copy the inode security context value to the user.
James Morrisd381d8a2005-10-30 14:59:22 -08003261 *
3262 * Permission check is handled by selinux_inode_getxattr hook.
3263 */
Andreas Gruenbacherea861df2015-12-24 11:09:39 -05003264static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003265{
David P. Quigley42492592008-02-04 22:29:39 -08003266 u32 size;
3267 int error;
3268 char *context = NULL;
Paul Moore20cdef82016-04-04 14:14:42 -04003269 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003270
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00003271 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3272 return -EOPNOTSUPP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003273
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003274 /*
3275 * If the caller has CAP_MAC_ADMIN, then get the raw context
3276 * value even if it is not defined by current policy; otherwise,
3277 * use the in-core value under current policy.
3278 * Use the non-auditing forms of the permission checks since
3279 * getxattr may be called by unprivileged processes commonly
3280 * and lack of permission just means that we fall back to the
3281 * in-core context value, not a denial.
3282 */
Paul Moore20cdef82016-04-04 14:14:42 -04003283 isec = inode_security(inode);
Stephen Smalleydb590002017-04-20 11:31:30 -04003284 if (has_cap_mac_admin(false))
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003285 error = security_sid_to_context_force(isec->sid, &context,
3286 &size);
3287 else
3288 error = security_sid_to_context(isec->sid, &context, &size);
David P. Quigley42492592008-02-04 22:29:39 -08003289 if (error)
3290 return error;
3291 error = size;
3292 if (alloc) {
3293 *buffer = context;
3294 goto out_nofree;
3295 }
3296 kfree(context);
3297out_nofree:
3298 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003299}
3300
3301static int selinux_inode_setsecurity(struct inode *inode, const char *name,
Eric Paris828dfe12008-04-17 13:17:49 -04003302 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003303{
Paul Moore2c971652016-04-19 16:36:28 -04003304 struct inode_security_struct *isec = inode_security_novalidate(inode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003305 u32 newsid;
3306 int rc;
3307
3308 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3309 return -EOPNOTSUPP;
3310
3311 if (!value || !size)
3312 return -EACCES;
3313
Rasmus Villemoes20ba96a2015-10-21 17:44:26 -04003314 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003315 if (rc)
3316 return rc;
3317
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003318 spin_lock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003319 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003320 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05003321 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003322 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003323 return 0;
3324}
3325
3326static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3327{
3328 const int len = sizeof(XATTR_NAME_SELINUX);
3329 if (buffer && len <= buffer_size)
3330 memcpy(buffer, XATTR_NAME_SELINUX, len);
3331 return len;
3332}
3333
Andreas Gruenbacherd6335d72015-12-24 11:09:39 -05003334static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02003335{
Andreas Gruenbachere817c2f2016-02-18 12:04:08 +01003336 struct inode_security_struct *isec = inode_security_novalidate(inode);
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02003337 *secid = isec->sid;
3338}
3339
Vivek Goyal56909eb2016-07-13 10:44:48 -04003340static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3341{
3342 u32 sid;
3343 struct task_security_struct *tsec;
3344 struct cred *new_creds = *new;
3345
3346 if (new_creds == NULL) {
3347 new_creds = prepare_creds();
3348 if (!new_creds)
3349 return -ENOMEM;
3350 }
3351
3352 tsec = new_creds->security;
3353 /* Get label from overlay inode and set it in create_sid */
3354 selinux_inode_getsecid(d_inode(src), &sid);
3355 tsec->create_sid = sid;
3356 *new = new_creds;
3357 return 0;
3358}
3359
Vivek Goyal19472b62016-07-13 10:44:50 -04003360static int selinux_inode_copy_up_xattr(const char *name)
3361{
3362 /* The copy_up hook above sets the initial context on an inode, but we
3363 * don't then want to overwrite it by blindly copying all the lower
3364 * xattrs up. Instead, we have to filter out SELinux-related xattrs.
3365 */
3366 if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3367 return 1; /* Discard */
3368 /*
3369 * Any other attribute apart from SELINUX is not claimed, supported
3370 * by selinux.
3371 */
3372 return -EOPNOTSUPP;
3373}
3374
Linus Torvalds1da177e2005-04-16 15:20:36 -07003375/* file security operations */
3376
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003377static int selinux_revalidate_file_permission(struct file *file, int mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003378{
David Howells88e67f32008-11-14 10:39:21 +11003379 const struct cred *cred = current_cred();
Al Viro496ad9a2013-01-23 17:07:38 -05003380 struct inode *inode = file_inode(file);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003381
Linus Torvalds1da177e2005-04-16 15:20:36 -07003382 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3383 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3384 mask |= MAY_APPEND;
3385
Paul Moore389fb8002009-03-27 17:10:34 -04003386 return file_has_perm(cred, file,
3387 file_mask_to_av(inode->i_mode, mask));
Linus Torvalds1da177e2005-04-16 15:20:36 -07003388}
3389
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003390static int selinux_file_permission(struct file *file, int mask)
3391{
Al Viro496ad9a2013-01-23 17:07:38 -05003392 struct inode *inode = file_inode(file);
Stephen Smalley20dda182009-06-22 14:54:53 -04003393 struct file_security_struct *fsec = file->f_security;
Andreas Gruenbacherb1973672016-01-05 23:12:33 +01003394 struct inode_security_struct *isec;
Stephen Smalley20dda182009-06-22 14:54:53 -04003395 u32 sid = current_sid();
3396
Paul Moore389fb8002009-03-27 17:10:34 -04003397 if (!mask)
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003398 /* No permission to check. Existence test. */
3399 return 0;
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003400
Andreas Gruenbacherb1973672016-01-05 23:12:33 +01003401 isec = inode_security(inode);
Stephen Smalley20dda182009-06-22 14:54:53 -04003402 if (sid == fsec->sid && fsec->isid == isec->sid &&
3403 fsec->pseqno == avc_policy_seqno())
Eric Paris83d49852012-04-04 13:45:40 -04003404 /* No change since file_open check. */
Stephen Smalley20dda182009-06-22 14:54:53 -04003405 return 0;
3406
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003407 return selinux_revalidate_file_permission(file, mask);
3408}
3409
Linus Torvalds1da177e2005-04-16 15:20:36 -07003410static int selinux_file_alloc_security(struct file *file)
3411{
3412 return file_alloc_security(file);
3413}
3414
3415static void selinux_file_free_security(struct file *file)
3416{
3417 file_free_security(file);
3418}
3419
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003420/*
3421 * Check whether a task has the ioctl permission and cmd
3422 * operation to an inode.
3423 */
Geliang Tang1d2a1682015-10-21 17:44:27 -04003424static int ioctl_has_perm(const struct cred *cred, struct file *file,
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003425 u32 requested, u16 cmd)
3426{
3427 struct common_audit_data ad;
3428 struct file_security_struct *fsec = file->f_security;
3429 struct inode *inode = file_inode(file);
Paul Moore20cdef82016-04-04 14:14:42 -04003430 struct inode_security_struct *isec;
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003431 struct lsm_ioctlop_audit ioctl;
3432 u32 ssid = cred_sid(cred);
3433 int rc;
3434 u8 driver = cmd >> 8;
3435 u8 xperm = cmd & 0xff;
3436
3437 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3438 ad.u.op = &ioctl;
3439 ad.u.op->cmd = cmd;
3440 ad.u.op->path = file->f_path;
3441
3442 if (ssid != fsec->sid) {
3443 rc = avc_has_perm(ssid, fsec->sid,
3444 SECCLASS_FD,
3445 FD__USE,
3446 &ad);
3447 if (rc)
3448 goto out;
3449 }
3450
3451 if (unlikely(IS_PRIVATE(inode)))
3452 return 0;
3453
Paul Moore20cdef82016-04-04 14:14:42 -04003454 isec = inode_security(inode);
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003455 rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3456 requested, driver, xperm, &ad);
3457out:
3458 return rc;
3459}
3460
Linus Torvalds1da177e2005-04-16 15:20:36 -07003461static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3462 unsigned long arg)
3463{
David Howells88e67f32008-11-14 10:39:21 +11003464 const struct cred *cred = current_cred();
Eric Paris0b24dcb2011-02-25 15:39:20 -05003465 int error = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003466
Eric Paris0b24dcb2011-02-25 15:39:20 -05003467 switch (cmd) {
3468 case FIONREAD:
3469 /* fall through */
3470 case FIBMAP:
3471 /* fall through */
3472 case FIGETBSZ:
3473 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003474 case FS_IOC_GETFLAGS:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003475 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003476 case FS_IOC_GETVERSION:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003477 error = file_has_perm(cred, file, FILE__GETATTR);
3478 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003479
Al Viro2f99c362012-03-23 16:04:05 -04003480 case FS_IOC_SETFLAGS:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003481 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003482 case FS_IOC_SETVERSION:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003483 error = file_has_perm(cred, file, FILE__SETATTR);
3484 break;
3485
3486 /* sys_ioctl() checks */
3487 case FIONBIO:
3488 /* fall through */
3489 case FIOASYNC:
3490 error = file_has_perm(cred, file, 0);
3491 break;
3492
3493 case KDSKBENT:
3494 case KDSKBSENT:
Eric Paris6a9de492012-01-03 12:25:14 -05003495 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04003496 SECURITY_CAP_AUDIT, true);
Eric Paris0b24dcb2011-02-25 15:39:20 -05003497 break;
3498
3499 /* default case assumes that the command will go
3500 * to the file's ioctl() function.
3501 */
3502 default:
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003503 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
Eric Paris0b24dcb2011-02-25 15:39:20 -05003504 }
3505 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003506}
3507
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003508static int default_noexec;
3509
Linus Torvalds1da177e2005-04-16 15:20:36 -07003510static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3511{
David Howells88e67f32008-11-14 10:39:21 +11003512 const struct cred *cred = current_cred();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003513 u32 sid = cred_sid(cred);
David Howellsd84f4f92008-11-14 10:39:23 +11003514 int rc = 0;
David Howells88e67f32008-11-14 10:39:21 +11003515
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003516 if (default_noexec &&
Stephen Smalley892e8ca2015-07-10 09:40:59 -04003517 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3518 (!shared && (prot & PROT_WRITE)))) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07003519 /*
3520 * We are making executable an anonymous mapping or a
3521 * private file mapping that will also be writable.
3522 * This has an additional check.
3523 */
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003524 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3525 PROCESS__EXECMEM, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003526 if (rc)
David Howellsd84f4f92008-11-14 10:39:23 +11003527 goto error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003528 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003529
3530 if (file) {
3531 /* read access is always possible with a mapping */
3532 u32 av = FILE__READ;
3533
3534 /* write access only matters if the mapping is shared */
3535 if (shared && (prot & PROT_WRITE))
3536 av |= FILE__WRITE;
3537
3538 if (prot & PROT_EXEC)
3539 av |= FILE__EXECUTE;
3540
David Howells88e67f32008-11-14 10:39:21 +11003541 return file_has_perm(cred, file, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003542 }
David Howellsd84f4f92008-11-14 10:39:23 +11003543
3544error:
3545 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003546}
3547
Al Viroe5467852012-05-30 13:30:51 -04003548static int selinux_mmap_addr(unsigned long addr)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003549{
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07003550 int rc = 0;
Paul Moore98883bf2014-03-19 16:46:11 -04003551
3552 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3553 u32 sid = current_sid();
3554 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3555 MEMPROTECT__MMAP_ZERO, NULL);
3556 }
3557
3558 return rc;
Al Viroe5467852012-05-30 13:30:51 -04003559}
Linus Torvalds1da177e2005-04-16 15:20:36 -07003560
Al Viroe5467852012-05-30 13:30:51 -04003561static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3562 unsigned long prot, unsigned long flags)
3563{
Stephen Smalley3ba4bf52017-05-05 09:14:48 -04003564 struct common_audit_data ad;
3565 int rc;
3566
3567 if (file) {
3568 ad.type = LSM_AUDIT_DATA_FILE;
3569 ad.u.file = file;
3570 rc = inode_has_perm(current_cred(), file_inode(file),
3571 FILE__MAP, &ad);
3572 if (rc)
3573 return rc;
3574 }
3575
Linus Torvalds1da177e2005-04-16 15:20:36 -07003576 if (selinux_checkreqprot)
3577 prot = reqprot;
3578
3579 return file_map_prot_check(file, prot,
3580 (flags & MAP_TYPE) == MAP_SHARED);
3581}
3582
3583static int selinux_file_mprotect(struct vm_area_struct *vma,
3584 unsigned long reqprot,
3585 unsigned long prot)
3586{
David Howells88e67f32008-11-14 10:39:21 +11003587 const struct cred *cred = current_cred();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003588 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003589
3590 if (selinux_checkreqprot)
3591 prot = reqprot;
3592
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003593 if (default_noexec &&
3594 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
James Morrisd541bbe2009-01-29 12:19:51 +11003595 int rc = 0;
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003596 if (vma->vm_start >= vma->vm_mm->start_brk &&
3597 vma->vm_end <= vma->vm_mm->brk) {
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003598 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3599 PROCESS__EXECHEAP, NULL);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003600 } else if (!vma->vm_file &&
Stephen Smalleyc2316db2016-04-08 13:55:03 -04003601 ((vma->vm_start <= vma->vm_mm->start_stack &&
3602 vma->vm_end >= vma->vm_mm->start_stack) ||
Andy Lutomirskid17af502016-09-30 10:58:58 -07003603 vma_is_stack_for_current(vma))) {
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003604 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3605 PROCESS__EXECSTACK, NULL);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003606 } else if (vma->vm_file && vma->anon_vma) {
3607 /*
3608 * We are making executable a file mapping that has
3609 * had some COW done. Since pages might have been
3610 * written, check ability to execute the possibly
3611 * modified content. This typically should only
3612 * occur for text relocations.
3613 */
David Howellsd84f4f92008-11-14 10:39:23 +11003614 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003615 }
Lorenzo Hernandez García-Hierro6b992192005-06-25 14:54:34 -07003616 if (rc)
3617 return rc;
3618 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003619
3620 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3621}
3622
3623static int selinux_file_lock(struct file *file, unsigned int cmd)
3624{
David Howells88e67f32008-11-14 10:39:21 +11003625 const struct cred *cred = current_cred();
3626
3627 return file_has_perm(cred, file, FILE__LOCK);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003628}
3629
3630static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3631 unsigned long arg)
3632{
David Howells88e67f32008-11-14 10:39:21 +11003633 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003634 int err = 0;
3635
3636 switch (cmd) {
Eric Paris828dfe12008-04-17 13:17:49 -04003637 case F_SETFL:
Eric Paris828dfe12008-04-17 13:17:49 -04003638 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
David Howells88e67f32008-11-14 10:39:21 +11003639 err = file_has_perm(cred, file, FILE__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003640 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003641 }
3642 /* fall through */
3643 case F_SETOWN:
3644 case F_SETSIG:
3645 case F_GETFL:
3646 case F_GETOWN:
3647 case F_GETSIG:
Cyrill Gorcunov1d151c32012-07-30 14:43:00 -07003648 case F_GETOWNER_UIDS:
Eric Paris828dfe12008-04-17 13:17:49 -04003649 /* Just check FD__USE permission */
David Howells88e67f32008-11-14 10:39:21 +11003650 err = file_has_perm(cred, file, 0);
Eric Paris828dfe12008-04-17 13:17:49 -04003651 break;
3652 case F_GETLK:
3653 case F_SETLK:
3654 case F_SETLKW:
Jeff Layton0d3f7a22014-04-22 08:23:58 -04003655 case F_OFD_GETLK:
3656 case F_OFD_SETLK:
3657 case F_OFD_SETLKW:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003658#if BITS_PER_LONG == 32
Eric Paris828dfe12008-04-17 13:17:49 -04003659 case F_GETLK64:
3660 case F_SETLK64:
3661 case F_SETLKW64:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003662#endif
David Howells88e67f32008-11-14 10:39:21 +11003663 err = file_has_perm(cred, file, FILE__LOCK);
Eric Paris828dfe12008-04-17 13:17:49 -04003664 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003665 }
3666
3667 return err;
3668}
3669
Jeff Laytone0b93ed2014-08-22 11:27:32 -04003670static void selinux_file_set_fowner(struct file *file)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003671{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003672 struct file_security_struct *fsec;
3673
Linus Torvalds1da177e2005-04-16 15:20:36 -07003674 fsec = file->f_security;
David Howells275bb412008-11-14 10:39:19 +11003675 fsec->fown_sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003676}
3677
3678static int selinux_file_send_sigiotask(struct task_struct *tsk,
3679 struct fown_struct *fown, int signum)
3680{
Eric Paris828dfe12008-04-17 13:17:49 -04003681 struct file *file;
Stephen Smalley65c90bc2009-05-04 15:43:18 -04003682 u32 sid = task_sid(tsk);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003683 u32 perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003684 struct file_security_struct *fsec;
3685
3686 /* struct fown_struct is never outside the context of a struct file */
Eric Paris828dfe12008-04-17 13:17:49 -04003687 file = container_of(fown, struct file, f_owner);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003688
Linus Torvalds1da177e2005-04-16 15:20:36 -07003689 fsec = file->f_security;
3690
3691 if (!signum)
3692 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3693 else
3694 perm = signal_to_av(signum);
3695
David Howells275bb412008-11-14 10:39:19 +11003696 return avc_has_perm(fsec->fown_sid, sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003697 SECCLASS_PROCESS, perm, NULL);
3698}
3699
3700static int selinux_file_receive(struct file *file)
3701{
David Howells88e67f32008-11-14 10:39:21 +11003702 const struct cred *cred = current_cred();
3703
3704 return file_has_perm(cred, file, file_to_av(file));
Linus Torvalds1da177e2005-04-16 15:20:36 -07003705}
3706
Eric Paris83d49852012-04-04 13:45:40 -04003707static int selinux_file_open(struct file *file, const struct cred *cred)
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003708{
3709 struct file_security_struct *fsec;
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003710 struct inode_security_struct *isec;
David Howellsd84f4f92008-11-14 10:39:23 +11003711
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003712 fsec = file->f_security;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05003713 isec = inode_security(file_inode(file));
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003714 /*
3715 * Save inode label and policy sequence number
3716 * at open-time so that selinux_file_permission
3717 * can determine whether revalidation is necessary.
