blob: 713c1648014f4cfb9b33a0d1b48acde28287ec36 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
Stephen Smalley7efbb602017-08-17 13:32:36 -04006 * Authors: Stephen Smalley, <sds@tycho.nsa.gov>
Eric Paris828dfe12008-04-17 13:17:49 -04007 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070010 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
Eric Paris2069f452008-07-04 09:47:13 +100012 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070014 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
Eric Paris828dfe12008-04-17 13:17:49 -040015 * <dgoeddel@trustedcs.com>
Paul Mooreed6d76e2009-08-28 18:12:49 -040016 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
Paul Moore82c21bf2011-08-01 11:10:33 +000017 * Paul Moore <paul@paul-moore.com>
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +090018 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
Eric Paris828dfe12008-04-17 13:17:49 -040019 * Yuichi Nakamura <ynakam@hitachisoft.jp>
Daniel Jurgens3a976fa2017-05-19 15:48:56 +030020 * Copyright (C) 2016 Mellanox Technologies
Linus Torvalds1da177e2005-04-16 15:20:36 -070021 *
22 * This program is free software; you can redistribute it and/or modify
23 * it under the terms of the GNU General Public License version 2,
Eric Paris828dfe12008-04-17 13:17:49 -040024 * as published by the Free Software Foundation.
Linus Torvalds1da177e2005-04-16 15:20:36 -070025 */
26
Linus Torvalds1da177e2005-04-16 15:20:36 -070027#include <linux/init.h>
Eric Paris0b24dcb2011-02-25 15:39:20 -050028#include <linux/kd.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070029#include <linux/kernel.h>
Roland McGrath0d094ef2008-07-25 19:45:49 -070030#include <linux/tracehook.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070031#include <linux/errno.h>
Ingo Molnar3f07c012017-02-08 18:51:30 +010032#include <linux/sched/signal.h>
Ingo Molnar29930022017-02-08 18:51:36 +010033#include <linux/sched/task.h>
Casey Schaufler3c4ed7b2015-05-02 15:10:46 -070034#include <linux/lsm_hooks.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070035#include <linux/xattr.h>
36#include <linux/capability.h>
37#include <linux/unistd.h>
38#include <linux/mm.h>
39#include <linux/mman.h>
40#include <linux/slab.h>
41#include <linux/pagemap.h>
Eric Paris0b24dcb2011-02-25 15:39:20 -050042#include <linux/proc_fs.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070043#include <linux/swap.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070044#include <linux/spinlock.h>
45#include <linux/syscalls.h>
Eric Paris2a7dba32011-02-01 11:05:39 -050046#include <linux/dcache.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070047#include <linux/file.h>
Al Viro9f3acc32008-04-24 07:44:08 -040048#include <linux/fdtable.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070049#include <linux/namei.h>
50#include <linux/mount.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070051#include <linux/netfilter_ipv4.h>
52#include <linux/netfilter_ipv6.h>
53#include <linux/tty.h>
54#include <net/icmp.h>
Stephen Hemminger227b60f2007-10-10 17:30:46 -070055#include <net/ip.h> /* for local_port_range[] */
Linus Torvalds1da177e2005-04-16 15:20:36 -070056#include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
Paul Moore47180062013-12-04 16:10:45 -050057#include <net/inet_connection_sock.h>
Paul Moore220deb92008-01-29 08:38:23 -050058#include <net/net_namespace.h>
Paul Moored621d352008-01-29 08:43:36 -050059#include <net/netlabel.h>
Eric Parisf5269712008-05-14 11:27:45 -040060#include <linux/uaccess.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070061#include <asm/ioctls.h>
Arun Sharma600634972011-07-26 16:09:06 -070062#include <linux/atomic.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070063#include <linux/bitops.h>
64#include <linux/interrupt.h>
65#include <linux/netdevice.h> /* for network interface checks */
Hong zhi guo77954982013-03-27 06:49:35 +000066#include <net/netlink.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070067#include <linux/tcp.h>
68#include <linux/udp.h>
James Morris2ee92d42006-11-13 16:09:01 -080069#include <linux/dccp.h>
Richard Hainesd4529302018-02-13 20:57:18 +000070#include <linux/sctp.h>
71#include <net/sctp/structs.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070072#include <linux/quota.h>
73#include <linux/un.h> /* for Unix socket types */
74#include <net/af_unix.h> /* for Unix socket types */
75#include <linux/parser.h>
76#include <linux/nfs_mount.h>
77#include <net/ipv6.h>
78#include <linux/hugetlb.h>
79#include <linux/personality.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070080#include <linux/audit.h>
Eric Paris6931dfc2005-06-30 02:58:51 -070081#include <linux/string.h>
Catherine Zhang877ce7c2006-06-29 12:27:47 -070082#include <linux/selinux.h>
Eric Paris23970742006-09-25 23:32:01 -070083#include <linux/mutex.h>
Frank Mayharf06febc2008-09-12 09:54:39 -070084#include <linux/posix-timers.h>
Kees Cook00234592010-02-03 15:36:43 -080085#include <linux/syslog.h>
Serge E. Hallyn34867402011-03-23 16:43:17 -070086#include <linux/user_namespace.h>
Paul Gortmaker44fc7ea2011-05-26 20:52:10 -040087#include <linux/export.h>
Al Viro40401532012-02-13 03:58:52 +000088#include <linux/msg.h>
89#include <linux/shm.h>
Chenbo Fengec27c352017-10-18 13:00:25 -070090#include <linux/bpf.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070091
92#include "avc.h"
93#include "objsec.h"
94#include "netif.h"
Paul Moore224dfbd2008-01-29 08:38:13 -050095#include "netnode.h"
Paul Moore3e1121722008-04-10 10:48:14 -040096#include "netport.h"
Daniel Jurgens409dcf32017-05-19 15:48:59 +030097#include "ibpkey.h"
Trent Jaegerd28d1e02005-12-13 23:12:40 -080098#include "xfrm.h"
Paul Moorec60475b2007-02-28 15:14:23 -050099#include "netlabel.h"
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +0200100#include "audit.h"
James Morris7b98a582011-08-30 12:52:32 +1000101#include "avc_ss.h"
Linus Torvalds1da177e2005-04-16 15:20:36 -0700102
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500103struct selinux_state selinux_state;
104
Paul Moored621d352008-01-29 08:43:36 -0500105/* SECMARK reference count */
James Morris56a4ca92011-08-17 11:08:43 +1000106static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
Paul Moored621d352008-01-29 08:43:36 -0500107
Linus Torvalds1da177e2005-04-16 15:20:36 -0700108#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500109static int selinux_enforcing_boot;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700110
111static int __init enforcing_setup(char *str)
112{
Eric Parisf5269712008-05-14 11:27:45 -0400113 unsigned long enforcing;
Jingoo Han29707b22014-02-05 15:13:14 +0900114 if (!kstrtoul(str, 0, &enforcing))
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500115 selinux_enforcing_boot = enforcing ? 1 : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700116 return 1;
117}
118__setup("enforcing=", enforcing_setup);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500119#else
120#define selinux_enforcing_boot 1
Linus Torvalds1da177e2005-04-16 15:20:36 -0700121#endif
122
123#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
124int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
125
126static int __init selinux_enabled_setup(char *str)
127{
Eric Parisf5269712008-05-14 11:27:45 -0400128 unsigned long enabled;
Jingoo Han29707b22014-02-05 15:13:14 +0900129 if (!kstrtoul(str, 0, &enabled))
Eric Parisf5269712008-05-14 11:27:45 -0400130 selinux_enabled = enabled ? 1 : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700131 return 1;
132}
133__setup("selinux=", selinux_enabled_setup);
Stephen Smalley30d55282006-05-03 10:52:36 -0400134#else
135int selinux_enabled = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700136#endif
137
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500138static unsigned int selinux_checkreqprot_boot =
139 CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
140
141static int __init checkreqprot_setup(char *str)
142{
143 unsigned long checkreqprot;
144
145 if (!kstrtoul(str, 0, &checkreqprot))
146 selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
147 return 1;
148}
149__setup("checkreqprot=", checkreqprot_setup);
150
Christoph Lametere18b8902006-12-06 20:33:20 -0800151static struct kmem_cache *sel_inode_cache;
Sangwoo63205652015-10-21 17:44:30 -0400152static struct kmem_cache *file_security_cache;
James Morris7cae7e22006-03-22 00:09:22 -0800153
Paul Moored621d352008-01-29 08:43:36 -0500154/**
155 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
156 *
157 * Description:
158 * This function checks the SECMARK reference counter to see if any SECMARK
159 * targets are currently configured, if the reference counter is greater than
160 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
Chris PeBenito2be4d742013-05-03 09:05:39 -0400161 * enabled, false (0) if SECMARK is disabled. If the always_check_network
162 * policy capability is enabled, SECMARK is always considered enabled.
Paul Moored621d352008-01-29 08:43:36 -0500163 *
164 */
165static int selinux_secmark_enabled(void)
166{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500167 return (selinux_policycap_alwaysnetwork() ||
168 atomic_read(&selinux_secmark_refcount));
Chris PeBenito2be4d742013-05-03 09:05:39 -0400169}
170
171/**
172 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
173 *
174 * Description:
175 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
176 * (1) if any are enabled or false (0) if neither are enabled. If the
177 * always_check_network policy capability is enabled, peer labeling
178 * is always considered enabled.
179 *
180 */
181static int selinux_peerlbl_enabled(void)
182{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500183 return (selinux_policycap_alwaysnetwork() ||
184 netlbl_enabled() || selinux_xfrm_enabled());
Paul Moored621d352008-01-29 08:43:36 -0500185}
186
Paul Moore615e51f2014-06-26 14:33:56 -0400187static int selinux_netcache_avc_callback(u32 event)
188{
189 if (event == AVC_CALLBACK_RESET) {
190 sel_netif_flush();
191 sel_netnode_flush();
192 sel_netport_flush();
193 synchronize_net();
194 }
195 return 0;
196}
197
Daniel Jurgens8f408ab2017-05-19 15:48:53 +0300198static int selinux_lsm_notifier_avc_callback(u32 event)
199{
Daniel Jurgens409dcf32017-05-19 15:48:59 +0300200 if (event == AVC_CALLBACK_RESET) {
201 sel_ib_pkey_flush();
Daniel Jurgens8f408ab2017-05-19 15:48:53 +0300202 call_lsm_notifier(LSM_POLICY_CHANGE, NULL);
Daniel Jurgens409dcf32017-05-19 15:48:59 +0300203 }
Daniel Jurgens8f408ab2017-05-19 15:48:53 +0300204
205 return 0;
206}
207
David Howellsd84f4f92008-11-14 10:39:23 +1100208/*
209 * initialise the security for the init task
210 */
211static void cred_init_security(void)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700212{
David Howells3b11a1d2008-11-14 10:39:26 +1100213 struct cred *cred = (struct cred *) current->real_cred;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700214 struct task_security_struct *tsec;
215
James Morris89d155e2005-10-30 14:59:21 -0800216 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700217 if (!tsec)
David Howellsd84f4f92008-11-14 10:39:23 +1100218 panic("SELinux: Failed to initialize initial task.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -0700219
David Howellsd84f4f92008-11-14 10:39:23 +1100220 tsec->osid = tsec->sid = SECINITSID_KERNEL;
David Howellsf1752ee2008-11-14 10:39:17 +1100221 cred->security = tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700222}
223
David Howells275bb412008-11-14 10:39:19 +1100224/*
David Howells88e67f32008-11-14 10:39:21 +1100225 * get the security ID of a set of credentials
226 */
227static inline u32 cred_sid(const struct cred *cred)
228{
229 const struct task_security_struct *tsec;
230
231 tsec = cred->security;
232 return tsec->sid;
233}
234
235/*
David Howells3b11a1d2008-11-14 10:39:26 +1100236 * get the objective security ID of a task
David Howells275bb412008-11-14 10:39:19 +1100237 */
238static inline u32 task_sid(const struct task_struct *task)
239{
David Howells275bb412008-11-14 10:39:19 +1100240 u32 sid;
241
242 rcu_read_lock();
David Howells88e67f32008-11-14 10:39:21 +1100243 sid = cred_sid(__task_cred(task));
David Howells275bb412008-11-14 10:39:19 +1100244 rcu_read_unlock();
245 return sid;
246}
247
David Howells88e67f32008-11-14 10:39:21 +1100248/* Allocate and free functions for each kind of security blob. */
249
Linus Torvalds1da177e2005-04-16 15:20:36 -0700250static int inode_alloc_security(struct inode *inode)
251{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700252 struct inode_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +1100253 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700254
Josef Bacika02fe132008-04-04 09:35:05 +1100255 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700256 if (!isec)
257 return -ENOMEM;
258
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +0100259 spin_lock_init(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700260 INIT_LIST_HEAD(&isec->list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700261 isec->inode = inode;
262 isec->sid = SECINITSID_UNLABELED;
263 isec->sclass = SECCLASS_FILE;
David Howells275bb412008-11-14 10:39:19 +1100264 isec->task_sid = sid;
Andreas Gruenbacher42059112016-11-10 22:18:27 +0100265 isec->initialized = LABEL_INVALID;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700266 inode->i_security = isec;
267
268 return 0;
269}
270
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500271static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
272
273/*
274 * Try reloading inode security labels that have been marked as invalid. The
275 * @may_sleep parameter indicates when sleeping and thus reloading labels is
Andreas Gruenbacher42059112016-11-10 22:18:27 +0100276 * allowed; when set to false, returns -ECHILD when the label is
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500277 * invalid. The @opt_dentry parameter should be set to a dentry of the inode;
278 * when no dentry is available, set it to NULL instead.