3718 * Task label is already saved in the file security
3719 * struct as its SID.
3720 */
3721 fsec->isid = isec->sid;
3722 fsec->pseqno = avc_policy_seqno();
3723 /*
3724 * Since the inode label or policy seqno may have changed
3725 * between the selinux_inode_permission check and the saving
3726 * of state above, recheck that access is still permitted.
3727 * Otherwise, access might never be revalidated against the
3728 * new inode label or new policy.
3729 * This check is not redundant - do not remove.
3730 */
David Howells13f8e982013-06-13 23:37:55 +01003731 return file_path_has_perm(cred, file, open_file_to_av(file));
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003732}
3733
Linus Torvalds1da177e2005-04-16 15:20:36 -07003734/* task security operations */
3735
Tetsuo Handaa79be232017-03-28 23:08:45 +09003736static int selinux_task_alloc(struct task_struct *task,
3737 unsigned long clone_flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003738{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003739 u32 sid = current_sid();
3740
3741 return avc_has_perm(sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003742}
3743
David Howellsf1752ee2008-11-14 10:39:17 +11003744/*
David Howellsee18d642009-09-02 09:14:21 +01003745 * allocate the SELinux part of blank credentials
3746 */
3747static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3748{
3749 struct task_security_struct *tsec;
3750
3751 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3752 if (!tsec)
3753 return -ENOMEM;
3754
3755 cred->security = tsec;
3756 return 0;
3757}
3758
3759/*
David Howellsf1752ee2008-11-14 10:39:17 +11003760 * detach and free the LSM part of a set of credentials
3761 */
3762static void selinux_cred_free(struct cred *cred)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003763{
David Howellsf1752ee2008-11-14 10:39:17 +11003764 struct task_security_struct *tsec = cred->security;
David Howellse0e81732009-09-02 09:13:40 +01003765
Tetsuo Handa2edeaa32011-02-07 13:36:10 +00003766 /*
3767 * cred->security == NULL if security_cred_alloc_blank() or
3768 * security_prepare_creds() returned an error.
3769 */
3770 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
David Howellse0e81732009-09-02 09:13:40 +01003771 cred->security = (void *) 0x7UL;
David Howellsf1752ee2008-11-14 10:39:17 +11003772 kfree(tsec);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003773}
3774
David Howellsd84f4f92008-11-14 10:39:23 +11003775/*
3776 * prepare a new set of credentials for modification
3777 */
3778static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3779 gfp_t gfp)
3780{
3781 const struct task_security_struct *old_tsec;
3782 struct task_security_struct *tsec;
3783
3784 old_tsec = old->security;
3785
3786 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3787 if (!tsec)
3788 return -ENOMEM;
3789
3790 new->security = tsec;
3791 return 0;
3792}
3793
3794/*
David Howellsee18d642009-09-02 09:14:21 +01003795 * transfer the SELinux data to a blank set of creds
3796 */
3797static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3798{
3799 const struct task_security_struct *old_tsec = old->security;
3800 struct task_security_struct *tsec = new->security;
3801
3802 *tsec = *old_tsec;
3803}
3804
3805/*
David Howells3a3b7ce2008-11-14 10:39:28 +11003806 * set the security data for a kernel service
3807 * - all the creation contexts are set to unlabelled
3808 */
3809static int selinux_kernel_act_as(struct cred *new, u32 secid)
3810{
3811 struct task_security_struct *tsec = new->security;
3812 u32 sid = current_sid();
3813 int ret;
3814
3815 ret = avc_has_perm(sid, secid,
3816 SECCLASS_KERNEL_SERVICE,
3817 KERNEL_SERVICE__USE_AS_OVERRIDE,
3818 NULL);
3819 if (ret == 0) {
3820 tsec->sid = secid;
3821 tsec->create_sid = 0;
3822 tsec->keycreate_sid = 0;
3823 tsec->sockcreate_sid = 0;
3824 }
3825 return ret;
3826}
3827
3828/*
3829 * set the file creation context in a security record to the same as the
3830 * objective context of the specified inode
3831 */
3832static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3833{
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05003834 struct inode_security_struct *isec = inode_security(inode);
David Howells3a3b7ce2008-11-14 10:39:28 +11003835 struct task_security_struct *tsec = new->security;
3836 u32 sid = current_sid();
3837 int ret;
3838
3839 ret = avc_has_perm(sid, isec->sid,
3840 SECCLASS_KERNEL_SERVICE,
3841 KERNEL_SERVICE__CREATE_FILES_AS,
3842 NULL);
3843
3844 if (ret == 0)
3845 tsec->create_sid = isec->sid;
David Howellsef574712010-02-26 01:56:16 +00003846 return ret;
David Howells3a3b7ce2008-11-14 10:39:28 +11003847}
3848
Eric Parisdd8dbf22009-11-03 16:35:32 +11003849static int selinux_kernel_module_request(char *kmod_name)
Eric Paris25354c42009-08-13 09:45:03 -04003850{
Eric Parisdd8dbf22009-11-03 16:35:32 +11003851 struct common_audit_data ad;
3852
Eric Paris50c205f2012-04-04 15:01:43 -04003853 ad.type = LSM_AUDIT_DATA_KMOD;
Eric Parisdd8dbf22009-11-03 16:35:32 +11003854 ad.u.kmod_name = kmod_name;
3855
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003856 return avc_has_perm(current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
Eric Parisdd8dbf22009-11-03 16:35:32 +11003857 SYSTEM__MODULE_REQUEST, &ad);
Eric Paris25354c42009-08-13 09:45:03 -04003858}
3859
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003860static int selinux_kernel_module_from_file(struct file *file)
3861{
3862 struct common_audit_data ad;
3863 struct inode_security_struct *isec;
3864 struct file_security_struct *fsec;
3865 u32 sid = current_sid();
3866 int rc;
3867
3868 /* init_module */
3869 if (file == NULL)
3870 return avc_has_perm(sid, sid, SECCLASS_SYSTEM,
3871 SYSTEM__MODULE_LOAD, NULL);
3872
3873 /* finit_module */
Paul Moore20cdef82016-04-04 14:14:42 -04003874
Vivek Goyal43af5de2016-09-09 11:37:49 -04003875 ad.type = LSM_AUDIT_DATA_FILE;
3876 ad.u.file = file;
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003877
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003878 fsec = file->f_security;
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003879 if (sid != fsec->sid) {
3880 rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3881 if (rc)
3882 return rc;
3883 }
3884
Paul Moore20cdef82016-04-04 14:14:42 -04003885 isec = inode_security(file_inode(file));
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003886 return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM,
3887 SYSTEM__MODULE_LOAD, &ad);
3888}
3889
3890static int selinux_kernel_read_file(struct file *file,
3891 enum kernel_read_file_id id)
3892{
3893 int rc = 0;
3894
3895 switch (id) {
3896 case READING_MODULE:
3897 rc = selinux_kernel_module_from_file(file);
3898 break;
3899 default:
3900 break;
3901 }
3902
3903 return rc;
3904}
3905
Linus Torvalds1da177e2005-04-16 15:20:36 -07003906static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3907{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003908 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3909 PROCESS__SETPGID, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003910}
3911
3912static int selinux_task_getpgid(struct task_struct *p)
3913{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003914 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3915 PROCESS__GETPGID, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003916}
3917
3918static int selinux_task_getsid(struct task_struct *p)
3919{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003920 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3921 PROCESS__GETSESSION, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003922}
3923
David Quigleyf9008e4c2006-06-30 01:55:46 -07003924static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3925{
David Howells275bb412008-11-14 10:39:19 +11003926 *secid = task_sid(p);
David Quigleyf9008e4c2006-06-30 01:55:46 -07003927}
3928
Linus Torvalds1da177e2005-04-16 15:20:36 -07003929static int selinux_task_setnice(struct task_struct *p, int nice)
3930{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003931 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3932 PROCESS__SETSCHED, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003933}
3934
James Morris03e68062006-06-23 02:03:58 -07003935static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3936{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003937 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3938 PROCESS__SETSCHED, NULL);
James Morris03e68062006-06-23 02:03:58 -07003939}
3940
David Quigleya1836a42006-06-30 01:55:49 -07003941static int selinux_task_getioprio(struct task_struct *p)
3942{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003943 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3944 PROCESS__GETSCHED, NULL);
David Quigleya1836a42006-06-30 01:55:49 -07003945}
3946
Stephen Smalley791ec492017-02-17 07:57:00 -05003947int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
3948 unsigned int flags)
3949{
3950 u32 av = 0;
3951
Stephen Smalley84e68852017-02-28 09:35:08 -05003952 if (!flags)
3953 return 0;
Stephen Smalley791ec492017-02-17 07:57:00 -05003954 if (flags & LSM_PRLIMIT_WRITE)
3955 av |= PROCESS__SETRLIMIT;
3956 if (flags & LSM_PRLIMIT_READ)
3957 av |= PROCESS__GETRLIMIT;
3958 return avc_has_perm(cred_sid(cred), cred_sid(tcred),
3959 SECCLASS_PROCESS, av, NULL);
3960}
3961
Jiri Slaby8fd00b42009-08-26 18:41:16 +02003962static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3963 struct rlimit *new_rlim)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003964{
Jiri Slaby8fd00b42009-08-26 18:41:16 +02003965 struct rlimit *old_rlim = p->signal->rlim + resource;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003966
3967 /* Control the ability to change the hard limit (whether
3968 lowering or raising it), so that the hard limit can
3969 later be used as a safe reset point for the soft limit
David Howellsd84f4f92008-11-14 10:39:23 +11003970 upon context transitions. See selinux_bprm_committing_creds. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07003971 if (old_rlim->rlim_max != new_rlim->rlim_max)
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003972 return avc_has_perm(current_sid(), task_sid(p),
3973 SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003974
3975 return 0;
3976}
3977
KOSAKI Motohirob0ae1982010-10-15 04:21:18 +09003978static int selinux_task_setscheduler(struct task_struct *p)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003979{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003980 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3981 PROCESS__SETSCHED, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003982}
3983
3984static int selinux_task_getscheduler(struct task_struct *p)
3985{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003986 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3987 PROCESS__GETSCHED, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003988}
3989
David Quigley35601542006-06-23 02:04:01 -07003990static int selinux_task_movememory(struct task_struct *p)
3991{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003992 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3993 PROCESS__SETSCHED, NULL);
David Quigley35601542006-06-23 02:04:01 -07003994}
3995
David Quigleyf9008e4c2006-06-30 01:55:46 -07003996static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3997 int sig, u32 secid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003998{
3999 u32 perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004000
Linus Torvalds1da177e2005-04-16 15:20:36 -07004001 if (!sig)
4002 perm = PROCESS__SIGNULL; /* null signal; existence test */
4003 else
4004 perm = signal_to_av(sig);
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004005 if (!secid)
4006 secid = current_sid();
4007 return avc_has_perm(secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004008}
4009
Linus Torvalds1da177e2005-04-16 15:20:36 -07004010static void selinux_task_to_inode(struct task_struct *p,
4011 struct inode *inode)
4012{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004013 struct inode_security_struct *isec = inode->i_security;
David Howells275bb412008-11-14 10:39:19 +11004014 u32 sid = task_sid(p);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004015
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004016 spin_lock(&isec->lock);
Andreas Gruenbacherdb978da2016-11-10 22:18:28 +01004017 isec->sclass = inode_mode_to_security_class(inode->i_mode);
David Howells275bb412008-11-14 10:39:19 +11004018 isec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05004019 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004020 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004021}
4022
Linus Torvalds1da177e2005-04-16 15:20:36 -07004023/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004024static int selinux_parse_skb_ipv4(struct sk_buff *skb,
Thomas Liu2bf49692009-07-14 12:14:09 -04004025 struct common_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004026{
4027 int offset, ihlen, ret = -EINVAL;
4028 struct iphdr _iph, *ih;
4029
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03004030 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004031 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4032 if (ih == NULL)
4033 goto out;
4034
4035 ihlen = ih->ihl * 4;
4036 if (ihlen < sizeof(_iph))
4037 goto out;
4038
Eric Paris48c62af2012-04-02 13:15:44 -04004039 ad->u.net->v4info.saddr = ih->saddr;
4040 ad->u.net->v4info.daddr = ih->daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004041 ret = 0;
4042
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004043 if (proto)
4044 *proto = ih->protocol;
4045
Linus Torvalds1da177e2005-04-16 15:20:36 -07004046 switch (ih->protocol) {
Eric Paris828dfe12008-04-17 13:17:49 -04004047 case IPPROTO_TCP: {
4048 struct tcphdr _tcph, *th;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004049
Eric Paris828dfe12008-04-17 13:17:49 -04004050 if (ntohs(ih->frag_off) & IP_OFFSET)
4051 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004052
4053 offset += ihlen;
4054 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4055 if (th == NULL)
4056 break;
4057
Eric Paris48c62af2012-04-02 13:15:44 -04004058 ad->u.net->sport = th->source;
4059 ad->u.net->dport = th->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004060 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004061 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004062
Eric Paris828dfe12008-04-17 13:17:49 -04004063 case IPPROTO_UDP: {
4064 struct udphdr _udph, *uh;
4065
4066 if (ntohs(ih->frag_off) & IP_OFFSET)
4067 break;
4068
4069 offset += ihlen;
4070 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4071 if (uh == NULL)
4072 break;
4073
Eric Paris48c62af2012-04-02 13:15:44 -04004074 ad->u.net->sport = uh->source;
4075 ad->u.net->dport = uh->dest;
Eric Paris828dfe12008-04-17 13:17:49 -04004076 break;
4077 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004078
James Morris2ee92d42006-11-13 16:09:01 -08004079 case IPPROTO_DCCP: {
4080 struct dccp_hdr _dccph, *dh;
4081
4082 if (ntohs(ih->frag_off) & IP_OFFSET)
4083 break;
4084
4085 offset += ihlen;
4086 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4087 if (dh == NULL)
4088 break;
4089
Eric Paris48c62af2012-04-02 13:15:44 -04004090 ad->u.net->sport = dh->dccph_sport;
4091 ad->u.net->dport = dh->dccph_dport;
James Morris2ee92d42006-11-13 16:09:01 -08004092 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004093 }
James Morris2ee92d42006-11-13 16:09:01 -08004094
Eric Paris828dfe12008-04-17 13:17:49 -04004095 default:
4096 break;
4097 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004098out:
4099 return ret;
4100}
4101
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04004102#if IS_ENABLED(CONFIG_IPV6)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004103
4104/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004105static int selinux_parse_skb_ipv6(struct sk_buff *skb,
Thomas Liu2bf49692009-07-14 12:14:09 -04004106 struct common_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004107{
4108 u8 nexthdr;
4109 int ret = -EINVAL, offset;
4110 struct ipv6hdr _ipv6h, *ip6;
Jesse Gross75f28112011-11-30 17:05:51 -08004111 __be16 frag_off;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004112
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03004113 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004114 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4115 if (ip6 == NULL)
4116 goto out;
4117
Eric Paris48c62af2012-04-02 13:15:44 -04004118 ad->u.net->v6info.saddr = ip6->saddr;
4119 ad->u.net->v6info.daddr = ip6->daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004120 ret = 0;
4121
4122 nexthdr = ip6->nexthdr;
4123 offset += sizeof(_ipv6h);
Jesse Gross75f28112011-11-30 17:05:51 -08004124 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004125 if (offset < 0)
4126 goto out;
4127
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004128 if (proto)
4129 *proto = nexthdr;
4130
Linus Torvalds1da177e2005-04-16 15:20:36 -07004131 switch (nexthdr) {
4132 case IPPROTO_TCP: {
Eric Paris828dfe12008-04-17 13:17:49 -04004133 struct tcphdr _tcph, *th;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004134
4135 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4136 if (th == NULL)
4137 break;
4138
Eric Paris48c62af2012-04-02 13:15:44 -04004139 ad->u.net->sport = th->source;
4140 ad->u.net->dport = th->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004141 break;
4142 }
4143
4144 case IPPROTO_UDP: {
4145 struct udphdr _udph, *uh;
4146
4147 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4148 if (uh == NULL)
4149 break;
4150
Eric Paris48c62af2012-04-02 13:15:44 -04004151 ad->u.net->sport = uh->source;
4152 ad->u.net->dport = uh->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004153 break;
4154 }
4155
James Morris2ee92d42006-11-13 16:09:01 -08004156 case IPPROTO_DCCP: {
4157 struct dccp_hdr _dccph, *dh;
4158
4159 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4160 if (dh == NULL)
4161 break;
4162
Eric Paris48c62af2012-04-02 13:15:44 -04004163 ad->u.net->sport = dh->dccph_sport;
4164 ad->u.net->dport = dh->dccph_dport;
James Morris2ee92d42006-11-13 16:09:01 -08004165 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004166 }
James Morris2ee92d42006-11-13 16:09:01 -08004167
Linus Torvalds1da177e2005-04-16 15:20:36 -07004168 /* includes fragments */
4169 default:
4170 break;
4171 }
4172out:
4173 return ret;
4174}
4175
4176#endif /* IPV6 */
4177
Thomas Liu2bf49692009-07-14 12:14:09 -04004178static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
David Howellscf9481e2008-07-27 21:31:07 +10004179 char **_addrp, int src, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004180{
David Howellscf9481e2008-07-27 21:31:07 +10004181 char *addrp;
4182 int ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004183
Eric Paris48c62af2012-04-02 13:15:44 -04004184 switch (ad->u.net->family) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07004185 case PF_INET:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004186 ret = selinux_parse_skb_ipv4(skb, ad, proto);
David Howellscf9481e2008-07-27 21:31:07 +10004187 if (ret)
4188 goto parse_error;
Eric Paris48c62af2012-04-02 13:15:44 -04004189 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4190 &ad->u.net->v4info.daddr);
David Howellscf9481e2008-07-27 21:31:07 +10004191 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004192
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04004193#if IS_ENABLED(CONFIG_IPV6)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004194 case PF_INET6:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004195 ret = selinux_parse_skb_ipv6(skb, ad, proto);
David Howellscf9481e2008-07-27 21:31:07 +10004196 if (ret)
4197 goto parse_error;
Eric Paris48c62af2012-04-02 13:15:44 -04004198 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4199 &ad->u.net->v6info.daddr);
David Howellscf9481e2008-07-27 21:31:07 +10004200 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004201#endif /* IPV6 */
4202 default:
David Howellscf9481e2008-07-27 21:31:07 +10004203 addrp = NULL;
4204 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004205 }
4206
David Howellscf9481e2008-07-27 21:31:07 +10004207parse_error:
4208 printk(KERN_WARNING
4209 "SELinux: failure in selinux_parse_skb(),"
4210 " unable to parse packet\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07004211 return ret;
David Howellscf9481e2008-07-27 21:31:07 +10004212
4213okay:
4214 if (_addrp)
4215 *_addrp = addrp;
4216 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004217}
4218
Paul Moore4f6a9932007-03-01 14:35:22 -05004219/**
Paul Moore220deb92008-01-29 08:38:23 -05004220 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
Paul Moore4f6a9932007-03-01 14:35:22 -05004221 * @skb: the packet
Paul Moore75e22912008-01-29 08:38:04 -05004222 * @family: protocol family
Paul Moore220deb92008-01-29 08:38:23 -05004223 * @sid: the packet's peer label SID
Paul Moore4f6a9932007-03-01 14:35:22 -05004224 *
4225 * Description:
Paul Moore220deb92008-01-29 08:38:23 -05004226 * Check the various different forms of network peer labeling and determine
4227 * the peer label/SID for the packet; most of the magic actually occurs in
4228 * the security server function security_net_peersid_cmp(). The function
4229 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4230 * or -EACCES if @sid is invalid due to inconsistencies with the different
4231 * peer labels.
Paul Moore4f6a9932007-03-01 14:35:22 -05004232 *
4233 */
Paul Moore220deb92008-01-29 08:38:23 -05004234static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
Paul Moore4f6a9932007-03-01 14:35:22 -05004235{
Paul Moore71f1cb02008-01-29 08:51:16 -05004236 int err;
Paul Moore4f6a9932007-03-01 14:35:22 -05004237 u32 xfrm_sid;
4238 u32 nlbl_sid;
Paul Moore220deb92008-01-29 08:38:23 -05004239 u32 nlbl_type;
Paul Moore4f6a9932007-03-01 14:35:22 -05004240
Paul Moore817eff72013-12-10 14:57:54 -05004241 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
Paul Moorebed4d7e2013-07-23 17:38:40 -04004242 if (unlikely(err))
4243 return -EACCES;
4244 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4245 if (unlikely(err))
4246 return -EACCES;
Paul Moore220deb92008-01-29 08:38:23 -05004247
Paul Moore71f1cb02008-01-29 08:51:16 -05004248 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
4249 if (unlikely(err)) {
4250 printk(KERN_WARNING
4251 "SELinux: failure in selinux_skb_peerlbl_sid(),"
4252 " unable to determine packet's peer label\n");
Paul Moore220deb92008-01-29 08:38:23 -05004253 return -EACCES;
Paul Moore71f1cb02008-01-29 08:51:16 -05004254 }
Paul Moore220deb92008-01-29 08:38:23 -05004255
4256 return 0;
Paul Moore4f6a9932007-03-01 14:35:22 -05004257}
4258
Paul Moore446b8022013-12-04 16:10:51 -05004259/**
4260 * selinux_conn_sid - Determine the child socket label for a connection
4261 * @sk_sid: the parent socket's SID
4262 * @skb_sid: the packet's SID
4263 * @conn_sid: the resulting connection SID
4264 *
4265 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4266 * combined with the MLS information from @skb_sid in order to create
4267 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
4268 * of @sk_sid. Returns zero on success, negative values on failure.
4269 *
4270 */
4271static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4272{
4273 int err = 0;
4274
4275 if (skb_sid != SECSID_NULL)
4276 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4277 else
4278 *conn_sid = sk_sid;
4279
4280 return err;
4281}
4282
Linus Torvalds1da177e2005-04-16 15:20:36 -07004283/* socket security operations */
Paul Moored4f2d972010-04-22 14:46:18 -04004284
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004285static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4286 u16 secclass, u32 *socksid)
Paul Moored4f2d972010-04-22 14:46:18 -04004287{
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004288 if (tsec->sockcreate_sid > SECSID_NULL) {
4289 *socksid = tsec->sockcreate_sid;
4290 return 0;
4291 }
4292
4293 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4294 socksid);
Paul Moored4f2d972010-04-22 14:46:18 -04004295}
4296
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004297static int sock_has_perm(struct sock *sk, u32 perms)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004298{
Paul Moore253bfae2010-04-22 14:46:19 -04004299 struct sk_security_struct *sksec = sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004300 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004301 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004302
Paul Moore253bfae2010-04-22 14:46:19 -04004303 if (sksec->sid == SECINITSID_KERNEL)
4304 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004305
Eric Paris50c205f2012-04-04 15:01:43 -04004306 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004307 ad.u.net = &net;
4308 ad.u.net->sk = sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004309
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004310 return avc_has_perm(current_sid(), sksec->sid, sksec->sclass, perms,
4311 &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004312}
4313
4314static int selinux_socket_create(int family, int type,
4315 int protocol, int kern)
4316{
Paul Moore5fb49872010-04-22 14:46:19 -04004317 const struct task_security_struct *tsec = current_security();
Paul Moored4f2d972010-04-22 14:46:18 -04004318 u32 newsid;
David Howells275bb412008-11-14 10:39:19 +11004319 u16 secclass;
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004320 int rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004321
4322 if (kern)
Paul Moored4f2d972010-04-22 14:46:18 -04004323 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004324
David Howells275bb412008-11-14 10:39:19 +11004325 secclass = socket_type_to_security_class(family, type, protocol);
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004326 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4327 if (rc)
4328 return rc;
4329
Paul Moored4f2d972010-04-22 14:46:18 -04004330 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004331}
4332
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07004333static int selinux_socket_post_create(struct socket *sock, int family,
4334 int type, int protocol, int kern)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004335{
Paul Moore5fb49872010-04-22 14:46:19 -04004336 const struct task_security_struct *tsec = current_security();
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05004337 struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004338 struct sk_security_struct *sksec;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004339 u16 sclass = socket_type_to_security_class(family, type, protocol);
4340 u32 sid = SECINITSID_KERNEL;
David Howells275bb412008-11-14 10:39:19 +11004341 int err = 0;
4342
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004343 if (!kern) {
4344 err = socket_sockcreate_sid(tsec, sclass, &sid);
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004345 if (err)
4346 return err;
4347 }
David Howells275bb412008-11-14 10:39:19 +11004348
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004349 isec->sclass = sclass;
4350 isec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05004351 isec->initialized = LABEL_INITIALIZED;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004352
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004353 if (sock->sk) {
4354 sksec = sock->sk->sk_security;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004355 sksec->sclass = sclass;
4356 sksec->sid = sid;
Paul Moore389fb8002009-03-27 17:10:34 -04004357 err = selinux_netlbl_socket_post_create(sock->sk, family);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004358 }
4359
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07004360 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004361}
4362
4363/* Range of port numbers used to automatically bind.
4364 Need to determine whether we should perform a name_bind
4365 permission check between the socket and the port number. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07004366
4367static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4368{
Paul Moore253bfae2010-04-22 14:46:19 -04004369 struct sock *sk = sock->sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004370 u16 family;
4371 int err;
4372
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004373 err = sock_has_perm(sk, SOCKET__BIND);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004374 if (err)
4375 goto out;
4376
4377 /*
4378 * If PF_INET or PF_INET6, check name_bind permission for the port.
James Morris13402582005-09-30 14:24:34 -04004379 * Multiple address binding for SCTP is not supported yet: we just
4380 * check the first address now.
Linus Torvalds1da177e2005-04-16 15:20:36 -07004381 */
Paul Moore253bfae2010-04-22 14:46:19 -04004382 family = sk->sk_family;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004383 if (family == PF_INET || family == PF_INET6) {
4384 char *addrp;
Paul Moore253bfae2010-04-22 14:46:19 -04004385 struct sk_security_struct *sksec = sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004386 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004387 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004388 struct sockaddr_in *addr4 = NULL;
4389 struct sockaddr_in6 *addr6 = NULL;
4390 unsigned short snum;
James Morrise399f982008-06-12 01:39:58 +10004391 u32 sid, node_perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004392
Linus Torvalds1da177e2005-04-16 15:20:36 -07004393 if (family == PF_INET) {
Alexander Potapenkoe2f586b2017-03-06 19:46:14 +01004394 if (addrlen < sizeof(struct sockaddr_in)) {
4395 err = -EINVAL;
4396 goto out;
4397 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004398 addr4 = (struct sockaddr_in *)address;
4399 snum = ntohs(addr4->sin_port);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004400 addrp = (char *)&addr4->sin_addr.s_addr;
4401 } else {
Alexander Potapenkoe2f586b2017-03-06 19:46:14 +01004402 if (addrlen < SIN6_LEN_RFC2133) {
4403 err = -EINVAL;
4404 goto out;
4405 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004406 addr6 = (struct sockaddr_in6 *)address;
4407 snum = ntohs(addr6->sin6_port);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004408 addrp = (char *)&addr6->sin6_addr.s6_addr;
4409 }
4410
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004411 if (snum) {
4412 int low, high;
4413
Eric W. Biederman0bbf87d2013-09-28 14:10:59 -07004414 inet_get_local_port_range(sock_net(sk), &low, &high);
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004415
Krister Johansen4548b682017-01-20 17:49:11 -08004416 if (snum < max(inet_prot_sock(sock_net(sk)), low) ||
4417 snum > high) {
Paul Moore3e1121722008-04-10 10:48:14 -04004418 err = sel_netport_sid(sk->sk_protocol,
4419 snum, &sid);
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004420 if (err)
4421 goto out;
Eric Paris50c205f2012-04-04 15:01:43 -04004422 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004423 ad.u.net = &net;
4424 ad.u.net->sport = htons(snum);
4425 ad.u.net->family = family;
Paul Moore253bfae2010-04-22 14:46:19 -04004426 err = avc_has_perm(sksec->sid, sid,
4427 sksec->sclass,
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004428 SOCKET__NAME_BIND, &ad);
4429 if (err)
4430 goto out;
4431 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004432 }
Eric Paris828dfe12008-04-17 13:17:49 -04004433
Paul Moore253bfae2010-04-22 14:46:19 -04004434 switch (sksec->sclass) {
James Morris13402582005-09-30 14:24:34 -04004435 case SECCLASS_TCP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004436 node_perm = TCP_SOCKET__NODE_BIND;
4437 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004438
James Morris13402582005-09-30 14:24:34 -04004439 case SECCLASS_UDP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004440 node_perm = UDP_SOCKET__NODE_BIND;
4441 break;
James Morris2ee92d42006-11-13 16:09:01 -08004442
4443 case SECCLASS_DCCP_SOCKET:
4444 node_perm = DCCP_SOCKET__NODE_BIND;
4445 break;
4446
Linus Torvalds1da177e2005-04-16 15:20:36 -07004447 default:
4448 node_perm = RAWIP_SOCKET__NODE_BIND;
4449 break;
4450 }
Eric Paris828dfe12008-04-17 13:17:49 -04004451
Paul Moore224dfbd2008-01-29 08:38:13 -05004452 err = sel_netnode_sid(addrp, family, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004453 if (err)
4454 goto out;
Eric Paris828dfe12008-04-17 13:17:49 -04004455
Eric Paris50c205f2012-04-04 15:01:43 -04004456 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004457 ad.u.net = &net;
4458 ad.u.net->sport = htons(snum);
4459 ad.u.net->family = family;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004460
4461 if (family == PF_INET)
Eric Paris48c62af2012-04-02 13:15:44 -04004462 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004463 else
Eric Paris48c62af2012-04-02 13:15:44 -04004464 ad.u.net->v6info.saddr = addr6->sin6_addr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004465
Paul Moore253bfae2010-04-22 14:46:19 -04004466 err = avc_has_perm(sksec->sid, sid,
4467 sksec->sclass, node_perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004468 if (err)
4469 goto out;
4470 }
4471out:
4472 return err;
4473}
4474
4475static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4476{
Paul Moore014ab192008-10-10 10:16:33 -04004477 struct sock *sk = sock->sk;
Paul Moore253bfae2010-04-22 14:46:19 -04004478 struct sk_security_struct *sksec = sk->sk_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004479 int err;
4480
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004481 err = sock_has_perm(sk, SOCKET__CONNECT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004482 if (err)
4483 return err;
4484
4485 /*
James Morris2ee92d42006-11-13 16:09:01 -08004486 * If a TCP or DCCP socket, check name_connect permission for the port.