279 */
280static int __inode_security_revalidate(struct inode *inode,
281 struct dentry *opt_dentry,
282 bool may_sleep)
283{
284 struct inode_security_struct *isec = inode->i_security;
285
286 might_sleep_if(may_sleep);
287
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500288 if (selinux_state.initialized &&
289 isec->initialized != LABEL_INITIALIZED) {
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500290 if (!may_sleep)
291 return -ECHILD;
292
293 /*
294 * Try reloading the inode security label. This will fail if
295 * @opt_dentry is NULL and no dentry for this inode can be
296 * found; in that case, continue using the old label.
297 */
298 inode_doinit_with_dentry(inode, opt_dentry);
299 }
300 return 0;
301}
302
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500303static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
304{
305 return inode->i_security;
306}
307
308static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
309{
310 int error;
311
312 error = __inode_security_revalidate(inode, NULL, !rcu);
313 if (error)
314 return ERR_PTR(error);
315 return inode->i_security;
316}
317
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500318/*
319 * Get the security label of an inode.
320 */
321static struct inode_security_struct *inode_security(struct inode *inode)
322{
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500323 __inode_security_revalidate(inode, NULL, true);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500324 return inode->i_security;
325}
326
Paul Moore2c971652016-04-19 16:36:28 -0400327static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
328{
329 struct inode *inode = d_backing_inode(dentry);
330
331 return inode->i_security;
332}
333
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500334/*
335 * Get the security label of a dentry's backing inode.
336 */
337static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
338{
339 struct inode *inode = d_backing_inode(dentry);
340
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500341 __inode_security_revalidate(inode, dentry, true);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500342 return inode->i_security;
343}
344
Steven Rostedt3dc91d42014-01-09 21:46:34 -0500345static void inode_free_rcu(struct rcu_head *head)
346{
347 struct inode_security_struct *isec;
348
349 isec = container_of(head, struct inode_security_struct, rcu);
350 kmem_cache_free(sel_inode_cache, isec);
351}
352
Linus Torvalds1da177e2005-04-16 15:20:36 -0700353static void inode_free_security(struct inode *inode)
354{
355 struct inode_security_struct *isec = inode->i_security;
356 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
357
Waiman Long9629d042015-07-10 17:19:56 -0400358 /*
359 * As not all inode security structures are in a list, we check for
360 * empty list outside of the lock to make sure that we won't waste
361 * time taking a lock doing nothing.
362 *
363 * The list_del_init() function can be safely called more than once.
364 * It should not be possible for this function to be called with
365 * concurrent list_add(), but for better safety against future changes
366 * in the code, we use list_empty_careful() here.
367 */
368 if (!list_empty_careful(&isec->list)) {
369 spin_lock(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700370 list_del_init(&isec->list);
Waiman Long9629d042015-07-10 17:19:56 -0400371 spin_unlock(&sbsec->isec_lock);
372 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700373
Steven Rostedt3dc91d42014-01-09 21:46:34 -0500374 /*
375 * The inode may still be referenced in a path walk and
376 * a call to selinux_inode_permission() can be made
377 * after inode_free_security() is called. Ideally, the VFS
378 * wouldn't do this, but fixing that is a much harder
379 * job. For now, simply free the i_security via RCU, and
380 * leave the current inode->i_security pointer intact.
381 * The inode will be freed after the RCU grace period too.
382 */
383 call_rcu(&isec->rcu, inode_free_rcu);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700384}
385
386static int file_alloc_security(struct file *file)
387{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700388 struct file_security_struct *fsec;
David Howells275bb412008-11-14 10:39:19 +1100389 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700390
Sangwoo63205652015-10-21 17:44:30 -0400391 fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700392 if (!fsec)
393 return -ENOMEM;
394
David Howells275bb412008-11-14 10:39:19 +1100395 fsec->sid = sid;
396 fsec->fown_sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700397 file->f_security = fsec;
398
399 return 0;
400}
401
402static void file_free_security(struct file *file)
403{
404 struct file_security_struct *fsec = file->f_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700405 file->f_security = NULL;
Sangwoo63205652015-10-21 17:44:30 -0400406 kmem_cache_free(file_security_cache, fsec);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700407}
408
409static int superblock_alloc_security(struct super_block *sb)
410{
411 struct superblock_security_struct *sbsec;
412
James Morris89d155e2005-10-30 14:59:21 -0800413 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700414 if (!sbsec)
415 return -ENOMEM;
416
Eric Parisbc7e9822006-09-25 23:32:02 -0700417 mutex_init(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700418 INIT_LIST_HEAD(&sbsec->isec_head);
419 spin_lock_init(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700420 sbsec->sb = sb;
421 sbsec->sid = SECINITSID_UNLABELED;
422 sbsec->def_sid = SECINITSID_FILE;
Eric Parisc312feb2006-07-10 04:43:53 -0700423 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700424 sb->s_security = sbsec;
425
426 return 0;
427}
428
429static void superblock_free_security(struct super_block *sb)
430{
431 struct superblock_security_struct *sbsec = sb->s_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700432 sb->s_security = NULL;
433 kfree(sbsec);
434}
435
Linus Torvalds1da177e2005-04-16 15:20:36 -0700436static inline int inode_doinit(struct inode *inode)
437{
438 return inode_doinit_with_dentry(inode, NULL);
439}
440
441enum {
Eric Paris31e87932007-09-19 17:19:12 -0400442 Opt_error = -1,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700443 Opt_context = 1,
444 Opt_fscontext = 2,
Eric Parisc9180a52007-11-30 13:00:35 -0500445 Opt_defcontext = 3,
446 Opt_rootcontext = 4,
David P. Quigley11689d42009-01-16 09:22:03 -0500447 Opt_labelsupport = 5,
Eric Parisd355987f2012-08-24 15:58:53 -0400448 Opt_nextmntopt = 6,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700449};
450
Eric Parisd355987f2012-08-24 15:58:53 -0400451#define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1)
452
Steven Whitehousea447c092008-10-13 10:46:57 +0100453static const match_table_t tokens = {
Eric Paris832cbd92008-04-01 13:24:09 -0400454 {Opt_context, CONTEXT_STR "%s"},
455 {Opt_fscontext, FSCONTEXT_STR "%s"},
456 {Opt_defcontext, DEFCONTEXT_STR "%s"},
457 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
David P. Quigley11689d42009-01-16 09:22:03 -0500458 {Opt_labelsupport, LABELSUPP_STR},
Eric Paris31e87932007-09-19 17:19:12 -0400459 {Opt_error, NULL},
Linus Torvalds1da177e2005-04-16 15:20:36 -0700460};
461
462#define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
463
Eric Parisc312feb2006-07-10 04:43:53 -0700464static int may_context_mount_sb_relabel(u32 sid,
465 struct superblock_security_struct *sbsec,
David Howells275bb412008-11-14 10:39:19 +1100466 const struct cred *cred)
Eric Parisc312feb2006-07-10 04:43:53 -0700467{
David Howells275bb412008-11-14 10:39:19 +1100468 const struct task_security_struct *tsec = cred->security;
Eric Parisc312feb2006-07-10 04:43:53 -0700469 int rc;
470
Stephen Smalley6b6bc622018-03-05 11:47:56 -0500471 rc = avc_has_perm(&selinux_state,
472 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
Eric Parisc312feb2006-07-10 04:43:53 -0700473 FILESYSTEM__RELABELFROM, NULL);
474 if (rc)
475 return rc;
476
Stephen Smalley6b6bc622018-03-05 11:47:56 -0500477 rc = avc_has_perm(&selinux_state,
478 tsec->sid, sid, SECCLASS_FILESYSTEM,
Eric Parisc312feb2006-07-10 04:43:53 -0700479 FILESYSTEM__RELABELTO, NULL);
480 return rc;
481}
482
Eric Paris08089252006-07-10 04:43:55 -0700483static int may_context_mount_inode_relabel(u32 sid,
484 struct superblock_security_struct *sbsec,
David Howells275bb412008-11-14 10:39:19 +1100485 const struct cred *cred)
Eric Paris08089252006-07-10 04:43:55 -0700486{
David Howells275bb412008-11-14 10:39:19 +1100487 const struct task_security_struct *tsec = cred->security;
Eric Paris08089252006-07-10 04:43:55 -0700488 int rc;
Stephen Smalley6b6bc622018-03-05 11:47:56 -0500489 rc = avc_has_perm(&selinux_state,
490 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
Eric Paris08089252006-07-10 04:43:55 -0700491 FILESYSTEM__RELABELFROM, NULL);
492 if (rc)
493 return rc;
494
Stephen Smalley6b6bc622018-03-05 11:47:56 -0500495 rc = avc_has_perm(&selinux_state,
496 sid, sbsec->sid, SECCLASS_FILESYSTEM,
Eric Paris08089252006-07-10 04:43:55 -0700497 FILESYSTEM__ASSOCIATE, NULL);
498 return rc;
499}
500
Eric Parisb43e7252012-10-10 14:27:35 -0400501static int selinux_is_sblabel_mnt(struct super_block *sb)
502{
503 struct superblock_security_struct *sbsec = sb->s_security;
504
Mark Salyzynd5f3a5f2015-02-04 11:34:30 -0500505 return sbsec->behavior == SECURITY_FS_USE_XATTR ||
506 sbsec->behavior == SECURITY_FS_USE_TRANS ||
507 sbsec->behavior == SECURITY_FS_USE_TASK ||
J. Bruce Fields9fc2b4b2015-06-04 15:57:25 -0400508 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
Mark Salyzynd5f3a5f2015-02-04 11:34:30 -0500509 /* Special handling. Genfs but also in-core setxattr handler */
510 !strcmp(sb->s_type->name, "sysfs") ||
511 !strcmp(sb->s_type->name, "pstore") ||
512 !strcmp(sb->s_type->name, "debugfs") ||
Yongqin Liua2c7c6f2017-01-09 10:07:30 -0500513 !strcmp(sb->s_type->name, "tracefs") ||
Stephen Smalley2651225b2017-02-28 10:35:56 -0500514 !strcmp(sb->s_type->name, "rootfs") ||
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500515 (selinux_policycap_cgroupseclabel() &&
Stephen Smalley2651225b2017-02-28 10:35:56 -0500516 (!strcmp(sb->s_type->name, "cgroup") ||
517 !strcmp(sb->s_type->name, "cgroup2")));
Eric Parisb43e7252012-10-10 14:27:35 -0400518}
519
Eric Parisc9180a52007-11-30 13:00:35 -0500520static int sb_finish_set_opts(struct super_block *sb)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700521{
522 struct superblock_security_struct *sbsec = sb->s_security;
523 struct dentry *root = sb->s_root;
David Howellsc6f493d2015-03-17 22:26:22 +0000524 struct inode *root_inode = d_backing_inode(root);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700525 int rc = 0;
526
Linus Torvalds1da177e2005-04-16 15:20:36 -0700527 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
528 /* Make sure that the xattr handler exists and that no
529 error other than -ENODATA is returned by getxattr on
530 the root directory. -ENODATA is ok, as this may be
531 the first boot of the SELinux kernel before we have
532 assigned xattr values to the filesystem. */
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +0200533 if (!(root_inode->i_opflags & IOP_XATTR)) {
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800534 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
535 "xattr support\n", sb->s_id, sb->s_type->name);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700536 rc = -EOPNOTSUPP;
537 goto out;
538 }
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +0200539
540 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700541 if (rc < 0 && rc != -ENODATA) {
542 if (rc == -EOPNOTSUPP)
543 printk(KERN_WARNING "SELinux: (dev %s, type "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800544 "%s) has no security xattr handler\n",
545 sb->s_id, sb->s_type->name);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700546 else
547 printk(KERN_WARNING "SELinux: (dev %s, type "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800548 "%s) getxattr errno %d\n", sb->s_id,
549 sb->s_type->name, -rc);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700550 goto out;
551 }
552 }
553
Eric Pariseadcabc2012-08-24 15:59:14 -0400554 sbsec->flags |= SE_SBINITIALIZED;
Scott Mayhew0b4d3452017-06-05 11:45:04 -0400555
556 /*
557 * Explicitly set or clear SBLABEL_MNT. It's not sufficient to simply
558 * leave the flag untouched because sb_clone_mnt_opts might be handing
559 * us a superblock that needs the flag to be cleared.