Linus Torvalds1da177e2005-04-16 15:20:36 -07004487 */
Paul Moore253bfae2010-04-22 14:46:19 -04004488 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4489 sksec->sclass == SECCLASS_DCCP_SOCKET) {
Thomas Liu2bf49692009-07-14 12:14:09 -04004490 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004491 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004492 struct sockaddr_in *addr4 = NULL;
4493 struct sockaddr_in6 *addr6 = NULL;
4494 unsigned short snum;
James Morris2ee92d42006-11-13 16:09:01 -08004495 u32 sid, perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004496
4497 if (sk->sk_family == PF_INET) {
4498 addr4 = (struct sockaddr_in *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07004499 if (addrlen < sizeof(struct sockaddr_in))
Linus Torvalds1da177e2005-04-16 15:20:36 -07004500 return -EINVAL;
4501 snum = ntohs(addr4->sin_port);
4502 } else {
4503 addr6 = (struct sockaddr_in6 *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07004504 if (addrlen < SIN6_LEN_RFC2133)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004505 return -EINVAL;
4506 snum = ntohs(addr6->sin6_port);
4507 }
4508
Paul Moore3e1121722008-04-10 10:48:14 -04004509 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004510 if (err)
4511 goto out;
4512
Paul Moore253bfae2010-04-22 14:46:19 -04004513 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
James Morris2ee92d42006-11-13 16:09:01 -08004514 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4515
Eric Paris50c205f2012-04-04 15:01:43 -04004516 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004517 ad.u.net = &net;
4518 ad.u.net->dport = htons(snum);
4519 ad.u.net->family = sk->sk_family;
Paul Moore253bfae2010-04-22 14:46:19 -04004520 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004521 if (err)
4522 goto out;
4523 }
4524
Paul Moore014ab192008-10-10 10:16:33 -04004525 err = selinux_netlbl_socket_connect(sk, address);
4526
Linus Torvalds1da177e2005-04-16 15:20:36 -07004527out:
4528 return err;
4529}
4530
4531static int selinux_socket_listen(struct socket *sock, int backlog)
4532{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004533 return sock_has_perm(sock->sk, SOCKET__LISTEN);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004534}
4535
4536static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4537{
4538 int err;
4539 struct inode_security_struct *isec;
4540 struct inode_security_struct *newisec;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004541 u16 sclass;
4542 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004543
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004544 err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004545 if (err)
4546 return err;
4547
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05004548 isec = inode_security_novalidate(SOCK_INODE(sock));
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004549 spin_lock(&isec->lock);
4550 sclass = isec->sclass;
4551 sid = isec->sid;
4552 spin_unlock(&isec->lock);
4553
4554 newisec = inode_security_novalidate(SOCK_INODE(newsock));
4555 newisec->sclass = sclass;
4556 newisec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05004557 newisec->initialized = LABEL_INITIALIZED;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004558
4559 return 0;
4560}
4561
4562static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
Eric Paris828dfe12008-04-17 13:17:49 -04004563 int size)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004564{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004565 return sock_has_perm(sock->sk, SOCKET__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004566}
4567
4568static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4569 int size, int flags)
4570{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004571 return sock_has_perm(sock->sk, SOCKET__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004572}
4573
4574static int selinux_socket_getsockname(struct socket *sock)
4575{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004576 return sock_has_perm(sock->sk, SOCKET__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004577}
4578
4579static int selinux_socket_getpeername(struct socket *sock)
4580{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004581 return sock_has_perm(sock->sk, SOCKET__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004582}
4583
Eric Paris828dfe12008-04-17 13:17:49 -04004584static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004585{
Paul Mooref8687af2006-10-30 15:22:15 -08004586 int err;
4587
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004588 err = sock_has_perm(sock->sk, SOCKET__SETOPT);
Paul Mooref8687af2006-10-30 15:22:15 -08004589 if (err)
4590 return err;
4591
4592 return selinux_netlbl_socket_setsockopt(sock, level, optname);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004593}
4594
4595static int selinux_socket_getsockopt(struct socket *sock, int level,
4596 int optname)
4597{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004598 return sock_has_perm(sock->sk, SOCKET__GETOPT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004599}
4600
4601static int selinux_socket_shutdown(struct socket *sock, int how)
4602{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004603 return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004604}
4605
David S. Miller3610cda2011-01-05 15:38:53 -08004606static int selinux_socket_unix_stream_connect(struct sock *sock,
4607 struct sock *other,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004608 struct sock *newsk)
4609{
David S. Miller3610cda2011-01-05 15:38:53 -08004610 struct sk_security_struct *sksec_sock = sock->sk_security;
4611 struct sk_security_struct *sksec_other = other->sk_security;
Paul Moore4d1e2452010-04-22 14:46:18 -04004612 struct sk_security_struct *sksec_new = newsk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004613 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004614 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004615 int err;
4616
Eric Paris50c205f2012-04-04 15:01:43 -04004617 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004618 ad.u.net = &net;
4619 ad.u.net->sk = other;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004620
Paul Moore4d1e2452010-04-22 14:46:18 -04004621 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4622 sksec_other->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004623 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4624 if (err)
4625 return err;
4626
Linus Torvalds1da177e2005-04-16 15:20:36 -07004627 /* server child socket */
Paul Moore4d1e2452010-04-22 14:46:18 -04004628 sksec_new->peer_sid = sksec_sock->sid;
4629 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4630 &sksec_new->sid);
4631 if (err)
4632 return err;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004633
Paul Moore4d1e2452010-04-22 14:46:18 -04004634 /* connecting socket */
4635 sksec_sock->peer_sid = sksec_new->sid;
4636
4637 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004638}
4639
4640static int selinux_socket_unix_may_send(struct socket *sock,
4641 struct socket *other)
4642{
Paul Moore253bfae2010-04-22 14:46:19 -04004643 struct sk_security_struct *ssec = sock->sk->sk_security;
4644 struct sk_security_struct *osec = other->sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004645 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004646 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004647
Eric Paris50c205f2012-04-04 15:01:43 -04004648 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004649 ad.u.net = &net;
4650 ad.u.net->sk = other->sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004651
Paul Moore253bfae2010-04-22 14:46:19 -04004652 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4653 &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004654}
4655
Paul Moorecbe0d6e2014-09-10 17:09:57 -04004656static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4657 char *addrp, u16 family, u32 peer_sid,
Thomas Liu2bf49692009-07-14 12:14:09 -04004658 struct common_audit_data *ad)
Paul Mooreeffad8d2008-01-29 08:49:27 -05004659{
4660 int err;
4661 u32 if_sid;
4662 u32 node_sid;
4663
Paul Moorecbe0d6e2014-09-10 17:09:57 -04004664 err = sel_netif_sid(ns, ifindex, &if_sid);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004665 if (err)
4666 return err;
4667 err = avc_has_perm(peer_sid, if_sid,
4668 SECCLASS_NETIF, NETIF__INGRESS, ad);
4669 if (err)
4670 return err;
4671
4672 err = sel_netnode_sid(addrp, family, &node_sid);
4673 if (err)
4674 return err;
4675 return avc_has_perm(peer_sid, node_sid,
4676 SECCLASS_NODE, NODE__RECVFROM, ad);
4677}
4678
Paul Moore220deb92008-01-29 08:38:23 -05004679static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
Paul Moored8395c82008-10-10 10:16:30 -04004680 u16 family)
Paul Moore220deb92008-01-29 08:38:23 -05004681{
Paul Moore277d3422008-12-31 12:54:11 -05004682 int err = 0;
Paul Moore220deb92008-01-29 08:38:23 -05004683 struct sk_security_struct *sksec = sk->sk_security;
Paul Moore220deb92008-01-29 08:38:23 -05004684 u32 sk_sid = sksec->sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04004685 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004686 struct lsm_network_audit net = {0,};
Paul Moored8395c82008-10-10 10:16:30 -04004687 char *addrp;
4688
Eric Paris50c205f2012-04-04 15:01:43 -04004689 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004690 ad.u.net = &net;
4691 ad.u.net->netif = skb->skb_iif;
4692 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04004693 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4694 if (err)
4695 return err;
Paul Moore220deb92008-01-29 08:38:23 -05004696
Paul Moore58bfbb52009-03-27 17:10:41 -04004697 if (selinux_secmark_enabled()) {
Paul Moore220deb92008-01-29 08:38:23 -05004698 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
Paul Moored8395c82008-10-10 10:16:30 -04004699 PACKET__RECV, &ad);
Paul Moore58bfbb52009-03-27 17:10:41 -04004700 if (err)
4701 return err;
4702 }
Paul Moore220deb92008-01-29 08:38:23 -05004703
Steffen Klassertb9679a72011-02-23 12:55:21 +01004704 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4705 if (err)
4706 return err;
4707 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004708
James Morris4e5ab4c2006-06-09 00:33:33 -07004709 return err;
4710}
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004711
James Morris4e5ab4c2006-06-09 00:33:33 -07004712static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4713{
Paul Moore220deb92008-01-29 08:38:23 -05004714 int err;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004715 struct sk_security_struct *sksec = sk->sk_security;
Paul Moore220deb92008-01-29 08:38:23 -05004716 u16 family = sk->sk_family;
4717 u32 sk_sid = sksec->sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04004718 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004719 struct lsm_network_audit net = {0,};
Paul Moore220deb92008-01-29 08:38:23 -05004720 char *addrp;
Paul Moored8395c82008-10-10 10:16:30 -04004721 u8 secmark_active;
4722 u8 peerlbl_active;
James Morris4e5ab4c2006-06-09 00:33:33 -07004723
James Morris4e5ab4c2006-06-09 00:33:33 -07004724 if (family != PF_INET && family != PF_INET6)
Paul Moore220deb92008-01-29 08:38:23 -05004725 return 0;
James Morris4e5ab4c2006-06-09 00:33:33 -07004726
4727 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
Al Viro87fcd702006-12-04 22:00:55 +00004728 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
James Morris4e5ab4c2006-06-09 00:33:33 -07004729 family = PF_INET;
4730
Paul Moored8395c82008-10-10 10:16:30 -04004731 /* If any sort of compatibility mode is enabled then handoff processing
4732 * to the selinux_sock_rcv_skb_compat() function to deal with the
4733 * special handling. We do this in an attempt to keep this function
4734 * as fast and as clean as possible. */
Paul Moore58bfbb52009-03-27 17:10:41 -04004735 if (!selinux_policycap_netpeer)
Paul Moored8395c82008-10-10 10:16:30 -04004736 return selinux_sock_rcv_skb_compat(sk, skb, family);
4737
4738 secmark_active = selinux_secmark_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04004739 peerlbl_active = selinux_peerlbl_enabled();
Paul Moored8395c82008-10-10 10:16:30 -04004740 if (!secmark_active && !peerlbl_active)
4741 return 0;
4742
Eric Paris50c205f2012-04-04 15:01:43 -04004743 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004744 ad.u.net = &net;
4745 ad.u.net->netif = skb->skb_iif;
4746 ad.u.net->family = family;
Paul Moore224dfbd2008-01-29 08:38:13 -05004747 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
James Morris4e5ab4c2006-06-09 00:33:33 -07004748 if (err)
Paul Moore220deb92008-01-29 08:38:23 -05004749 return err;
James Morris4e5ab4c2006-06-09 00:33:33 -07004750
Paul Moored8395c82008-10-10 10:16:30 -04004751 if (peerlbl_active) {
Paul Moored621d352008-01-29 08:43:36 -05004752 u32 peer_sid;
4753
4754 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4755 if (err)
4756 return err;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04004757 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4758 addrp, family, peer_sid, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04004759 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04004760 selinux_netlbl_err(skb, family, err, 0);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004761 return err;
Paul Mooredfaebe92008-10-10 10:16:31 -04004762 }
Paul Moored621d352008-01-29 08:43:36 -05004763 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4764 PEER__RECV, &ad);
Chad Hanson46d01d62013-12-23 17:45:01 -05004765 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04004766 selinux_netlbl_err(skb, family, err, 0);
Chad Hanson46d01d62013-12-23 17:45:01 -05004767 return err;
4768 }
Paul Moored621d352008-01-29 08:43:36 -05004769 }
4770
Paul Moored8395c82008-10-10 10:16:30 -04004771 if (secmark_active) {
Paul Mooreeffad8d2008-01-29 08:49:27 -05004772 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4773 PACKET__RECV, &ad);
4774 if (err)
4775 return err;
4776 }
4777
Paul Moored621d352008-01-29 08:43:36 -05004778 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004779}
4780
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004781static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4782 int __user *optlen, unsigned len)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004783{
4784 int err = 0;
4785 char *scontext;
4786 u32 scontext_len;
Paul Moore253bfae2010-04-22 14:46:19 -04004787 struct sk_security_struct *sksec = sock->sk->sk_security;
Paul Moore3de4bab2006-11-17 17:38:54 -05004788 u32 peer_sid = SECSID_NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004789
Paul Moore253bfae2010-04-22 14:46:19 -04004790 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4791 sksec->sclass == SECCLASS_TCP_SOCKET)
Eric Parisdd3e7832010-04-07 15:08:46 -04004792 peer_sid = sksec->peer_sid;
Paul Moore253bfae2010-04-22 14:46:19 -04004793 if (peer_sid == SECSID_NULL)
4794 return -ENOPROTOOPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004795
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004796 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004797 if (err)
Paul Moore253bfae2010-04-22 14:46:19 -04004798 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004799
4800 if (scontext_len > len) {
4801 err = -ERANGE;
4802 goto out_len;
4803 }
4804
4805 if (copy_to_user(optval, scontext, scontext_len))
4806 err = -EFAULT;
4807
4808out_len:
4809 if (put_user(scontext_len, optlen))
4810 err = -EFAULT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004811 kfree(scontext);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004812 return err;
4813}
4814
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07004815static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004816{
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07004817 u32 peer_secid = SECSID_NULL;
Paul Moore75e22912008-01-29 08:38:04 -05004818 u16 family;
Paul Moore899134f2016-03-28 15:19:10 -04004819 struct inode_security_struct *isec;
Catherine Zhang877ce7c2006-06-29 12:27:47 -07004820
Paul Mooreaa862902008-10-10 10:16:29 -04004821 if (skb && skb->protocol == htons(ETH_P_IP))
4822 family = PF_INET;
4823 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4824 family = PF_INET6;
4825 else if (sock)
Paul Moore75e22912008-01-29 08:38:04 -05004826 family = sock->sk->sk_family;
Paul Moore75e22912008-01-29 08:38:04 -05004827 else
4828 goto out;
4829
Paul Moore899134f2016-03-28 15:19:10 -04004830 if (sock && family == PF_UNIX) {
4831 isec = inode_security_novalidate(SOCK_INODE(sock));
4832 peer_secid = isec->sid;
4833 } else if (skb)
Paul Moore220deb92008-01-29 08:38:23 -05004834 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004835
Paul Moore75e22912008-01-29 08:38:04 -05004836out:
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07004837 *secid = peer_secid;
Paul Moore75e22912008-01-29 08:38:04 -05004838 if (peer_secid == SECSID_NULL)
4839 return -EINVAL;
4840 return 0;
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004841}
4842
Al Viro7d877f32005-10-21 03:20:43 -04004843static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004844{
Paul Moore84914b72010-04-22 14:46:18 -04004845 struct sk_security_struct *sksec;
4846
4847 sksec = kzalloc(sizeof(*sksec), priority);
4848 if (!sksec)
4849 return -ENOMEM;
4850
4851 sksec->peer_sid = SECINITSID_UNLABELED;
4852 sksec->sid = SECINITSID_UNLABELED;
Stephen Smalley5dee25d2015-07-10 17:19:57 -04004853 sksec->sclass = SECCLASS_SOCKET;
Paul Moore84914b72010-04-22 14:46:18 -04004854 selinux_netlbl_sk_security_reset(sksec);
4855 sk->sk_security = sksec;
4856
4857 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004858}
4859
4860static void selinux_sk_free_security(struct sock *sk)
4861{
Paul Moore84914b72010-04-22 14:46:18 -04004862 struct sk_security_struct *sksec = sk->sk_security;
4863
4864 sk->sk_security = NULL;
4865 selinux_netlbl_sk_security_free(sksec);
4866 kfree(sksec);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004867}
4868
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004869static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4870{
Eric Parisdd3e7832010-04-07 15:08:46 -04004871 struct sk_security_struct *sksec = sk->sk_security;
4872 struct sk_security_struct *newsksec = newsk->sk_security;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004873
Eric Parisdd3e7832010-04-07 15:08:46 -04004874 newsksec->sid = sksec->sid;
4875 newsksec->peer_sid = sksec->peer_sid;
4876 newsksec->sclass = sksec->sclass;
Paul Moore99f59ed2006-08-29 17:53:48 -07004877
Eric Parisdd3e7832010-04-07 15:08:46 -04004878 selinux_netlbl_sk_security_reset(newsksec);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004879}
4880
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07004881static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004882{
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004883 if (!sk)
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07004884 *secid = SECINITSID_ANY_SOCKET;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004885 else {
4886 struct sk_security_struct *sksec = sk->sk_security;
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004887
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07004888 *secid = sksec->sid;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004889 }
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004890}
4891
Eric Paris828dfe12008-04-17 13:17:49 -04004892static void selinux_sock_graft(struct sock *sk, struct socket *parent)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004893{
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05004894 struct inode_security_struct *isec =
4895 inode_security_novalidate(SOCK_INODE(parent));
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004896 struct sk_security_struct *sksec = sk->sk_security;
4897
Paul Moore2873ead2014-07-28 10:42:48 -04004898 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4899 sk->sk_family == PF_UNIX)
David Woodhouse2148ccc2006-09-29 15:50:25 -07004900 isec->sid = sksec->sid;
Paul Moore220deb92008-01-29 08:38:23 -05004901 sksec->sclass = isec->sclass;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004902}
4903
Adrian Bunk9a673e52006-08-15 00:03:53 -07004904static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4905 struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004906{
4907 struct sk_security_struct *sksec = sk->sk_security;
4908 int err;
Paul Moore0b1f24e2013-12-03 11:39:13 -05004909 u16 family = req->rsk_ops->family;
Paul Moore446b8022013-12-04 16:10:51 -05004910 u32 connsid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004911 u32 peersid;
4912
Paul Mooreaa862902008-10-10 10:16:29 -04004913 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
Paul Moore220deb92008-01-29 08:38:23 -05004914 if (err)
4915 return err;
Paul Moore446b8022013-12-04 16:10:51 -05004916 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4917 if (err)
4918 return err;
4919 req->secid = connsid;
4920 req->peer_secid = peersid;
Venkat Yekkiralaa51c64f2006-07-27 22:01:34 -07004921
Paul Moore389fb8002009-03-27 17:10:34 -04004922 return selinux_netlbl_inet_conn_request(req, family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004923}
4924
Adrian Bunk9a673e52006-08-15 00:03:53 -07004925static void selinux_inet_csk_clone(struct sock *newsk,
4926 const struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004927{
4928 struct sk_security_struct *newsksec = newsk->sk_security;
4929
4930 newsksec->sid = req->secid;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004931 newsksec->peer_sid = req->peer_secid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004932 /* NOTE: Ideally, we should also get the isec->sid for the
4933 new socket in sync, but we don't have the isec available yet.