560 */
Eric Parisb43e7252012-10-10 14:27:35 -0400561 if (selinux_is_sblabel_mnt(sb))
Eric Paris12f348b2012-10-09 10:56:25 -0400562 sbsec->flags |= SBLABEL_MNT;
Scott Mayhew0b4d3452017-06-05 11:45:04 -0400563 else
564 sbsec->flags &= ~SBLABEL_MNT;
David P. Quigleyddd29ec2009-09-09 14:25:37 -0400565
Linus Torvalds1da177e2005-04-16 15:20:36 -0700566 /* Initialize the root inode. */
Eric Parisc9180a52007-11-30 13:00:35 -0500567 rc = inode_doinit_with_dentry(root_inode, root);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700568
569 /* Initialize any other inodes associated with the superblock, e.g.
570 inodes created prior to initial policy load or inodes created
571 during get_sb by a pseudo filesystem that directly
572 populates itself. */
573 spin_lock(&sbsec->isec_lock);
574next_inode:
575 if (!list_empty(&sbsec->isec_head)) {
576 struct inode_security_struct *isec =
577 list_entry(sbsec->isec_head.next,
Eric Parisc9180a52007-11-30 13:00:35 -0500578 struct inode_security_struct, list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700579 struct inode *inode = isec->inode;
Stephen Smalley923190d2014-10-06 16:32:52 -0400580 list_del_init(&isec->list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700581 spin_unlock(&sbsec->isec_lock);
582 inode = igrab(inode);
583 if (inode) {
Eric Parisc9180a52007-11-30 13:00:35 -0500584 if (!IS_PRIVATE(inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700585 inode_doinit(inode);
586 iput(inode);
587 }
588 spin_lock(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700589 goto next_inode;
590 }
591 spin_unlock(&sbsec->isec_lock);
592out:
Eric Parisc9180a52007-11-30 13:00:35 -0500593 return rc;
594}
595
596/*
597 * This function should allow an FS to ask what it's mount security
598 * options were so it can use those later for submounts, displaying
599 * mount options, or whatever.
600 */
601static int selinux_get_mnt_opts(const struct super_block *sb,
Eric Parise0007522008-03-05 10:31:54 -0500602 struct security_mnt_opts *opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500603{
604 int rc = 0, i;
605 struct superblock_security_struct *sbsec = sb->s_security;
606 char *context = NULL;
607 u32 len;
608 char tmp;
609
Eric Parise0007522008-03-05 10:31:54 -0500610 security_init_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500611
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500612 if (!(sbsec->flags & SE_SBINITIALIZED))
Eric Parisc9180a52007-11-30 13:00:35 -0500613 return -EINVAL;
614
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500615 if (!selinux_state.initialized)
Eric Parisc9180a52007-11-30 13:00:35 -0500616 return -EINVAL;
617
Eric Parisaf8e50c2012-08-24 15:59:00 -0400618 /* make sure we always check enough bits to cover the mask */
619 BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
620
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500621 tmp = sbsec->flags & SE_MNTMASK;
Eric Parisc9180a52007-11-30 13:00:35 -0500622 /* count the number of mount options for this sb */
Eric Parisaf8e50c2012-08-24 15:59:00 -0400623 for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
Eric Parisc9180a52007-11-30 13:00:35 -0500624 if (tmp & 0x01)
Eric Parise0007522008-03-05 10:31:54 -0500625 opts->num_mnt_opts++;
Eric Parisc9180a52007-11-30 13:00:35 -0500626 tmp >>= 1;
627 }
David P. Quigley11689d42009-01-16 09:22:03 -0500628 /* Check if the Label support flag is set */
Eric Paris0b4bdb32013-08-28 13:32:42 -0400629 if (sbsec->flags & SBLABEL_MNT)
David P. Quigley11689d42009-01-16 09:22:03 -0500630 opts->num_mnt_opts++;
Eric Parisc9180a52007-11-30 13:00:35 -0500631
Eric Parise0007522008-03-05 10:31:54 -0500632 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
633 if (!opts->mnt_opts) {
Eric Parisc9180a52007-11-30 13:00:35 -0500634 rc = -ENOMEM;
635 goto out_free;
636 }
637
Eric Parise0007522008-03-05 10:31:54 -0500638 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
639 if (!opts->mnt_opts_flags) {
Eric Parisc9180a52007-11-30 13:00:35 -0500640 rc = -ENOMEM;
641 goto out_free;
642 }
643
644 i = 0;
645 if (sbsec->flags & FSCONTEXT_MNT) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500646 rc = security_sid_to_context(&selinux_state, sbsec->sid,
647 &context, &len);
Eric Parisc9180a52007-11-30 13:00:35 -0500648 if (rc)
649 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500650 opts->mnt_opts[i] = context;
651 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500652 }
653 if (sbsec->flags & CONTEXT_MNT) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500654 rc = security_sid_to_context(&selinux_state,
655 sbsec->mntpoint_sid,
656 &context, &len);
Eric Parisc9180a52007-11-30 13:00:35 -0500657 if (rc)
658 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500659 opts->mnt_opts[i] = context;
660 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500661 }
662 if (sbsec->flags & DEFCONTEXT_MNT) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500663 rc = security_sid_to_context(&selinux_state, sbsec->def_sid,
664 &context, &len);
Eric Parisc9180a52007-11-30 13:00:35 -0500665 if (rc)
666 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500667 opts->mnt_opts[i] = context;
668 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500669 }
670 if (sbsec->flags & ROOTCONTEXT_MNT) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500671 struct dentry *root = sbsec->sb->s_root;
672 struct inode_security_struct *isec = backing_inode_security(root);
Eric Parisc9180a52007-11-30 13:00:35 -0500673
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500674 rc = security_sid_to_context(&selinux_state, isec->sid,
675 &context, &len);
Eric Parisc9180a52007-11-30 13:00:35 -0500676 if (rc)
677 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500678 opts->mnt_opts[i] = context;
679 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500680 }
Eric Paris12f348b2012-10-09 10:56:25 -0400681 if (sbsec->flags & SBLABEL_MNT) {
David P. Quigley11689d42009-01-16 09:22:03 -0500682 opts->mnt_opts[i] = NULL;
Eric Paris12f348b2012-10-09 10:56:25 -0400683 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
David P. Quigley11689d42009-01-16 09:22:03 -0500684 }
Eric Parisc9180a52007-11-30 13:00:35 -0500685
Eric Parise0007522008-03-05 10:31:54 -0500686 BUG_ON(i != opts->num_mnt_opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500687
688 return 0;
689
690out_free:
Eric Parise0007522008-03-05 10:31:54 -0500691 security_free_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500692 return rc;
693}
694
695static int bad_option(struct superblock_security_struct *sbsec, char flag,
696 u32 old_sid, u32 new_sid)
697{
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500698 char mnt_flags = sbsec->flags & SE_MNTMASK;
699
Eric Parisc9180a52007-11-30 13:00:35 -0500700 /* check if the old mount command had the same options */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500701 if (sbsec->flags & SE_SBINITIALIZED)
Eric Parisc9180a52007-11-30 13:00:35 -0500702 if (!(sbsec->flags & flag) ||
703 (old_sid != new_sid))
704 return 1;
705
706 /* check if we were passed the same options twice,
707 * aka someone passed context=a,context=b
708 */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500709 if (!(sbsec->flags & SE_SBINITIALIZED))
710 if (mnt_flags & flag)
Eric Parisc9180a52007-11-30 13:00:35 -0500711 return 1;
712 return 0;
713}
Eric Parise0007522008-03-05 10:31:54 -0500714
Eric Parisc9180a52007-11-30 13:00:35 -0500715/*
716 * Allow filesystems with binary mount data to explicitly set mount point
717 * labeling information.