4934 So we will wait until sock_graft to do it, by which
4935 time it will have been created and available. */
Paul Moore99f59ed2006-08-29 17:53:48 -07004936
Paul Moore9f2ad662006-11-17 17:38:53 -05004937 /* We don't need to take any sort of lock here as we are the only
4938 * thread with access to newsksec */
Paul Moore389fb8002009-03-27 17:10:34 -04004939 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004940}
4941
Paul Moore014ab192008-10-10 10:16:33 -04004942static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004943{
Paul Mooreaa862902008-10-10 10:16:29 -04004944 u16 family = sk->sk_family;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004945 struct sk_security_struct *sksec = sk->sk_security;
4946
Paul Mooreaa862902008-10-10 10:16:29 -04004947 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4948 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4949 family = PF_INET;
4950
4951 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004952}
4953
Eric Paris2606fd12010-10-13 16:24:41 -04004954static int selinux_secmark_relabel_packet(u32 sid)
4955{
4956 const struct task_security_struct *__tsec;
4957 u32 tsid;
4958
4959 __tsec = current_security();
4960 tsid = __tsec->sid;
4961
4962 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4963}
4964
4965static void selinux_secmark_refcount_inc(void)
4966{
4967 atomic_inc(&selinux_secmark_refcount);
4968}
4969
4970static void selinux_secmark_refcount_dec(void)
4971{
4972 atomic_dec(&selinux_secmark_refcount);
4973}
4974
Adrian Bunk9a673e52006-08-15 00:03:53 -07004975static void selinux_req_classify_flow(const struct request_sock *req,
4976 struct flowi *fl)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004977{
David S. Miller1d28f422011-03-12 00:29:39 -05004978 fl->flowi_secid = req->secid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004979}
4980
Paul Moore5dbbaf22013-01-14 07:12:19 +00004981static int selinux_tun_dev_alloc_security(void **security)
4982{
4983 struct tun_security_struct *tunsec;
4984
4985 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4986 if (!tunsec)
4987 return -ENOMEM;
4988 tunsec->sid = current_sid();
4989
4990 *security = tunsec;
4991 return 0;
4992}
4993
4994static void selinux_tun_dev_free_security(void *security)
4995{
4996 kfree(security);
4997}
4998
Paul Mooreed6d76e2009-08-28 18:12:49 -04004999static int selinux_tun_dev_create(void)
5000{
5001 u32 sid = current_sid();
5002
5003 /* we aren't taking into account the "sockcreate" SID since the socket
5004 * that is being created here is not a socket in the traditional sense,
5005 * instead it is a private sock, accessible only to the kernel, and
5006 * representing a wide range of network traffic spanning multiple
5007 * connections unlike traditional sockets - check the TUN driver to
5008 * get a better understanding of why this socket is special */
5009
5010 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5011 NULL);
5012}
5013
Paul Moore5dbbaf22013-01-14 07:12:19 +00005014static int selinux_tun_dev_attach_queue(void *security)
Paul Mooreed6d76e2009-08-28 18:12:49 -04005015{
Paul Moore5dbbaf22013-01-14 07:12:19 +00005016 struct tun_security_struct *tunsec = security;
5017
5018 return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5019 TUN_SOCKET__ATTACH_QUEUE, NULL);
5020}
5021
5022static int selinux_tun_dev_attach(struct sock *sk, void *security)
5023{
5024 struct tun_security_struct *tunsec = security;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005025 struct sk_security_struct *sksec = sk->sk_security;
5026
5027 /* we don't currently perform any NetLabel based labeling here and it
5028 * isn't clear that we would want to do so anyway; while we could apply
5029 * labeling without the support of the TUN user the resulting labeled
5030 * traffic from the other end of the connection would almost certainly
5031 * cause confusion to the TUN user that had no idea network labeling
5032 * protocols were being used */
5033
Paul Moore5dbbaf22013-01-14 07:12:19 +00005034 sksec->sid = tunsec->sid;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005035 sksec->sclass = SECCLASS_TUN_SOCKET;
Paul Moore5dbbaf22013-01-14 07:12:19 +00005036
5037 return 0;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005038}
5039
Paul Moore5dbbaf22013-01-14 07:12:19 +00005040static int selinux_tun_dev_open(void *security)
Paul Mooreed6d76e2009-08-28 18:12:49 -04005041{
Paul Moore5dbbaf22013-01-14 07:12:19 +00005042 struct tun_security_struct *tunsec = security;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005043 u32 sid = current_sid();
5044 int err;
5045
Paul Moore5dbbaf22013-01-14 07:12:19 +00005046 err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
Paul Mooreed6d76e2009-08-28 18:12:49 -04005047 TUN_SOCKET__RELABELFROM, NULL);
5048 if (err)
5049 return err;
5050 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
5051 TUN_SOCKET__RELABELTO, NULL);
5052 if (err)
5053 return err;
Paul Moore5dbbaf22013-01-14 07:12:19 +00005054 tunsec->sid = sid;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005055
5056 return 0;
5057}
5058
Linus Torvalds1da177e2005-04-16 15:20:36 -07005059static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5060{
5061 int err = 0;
5062 u32 perm;
5063 struct nlmsghdr *nlh;
Paul Moore253bfae2010-04-22 14:46:19 -04005064 struct sk_security_struct *sksec = sk->sk_security;
Eric Paris828dfe12008-04-17 13:17:49 -04005065
Hong zhi guo77954982013-03-27 06:49:35 +00005066 if (skb->len < NLMSG_HDRLEN) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005067 err = -EINVAL;
5068 goto out;
5069 }
Arnaldo Carvalho de Melob529ccf2007-04-25 19:08:35 -07005070 nlh = nlmsg_hdr(skb);
Eric Paris828dfe12008-04-17 13:17:49 -04005071
Paul Moore253bfae2010-04-22 14:46:19 -04005072 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005073 if (err) {
5074 if (err == -EINVAL) {
Vladis Dronov76319942015-12-24 11:09:41 -05005075 pr_warn_ratelimited("SELinux: unrecognized netlink"
5076 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5077 " pig=%d comm=%s\n",
Marek Milkoviccded3ff2015-06-04 16:22:16 -04005078 sk->sk_protocol, nlh->nlmsg_type,
Vladis Dronov76319942015-12-24 11:09:41 -05005079 secclass_map[sksec->sclass - 1].name,
5080 task_pid_nr(current), current->comm);
Eric Paris39c9aed2008-11-05 09:34:42 -05005081 if (!selinux_enforcing || security_get_allow_unknown())
Linus Torvalds1da177e2005-04-16 15:20:36 -07005082 err = 0;
5083 }
5084
5085 /* Ignore */
5086 if (err == -ENOENT)
5087 err = 0;
5088 goto out;
5089 }
5090
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005091 err = sock_has_perm(sk, perm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005092out:
5093 return err;
5094}
5095
5096#ifdef CONFIG_NETFILTER
5097
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005098static unsigned int selinux_ip_forward(struct sk_buff *skb,
5099 const struct net_device *indev,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005100 u16 family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005101{
Paul Mooredfaebe92008-10-10 10:16:31 -04005102 int err;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005103 char *addrp;
5104 u32 peer_sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04005105 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005106 struct lsm_network_audit net = {0,};
Paul Mooreeffad8d2008-01-29 08:49:27 -05005107 u8 secmark_active;
Paul Moore948bf852008-10-10 10:16:32 -04005108 u8 netlbl_active;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005109 u8 peerlbl_active;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005110
Paul Mooreeffad8d2008-01-29 08:49:27 -05005111 if (!selinux_policycap_netpeer)
5112 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005113
Paul Mooreeffad8d2008-01-29 08:49:27 -05005114 secmark_active = selinux_secmark_enabled();
Paul Moore948bf852008-10-10 10:16:32 -04005115 netlbl_active = netlbl_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04005116 peerlbl_active = selinux_peerlbl_enabled();
Paul Mooreeffad8d2008-01-29 08:49:27 -05005117 if (!secmark_active && !peerlbl_active)
5118 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005119
Paul Moored8395c82008-10-10 10:16:30 -04005120 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5121 return NF_DROP;
5122
Eric Paris50c205f2012-04-04 15:01:43 -04005123 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005124 ad.u.net = &net;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005125 ad.u.net->netif = indev->ifindex;
Eric Paris48c62af2012-04-02 13:15:44 -04005126 ad.u.net->family = family;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005127 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5128 return NF_DROP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005129
Paul Mooredfaebe92008-10-10 10:16:31 -04005130 if (peerlbl_active) {
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005131 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5132 addrp, family, peer_sid, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04005133 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04005134 selinux_netlbl_err(skb, family, err, 1);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005135 return NF_DROP;
Paul Mooredfaebe92008-10-10 10:16:31 -04005136 }
5137 }
Paul Mooreeffad8d2008-01-29 08:49:27 -05005138
5139 if (secmark_active)
5140 if (avc_has_perm(peer_sid, skb->secmark,
5141 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5142 return NF_DROP;
5143
Paul Moore948bf852008-10-10 10:16:32 -04005144 if (netlbl_active)
5145 /* we do this in the FORWARD path and not the POST_ROUTING
5146 * path because we want to make sure we apply the necessary
5147 * labeling before IPsec is applied so we can leverage AH
5148 * protection */
5149 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5150 return NF_DROP;
5151
Paul Mooreeffad8d2008-01-29 08:49:27 -05005152 return NF_ACCEPT;
5153}
5154
Eric W. Biederman06198b32015-09-18 14:33:06 -05005155static unsigned int selinux_ipv4_forward(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005156 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005157 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005158{
David S. Miller238e54c2015-04-03 20:32:56 -04005159 return selinux_ip_forward(skb, state->in, PF_INET);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005160}
5161
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005162#if IS_ENABLED(CONFIG_IPV6)
Eric W. Biederman06198b32015-09-18 14:33:06 -05005163static unsigned int selinux_ipv6_forward(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005164 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005165 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005166{
David S. Miller238e54c2015-04-03 20:32:56 -04005167 return selinux_ip_forward(skb, state->in, PF_INET6);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005168}
5169#endif /* IPV6 */
5170
Paul Moore948bf852008-10-10 10:16:32 -04005171static unsigned int selinux_ip_output(struct sk_buff *skb,
5172 u16 family)
5173{
Paul Moore47180062013-12-04 16:10:45 -05005174 struct sock *sk;
Paul Moore948bf852008-10-10 10:16:32 -04005175 u32 sid;
5176
5177 if (!netlbl_enabled())
5178 return NF_ACCEPT;
5179
5180 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5181 * because we want to make sure we apply the necessary labeling
5182 * before IPsec is applied so we can leverage AH protection */
Paul Moore47180062013-12-04 16:10:45 -05005183 sk = skb->sk;
5184 if (sk) {
5185 struct sk_security_struct *sksec;
5186
Eric Dumazete446f9d2015-10-08 05:01:55 -07005187 if (sk_listener(sk))
Paul Moore47180062013-12-04 16:10:45 -05005188 /* if the socket is the listening state then this
5189 * packet is a SYN-ACK packet which means it needs to
5190 * be labeled based on the connection/request_sock and
5191 * not the parent socket. unfortunately, we can't
5192 * lookup the request_sock yet as it isn't queued on
5193 * the parent socket until after the SYN-ACK is sent.
5194 * the "solution" is to simply pass the packet as-is
5195 * as any IP option based labeling should be copied
5196 * from the initial connection request (in the IP
5197 * layer). it is far from ideal, but until we get a
5198 * security label in the packet itself this is the
5199 * best we can do. */
5200 return NF_ACCEPT;
5201
5202 /* standard practice, label using the parent socket */
5203 sksec = sk->sk_security;
Paul Moore948bf852008-10-10 10:16:32 -04005204 sid = sksec->sid;
5205 } else
5206 sid = SECINITSID_KERNEL;
5207 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5208 return NF_DROP;
5209
5210 return NF_ACCEPT;
5211}
5212
Eric W. Biederman06198b32015-09-18 14:33:06 -05005213static unsigned int selinux_ipv4_output(void *priv,
Paul Moore948bf852008-10-10 10:16:32 -04005214 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005215 const struct nf_hook_state *state)
Paul Moore948bf852008-10-10 10:16:32 -04005216{
5217 return selinux_ip_output(skb, PF_INET);
5218}
5219
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005220#if IS_ENABLED(CONFIG_IPV6)
Huw Davies2917f572016-06-27 15:06:15 -04005221static unsigned int selinux_ipv6_output(void *priv,
5222 struct sk_buff *skb,
5223 const struct nf_hook_state *state)
5224{
5225 return selinux_ip_output(skb, PF_INET6);
5226}
5227#endif /* IPV6 */
5228
Paul Mooreeffad8d2008-01-29 08:49:27 -05005229static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5230 int ifindex,
Paul Moored8395c82008-10-10 10:16:30 -04005231 u16 family)
James Morris4e5ab4c2006-06-09 00:33:33 -07005232{
Eric Dumazet54abc682015-11-08 10:54:07 -08005233 struct sock *sk = skb_to_full_sk(skb);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005234 struct sk_security_struct *sksec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005235 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005236 struct lsm_network_audit net = {0,};
Paul Moored8395c82008-10-10 10:16:30 -04005237 char *addrp;
5238 u8 proto;
James Morris4e5ab4c2006-06-09 00:33:33 -07005239
Paul Mooreeffad8d2008-01-29 08:49:27 -05005240 if (sk == NULL)
5241 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005242 sksec = sk->sk_security;
James Morris4e5ab4c2006-06-09 00:33:33 -07005243
Eric Paris50c205f2012-04-04 15:01:43 -04005244 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005245 ad.u.net = &net;
5246 ad.u.net->netif = ifindex;
5247 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04005248 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5249 return NF_DROP;
5250
Paul Moore58bfbb52009-03-27 17:10:41 -04005251 if (selinux_secmark_enabled())
Paul Mooreeffad8d2008-01-29 08:49:27 -05005252 if (avc_has_perm(sksec->sid, skb->secmark,
Paul Moored8395c82008-10-10 10:16:30 -04005253 SECCLASS_PACKET, PACKET__SEND, &ad))
Eric Paris2fe66ec2010-11-23 06:28:08 +00005254 return NF_DROP_ERR(-ECONNREFUSED);
James Morris4e5ab4c2006-06-09 00:33:33 -07005255
Steffen Klassertb9679a72011-02-23 12:55:21 +01005256 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5257 return NF_DROP_ERR(-ECONNREFUSED);
James Morris4e5ab4c2006-06-09 00:33:33 -07005258
Paul Mooreeffad8d2008-01-29 08:49:27 -05005259 return NF_ACCEPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005260}
5261
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005262static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5263 const struct net_device *outdev,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005264 u16 family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005265{
Paul Mooreeffad8d2008-01-29 08:49:27 -05005266 u32 secmark_perm;
5267 u32 peer_sid;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005268 int ifindex = outdev->ifindex;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005269 struct sock *sk;
Thomas Liu2bf49692009-07-14 12:14:09 -04005270 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005271 struct lsm_network_audit net = {0,};
Paul Mooreeffad8d2008-01-29 08:49:27 -05005272 char *addrp;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005273 u8 secmark_active;
5274 u8 peerlbl_active;
5275
Paul Mooreeffad8d2008-01-29 08:49:27 -05005276 /* If any sort of compatibility mode is enabled then handoff processing
5277 * to the selinux_ip_postroute_compat() function to deal with the
5278 * special handling. We do this in an attempt to keep this function
5279 * as fast and as clean as possible. */
Paul Moore58bfbb52009-03-27 17:10:41 -04005280 if (!selinux_policycap_netpeer)
Paul Moored8395c82008-10-10 10:16:30 -04005281 return selinux_ip_postroute_compat(skb, ifindex, family);
Paul Moorec0828e52013-12-10 14:58:01 -05005282
Paul Mooreeffad8d2008-01-29 08:49:27 -05005283 secmark_active = selinux_secmark_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04005284 peerlbl_active = selinux_peerlbl_enabled();
Paul Mooreeffad8d2008-01-29 08:49:27 -05005285 if (!secmark_active && !peerlbl_active)
5286 return NF_ACCEPT;
5287
Eric Dumazet54abc682015-11-08 10:54:07 -08005288 sk = skb_to_full_sk(skb);
Paul Moorec0828e52013-12-10 14:58:01 -05005289
Paul Mooreeffad8d2008-01-29 08:49:27 -05005290#ifdef CONFIG_XFRM
5291 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5292 * packet transformation so allow the packet to pass without any checks
5293 * since we'll have another chance to perform access control checks
5294 * when the packet is on it's final way out.