718 */
Eric Parise0007522008-03-05 10:31:54 -0500719static int selinux_set_mnt_opts(struct super_block *sb,
David Quigley649f6e72013-05-22 12:50:36 -0400720 struct security_mnt_opts *opts,
721 unsigned long kern_flags,
722 unsigned long *set_kern_flags)
Eric Parisc9180a52007-11-30 13:00:35 -0500723{
David Howells275bb412008-11-14 10:39:19 +1100724 const struct cred *cred = current_cred();
Eric Parisc9180a52007-11-30 13:00:35 -0500725 int rc = 0, i;
Eric Parisc9180a52007-11-30 13:00:35 -0500726 struct superblock_security_struct *sbsec = sb->s_security;
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800727 const char *name = sb->s_type->name;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500728 struct dentry *root = sbsec->sb->s_root;
Paul Moore2c971652016-04-19 16:36:28 -0400729 struct inode_security_struct *root_isec;
Eric Parisc9180a52007-11-30 13:00:35 -0500730 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
731 u32 defcontext_sid = 0;
Eric Parise0007522008-03-05 10:31:54 -0500732 char **mount_options = opts->mnt_opts;
733 int *flags = opts->mnt_opts_flags;
734 int num_opts = opts->num_mnt_opts;
Eric Parisc9180a52007-11-30 13:00:35 -0500735
736 mutex_lock(&sbsec->lock);
737
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500738 if (!selinux_state.initialized) {
Eric Parisc9180a52007-11-30 13:00:35 -0500739 if (!num_opts) {
740 /* Defer initialization until selinux_complete_init,
741 after the initial policy is loaded and the security
742 server is ready to handle calls. */
Eric Parisc9180a52007-11-30 13:00:35 -0500743 goto out;
744 }
745 rc = -EINVAL;
Eric Paris744ba352008-04-17 11:52:44 -0400746 printk(KERN_WARNING "SELinux: Unable to set superblock options "
747 "before the security server is initialized\n");
Eric Parisc9180a52007-11-30 13:00:35 -0500748 goto out;
749 }
David Quigley649f6e72013-05-22 12:50:36 -0400750 if (kern_flags && !set_kern_flags) {
751 /* Specifying internal flags without providing a place to
752 * place the results is not allowed */
753 rc = -EINVAL;
754 goto out;
755 }
Eric Parisc9180a52007-11-30 13:00:35 -0500756
757 /*
Eric Parise0007522008-03-05 10:31:54 -0500758 * Binary mount data FS will come through this function twice. Once
759 * from an explicit call and once from the generic calls from the vfs.
760 * Since the generic VFS calls will not contain any security mount data
761 * we need to skip the double mount verification.
762 *
763 * This does open a hole in which we will not notice if the first
764 * mount using this sb set explict options and a second mount using
765 * this sb does not set any security options. (The first options
766 * will be used for both mounts)
767 */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500768 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
Eric Parise0007522008-03-05 10:31:54 -0500769 && (num_opts == 0))
Eric Parisf5269712008-05-14 11:27:45 -0400770 goto out;
Eric Parise0007522008-03-05 10:31:54 -0500771
Paul Moore2c971652016-04-19 16:36:28 -0400772 root_isec = backing_inode_security_novalidate(root);
773
Eric Parise0007522008-03-05 10:31:54 -0500774 /*
Eric Parisc9180a52007-11-30 13:00:35 -0500775 * parse the mount options, check if they are valid sids.
776 * also check if someone is trying to mount the same sb more
777 * than once with different security options.
778 */
779 for (i = 0; i < num_opts; i++) {
780 u32 sid;
David P. Quigley11689d42009-01-16 09:22:03 -0500781
Eric Paris12f348b2012-10-09 10:56:25 -0400782 if (flags[i] == SBLABEL_MNT)
David P. Quigley11689d42009-01-16 09:22:03 -0500783 continue;
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500784 rc = security_context_str_to_sid(&selinux_state,
785 mount_options[i], &sid,
786 GFP_KERNEL);
Eric Parisc9180a52007-11-30 13:00:35 -0500787 if (rc) {
Rasmus Villemoes44be2f62015-10-21 17:44:25 -0400788 printk(KERN_WARNING "SELinux: security_context_str_to_sid"
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800789 "(%s) failed for (dev %s, type %s) errno=%d\n",
790 mount_options[i], sb->s_id, name, rc);
Eric Parisc9180a52007-11-30 13:00:35 -0500791 goto out;
792 }
793 switch (flags[i]) {
794 case FSCONTEXT_MNT:
795 fscontext_sid = sid;
796
797 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
798 fscontext_sid))
799 goto out_double_mount;
800
801 sbsec->flags |= FSCONTEXT_MNT;
802 break;
803 case CONTEXT_MNT:
804 context_sid = sid;
805
806 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
807 context_sid))
808 goto out_double_mount;
809
810 sbsec->flags |= CONTEXT_MNT;
811 break;
812 case ROOTCONTEXT_MNT:
813 rootcontext_sid = sid;
814
815 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
816 rootcontext_sid))
817 goto out_double_mount;
818
819 sbsec->flags |= ROOTCONTEXT_MNT;
820
821 break;
822 case DEFCONTEXT_MNT:
823 defcontext_sid = sid;
824
825 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
826 defcontext_sid))
827 goto out_double_mount;
828
829 sbsec->flags |= DEFCONTEXT_MNT;
830
831 break;
832 default:
833 rc = -EINVAL;
834 goto out;
835 }
836 }
837
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500838 if (sbsec->flags & SE_SBINITIALIZED) {
Eric Parisc9180a52007-11-30 13:00:35 -0500839 /* previously mounted with options, but not on this attempt? */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500840 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500841 goto out_double_mount;
842 rc = 0;
843 goto out;
844 }
845
James Morris089be432008-07-15 18:32:49 +1000846 if (strcmp(sb->s_type->name, "proc") == 0)
Stephen Smalley134509d2015-06-04 16:22:17 -0400847 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
848
Stephen Smalley8e014722015-06-04 16:22:17 -0400849 if (!strcmp(sb->s_type->name, "debugfs") ||
Jeff Vander Stoep6a391182017-06-20 09:35:33 -0700850 !strcmp(sb->s_type->name, "tracefs") ||
Stephen Smalley8e014722015-06-04 16:22:17 -0400851 !strcmp(sb->s_type->name, "sysfs") ||
Antonio Murdaca901ef842017-02-09 17:02:42 +0100852 !strcmp(sb->s_type->name, "pstore") ||
853 !strcmp(sb->s_type->name, "cgroup") ||
854 !strcmp(sb->s_type->name, "cgroup2"))
Stephen Smalley134509d2015-06-04 16:22:17 -0400855 sbsec->flags |= SE_SBGENFS;
Eric Parisc9180a52007-11-30 13:00:35 -0500856
David Quigleyeb9ae682013-05-22 12:50:37 -0400857 if (!sbsec->behavior) {
858 /*
859 * Determine the labeling behavior to use for this
860 * filesystem type.
861 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500862 rc = security_fs_use(&selinux_state, sb);
David Quigleyeb9ae682013-05-22 12:50:37 -0400863 if (rc) {
864 printk(KERN_WARNING
865 "%s: security_fs_use(%s) returned %d\n",
866 __func__, sb->s_type->name, rc);
867 goto out;
868 }
Eric Parisc9180a52007-11-30 13:00:35 -0500869 }
Seth Forsheeaad82892016-04-26 14:36:20 -0500870
871 /*
Stephen Smalley01593d32017-01-09 10:07:31 -0500872 * If this is a user namespace mount and the filesystem type is not
873 * explicitly whitelisted, then no contexts are allowed on the command
874 * line and security labels must be ignored.
Seth Forsheeaad82892016-04-26 14:36:20 -0500875 */
Stephen Smalley01593d32017-01-09 10:07:31 -0500876 if (sb->s_user_ns != &init_user_ns &&
877 strcmp(sb->s_type->name, "tmpfs") &&
878 strcmp(sb->s_type->name, "ramfs") &&
879 strcmp(sb->s_type->name, "devpts")) {
Seth Forsheeaad82892016-04-26 14:36:20 -0500880 if (context_sid || fscontext_sid || rootcontext_sid ||
881 defcontext_sid) {
882 rc = -EACCES;
883 goto out;
884 }
885 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
886 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500887 rc = security_transition_sid(&selinux_state,
888 current_sid(),
889 current_sid(),
Seth Forsheeaad82892016-04-26 14:36:20 -0500890 SECCLASS_FILE, NULL,
891 &sbsec->mntpoint_sid);
892 if (rc)
893 goto out;
894 }
895 goto out_set_opts;
896 }
897
Eric Parisc9180a52007-11-30 13:00:35 -0500898 /* sets the context of the superblock for the fs being mounted. */
899 if (fscontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100900 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500901 if (rc)
902 goto out;
903
904 sbsec->sid = fscontext_sid;
905 }
906
907 /*
908 * Switch to using mount point labeling behavior.
909 * sets the label used on all file below the mountpoint, and will set
910 * the superblock context if not already set.
911 */
David Quigleyeb9ae682013-05-22 12:50:37 -0400912 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
913 sbsec->behavior = SECURITY_FS_USE_NATIVE;
914 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
915 }
916
Eric Parisc9180a52007-11-30 13:00:35 -0500917 if (context_sid) {
918 if (!fscontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100919 rc = may_context_mount_sb_relabel(context_sid, sbsec,
920 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500921 if (rc)
922 goto out;
923 sbsec->sid = context_sid;
924 } else {
David Howells275bb412008-11-14 10:39:19 +1100925 rc = may_context_mount_inode_relabel(context_sid, sbsec,
926 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500927 if (rc)
928 goto out;
929 }
930 if (!rootcontext_sid)
931 rootcontext_sid = context_sid;
932
933 sbsec->mntpoint_sid = context_sid;
934 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
935 }
936
937 if (rootcontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100938 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
939 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500940 if (rc)
941 goto out;
942
943 root_isec->sid = rootcontext_sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -0500944 root_isec->initialized = LABEL_INITIALIZED;
Eric Parisc9180a52007-11-30 13:00:35 -0500945 }
946
947 if (defcontext_sid) {
David Quigleyeb9ae682013-05-22 12:50:37 -0400948 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
949 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
Eric Parisc9180a52007-11-30 13:00:35 -0500950 rc = -EINVAL;
951 printk(KERN_WARNING "SELinux: defcontext option is "
952 "invalid for this filesystem type\n");
953 goto out;
954 }
955
956 if (defcontext_sid != sbsec->def_sid) {
957 rc = may_context_mount_inode_relabel(defcontext_sid,
David Howells275bb412008-11-14 10:39:19 +1100958 sbsec, cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500959 if (rc)
960 goto out;
961 }
962
963 sbsec->def_sid = defcontext_sid;
964 }
965
Seth Forsheeaad82892016-04-26 14:36:20 -0500966out_set_opts:
Eric Parisc9180a52007-11-30 13:00:35 -0500967 rc = sb_finish_set_opts(sb);
968out:
Eric Parisbc7e9822006-09-25 23:32:02 -0700969 mutex_unlock(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700970 return rc;
Eric Parisc9180a52007-11-30 13:00:35 -0500971out_double_mount:
972 rc = -EINVAL;
973 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800974 "security settings for (dev %s, type %s)\n", sb->s_id, name);
Eric Parisc9180a52007-11-30 13:00:35 -0500975 goto out;
976}
977
Jeff Layton094f7b62013-04-01 08:14:24 -0400978static int selinux_cmp_sb_context(const struct super_block *oldsb,
979 const struct super_block *newsb)
980{
981 struct superblock_security_struct *old = oldsb->s_security;
982 struct superblock_security_struct *new = newsb->s_security;
983 char oldflags = old->flags & SE_MNTMASK;
984 char newflags = new->flags & SE_MNTMASK;
985
986 if (oldflags != newflags)
987 goto mismatch;
988 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
989 goto mismatch;
990 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
991 goto mismatch;
992 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
993 goto mismatch;
994 if (oldflags & ROOTCONTEXT_MNT) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500995 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
996 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
Jeff Layton094f7b62013-04-01 08:14:24 -0400997 if (oldroot->sid != newroot->sid)
998 goto mismatch;
999 }
1000 return 0;
1001mismatch:
1002 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, "
1003 "different security settings for (dev %s, "
1004 "type %s)\n", newsb->s_id, newsb->s_type->name);
1005 return -EBUSY;
1006}
1007
1008static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001009 struct super_block *newsb,
1010 unsigned long kern_flags,
1011 unsigned long *set_kern_flags)
Eric Parisc9180a52007-11-30 13:00:35 -05001012{
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001013 int rc = 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001014 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
1015 struct superblock_security_struct *newsbsec = newsb->s_security;
1016
1017 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
1018 int set_context = (oldsbsec->flags & CONTEXT_MNT);
1019 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
1020
Eric Paris0f5e6422008-04-21 16:24:11 -04001021 /*
1022 * if the parent was able to be mounted it clearly had no special lsm
Al Viroe8c26252010-03-23 06:36:54 -04001023 * mount options. thus we can safely deal with this superblock later
Eric Paris0f5e6422008-04-21 16:24:11 -04001024 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001025 if (!selinux_state.initialized)
Jeff Layton094f7b62013-04-01 08:14:24 -04001026 return 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001027
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001028 /*
1029 * Specifying internal flags without providing a place to
1030 * place the results is not allowed.
1031 */
1032 if (kern_flags && !set_kern_flags)
1033 return -EINVAL;
1034
Eric Parisc9180a52007-11-30 13:00:35 -05001035 /* how can we clone if the old one wasn't set up?? */
David P. Quigley0d90a7e2009-01-16 09:22:02 -05001036 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
Eric Parisc9180a52007-11-30 13:00:35 -05001037
Jeff Layton094f7b62013-04-01 08:14:24 -04001038 /* if fs is reusing a sb, make sure that the contexts match */
David P. Quigley0d90a7e2009-01-16 09:22:02 -05001039 if (newsbsec->flags & SE_SBINITIALIZED)
Jeff Layton094f7b62013-04-01 08:14:24 -04001040 return selinux_cmp_sb_context(oldsb, newsb);
Eric Paris5a552612008-04-09 14:08:35 -04001041
Eric Parisc9180a52007-11-30 13:00:35 -05001042 mutex_lock(&newsbsec->lock);
1043
1044 newsbsec->flags = oldsbsec->flags;
1045
1046 newsbsec->sid = oldsbsec->sid;
1047 newsbsec->def_sid = oldsbsec->def_sid;
1048 newsbsec->behavior = oldsbsec->behavior;
1049
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001050 if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
1051 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001052 rc = security_fs_use(&selinux_state, newsb);
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001053 if (rc)
1054 goto out;
1055 }
1056
1057 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
1058 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
1059 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
1060 }
1061
Eric Parisc9180a52007-11-30 13:00:35 -05001062 if (set_context) {
1063 u32 sid = oldsbsec->mntpoint_sid;
1064
1065 if (!set_fscontext)
1066 newsbsec->sid = sid;
1067 if (!set_rootcontext) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001068 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
Eric Parisc9180a52007-11-30 13:00:35 -05001069 newisec->sid = sid;
1070 }
1071 newsbsec->mntpoint_sid = sid;
1072 }
1073 if (set_rootcontext) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001074 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
1075 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
Eric Parisc9180a52007-11-30 13:00:35 -05001076
1077 newisec->sid = oldisec->sid;
1078 }
1079
1080 sb_finish_set_opts(newsb);
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001081out:
Eric Parisc9180a52007-11-30 13:00:35 -05001082 mutex_unlock(&newsbsec->lock);
Scott Mayhew0b4d3452017-06-05 11:45:04 -04001083 return rc;
Eric Parisc9180a52007-11-30 13:00:35 -05001084}
1085
Adrian Bunk2e1479d2008-03-17 22:29:23 +02001086static int selinux_parse_opts_str(char *options,
1087 struct security_mnt_opts *opts)
Eric Parisc9180a52007-11-30 13:00:35 -05001088{
Eric Parise0007522008-03-05 10:31:54 -05001089 char *p;
Eric Parisc9180a52007-11-30 13:00:35 -05001090 char *context = NULL, *defcontext = NULL;
1091 char *fscontext = NULL, *rootcontext = NULL;
Eric Parise0007522008-03-05 10:31:54 -05001092 int rc, num_mnt_opts = 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001093
Eric Parise0007522008-03-05 10:31:54 -05001094 opts->num_mnt_opts = 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001095
1096 /* Standard string-based options. */
1097 while ((p = strsep(&options, "|")) != NULL) {
1098 int token;
1099 substring_t args[MAX_OPT_ARGS];
1100
1101 if (!*p)
1102 continue;
1103
1104 token = match_token(p, tokens, args);
1105
1106 switch (token) {
1107 case Opt_context:
1108 if (context || defcontext) {
1109 rc = -EINVAL;
1110 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1111 goto out_err;
1112 }
1113 context = match_strdup(&args[0]);
1114 if (!context) {
1115 rc = -ENOMEM;
1116 goto out_err;
1117 }
1118 break;
1119
1120 case Opt_fscontext:
1121 if (fscontext) {
1122 rc = -EINVAL;
1123 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1124 goto out_err;
1125 }
1126 fscontext = match_strdup(&args[0]);
1127 if (!fscontext) {
1128 rc = -ENOMEM;
1129 goto out_err;
1130 }
1131 break;
1132
1133 case Opt_rootcontext:
1134 if (rootcontext) {
1135 rc = -EINVAL;
1136 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1137 goto out_err;
1138 }
1139 rootcontext = match_strdup(&args[0]);
1140 if (!rootcontext) {
1141 rc = -ENOMEM;
1142 goto out_err;
1143 }
1144 break;
1145
1146 case Opt_defcontext:
1147 if (context || defcontext) {
1148 rc = -EINVAL;
1149 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1150 goto out_err;
1151 }
1152 defcontext = match_strdup(&args[0]);
1153 if (!defcontext) {
1154 rc = -ENOMEM;
1155 goto out_err;
1156 }
1157 break;
David P. Quigley11689d42009-01-16 09:22:03 -05001158 case Opt_labelsupport:
1159 break;
Eric Parisc9180a52007-11-30 13:00:35 -05001160 default:
1161 rc = -EINVAL;
1162 printk(KERN_WARNING "SELinux: unknown mount option\n");
1163 goto out_err;
1164
1165 }
1166 }
1167
Eric Parise0007522008-03-05 10:31:54 -05001168 rc = -ENOMEM;
Tetsuo Handa8931c3b2016-11-14 20:16:12 +09001169 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_KERNEL);
Eric Parise0007522008-03-05 10:31:54 -05001170 if (!opts->mnt_opts)
1171 goto out_err;
1172
Tetsuo Handa8931c3b2016-11-14 20:16:12 +09001173 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int),
1174 GFP_KERNEL);
Paul Moore023f1082017-06-07 16:48:19 -04001175 if (!opts->mnt_opts_flags)
Eric Parise0007522008-03-05 10:31:54 -05001176 goto out_err;
Eric Parisc9180a52007-11-30 13:00:35 -05001177
Eric Parise0007522008-03-05 10:31:54 -05001178 if (fscontext) {
1179 opts->mnt_opts[num_mnt_opts] = fscontext;
1180 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1181 }
1182 if (context) {
1183 opts->mnt_opts[num_mnt_opts] = context;
1184 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1185 }
1186 if (rootcontext) {
1187 opts->mnt_opts[num_mnt_opts] = rootcontext;
1188 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1189 }
1190 if (defcontext) {
1191 opts->mnt_opts[num_mnt_opts] = defcontext;
1192 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1193 }
1194
1195 opts->num_mnt_opts = num_mnt_opts;
1196 return 0;
1197
Eric Parisc9180a52007-11-30 13:00:35 -05001198out_err:
Paul Moore023f1082017-06-07 16:48:19 -04001199 security_free_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -05001200 kfree(context);
1201 kfree(defcontext);
1202 kfree(fscontext);
1203 kfree(rootcontext);
1204 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001205}
Eric Parise0007522008-03-05 10:31:54 -05001206/*
1207 * string mount options parsing and call set the sbsec
1208 */
1209static int superblock_doinit(struct super_block *sb, void *data)
1210{
1211 int rc = 0;
1212 char *options = data;
1213 struct security_mnt_opts opts;
1214
1215 security_init_mnt_opts(&opts);
1216
1217 if (!data)
1218 goto out;
1219
1220 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1221
1222 rc = selinux_parse_opts_str(options, &opts);
1223 if (rc)
1224 goto out_err;
1225
1226out:
David Quigley649f6e72013-05-22 12:50:36 -04001227 rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
Eric Parise0007522008-03-05 10:31:54 -05001228
1229out_err:
1230 security_free_mnt_opts(&opts);
1231 return rc;
1232}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001233
Adrian Bunk3583a712008-07-22 20:21:23 +03001234static void selinux_write_opts(struct seq_file *m,
1235 struct security_mnt_opts *opts)
Eric Paris2069f452008-07-04 09:47:13 +10001236{
1237 int i;
1238 char *prefix;
1239
1240 for (i = 0; i < opts->num_mnt_opts; i++) {
David P. Quigley11689d42009-01-16 09:22:03 -05001241 char *has_comma;
1242
1243 if (opts->mnt_opts[i])
1244 has_comma = strchr(opts->mnt_opts[i], ',');
1245 else
1246 has_comma = NULL;
Eric Paris2069f452008-07-04 09:47:13 +10001247
1248 switch (opts->mnt_opts_flags[i]) {
1249 case CONTEXT_MNT:
1250 prefix = CONTEXT_STR;
1251 break;
1252 case FSCONTEXT_MNT:
1253 prefix = FSCONTEXT_STR;
1254 break;
1255 case ROOTCONTEXT_MNT:
1256 prefix = ROOTCONTEXT_STR;
1257 break;
1258 case DEFCONTEXT_MNT:
1259 prefix = DEFCONTEXT_STR;
1260 break;
Eric Paris12f348b2012-10-09 10:56:25 -04001261 case SBLABEL_MNT:
David P. Quigley11689d42009-01-16 09:22:03 -05001262 seq_putc(m, ',');
1263 seq_puts(m, LABELSUPP_STR);
1264 continue;
Eric Paris2069f452008-07-04 09:47:13 +10001265 default:
1266 BUG();
Eric Parisa35c6c832011-04-20 10:21:28 -04001267 return;
Eric Paris2069f452008-07-04 09:47:13 +10001268 };
1269 /* we need a comma before each option */
1270 seq_putc(m, ',');
1271 seq_puts(m, prefix);
1272 if (has_comma)
1273 seq_putc(m, '\"');
Kees Cooka068acf2015-09-04 15:44:57 -07001274 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
Eric Paris2069f452008-07-04 09:47:13 +10001275 if (has_comma)
1276 seq_putc(m, '\"');
1277 }
1278}
1279
1280static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1281{
1282 struct security_mnt_opts opts;
1283 int rc;
1284
1285 rc = selinux_get_mnt_opts(sb, &opts);
Eric Paris383795c2008-07-29 17:07:26 -04001286 if (rc) {
1287 /* before policy load we may get EINVAL, don't show anything */
1288 if (rc == -EINVAL)
1289 rc = 0;
Eric Paris2069f452008-07-04 09:47:13 +10001290 return rc;
Eric Paris383795c2008-07-29 17:07:26 -04001291 }
Eric Paris2069f452008-07-04 09:47:13 +10001292
1293 selinux_write_opts(m, &opts);
1294
1295 security_free_mnt_opts(&opts);
1296
1297 return rc;
1298}
1299
Linus Torvalds1da177e2005-04-16 15:20:36 -07001300static inline u16 inode_mode_to_security_class(umode_t mode)
1301{
1302 switch (mode & S_IFMT) {
1303 case S_IFSOCK:
1304 return SECCLASS_SOCK_FILE;
1305 case S_IFLNK:
1306 return SECCLASS_LNK_FILE;
1307 case S_IFREG:
1308 return SECCLASS_FILE;
1309 case S_IFBLK:
1310 return SECCLASS_BLK_FILE;
1311 case S_IFDIR:
1312 return SECCLASS_DIR;
1313 case S_IFCHR:
1314 return SECCLASS_CHR_FILE;
1315 case S_IFIFO:
1316 return SECCLASS_FIFO_FILE;
1317
1318 }
1319
1320 return SECCLASS_FILE;
1321}
1322
James Morris13402582005-09-30 14:24:34 -04001323static inline int default_protocol_stream(int protocol)
1324{
1325 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1326}
1327
1328static inline int default_protocol_dgram(int protocol)
1329{
1330 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1331}
1332