5295 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
Paul Moorec0828e52013-12-10 14:58:01 -05005296 * is NULL, in this case go ahead and apply access control.
5297 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5298 * TCP listening state we cannot wait until the XFRM processing
5299 * is done as we will miss out on the SA label if we do;
5300 * unfortunately, this means more work, but it is only once per
5301 * connection. */
5302 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
Eric Dumazete446f9d2015-10-08 05:01:55 -07005303 !(sk && sk_listener(sk)))
Paul Mooreeffad8d2008-01-29 08:49:27 -05005304 return NF_ACCEPT;
5305#endif
Paul Mooreeffad8d2008-01-29 08:49:27 -05005306
Paul Moored8395c82008-10-10 10:16:30 -04005307 if (sk == NULL) {
Paul Moore446b8022013-12-04 16:10:51 -05005308 /* Without an associated socket the packet is either coming
5309 * from the kernel or it is being forwarded; check the packet
5310 * to determine which and if the packet is being forwarded
5311 * query the packet directly to determine the security label. */
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005312 if (skb->skb_iif) {
5313 secmark_perm = PACKET__FORWARD_OUT;
Paul Moored8395c82008-10-10 10:16:30 -04005314 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005315 return NF_DROP;
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005316 } else {
5317 secmark_perm = PACKET__SEND;
Paul Moored8395c82008-10-10 10:16:30 -04005318 peer_sid = SECINITSID_KERNEL;
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005319 }
Eric Dumazete446f9d2015-10-08 05:01:55 -07005320 } else if (sk_listener(sk)) {
Paul Moore446b8022013-12-04 16:10:51 -05005321 /* Locally generated packet but the associated socket is in the
5322 * listening state which means this is a SYN-ACK packet. In
5323 * this particular case the correct security label is assigned
5324 * to the connection/request_sock but unfortunately we can't
5325 * query the request_sock as it isn't queued on the parent
5326 * socket until after the SYN-ACK packet is sent; the only
5327 * viable choice is to regenerate the label like we do in
5328 * selinux_inet_conn_request(). See also selinux_ip_output()
5329 * for similar problems. */
5330 u32 skb_sid;
Eric Dumazete446f9d2015-10-08 05:01:55 -07005331 struct sk_security_struct *sksec;
5332
Eric Dumazete446f9d2015-10-08 05:01:55 -07005333 sksec = sk->sk_security;
Paul Moore446b8022013-12-04 16:10:51 -05005334 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5335 return NF_DROP;
Paul Moorec0828e52013-12-10 14:58:01 -05005336 /* At this point, if the returned skb peerlbl is SECSID_NULL
5337 * and the packet has been through at least one XFRM
5338 * transformation then we must be dealing with the "final"
5339 * form of labeled IPsec packet; since we've already applied
5340 * all of our access controls on this packet we can safely
5341 * pass the packet. */
5342 if (skb_sid == SECSID_NULL) {
5343 switch (family) {
5344 case PF_INET:
5345 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5346 return NF_ACCEPT;
5347 break;
5348 case PF_INET6:
5349 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5350 return NF_ACCEPT;
Paul Moorea7a91a12014-09-03 10:51:59 -04005351 break;
Paul Moorec0828e52013-12-10 14:58:01 -05005352 default:
5353 return NF_DROP_ERR(-ECONNREFUSED);
5354 }
5355 }
Paul Moore446b8022013-12-04 16:10:51 -05005356 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5357 return NF_DROP;
5358 secmark_perm = PACKET__SEND;
Paul Moored8395c82008-10-10 10:16:30 -04005359 } else {
Paul Moore446b8022013-12-04 16:10:51 -05005360 /* Locally generated packet, fetch the security label from the
5361 * associated socket. */
Paul Mooreeffad8d2008-01-29 08:49:27 -05005362 struct sk_security_struct *sksec = sk->sk_security;
5363 peer_sid = sksec->sid;
5364 secmark_perm = PACKET__SEND;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005365 }
5366
Eric Paris50c205f2012-04-04 15:01:43 -04005367 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005368 ad.u.net = &net;
5369 ad.u.net->netif = ifindex;
5370 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04005371 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
Eric Paris04f6d702010-11-23 06:28:02 +00005372 return NF_DROP;
Paul Moored8395c82008-10-10 10:16:30 -04005373
Paul Mooreeffad8d2008-01-29 08:49:27 -05005374 if (secmark_active)
5375 if (avc_has_perm(peer_sid, skb->secmark,
5376 SECCLASS_PACKET, secmark_perm, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005377 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005378
5379 if (peerlbl_active) {
5380 u32 if_sid;
5381 u32 node_sid;
5382
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005383 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005384 return NF_DROP;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005385 if (avc_has_perm(peer_sid, if_sid,
5386 SECCLASS_NETIF, NETIF__EGRESS, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005387 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005388
5389 if (sel_netnode_sid(addrp, family, &node_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005390 return NF_DROP;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005391 if (avc_has_perm(peer_sid, node_sid,
5392 SECCLASS_NODE, NODE__SENDTO, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005393 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005394 }
5395
5396 return NF_ACCEPT;
5397}
5398
Eric W. Biederman06198b32015-09-18 14:33:06 -05005399static unsigned int selinux_ipv4_postroute(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005400 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005401 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005402{
David S. Miller238e54c2015-04-03 20:32:56 -04005403 return selinux_ip_postroute(skb, state->out, PF_INET);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005404}
5405
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005406#if IS_ENABLED(CONFIG_IPV6)
Eric W. Biederman06198b32015-09-18 14:33:06 -05005407static unsigned int selinux_ipv6_postroute(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005408 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005409 const struct nf_hook_state *state)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005410{
David S. Miller238e54c2015-04-03 20:32:56 -04005411 return selinux_ip_postroute(skb, state->out, PF_INET6);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005412}
Linus Torvalds1da177e2005-04-16 15:20:36 -07005413#endif /* IPV6 */
5414
5415#endif /* CONFIG_NETFILTER */
5416
Linus Torvalds1da177e2005-04-16 15:20:36 -07005417static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5418{
Stephen Smalley941fc5b2009-10-01 14:48:23 -04005419 return selinux_nlmsg_perm(sk, skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005420}
5421
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005422static int ipc_alloc_security(struct kern_ipc_perm *perm,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005423 u16 sclass)
5424{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005425 struct ipc_security_struct *isec;
5426
James Morris89d155e2005-10-30 14:59:21 -08005427 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005428 if (!isec)
5429 return -ENOMEM;
5430
Linus Torvalds1da177e2005-04-16 15:20:36 -07005431 isec->sclass = sclass;
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005432 isec->sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005433 perm->security = isec;
5434
5435 return 0;
5436}
5437
5438static void ipc_free_security(struct kern_ipc_perm *perm)
5439{
5440 struct ipc_security_struct *isec = perm->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005441 perm->security = NULL;
5442 kfree(isec);
5443}
5444
5445static int msg_msg_alloc_security(struct msg_msg *msg)
5446{
5447 struct msg_security_struct *msec;
5448
James Morris89d155e2005-10-30 14:59:21 -08005449 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005450 if (!msec)
5451 return -ENOMEM;
5452
Linus Torvalds1da177e2005-04-16 15:20:36 -07005453 msec->sid = SECINITSID_UNLABELED;
5454 msg->security = msec;
5455
5456 return 0;
5457}
5458
5459static void msg_msg_free_security(struct msg_msg *msg)
5460{
5461 struct msg_security_struct *msec = msg->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005462
5463 msg->security = NULL;
5464 kfree(msec);
5465}
5466
5467static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
Stephen Smalley6af963f2005-05-01 08:58:39 -07005468 u32 perms)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005469{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005470 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005471 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005472 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005473
Linus Torvalds1da177e2005-04-16 15:20:36 -07005474 isec = ipc_perms->security;
5475
Eric Paris50c205f2012-04-04 15:01:43 -04005476 ad.type = LSM_AUDIT_DATA_IPC;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005477 ad.u.ipc_id = ipc_perms->key;
5478
David Howells275bb412008-11-14 10:39:19 +11005479 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005480}
5481
5482static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5483{
5484 return msg_msg_alloc_security(msg);
5485}
5486
5487static void selinux_msg_msg_free_security(struct msg_msg *msg)
5488{
5489 msg_msg_free_security(msg);
5490}
5491
5492/* message queue security operations */
5493static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5494{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005495 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005496 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005497 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005498 int rc;
5499
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005500 rc = ipc_alloc_security(&msq->q_perm, SECCLASS_MSGQ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005501 if (rc)
5502 return rc;
5503
Linus Torvalds1da177e2005-04-16 15:20:36 -07005504 isec = msq->q_perm.security;
5505
Eric Paris50c205f2012-04-04 15:01:43 -04005506 ad.type = LSM_AUDIT_DATA_IPC;
Eric Paris828dfe12008-04-17 13:17:49 -04005507 ad.u.ipc_id = msq->q_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005508
David Howells275bb412008-11-14 10:39:19 +11005509 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005510 MSGQ__CREATE, &ad);
5511 if (rc) {
5512 ipc_free_security(&msq->q_perm);
5513 return rc;
5514 }
5515 return 0;
5516}
5517
5518static void selinux_msg_queue_free_security(struct msg_queue *msq)
5519{
5520 ipc_free_security(&msq->q_perm);
5521}
5522
5523static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5524{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005525 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005526 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005527 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005528
Linus Torvalds1da177e2005-04-16 15:20:36 -07005529 isec = msq->q_perm.security;
5530
Eric Paris50c205f2012-04-04 15:01:43 -04005531 ad.type = LSM_AUDIT_DATA_IPC;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005532 ad.u.ipc_id = msq->q_perm.key;
5533
David Howells275bb412008-11-14 10:39:19 +11005534 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005535 MSGQ__ASSOCIATE, &ad);
5536}
5537
5538static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5539{
5540 int err;
5541 int perms;
5542
Eric Paris828dfe12008-04-17 13:17:49 -04005543 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005544 case IPC_INFO:
5545 case MSG_INFO:
5546 /* No specific object, just general system-wide information. */
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005547 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5548 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005549 case IPC_STAT:
5550 case MSG_STAT:
5551 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5552 break;
5553 case IPC_SET:
5554 perms = MSGQ__SETATTR;
5555 break;
5556 case IPC_RMID:
5557 perms = MSGQ__DESTROY;
5558 break;
5559 default:
5560 return 0;
5561 }
5562
Stephen Smalley6af963f2005-05-01 08:58:39 -07005563 err = ipc_has_perm(&msq->q_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005564 return err;
5565}
5566
5567static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5568{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005569 struct ipc_security_struct *isec;
5570 struct msg_security_struct *msec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005571 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005572 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005573 int rc;
5574
Linus Torvalds1da177e2005-04-16 15:20:36 -07005575 isec = msq->q_perm.security;
5576 msec = msg->security;
5577
5578 /*
5579 * First time through, need to assign label to the message
5580 */
5581 if (msec->sid == SECINITSID_UNLABELED) {
5582 /*
5583 * Compute new sid based on current process and
5584 * message queue this message will be stored in
5585 */
David Howells275bb412008-11-14 10:39:19 +11005586 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
Eric Paris652bb9b2011-02-01 11:05:40 -05005587 NULL, &msec->sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005588 if (rc)
5589 return rc;
5590 }
5591
Eric Paris50c205f2012-04-04 15:01:43 -04005592 ad.type = LSM_AUDIT_DATA_IPC;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005593 ad.u.ipc_id = msq->q_perm.key;
5594
5595 /* Can this process write to the queue? */
David Howells275bb412008-11-14 10:39:19 +11005596 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005597 MSGQ__WRITE, &ad);
5598 if (!rc)
5599 /* Can this process send the message */
David Howells275bb412008-11-14 10:39:19 +11005600 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5601 MSG__SEND, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005602 if (!rc)
5603 /* Can the message be put in the queue? */
David Howells275bb412008-11-14 10:39:19 +11005604 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5605 MSGQ__ENQUEUE, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005606
5607 return rc;
5608}
5609
5610static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5611 struct task_struct *target,
5612 long type, int mode)
5613{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005614 struct ipc_security_struct *isec;
5615 struct msg_security_struct *msec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005616 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005617 u32 sid = task_sid(target);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005618 int rc;
5619
Linus Torvalds1da177e2005-04-16 15:20:36 -07005620 isec = msq->q_perm.security;
5621 msec = msg->security;
5622
Eric Paris50c205f2012-04-04 15:01:43 -04005623 ad.type = LSM_AUDIT_DATA_IPC;
Eric Paris828dfe12008-04-17 13:17:49 -04005624 ad.u.ipc_id = msq->q_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005625
David Howells275bb412008-11-14 10:39:19 +11005626 rc = avc_has_perm(sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005627 SECCLASS_MSGQ, MSGQ__READ, &ad);
5628 if (!rc)
David Howells275bb412008-11-14 10:39:19 +11005629 rc = avc_has_perm(sid, msec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005630 SECCLASS_MSG, MSG__RECEIVE, &ad);
5631 return rc;
5632}
5633
5634/* Shared Memory security operations */
5635static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5636{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005637 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005638 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005639 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005640 int rc;
5641
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005642 rc = ipc_alloc_security(&shp->shm_perm, SECCLASS_SHM);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005643 if (rc)
5644 return rc;
5645
Linus Torvalds1da177e2005-04-16 15:20:36 -07005646 isec = shp->shm_perm.security;