Linus Torvalds1da177e2005-04-16 15:20:36 -07001333static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1334{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001335 int extsockclass = selinux_policycap_extsockclass();
Stephen Smalleyda69a532017-01-09 10:07:30 -05001336
Linus Torvalds1da177e2005-04-16 15:20:36 -07001337 switch (family) {
1338 case PF_UNIX:
1339 switch (type) {
1340 case SOCK_STREAM:
1341 case SOCK_SEQPACKET:
1342 return SECCLASS_UNIX_STREAM_SOCKET;
1343 case SOCK_DGRAM:
Luis Ressel2a764b52017-07-25 15:13:41 -04001344 case SOCK_RAW:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001345 return SECCLASS_UNIX_DGRAM_SOCKET;
1346 }
1347 break;
1348 case PF_INET:
1349 case PF_INET6:
1350 switch (type) {
1351 case SOCK_STREAM:
Stephen Smalleyda69a532017-01-09 10:07:30 -05001352 case SOCK_SEQPACKET:
James Morris13402582005-09-30 14:24:34 -04001353 if (default_protocol_stream(protocol))
1354 return SECCLASS_TCP_SOCKET;
Stephen Smalleyda69a532017-01-09 10:07:30 -05001355 else if (extsockclass && protocol == IPPROTO_SCTP)
1356 return SECCLASS_SCTP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001357 else
1358 return SECCLASS_RAWIP_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001359 case SOCK_DGRAM:
James Morris13402582005-09-30 14:24:34 -04001360 if (default_protocol_dgram(protocol))
1361 return SECCLASS_UDP_SOCKET;
Stephen Smalleyef379792017-01-09 10:07:31 -05001362 else if (extsockclass && (protocol == IPPROTO_ICMP ||
1363 protocol == IPPROTO_ICMPV6))
Stephen Smalleyda69a532017-01-09 10:07:30 -05001364 return SECCLASS_ICMP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001365 else
1366 return SECCLASS_RAWIP_SOCKET;
James Morris2ee92d42006-11-13 16:09:01 -08001367 case SOCK_DCCP:
1368 return SECCLASS_DCCP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001369 default:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001370 return SECCLASS_RAWIP_SOCKET;
1371 }
1372 break;
1373 case PF_NETLINK:
1374 switch (protocol) {
1375 case NETLINK_ROUTE:
1376 return SECCLASS_NETLINK_ROUTE_SOCKET;
Pavel Emelyanov7f1fb602011-12-06 07:56:43 +00001377 case NETLINK_SOCK_DIAG:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001378 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1379 case NETLINK_NFLOG:
1380 return SECCLASS_NETLINK_NFLOG_SOCKET;
1381 case NETLINK_XFRM:
1382 return SECCLASS_NETLINK_XFRM_SOCKET;
1383 case NETLINK_SELINUX:
1384 return SECCLASS_NETLINK_SELINUX_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001385 case NETLINK_ISCSI:
1386 return SECCLASS_NETLINK_ISCSI_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001387 case NETLINK_AUDIT:
1388 return SECCLASS_NETLINK_AUDIT_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001389 case NETLINK_FIB_LOOKUP:
1390 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1391 case NETLINK_CONNECTOR:
1392 return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1393 case NETLINK_NETFILTER:
1394 return SECCLASS_NETLINK_NETFILTER_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001395 case NETLINK_DNRTMSG:
1396 return SECCLASS_NETLINK_DNRT_SOCKET;
James Morris0c9b7942005-04-16 15:24:13 -07001397 case NETLINK_KOBJECT_UEVENT:
1398 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001399 case NETLINK_GENERIC:
1400 return SECCLASS_NETLINK_GENERIC_SOCKET;
1401 case NETLINK_SCSITRANSPORT:
1402 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1403 case NETLINK_RDMA:
1404 return SECCLASS_NETLINK_RDMA_SOCKET;
1405 case NETLINK_CRYPTO:
1406 return SECCLASS_NETLINK_CRYPTO_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001407 default:
1408 return SECCLASS_NETLINK_SOCKET;
1409 }
1410 case PF_PACKET:
1411 return SECCLASS_PACKET_SOCKET;
1412 case PF_KEY:
1413 return SECCLASS_KEY_SOCKET;
Christopher J. PeBenito3e3ff152006-06-09 00:25:03 -07001414 case PF_APPLETALK:
1415 return SECCLASS_APPLETALK_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001416 }
1417
Stephen Smalleyda69a532017-01-09 10:07:30 -05001418 if (extsockclass) {
1419 switch (family) {
1420 case PF_AX25:
1421 return SECCLASS_AX25_SOCKET;
1422 case PF_IPX:
1423 return SECCLASS_IPX_SOCKET;
1424 case PF_NETROM:
1425 return SECCLASS_NETROM_SOCKET;
Stephen Smalleyda69a532017-01-09 10:07:30 -05001426 case PF_ATMPVC:
1427 return SECCLASS_ATMPVC_SOCKET;
1428 case PF_X25:
1429 return SECCLASS_X25_SOCKET;
1430 case PF_ROSE:
1431 return SECCLASS_ROSE_SOCKET;
1432 case PF_DECnet:
1433 return SECCLASS_DECNET_SOCKET;
1434 case PF_ATMSVC:
1435 return SECCLASS_ATMSVC_SOCKET;
1436 case PF_RDS:
1437 return SECCLASS_RDS_SOCKET;
1438 case PF_IRDA:
1439 return SECCLASS_IRDA_SOCKET;
1440 case PF_PPPOX:
1441 return SECCLASS_PPPOX_SOCKET;
1442 case PF_LLC:
1443 return SECCLASS_LLC_SOCKET;
Stephen Smalleyda69a532017-01-09 10:07:30 -05001444 case PF_CAN:
1445 return SECCLASS_CAN_SOCKET;
1446 case PF_TIPC:
1447 return SECCLASS_TIPC_SOCKET;
1448 case PF_BLUETOOTH:
1449 return SECCLASS_BLUETOOTH_SOCKET;
1450 case PF_IUCV:
1451 return SECCLASS_IUCV_SOCKET;
1452 case PF_RXRPC:
1453 return SECCLASS_RXRPC_SOCKET;
1454 case PF_ISDN:
1455 return SECCLASS_ISDN_SOCKET;
1456 case PF_PHONET:
1457 return SECCLASS_PHONET_SOCKET;
1458 case PF_IEEE802154:
1459 return SECCLASS_IEEE802154_SOCKET;
1460 case PF_CAIF:
1461 return SECCLASS_CAIF_SOCKET;
1462 case PF_ALG:
1463 return SECCLASS_ALG_SOCKET;
1464 case PF_NFC:
1465 return SECCLASS_NFC_SOCKET;
1466 case PF_VSOCK:
1467 return SECCLASS_VSOCK_SOCKET;
1468 case PF_KCM:
1469 return SECCLASS_KCM_SOCKET;
1470 case PF_QIPCRTR:
1471 return SECCLASS_QIPCRTR_SOCKET;
Linus Torvalds3051bf32017-02-22 10:15:09 -08001472 case PF_SMC:
1473 return SECCLASS_SMC_SOCKET;
1474#if PF_MAX > 44
Stephen Smalleyda69a532017-01-09 10:07:30 -05001475#error New address family defined, please update this function.
1476#endif
1477 }
1478 }
1479
Linus Torvalds1da177e2005-04-16 15:20:36 -07001480 return SECCLASS_SOCKET;
1481}
1482
Stephen Smalley134509d2015-06-04 16:22:17 -04001483static int selinux_genfs_get_sid(struct dentry *dentry,
1484 u16 tclass,
1485 u16 flags,
1486 u32 *sid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001487{
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001488 int rc;
Al Virofc640052016-04-10 01:33:30 -04001489 struct super_block *sb = dentry->d_sb;
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001490 char *buffer, *path;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001491
Eric Paris828dfe12008-04-17 13:17:49 -04001492 buffer = (char *)__get_free_page(GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001493 if (!buffer)
1494 return -ENOMEM;
1495
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001496 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1497 if (IS_ERR(path))
1498 rc = PTR_ERR(path);
1499 else {
Stephen Smalley134509d2015-06-04 16:22:17 -04001500 if (flags & SE_SBPROC) {
1501 /* each process gets a /proc/PID/ entry. Strip off the
1502 * PID part to get a valid selinux labeling.
1503 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1504 while (path[1] >= '0' && path[1] <= '9') {
1505 path[1] = '/';
1506 path++;
1507 }
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001508 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001509 rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1510 path, tclass, sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001511 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001512 free_page((unsigned long)buffer);
1513 return rc;
1514}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001515
1516/* The inode's security attributes must be initialized before first use. */
1517static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1518{
1519 struct superblock_security_struct *sbsec = NULL;
1520 struct inode_security_struct *isec = inode->i_security;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001521 u32 task_sid, sid = 0;
1522 u16 sclass;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001523 struct dentry *dentry;
1524#define INITCONTEXTLEN 255
1525 char *context = NULL;
1526 unsigned len = 0;
1527 int rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001528
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05001529 if (isec->initialized == LABEL_INITIALIZED)
Andreas Gruenbacher13457d02016-11-10 22:18:29 +01001530 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001531
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001532 spin_lock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05001533 if (isec->initialized == LABEL_INITIALIZED)
Eric Paris23970742006-09-25 23:32:01 -07001534 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001535
Andreas Gruenbacher13457d02016-11-10 22:18:29 +01001536 if (isec->sclass == SECCLASS_FILE)
1537 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1538
Linus Torvalds1da177e2005-04-16 15:20:36 -07001539 sbsec = inode->i_sb->s_security;
David P. Quigley0d90a7e2009-01-16 09:22:02 -05001540 if (!(sbsec->flags & SE_SBINITIALIZED)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001541 /* Defer initialization until selinux_complete_init,
1542 after the initial policy is loaded and the security
1543 server is ready to handle calls. */
1544 spin_lock(&sbsec->isec_lock);
1545 if (list_empty(&isec->list))
1546 list_add(&isec->list, &sbsec->isec_head);
1547 spin_unlock(&sbsec->isec_lock);
Eric Paris23970742006-09-25 23:32:01 -07001548 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001549 }
1550
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001551 sclass = isec->sclass;
1552 task_sid = isec->task_sid;
1553 sid = isec->sid;
1554 isec->initialized = LABEL_PENDING;
1555 spin_unlock(&isec->lock);
1556
Linus Torvalds1da177e2005-04-16 15:20:36 -07001557 switch (sbsec->behavior) {
David Quigleyeb9ae682013-05-22 12:50:37 -04001558 case SECURITY_FS_USE_NATIVE:
1559 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001560 case SECURITY_FS_USE_XATTR:
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001561 if (!(inode->i_opflags & IOP_XATTR)) {
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001562 sid = sbsec->def_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001563 break;
1564 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001565 /* Need a dentry, since the xattr API requires one.