5647
Eric Paris50c205f2012-04-04 15:01:43 -04005648 ad.type = LSM_AUDIT_DATA_IPC;
Eric Paris828dfe12008-04-17 13:17:49 -04005649 ad.u.ipc_id = shp->shm_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005650
David Howells275bb412008-11-14 10:39:19 +11005651 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005652 SHM__CREATE, &ad);
5653 if (rc) {
5654 ipc_free_security(&shp->shm_perm);
5655 return rc;
5656 }
5657 return 0;
5658}
5659
5660static void selinux_shm_free_security(struct shmid_kernel *shp)
5661{
5662 ipc_free_security(&shp->shm_perm);
5663}
5664
5665static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5666{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005667 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005668 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005669 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005670
Linus Torvalds1da177e2005-04-16 15:20:36 -07005671 isec = shp->shm_perm.security;
5672
Eric Paris50c205f2012-04-04 15:01:43 -04005673 ad.type = LSM_AUDIT_DATA_IPC;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005674 ad.u.ipc_id = shp->shm_perm.key;
5675
David Howells275bb412008-11-14 10:39:19 +11005676 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005677 SHM__ASSOCIATE, &ad);
5678}
5679
5680/* Note, at this point, shp is locked down */
5681static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5682{
5683 int perms;
5684 int err;
5685
Eric Paris828dfe12008-04-17 13:17:49 -04005686 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005687 case IPC_INFO:
5688 case SHM_INFO:
5689 /* No specific object, just general system-wide information. */
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005690 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5691 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005692 case IPC_STAT:
5693 case SHM_STAT:
5694 perms = SHM__GETATTR | SHM__ASSOCIATE;
5695 break;
5696 case IPC_SET:
5697 perms = SHM__SETATTR;
5698 break;
5699 case SHM_LOCK:
5700 case SHM_UNLOCK:
5701 perms = SHM__LOCK;
5702 break;
5703 case IPC_RMID:
5704 perms = SHM__DESTROY;
5705 break;
5706 default:
5707 return 0;
5708 }
5709
Stephen Smalley6af963f2005-05-01 08:58:39 -07005710 err = ipc_has_perm(&shp->shm_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005711 return err;
5712}
5713
5714static int selinux_shm_shmat(struct shmid_kernel *shp,
5715 char __user *shmaddr, int shmflg)
5716{
5717 u32 perms;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005718
5719 if (shmflg & SHM_RDONLY)
5720 perms = SHM__READ;
5721 else
5722 perms = SHM__READ | SHM__WRITE;
5723
Stephen Smalley6af963f2005-05-01 08:58:39 -07005724 return ipc_has_perm(&shp->shm_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005725}
5726
5727/* Semaphore security operations */
5728static int selinux_sem_alloc_security(struct sem_array *sma)
5729{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005730 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005731 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005732 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005733 int rc;
5734
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005735 rc = ipc_alloc_security(&sma->sem_perm, SECCLASS_SEM);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005736 if (rc)
5737 return rc;
5738
Linus Torvalds1da177e2005-04-16 15:20:36 -07005739 isec = sma->sem_perm.security;
5740
Eric Paris50c205f2012-04-04 15:01:43 -04005741 ad.type = LSM_AUDIT_DATA_IPC;
Eric Paris828dfe12008-04-17 13:17:49 -04005742 ad.u.ipc_id = sma->sem_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005743
David Howells275bb412008-11-14 10:39:19 +11005744 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005745 SEM__CREATE, &ad);
5746 if (rc) {
5747 ipc_free_security(&sma->sem_perm);
5748 return rc;
5749 }
5750 return 0;
5751}
5752
5753static void selinux_sem_free_security(struct sem_array *sma)
5754{
5755 ipc_free_security(&sma->sem_perm);
5756}
5757
5758static int selinux_sem_associate(struct sem_array *sma, int semflg)
5759{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005760 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005761 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005762 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005763
Linus Torvalds1da177e2005-04-16 15:20:36 -07005764 isec = sma->sem_perm.security;
5765
Eric Paris50c205f2012-04-04 15:01:43 -04005766 ad.type = LSM_AUDIT_DATA_IPC;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005767 ad.u.ipc_id = sma->sem_perm.key;
5768
David Howells275bb412008-11-14 10:39:19 +11005769 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005770 SEM__ASSOCIATE, &ad);
5771}
5772
5773/* Note, at this point, sma is locked down */
5774static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5775{
5776 int err;
5777 u32 perms;
5778
Eric Paris828dfe12008-04-17 13:17:49 -04005779 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005780 case IPC_INFO:
5781 case SEM_INFO:
5782 /* No specific object, just general system-wide information. */
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005783 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5784 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005785 case GETPID:
5786 case GETNCNT:
5787 case GETZCNT:
5788 perms = SEM__GETATTR;
5789 break;
5790 case GETVAL:
5791 case GETALL:
5792 perms = SEM__READ;
5793 break;
5794 case SETVAL:
5795 case SETALL:
5796 perms = SEM__WRITE;
5797 break;
5798 case IPC_RMID:
5799 perms = SEM__DESTROY;
5800 break;
5801 case IPC_SET:
5802 perms = SEM__SETATTR;
5803 break;
5804 case IPC_STAT:
5805 case SEM_STAT:
5806 perms = SEM__GETATTR | SEM__ASSOCIATE;
5807 break;
5808 default:
5809 return 0;
5810 }
5811
Stephen Smalley6af963f2005-05-01 08:58:39 -07005812 err = ipc_has_perm(&sma->sem_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005813 return err;
5814}
5815
5816static int selinux_sem_semop(struct sem_array *sma,
5817 struct sembuf *sops, unsigned nsops, int alter)
5818{
5819 u32 perms;
5820
5821 if (alter)
5822 perms = SEM__READ | SEM__WRITE;
5823 else
5824 perms = SEM__READ;
5825
Stephen Smalley6af963f2005-05-01 08:58:39 -07005826 return ipc_has_perm(&sma->sem_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005827}
5828
5829static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5830{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005831 u32 av = 0;
5832
Linus Torvalds1da177e2005-04-16 15:20:36 -07005833 av = 0;
5834 if (flag & S_IRUGO)
5835 av |= IPC__UNIX_READ;
5836 if (flag & S_IWUGO)
5837 av |= IPC__UNIX_WRITE;
5838
5839 if (av == 0)
5840 return 0;
5841
Stephen Smalley6af963f2005-05-01 08:58:39 -07005842 return ipc_has_perm(ipcp, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005843}
5844
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02005845static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5846{
5847 struct ipc_security_struct *isec = ipcp->security;
5848 *secid = isec->sid;
5849}
5850
Eric Paris828dfe12008-04-17 13:17:49 -04005851static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005852{
5853 if (inode)
5854 inode_doinit_with_dentry(inode, dentry);
5855}
5856
5857static int selinux_getprocattr(struct task_struct *p,
Al Viro04ff9702007-03-12 16:17:58 +00005858 char *name, char **value)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005859{
David Howells275bb412008-11-14 10:39:19 +11005860 const struct task_security_struct *__tsec;
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00005861 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005862 int error;
Al Viro04ff9702007-03-12 16:17:58 +00005863 unsigned len;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005864
David Howells275bb412008-11-14 10:39:19 +11005865 rcu_read_lock();
5866 __tsec = __task_cred(p)->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005867
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005868 if (current != p) {
5869 error = avc_has_perm(current_sid(), __tsec->sid,
5870 SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
5871 if (error)
5872 goto bad;
5873 }
5874
Linus Torvalds1da177e2005-04-16 15:20:36 -07005875 if (!strcmp(name, "current"))
David Howells275bb412008-11-14 10:39:19 +11005876 sid = __tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005877 else if (!strcmp(name, "prev"))
David Howells275bb412008-11-14 10:39:19 +11005878 sid = __tsec->osid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005879 else if (!strcmp(name, "exec"))
David Howells275bb412008-11-14 10:39:19 +11005880 sid = __tsec->exec_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005881 else if (!strcmp(name, "fscreate"))
David Howells275bb412008-11-14 10:39:19 +11005882 sid = __tsec->create_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07005883 else if (!strcmp(name, "keycreate"))
David Howells275bb412008-11-14 10:39:19 +11005884 sid = __tsec->keycreate_sid;
Eric Paris42c3e032006-06-26 00:26:03 -07005885 else if (!strcmp(name, "sockcreate"))
David Howells275bb412008-11-14 10:39:19 +11005886 sid = __tsec->sockcreate_sid;
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005887 else {
5888 error = -EINVAL;
5889 goto bad;
5890 }
David Howells275bb412008-11-14 10:39:19 +11005891 rcu_read_unlock();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005892
5893 if (!sid)
5894 return 0;
5895
Al Viro04ff9702007-03-12 16:17:58 +00005896 error = security_sid_to_context(sid, value, &len);
5897 if (error)
5898 return error;
5899 return len;
David Howells275bb412008-11-14 10:39:19 +11005900
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005901bad:
David Howells275bb412008-11-14 10:39:19 +11005902 rcu_read_unlock();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005903 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005904}
5905
Stephen Smalleyb21507e2017-01-09 10:07:31 -05005906static int selinux_setprocattr(const char *name, void *value, size_t size)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005907{
5908 struct task_security_struct *tsec;
David Howellsd84f4f92008-11-14 10:39:23 +11005909 struct cred *new;
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005910 u32 mysid = current_sid(), sid = 0, ptsid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005911 int error;
5912 char *str = value;
5913
Linus Torvalds1da177e2005-04-16 15:20:36 -07005914 /*
5915 * Basic control over ability to set these attributes at all.
Linus Torvalds1da177e2005-04-16 15:20:36 -07005916 */
5917 if (!strcmp(name, "exec"))
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005918 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5919 PROCESS__SETEXEC, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005920 else if (!strcmp(name, "fscreate"))
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005921 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5922 PROCESS__SETFSCREATE, NULL);
Michael LeMay4eb582c2006-06-26 00:24:57 -07005923 else if (!strcmp(name, "keycreate"))
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005924 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5925 PROCESS__SETKEYCREATE, NULL);
Eric Paris42c3e032006-06-26 00:26:03 -07005926 else if (!strcmp(name, "sockcreate"))
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005927 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5928 PROCESS__SETSOCKCREATE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005929 else if (!strcmp(name, "current"))
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005930 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5931 PROCESS__SETCURRENT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005932 else
5933 error = -EINVAL;
5934 if (error)
5935 return error;
5936
5937 /* Obtain a SID for the context, if one was specified. */
Stephen Smalleya050a572017-01-31 11:54:04 -05005938 if (size && str[0] && str[0] != '\n') {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005939 if (str[size-1] == '\n') {
5940 str[size-1] = 0;
5941 size--;
5942 }
Nikolay Aleksandrov52a4c642014-03-07 12:44:19 +01005943 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
Stephen Smalley12b29f32008-05-07 13:03:20 -04005944 if (error == -EINVAL && !strcmp(name, "fscreate")) {
Stephen Smalleydb590002017-04-20 11:31:30 -04005945 if (!has_cap_mac_admin(true)) {
Eric Parisd6ea83e2012-04-04 13:45:49 -04005946 struct audit_buffer *ab;
5947 size_t audit_size;
5948
5949 /* We strip a nul only if it is at the end, otherwise the
5950 * context contains a nul and we should audit that */
5951 if (str[size - 1] == '\0')
5952 audit_size = size - 1;
5953 else
5954 audit_size = size;
5955 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5956 audit_log_format(ab, "op=fscreate invalid_context=");
5957 audit_log_n_untrustedstring(ab, value, audit_size);
5958 audit_log_end(ab);
5959
Stephen Smalley12b29f32008-05-07 13:03:20 -04005960 return error;
Eric Parisd6ea83e2012-04-04 13:45:49 -04005961 }
Stephen Smalley12b29f32008-05-07 13:03:20 -04005962 error = security_context_to_sid_force(value, size,
5963 &sid);
5964 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07005965 if (error)
5966 return error;
5967 }
5968
David Howellsd84f4f92008-11-14 10:39:23 +11005969 new = prepare_creds();
5970 if (!new)
5971 return -ENOMEM;
5972
Linus Torvalds1da177e2005-04-16 15:20:36 -07005973 /* Permission checking based on the specified context is
5974 performed during the actual operation (execve,
5975 open/mkdir/...), when we know the full context of the
David Howellsd84f4f92008-11-14 10:39:23 +11005976 operation. See selinux_bprm_set_creds for the execve
Linus Torvalds1da177e2005-04-16 15:20:36 -07005977 checks and may_create for the file creation checks. The
5978 operation will then fail if the context is not permitted. */
David Howellsd84f4f92008-11-14 10:39:23 +11005979 tsec = new->security;
5980 if (!strcmp(name, "exec")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005981 tsec->exec_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11005982 } else if (!strcmp(name, "fscreate")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005983 tsec->create_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11005984 } else if (!strcmp(name, "keycreate")) {
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005985 error = avc_has_perm(mysid, sid, SECCLASS_KEY, KEY__CREATE,
5986 NULL);
Michael LeMay4eb582c2006-06-26 00:24:57 -07005987 if (error)
David Howellsd84f4f92008-11-14 10:39:23 +11005988 goto abort_change;
Michael LeMay4eb582c2006-06-26 00:24:57 -07005989 tsec->keycreate_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11005990 } else if (!strcmp(name, "sockcreate")) {
Eric Paris42c3e032006-06-26 00:26:03 -07005991 tsec->sockcreate_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11005992 } else if (!strcmp(name, "current")) {
5993 error = -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005994 if (sid == 0)
David Howellsd84f4f92008-11-14 10:39:23 +11005995 goto abort_change;
KaiGai Koheid9250de2008-08-28 16:35:57 +09005996
David Howellsd84f4f92008-11-14 10:39:23 +11005997 /* Only allow single threaded processes to change context */
5998 error = -EPERM;
Oleg Nesterov5bb459b2009-07-10 03:48:23 +02005999 if (!current_is_single_threaded()) {
David Howellsd84f4f92008-11-14 10:39:23 +11006000 error = security_bounded_transition(tsec->sid, sid);
6001 if (error)
6002 goto abort_change;
Eric Paris828dfe12008-04-17 13:17:49 -04006003 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07006004
6005 /* Check permissions for the transition. */
6006 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
Eric Paris828dfe12008-04-17 13:17:49 -04006007 PROCESS__DYNTRANSITION, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006008 if (error)
David Howellsd84f4f92008-11-14 10:39:23 +11006009 goto abort_change;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006010
6011 /* Check for ptracing, and update the task SID if ok.