1566 Life would be simpler if we could just pass the inode. */
1567 if (opt_dentry) {
1568 /* Called from d_instantiate or d_splice_alias. */
1569 dentry = dget(opt_dentry);
1570 } else {
1571 /* Called from selinux_complete_init, try to find a dentry. */
1572 dentry = d_find_alias(inode);
1573 }
1574 if (!dentry) {
Eric Parisdf7f54c2009-03-09 14:35:58 -04001575 /*
1576 * this is can be hit on boot when a file is accessed
1577 * before the policy is loaded. When we load policy we
1578 * may find inodes that have no dentry on the
1579 * sbsec->isec_head list. No reason to complain as these
1580 * will get fixed up the next time we go through
1581 * inode_doinit with a dentry, before these inodes could
1582 * be used again by userspace.
1583 */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001584 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001585 }
1586
1587 len = INITCONTEXTLEN;
Eric Paris4cb912f2009-02-12 14:50:05 -05001588 context = kmalloc(len+1, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001589 if (!context) {
1590 rc = -ENOMEM;
1591 dput(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001592 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001593 }
Eric Paris4cb912f2009-02-12 14:50:05 -05001594 context[len] = '\0';
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001595 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001596 if (rc == -ERANGE) {
James Morris314dabb2009-08-10 22:00:13 +10001597 kfree(context);
1598
Linus Torvalds1da177e2005-04-16 15:20:36 -07001599 /* Need a larger buffer. Query for the right size. */
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001600 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001601 if (rc < 0) {
1602 dput(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001603 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001604 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001605 len = rc;
Eric Paris4cb912f2009-02-12 14:50:05 -05001606 context = kmalloc(len+1, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001607 if (!context) {
1608 rc = -ENOMEM;
1609 dput(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001610 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001611 }
Eric Paris4cb912f2009-02-12 14:50:05 -05001612 context[len] = '\0';
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001613 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001614 }
1615 dput(dentry);
1616 if (rc < 0) {
1617 if (rc != -ENODATA) {
Eric Paris744ba352008-04-17 11:52:44 -04001618 printk(KERN_WARNING "SELinux: %s: getxattr returned "
Harvey Harrisondd6f9532008-03-06 10:03:59 +11001619 "%d for dev=%s ino=%ld\n", __func__,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001620 -rc, inode->i_sb->s_id, inode->i_ino);
1621 kfree(context);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001622 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001623 }
1624 /* Map ENODATA to the default file SID */
1625 sid = sbsec->def_sid;
1626 rc = 0;
1627 } else {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001628 rc = security_context_to_sid_default(&selinux_state,
1629 context, rc, &sid,
Stephen Smalley869ab512008-04-04 08:46:05 -04001630 sbsec->def_sid,
1631 GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001632 if (rc) {
Eric Paris4ba0a8a2009-02-12 15:01:10 -05001633 char *dev = inode->i_sb->s_id;
1634 unsigned long ino = inode->i_ino;
1635
1636 if (rc == -EINVAL) {
1637 if (printk_ratelimit())
1638 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1639 "context=%s. This indicates you may need to relabel the inode or the "
1640 "filesystem in question.\n", ino, dev, context);
1641 } else {
1642 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1643 "returned %d for dev=%s ino=%ld\n",
1644 __func__, context, -rc, dev, ino);
1645 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001646 kfree(context);
1647 /* Leave with the unlabeled SID */
1648 rc = 0;
1649 break;
1650 }
1651 }
1652 kfree(context);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001653 break;
1654 case SECURITY_FS_USE_TASK:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001655 sid = task_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001656 break;
1657 case SECURITY_FS_USE_TRANS:
1658 /* Default to the fs SID. */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001659 sid = sbsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001660
1661 /* Try to obtain a transition SID. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001662 rc = security_transition_sid(&selinux_state, task_sid, sid,
1663 sclass, NULL, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001664 if (rc)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001665 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001666 break;
Eric Parisc312feb2006-07-10 04:43:53 -07001667 case SECURITY_FS_USE_MNTPOINT:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001668 sid = sbsec->mntpoint_sid;
Eric Parisc312feb2006-07-10 04:43:53 -07001669 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001670 default:
Eric Parisc312feb2006-07-10 04:43:53 -07001671 /* Default to the fs superblock SID. */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001672 sid = sbsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001673
Stephen Smalley134509d2015-06-04 16:22:17 -04001674 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
Paul Mooref64410e2014-03-19 16:46:18 -04001675 /* We must have a dentry to determine the label on
1676 * procfs inodes */
1677 if (opt_dentry)
1678 /* Called from d_instantiate or
1679 * d_splice_alias. */
1680 dentry = dget(opt_dentry);
1681 else
1682 /* Called from selinux_complete_init, try to
1683 * find a dentry. */
1684 dentry = d_find_alias(inode);
1685 /*
1686 * This can be hit on boot when a file is accessed
1687 * before the policy is loaded. When we load policy we
1688 * may find inodes that have no dentry on the
1689 * sbsec->isec_head list. No reason to complain as
1690 * these will get fixed up the next time we go through
1691 * inode_doinit() with a dentry, before these inodes
1692 * could be used again by userspace.
1693 */
1694 if (!dentry)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001695 goto out;
1696 rc = selinux_genfs_get_sid(dentry, sclass,
Stephen Smalley134509d2015-06-04 16:22:17 -04001697 sbsec->flags, &sid);
Paul Mooref64410e2014-03-19 16:46:18 -04001698 dput(dentry);
1699 if (rc)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001700 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001701 }
1702 break;
1703 }
1704
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001705out:
1706 spin_lock(&isec->lock);
1707 if (isec->initialized == LABEL_PENDING) {
1708 if (!sid || rc) {
1709 isec->initialized = LABEL_INVALID;
1710 goto out_unlock;
1711 }
1712
1713 isec->initialized = LABEL_INITIALIZED;
1714 isec->sid = sid;
1715 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001716
Eric Paris23970742006-09-25 23:32:01 -07001717out_unlock:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001718 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001719 return rc;
1720}
1721
1722/* Convert a Linux signal to an access vector. */
1723static inline u32 signal_to_av(int sig)
1724{
1725 u32 perm = 0;
1726
1727 switch (sig) {
1728 case SIGCHLD:
1729 /* Commonly granted from child to parent. */
1730 perm = PROCESS__SIGCHLD;
1731 break;
1732 case SIGKILL:
1733 /* Cannot be caught or ignored */
1734 perm = PROCESS__SIGKILL;
1735 break;
1736 case SIGSTOP:
1737 /* Cannot be caught or ignored */
1738 perm = PROCESS__SIGSTOP;
1739 break;
1740 default:
1741 /* All other signals. */
1742 perm = PROCESS__SIGNAL;
1743 break;
1744 }
1745
1746 return perm;
1747}
1748
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001749#if CAP_LAST_CAP > 63
1750#error Fix SELinux to handle capabilities > 63.
1751#endif
1752
Linus Torvalds1da177e2005-04-16 15:20:36 -07001753/* Check whether a task is allowed to use a capability. */
Eric Paris6a9de492012-01-03 12:25:14 -05001754static int cred_has_capability(const struct cred *cred,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001755 int cap, int audit, bool initns)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001756{
Thomas Liu2bf49692009-07-14 12:14:09 -04001757 struct common_audit_data ad;
Eric Paris06112162008-11-11 22:02:50 +11001758 struct av_decision avd;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001759 u16 sclass;
David Howells3699c532009-01-06 22:27:01 +00001760 u32 sid = cred_sid(cred);
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001761 u32 av = CAP_TO_MASK(cap);
Eric Paris06112162008-11-11 22:02:50 +11001762 int rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001763
Eric Paris50c205f2012-04-04 15:01:43 -04001764 ad.type = LSM_AUDIT_DATA_CAP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001765 ad.u.cap = cap;
1766
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001767 switch (CAP_TO_INDEX(cap)) {
1768 case 0:
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001769 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001770 break;
1771 case 1:
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001772 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001773 break;
1774 default:
1775 printk(KERN_ERR
1776 "SELinux: out of range capability %d\n", cap);
1777 BUG();
Eric Parisa35c6c832011-04-20 10:21:28 -04001778 return -EINVAL;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001779 }
Eric Paris06112162008-11-11 22:02:50 +11001780
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001781 rc = avc_has_perm_noaudit(&selinux_state,
1782 sid, sid, sclass, av, 0, &avd);
Eric Paris9ade0cf2011-04-25 16:26:29 -04001783 if (audit == SECURITY_CAP_AUDIT) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001784 int rc2 = avc_audit(&selinux_state,
1785 sid, sid, sclass, av, &avd, rc, &ad, 0);
Eric Paris9ade0cf2011-04-25 16:26:29 -04001786 if (rc2)
1787 return rc2;
1788 }
Eric Paris06112162008-11-11 22:02:50 +11001789 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001790}
1791
Linus Torvalds1da177e2005-04-16 15:20:36 -07001792/* Check whether a task has a particular permission to an inode.
1793 The 'adp' parameter is optional and allows other audit
1794 data to be passed (e.g. the dentry). */
David Howells88e67f32008-11-14 10:39:21 +11001795static int inode_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001796 struct inode *inode,
1797 u32 perms,
Linus Torvalds19e49832013-10-04 12:54:11 -07001798 struct common_audit_data *adp)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001799{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001800 struct inode_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +11001801 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001802
David Howellse0e81732009-09-02 09:13:40 +01001803 validate_creds(cred);
1804
Eric Paris828dfe12008-04-17 13:17:49 -04001805 if (unlikely(IS_PRIVATE(inode)))
Stephen Smalleybbaca6c2007-02-14 00:34:16 -08001806 return 0;
1807
David Howells88e67f32008-11-14 10:39:21 +11001808 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001809 isec = inode->i_security;
1810
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001811 return avc_has_perm(&selinux_state,
1812 sid, isec->sid, isec->sclass, perms, adp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001813}
1814
1815/* Same as inode_has_perm, but pass explicit audit data containing
1816 the dentry to help the auditing code to more easily generate the
1817 pathname if needed. */
David Howells88e67f32008-11-14 10:39:21 +11001818static inline int dentry_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001819 struct dentry *dentry,
1820 u32 av)
1821{
David Howellsc6f493d2015-03-17 22:26:22 +00001822 struct inode *inode = d_backing_inode(dentry);
Thomas Liu2bf49692009-07-14 12:14:09 -04001823 struct common_audit_data ad;
David Howells88e67f32008-11-14 10:39:21 +11001824
Eric Paris50c205f2012-04-04 15:01:43 -04001825 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Paris2875fa02011-04-28 16:04:24 -04001826 ad.u.dentry = dentry;
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05001827 __inode_security_revalidate(inode, dentry, true);
Linus Torvalds19e49832013-10-04 12:54:11 -07001828 return inode_has_perm(cred, inode, av, &ad);
Eric Paris2875fa02011-04-28 16:04:24 -04001829}
1830
1831/* Same as inode_has_perm, but pass explicit audit data containing
1832 the path to help the auditing code to more easily generate the
1833 pathname if needed. */
1834static inline int path_has_perm(const struct cred *cred,
Al Viro3f7036a2015-03-08 19:28:30 -04001835 const struct path *path,
Eric Paris2875fa02011-04-28 16:04:24 -04001836 u32 av)
1837{
David Howellsc6f493d2015-03-17 22:26:22 +00001838 struct inode *inode = d_backing_inode(path->dentry);
Eric Paris2875fa02011-04-28 16:04:24 -04001839 struct common_audit_data ad;
1840
Eric Paris50c205f2012-04-04 15:01:43 -04001841 ad.type = LSM_AUDIT_DATA_PATH;
Eric Paris2875fa02011-04-28 16:04:24 -04001842 ad.u.path = *path;
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05001843 __inode_security_revalidate(inode, path->dentry, true);
Linus Torvalds19e49832013-10-04 12:54:11 -07001844 return inode_has_perm(cred, inode, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001845}
1846
David Howells13f8e982013-06-13 23:37:55 +01001847/* Same as path_has_perm, but uses the inode from the file struct. */
1848static inline int file_path_has_perm(const struct cred *cred,
1849 struct file *file,
1850 u32 av)
1851{
1852 struct common_audit_data ad;
1853
Vivek Goyal43af5de2016-09-09 11:37:49 -04001854 ad.type = LSM_AUDIT_DATA_FILE;
1855 ad.u.file = file;
Linus Torvalds19e49832013-10-04 12:54:11 -07001856 return inode_has_perm(cred, file_inode(file), av, &ad);
David Howells13f8e982013-06-13 23:37:55 +01001857}
1858
Chenbo Fengf66e4482017-10-18 13:00:26 -07001859#ifdef CONFIG_BPF_SYSCALL
1860static int bpf_fd_pass(struct file *file, u32 sid);
1861#endif
1862
Linus Torvalds1da177e2005-04-16 15:20:36 -07001863/* Check whether a task can use an open file descriptor to
1864 access an inode in a given way. Check access to the
1865 descriptor itself, and then use dentry_has_perm to
1866 check a particular permission to the file.