6012 Otherwise, leave SID unchanged and fail. */
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006013 ptsid = ptrace_parent_sid();
Paul Moore0c6181c2016-03-30 21:41:21 -04006014 if (ptsid != 0) {
David Howellsd84f4f92008-11-14 10:39:23 +11006015 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
6016 PROCESS__PTRACE, NULL);
6017 if (error)
6018 goto abort_change;
6019 }
6020
6021 tsec->sid = sid;
6022 } else {
6023 error = -EINVAL;
6024 goto abort_change;
6025 }
6026
6027 commit_creds(new);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006028 return size;
David Howellsd84f4f92008-11-14 10:39:23 +11006029
6030abort_change:
6031 abort_creds(new);
6032 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006033}
6034
David Quigley746df9b2013-05-22 12:50:35 -04006035static int selinux_ismaclabel(const char *name)
6036{
6037 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6038}
6039
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006040static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6041{
6042 return security_sid_to_context(secid, secdata, seclen);
6043}
6044
David Howells7bf570d2008-04-29 20:52:51 +01006045static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
David Howells63cb3442008-01-15 23:47:35 +00006046{
Nikolay Aleksandrov52a4c642014-03-07 12:44:19 +01006047 return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
David Howells63cb3442008-01-15 23:47:35 +00006048}
6049
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006050static void selinux_release_secctx(char *secdata, u32 seclen)
6051{
Paul Moore088999e2007-08-01 11:12:58 -04006052 kfree(secdata);
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006053}
6054
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006055static void selinux_inode_invalidate_secctx(struct inode *inode)
6056{
6057 struct inode_security_struct *isec = inode->i_security;
6058
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01006059 spin_lock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006060 isec->initialized = LABEL_INVALID;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01006061 spin_unlock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006062}
6063
David P. Quigley1ee65e32009-09-03 14:25:57 -04006064/*
6065 * called with inode->i_mutex locked
6066 */
6067static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6068{
6069 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
6070}
6071
6072/*
6073 * called with inode->i_mutex locked
6074 */
6075static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6076{
6077 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6078}
6079
6080static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6081{
6082 int len = 0;
6083 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6084 ctx, true);
6085 if (len < 0)
6086 return len;
6087 *ctxlen = len;
6088 return 0;
6089}
Michael LeMayd7200242006-06-22 14:47:17 -07006090#ifdef CONFIG_KEYS
6091
David Howellsd84f4f92008-11-14 10:39:23 +11006092static int selinux_key_alloc(struct key *k, const struct cred *cred,
David Howells7e047ef2006-06-26 00:24:50 -07006093 unsigned long flags)
Michael LeMayd7200242006-06-22 14:47:17 -07006094{
David Howellsd84f4f92008-11-14 10:39:23 +11006095 const struct task_security_struct *tsec;
Michael LeMayd7200242006-06-22 14:47:17 -07006096 struct key_security_struct *ksec;
6097
6098 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6099 if (!ksec)
6100 return -ENOMEM;
6101
David Howellsd84f4f92008-11-14 10:39:23 +11006102 tsec = cred->security;
6103 if (tsec->keycreate_sid)
6104 ksec->sid = tsec->keycreate_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07006105 else
David Howellsd84f4f92008-11-14 10:39:23 +11006106 ksec->sid = tsec->sid;
Michael LeMayd7200242006-06-22 14:47:17 -07006107
David Howells275bb412008-11-14 10:39:19 +11006108 k->security = ksec;
Michael LeMayd7200242006-06-22 14:47:17 -07006109 return 0;
6110}
6111
6112static void selinux_key_free(struct key *k)
6113{
6114 struct key_security_struct *ksec = k->security;
6115
6116 k->security = NULL;
6117 kfree(ksec);
6118}
6119
6120static int selinux_key_permission(key_ref_t key_ref,
David Howellsd84f4f92008-11-14 10:39:23 +11006121 const struct cred *cred,
David Howellsf5895942014-03-14 17:44:49 +00006122 unsigned perm)
Michael LeMayd7200242006-06-22 14:47:17 -07006123{
6124 struct key *key;
Michael LeMayd7200242006-06-22 14:47:17 -07006125 struct key_security_struct *ksec;
David Howells275bb412008-11-14 10:39:19 +11006126 u32 sid;
Michael LeMayd7200242006-06-22 14:47:17 -07006127
6128 /* if no specific permissions are requested, we skip the
6129 permission check. No serious, additional covert channels
6130 appear to be created. */
6131 if (perm == 0)
6132 return 0;
6133
David Howellsd84f4f92008-11-14 10:39:23 +11006134 sid = cred_sid(cred);
David Howells275bb412008-11-14 10:39:19 +11006135
6136 key = key_ref_to_ptr(key_ref);
6137 ksec = key->security;
6138
6139 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
Michael LeMayd7200242006-06-22 14:47:17 -07006140}
6141
David Howells70a5bb72008-04-29 01:01:26 -07006142static int selinux_key_getsecurity(struct key *key, char **_buffer)
6143{
6144 struct key_security_struct *ksec = key->security;
6145 char *context = NULL;
6146 unsigned len;
6147 int rc;
6148
6149 rc = security_sid_to_context(ksec->sid, &context, &len);
6150 if (!rc)
6151 rc = len;
6152 *_buffer = context;
6153 return rc;
6154}
6155
Michael LeMayd7200242006-06-22 14:47:17 -07006156#endif
6157
James Morrisca97d932017-02-15 00:18:51 +11006158static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
Casey Schauflere20b0432015-05-02 15:11:36 -07006159 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6160 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6161 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6162 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02006163
Casey Schauflere20b0432015-05-02 15:11:36 -07006164 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6165 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6166 LSM_HOOK_INIT(capget, selinux_capget),
6167 LSM_HOOK_INIT(capset, selinux_capset),
6168 LSM_HOOK_INIT(capable, selinux_capable),
6169 LSM_HOOK_INIT(quotactl, selinux_quotactl),
6170 LSM_HOOK_INIT(quota_on, selinux_quota_on),
6171 LSM_HOOK_INIT(syslog, selinux_syslog),
6172 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
Stephen Smalley79af7302015-01-21 10:54:10 -05006173
Casey Schauflere20b0432015-05-02 15:11:36 -07006174 LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006175
Casey Schauflere20b0432015-05-02 15:11:36 -07006176 LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6177 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6178 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6179 LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006180
Casey Schauflere20b0432015-05-02 15:11:36 -07006181 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6182 LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6183 LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
6184 LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6185 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6186 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6187 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6188 LSM_HOOK_INIT(sb_mount, selinux_mount),
6189 LSM_HOOK_INIT(sb_umount, selinux_umount),
6190 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6191 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6192 LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006193
Casey Schauflere20b0432015-05-02 15:11:36 -07006194 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
Vivek Goyala518b0a2016-07-13 10:44:53 -04006195 LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
Eric Parise0007522008-03-05 10:31:54 -05006196
Casey Schauflere20b0432015-05-02 15:11:36 -07006197 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6198 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6199 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6200 LSM_HOOK_INIT(inode_create, selinux_inode_create),
6201 LSM_HOOK_INIT(inode_link, selinux_inode_link),
6202 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6203 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6204 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6205 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6206 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6207 LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6208 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6209 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6210 LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6211 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6212 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6213 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6214 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6215 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6216 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6217 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6218 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6219 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6220 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6221 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
Vivek Goyal56909eb2016-07-13 10:44:48 -04006222 LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
Vivek Goyal19472b62016-07-13 10:44:50 -04006223 LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006224
Casey Schauflere20b0432015-05-02 15:11:36 -07006225 LSM_HOOK_INIT(file_permission, selinux_file_permission),
6226 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6227 LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
6228 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6229 LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6230 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6231 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6232 LSM_HOOK_INIT(file_lock, selinux_file_lock),
6233 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6234 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6235 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6236 LSM_HOOK_INIT(file_receive, selinux_file_receive),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006237
Casey Schauflere20b0432015-05-02 15:11:36 -07006238 LSM_HOOK_INIT(file_open, selinux_file_open),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006239
Tetsuo Handaa79be232017-03-28 23:08:45 +09006240 LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
Casey Schauflere20b0432015-05-02 15:11:36 -07006241 LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
6242 LSM_HOOK_INIT(cred_free, selinux_cred_free),
6243 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6244 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6245 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6246 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6247 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07006248 LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
Casey Schauflere20b0432015-05-02 15:11:36 -07006249 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6250 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6251 LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6252 LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6253 LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6254 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6255 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
Stephen Smalley791ec492017-02-17 07:57:00 -05006256 LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
Casey Schauflere20b0432015-05-02 15:11:36 -07006257 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6258 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6259 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6260 LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6261 LSM_HOOK_INIT(task_kill, selinux_task_kill),
Casey Schauflere20b0432015-05-02 15:11:36 -07006262 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09006263
Casey Schauflere20b0432015-05-02 15:11:36 -07006264 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6265 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006266
Casey Schauflere20b0432015-05-02 15:11:36 -07006267 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6268 LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006269
Casey Schauflere20b0432015-05-02 15:11:36 -07006270 LSM_HOOK_INIT(msg_queue_alloc_security,
6271 selinux_msg_queue_alloc_security),
6272 LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6273 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6274 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6275 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6276 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006277
Casey Schauflere20b0432015-05-02 15:11:36 -07006278 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6279 LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6280 LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6281 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6282 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006283
Casey Schauflere20b0432015-05-02 15:11:36 -07006284 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6285 LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6286 LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6287 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6288 LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006289
Casey Schauflere20b0432015-05-02 15:11:36 -07006290 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006291
Casey Schauflere20b0432015-05-02 15:11:36 -07006292 LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6293 LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006294
Casey Schauflere20b0432015-05-02 15:11:36 -07006295 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6296 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6297 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6298 LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006299 LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
Casey Schauflere20b0432015-05-02 15:11:36 -07006300 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6301 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6302 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006303
Casey Schauflere20b0432015-05-02 15:11:36 -07006304 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6305 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006306
Casey Schauflere20b0432015-05-02 15:11:36 -07006307 LSM_HOOK_INIT(socket_create, selinux_socket_create),
6308 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6309 LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6310 LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6311 LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6312 LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6313 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6314 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6315 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6316 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6317 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6318 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6319 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6320 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6321 LSM_HOOK_INIT(socket_getpeersec_stream,
6322 selinux_socket_getpeersec_stream),
6323 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6324 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6325 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6326 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6327 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6328 LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6329 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6330 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6331 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6332 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6333 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6334 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6335 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6336 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6337 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6338 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6339 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6340 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6341 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
Trent Jaegerd28d1e02005-12-13 23:12:40 -08006342
6343#ifdef CONFIG_SECURITY_NETWORK_XFRM
Casey Schauflere20b0432015-05-02 15:11:36 -07006344 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6345 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6346 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6347 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6348 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6349 LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6350 selinux_xfrm_state_alloc_acquire),
6351 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6352 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6353 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6354 LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6355 selinux_xfrm_state_pol_flow_match),
6356 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006357#endif
Michael LeMayd7200242006-06-22 14:47:17 -07006358
6359#ifdef CONFIG_KEYS
Casey Schauflere20b0432015-05-02 15:11:36 -07006360 LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6361 LSM_HOOK_INIT(key_free, selinux_key_free),
6362 LSM_HOOK_INIT(key_permission, selinux_key_permission),
6363 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
Michael LeMayd7200242006-06-22 14:47:17 -07006364#endif
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +02006365
6366#ifdef CONFIG_AUDIT
Casey Schauflere20b0432015-05-02 15:11:36 -07006367 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6368 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6369 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6370 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +02006371#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07006372};
6373
6374static __init int selinux_init(void)
6375{
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07006376 if (!security_module_enable("selinux")) {
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02006377 selinux_enabled = 0;
6378 return 0;
6379 }
6380
Linus Torvalds1da177e2005-04-16 15:20:36 -07006381 if (!selinux_enabled) {
6382 printk(KERN_INFO "SELinux: Disabled at boot.\n");
6383 return 0;
6384 }
6385
6386 printk(KERN_INFO "SELinux: Initializing.\n");
6387
6388 /* Set the security state for the initial task. */
David Howellsd84f4f92008-11-14 10:39:23 +11006389 cred_init_security();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006390
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04006391 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6392
James Morris7cae7e22006-03-22 00:09:22 -08006393 sel_inode_cache = kmem_cache_create("selinux_inode_security",
6394 sizeof(struct inode_security_struct),
Paul Mundt20c2df82007-07-20 10:11:58 +09006395 0, SLAB_PANIC, NULL);
Sangwoo63205652015-10-21 17:44:30 -04006396 file_security_cache = kmem_cache_create("selinux_file_security",
6397 sizeof(struct file_security_struct),
6398 0, SLAB_PANIC, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006399 avc_init();
6400
Casey Schauflerd69dece52017-01-18 17:09:05 -08006401 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
Linus Torvalds1da177e2005-04-16 15:20:36 -07006402
Paul Moore615e51f2014-06-26 14:33:56 -04006403 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6404 panic("SELinux: Unable to register AVC netcache callback\n");
6405
Eric Paris828dfe12008-04-17 13:17:49 -04006406 if (selinux_enforcing)
Eric Parisfadcdb42007-02-22 18:11:31 -05006407 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
Eric Paris828dfe12008-04-17 13:17:49 -04006408 else
Eric Parisfadcdb42007-02-22 18:11:31 -05006409 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
Michael LeMayd7200242006-06-22 14:47:17 -07006410
Linus Torvalds1da177e2005-04-16 15:20:36 -07006411 return 0;
6412}
6413
Al Viroe8c26252010-03-23 06:36:54 -04006414static void delayed_superblock_init(struct super_block *sb, void *unused)
6415{
6416 superblock_doinit(sb, NULL);
6417}
6418
Linus Torvalds1da177e2005-04-16 15:20:36 -07006419void selinux_complete_init(void)
6420{
Eric Parisfadcdb42007-02-22 18:11:31 -05006421 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07006422
6423 /* Set up any superblocks initialized prior to the policy load. */
Eric Parisfadcdb42007-02-22 18:11:31 -05006424 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
Al Viroe8c26252010-03-23 06:36:54 -04006425 iterate_supers(delayed_superblock_init, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006426}
6427
6428/* SELinux requires early initialization in order to label
6429 all processes and objects when they are created. */
6430security_initcall(selinux_init);
6431
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08006432#if defined(CONFIG_NETFILTER)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006433
Jiri Pirko25db6be2014-09-03 17:42:13 +02006434static struct nf_hook_ops selinux_nf_ops[] = {
Paul Mooreeffad8d2008-01-29 08:49:27 -05006435 {
6436 .hook = selinux_ipv4_postroute,
Alban Crequy2597a832012-05-14 03:56:39 +00006437 .pf = NFPROTO_IPV4,
Paul Mooreeffad8d2008-01-29 08:49:27 -05006438 .hooknum = NF_INET_POST_ROUTING,
6439 .priority = NF_IP_PRI_SELINUX_LAST,
6440 },
6441 {
6442 .hook = selinux_ipv4_forward,
Alban Crequy2597a832012-05-14 03:56:39 +00006443 .pf = NFPROTO_IPV4,
Paul Mooreeffad8d2008-01-29 08:49:27 -05006444 .hooknum = NF_INET_FORWARD,
6445 .priority = NF_IP_PRI_SELINUX_FIRST,
Paul Moore948bf852008-10-10 10:16:32 -04006446 },
6447 {
6448 .hook = selinux_ipv4_output,
Alban Crequy2597a832012-05-14 03:56:39 +00006449 .pf = NFPROTO_IPV4,
Paul Moore948bf852008-10-10 10:16:32 -04006450 .hooknum = NF_INET_LOCAL_OUT,
6451 .priority = NF_IP_PRI_SELINUX_FIRST,
Jiri Pirko25db6be2014-09-03 17:42:13 +02006452 },
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04006453#if IS_ENABLED(CONFIG_IPV6)
Paul Mooreeffad8d2008-01-29 08:49:27 -05006454 {
6455 .hook = selinux_ipv6_postroute,
Alban Crequy2597a832012-05-14 03:56:39 +00006456 .pf = NFPROTO_IPV6,
Paul Mooreeffad8d2008-01-29 08:49:27 -05006457 .hooknum = NF_INET_POST_ROUTING,
6458 .priority = NF_IP6_PRI_SELINUX_LAST,
6459 },
6460 {
6461 .hook = selinux_ipv6_forward,
Alban Crequy2597a832012-05-14 03:56:39 +00006462 .pf = NFPROTO_IPV6,
Paul Mooreeffad8d2008-01-29 08:49:27 -05006463 .hooknum = NF_INET_FORWARD,
6464 .priority = NF_IP6_PRI_SELINUX_FIRST,
Jiri Pirko25db6be2014-09-03 17:42:13 +02006465 },
Huw Davies2917f572016-06-27 15:06:15 -04006466 {
6467 .hook = selinux_ipv6_output,
6468 .pf = NFPROTO_IPV6,
6469 .hooknum = NF_INET_LOCAL_OUT,
6470 .priority = NF_IP6_PRI_SELINUX_FIRST,
6471 },
Linus Torvalds1da177e2005-04-16 15:20:36 -07006472#endif /* IPV6 */
Jiri Pirko25db6be2014-09-03 17:42:13 +02006473};
Linus Torvalds1da177e2005-04-16 15:20:36 -07006474
6475static int __init selinux_nf_ip_init(void)
6476{
Jiri Pirko25db6be2014-09-03 17:42:13 +02006477 int err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006478
6479 if (!selinux_enabled)
Jiri Pirko25db6be2014-09-03 17:42:13 +02006480 return 0;
Eric Parisfadcdb42007-02-22 18:11:31 -05006481
6482 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
6483
Jiri Pirko25db6be2014-09-03 17:42:13 +02006484 err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
Alexey Dobriyan6c5a9d22008-07-26 17:48:15 -07006485 if (err)
Jiri Pirko25db6be2014-09-03 17:42:13 +02006486 panic("SELinux: nf_register_hooks: error %d\n", err);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006487
Jiri Pirko25db6be2014-09-03 17:42:13 +02006488 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006489}
6490
6491__initcall(selinux_nf_ip_init);
6492
6493#ifdef CONFIG_SECURITY_SELINUX_DISABLE
6494static void selinux_nf_ip_exit(void)
6495{
Eric Parisfadcdb42007-02-22 18:11:31 -05006496 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07006497
Jiri Pirko25db6be2014-09-03 17:42:13 +02006498 nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
Linus Torvalds1da177e2005-04-16 15:20:36 -07006499}
6500#endif
6501
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08006502#else /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07006503
6504#ifdef CONFIG_SECURITY_SELINUX_DISABLE
6505#define selinux_nf_ip_exit()
6506#endif
6507
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08006508#endif /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07006509
6510#ifdef CONFIG_SECURITY_SELINUX_DISABLE
Eric Paris828dfe12008-04-17 13:17:49 -04006511static int selinux_disabled;
6512
Linus Torvalds1da177e2005-04-16 15:20:36 -07006513int selinux_disable(void)
6514{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006515 if (ss_initialized) {
6516 /* Not permitted after initial policy load. */
6517 return -EINVAL;
6518 }
6519
6520 if (selinux_disabled) {
6521 /* Only do this once. */
6522 return -EINVAL;
6523 }
6524
6525 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
6526
6527 selinux_disabled = 1;
Stephen Smalley30d55282006-05-03 10:52:36 -04006528 selinux_enabled = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006529
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07006530 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
Linus Torvalds1da177e2005-04-16 15:20:36 -07006531
Eric Parisaf8ff042009-09-20 21:23:01 -04006532 /* Try to destroy the avc node cache */
6533 avc_disable();
6534
Linus Torvalds1da177e2005-04-16 15:20:36 -07006535 /* Unregister netfilter hooks. */
6536 selinux_nf_ip_exit();
6537
6538 /* Unregister selinuxfs. */
6539 exit_sel_fs();
6540
6541 return 0;
6542}
6543#endif