1867 Access to the descriptor is implicitly granted if it
1868 has the same SID as the process. If av is zero, then
1869 access to the file is not checked, e.g. for cases
1870 where only the descriptor is affected like seek. */
David Howells88e67f32008-11-14 10:39:21 +11001871static int file_has_perm(const struct cred *cred,
1872 struct file *file,
1873 u32 av)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001874{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001875 struct file_security_struct *fsec = file->f_security;
Al Viro496ad9a2013-01-23 17:07:38 -05001876 struct inode *inode = file_inode(file);
Thomas Liu2bf49692009-07-14 12:14:09 -04001877 struct common_audit_data ad;
David Howells88e67f32008-11-14 10:39:21 +11001878 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001879 int rc;
1880
Vivek Goyal43af5de2016-09-09 11:37:49 -04001881 ad.type = LSM_AUDIT_DATA_FILE;
1882 ad.u.file = file;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001883
David Howells275bb412008-11-14 10:39:19 +11001884 if (sid != fsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001885 rc = avc_has_perm(&selinux_state,
1886 sid, fsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001887 SECCLASS_FD,
1888 FD__USE,
1889 &ad);
1890 if (rc)
David Howells88e67f32008-11-14 10:39:21 +11001891 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001892 }
1893
Chenbo Fengf66e4482017-10-18 13:00:26 -07001894#ifdef CONFIG_BPF_SYSCALL
1895 rc = bpf_fd_pass(file, cred_sid(cred));
1896 if (rc)
1897 return rc;
1898#endif
1899
Linus Torvalds1da177e2005-04-16 15:20:36 -07001900 /* av is zero if only checking access to the descriptor. */
David Howells88e67f32008-11-14 10:39:21 +11001901 rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001902 if (av)
Linus Torvalds19e49832013-10-04 12:54:11 -07001903 rc = inode_has_perm(cred, inode, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001904
David Howells88e67f32008-11-14 10:39:21 +11001905out:
1906 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001907}
1908
David Howellsc3c188b2015-07-10 17:19:58 -04001909/*
1910 * Determine the label for an inode that might be unioned.
1911 */
Vivek Goyalc957f6d2016-07-13 10:44:51 -04001912static int
1913selinux_determine_inode_label(const struct task_security_struct *tsec,
1914 struct inode *dir,
1915 const struct qstr *name, u16 tclass,
1916 u32 *_new_isid)
David Howellsc3c188b2015-07-10 17:19:58 -04001917{
1918 const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
David Howellsc3c188b2015-07-10 17:19:58 -04001919
1920 if ((sbsec->flags & SE_SBINITIALIZED) &&
1921 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1922 *_new_isid = sbsec->mntpoint_sid;
1923 } else if ((sbsec->flags & SBLABEL_MNT) &&
1924 tsec->create_sid) {
1925 *_new_isid = tsec->create_sid;
1926 } else {
Paul Moore20cdef82016-04-04 14:14:42 -04001927 const struct inode_security_struct *dsec = inode_security(dir);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001928 return security_transition_sid(&selinux_state, tsec->sid,
1929 dsec->sid, tclass,
David Howellsc3c188b2015-07-10 17:19:58 -04001930 name, _new_isid);
1931 }
1932
1933 return 0;
1934}
1935
Linus Torvalds1da177e2005-04-16 15:20:36 -07001936/* Check whether a task can create a file. */
1937static int may_create(struct inode *dir,
1938 struct dentry *dentry,
1939 u16 tclass)
1940{
Paul Moore5fb49872010-04-22 14:46:19 -04001941 const struct task_security_struct *tsec = current_security();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001942 struct inode_security_struct *dsec;
1943 struct superblock_security_struct *sbsec;
David Howells275bb412008-11-14 10:39:19 +11001944 u32 sid, newsid;
Thomas Liu2bf49692009-07-14 12:14:09 -04001945 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001946 int rc;
1947
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001948 dsec = inode_security(dir);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001949 sbsec = dir->i_sb->s_security;
1950
David Howells275bb412008-11-14 10:39:19 +11001951 sid = tsec->sid;
David Howells275bb412008-11-14 10:39:19 +11001952
Eric Paris50c205f2012-04-04 15:01:43 -04001953 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04001954 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001955
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001956 rc = avc_has_perm(&selinux_state,
1957 sid, dsec->sid, SECCLASS_DIR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001958 DIR__ADD_NAME | DIR__SEARCH,
1959 &ad);
1960 if (rc)
1961 return rc;
1962
Vivek Goyalc957f6d2016-07-13 10:44:51 -04001963 rc = selinux_determine_inode_label(current_security(), dir,
1964 &dentry->d_name, tclass, &newsid);
David Howellsc3c188b2015-07-10 17:19:58 -04001965 if (rc)
1966 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001967
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001968 rc = avc_has_perm(&selinux_state,
1969 sid, newsid, tclass, FILE__CREATE, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001970 if (rc)
1971 return rc;
1972
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001973 return avc_has_perm(&selinux_state,
1974 newsid, sbsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001975 SECCLASS_FILESYSTEM,
1976 FILESYSTEM__ASSOCIATE, &ad);
1977}
1978
Eric Paris828dfe12008-04-17 13:17:49 -04001979#define MAY_LINK 0
1980#define MAY_UNLINK 1
1981#define MAY_RMDIR 2
Linus Torvalds1da177e2005-04-16 15:20:36 -07001982
1983/* Check whether a task can link, unlink, or rmdir a file/directory. */
1984static int may_link(struct inode *dir,
1985 struct dentry *dentry,
1986 int kind)
1987
1988{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001989 struct inode_security_struct *dsec, *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04001990 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11001991 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001992 u32 av;
1993 int rc;
1994
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001995 dsec = inode_security(dir);
1996 isec = backing_inode_security(dentry);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001997
Eric Paris50c205f2012-04-04 15:01:43 -04001998 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04001999 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002000
2001 av = DIR__SEARCH;
2002 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002003 rc = avc_has_perm(&selinux_state,
2004 sid, dsec->sid, SECCLASS_DIR, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002005 if (rc)
2006 return rc;
2007
2008 switch (kind) {
2009 case MAY_LINK:
2010 av = FILE__LINK;
2011 break;
2012 case MAY_UNLINK:
2013 av = FILE__UNLINK;
2014 break;
2015 case MAY_RMDIR:
2016 av = DIR__RMDIR;
2017 break;
2018 default:
Eric Paris744ba352008-04-17 11:52:44 -04002019 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
2020 __func__, kind);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002021 return 0;
2022 }
2023
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002024 rc = avc_has_perm(&selinux_state,
2025 sid, isec->sid, isec->sclass, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002026 return rc;
2027}
2028
2029static inline int may_rename(struct inode *old_dir,
2030 struct dentry *old_dentry,
2031 struct inode *new_dir,
2032 struct dentry *new_dentry)
2033{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002034 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04002035 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11002036 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002037 u32 av;
2038 int old_is_dir, new_is_dir;
2039 int rc;
2040
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002041 old_dsec = inode_security(old_dir);
2042 old_isec = backing_inode_security(old_dentry);
David Howellse36cb0b2015-01-29 12:02:35 +00002043 old_is_dir = d_is_dir(old_dentry);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002044 new_dsec = inode_security(new_dir);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002045
Eric Paris50c205f2012-04-04 15:01:43 -04002046 ad.type = LSM_AUDIT_DATA_DENTRY;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002047
Eric Parisa2694342011-04-25 13:10:27 -04002048 ad.u.dentry = old_dentry;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002049 rc = avc_has_perm(&selinux_state,
2050 sid, old_dsec->sid, SECCLASS_DIR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002051 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
2052 if (rc)
2053 return rc;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002054 rc = avc_has_perm(&selinux_state,
2055 sid, old_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002056 old_isec->sclass, FILE__RENAME, &ad);
2057 if (rc)
2058 return rc;
2059 if (old_is_dir && new_dir != old_dir) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002060 rc = avc_has_perm(&selinux_state,
2061 sid, old_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002062 old_isec->sclass, DIR__REPARENT, &ad);
2063 if (rc)
2064 return rc;
2065 }
2066
Eric Parisa2694342011-04-25 13:10:27 -04002067 ad.u.dentry = new_dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002068 av = DIR__ADD_NAME | DIR__SEARCH;
David Howells2c616d42015-01-29 12:02:33 +00002069 if (d_is_positive(new_dentry))
Linus Torvalds1da177e2005-04-16 15:20:36 -07002070 av |= DIR__REMOVE_NAME;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002071 rc = avc_has_perm(&selinux_state,
2072 sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002073 if (rc)
2074 return rc;
David Howells2c616d42015-01-29 12:02:33 +00002075 if (d_is_positive(new_dentry)) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002076 new_isec = backing_inode_security(new_dentry);
David Howellse36cb0b2015-01-29 12:02:35 +00002077 new_is_dir = d_is_dir(new_dentry);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002078 rc = avc_has_perm(&selinux_state,
2079 sid, new_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002080 new_isec->sclass,
2081 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
2082 if (rc)
2083 return rc;
2084 }
2085
2086 return 0;
2087}
2088
2089/* Check whether a task can perform a filesystem operation. */
David Howells88e67f32008-11-14 10:39:21 +11002090static int superblock_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002091 struct super_block *sb,
2092 u32 perms,
Thomas Liu2bf49692009-07-14 12:14:09 -04002093 struct common_audit_data *ad)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002094{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002095 struct superblock_security_struct *sbsec;
David Howells88e67f32008-11-14 10:39:21 +11002096 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002097
Linus Torvalds1da177e2005-04-16 15:20:36 -07002098 sbsec = sb->s_security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002099 return avc_has_perm(&selinux_state,
2100 sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002101}
2102
2103/* Convert a Linux mode and permission mask to an access vector. */
2104static inline u32 file_mask_to_av(int mode, int mask)
2105{
2106 u32 av = 0;
2107
Al Virodba19c62011-07-25 20:49:29 -04002108 if (!S_ISDIR(mode)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002109 if (mask & MAY_EXEC)
2110 av |= FILE__EXECUTE;
2111 if (mask & MAY_READ)
2112 av |= FILE__READ;
2113
2114 if (mask & MAY_APPEND)
2115 av |= FILE__APPEND;
2116 else if (mask & MAY_WRITE)
2117 av |= FILE__WRITE;
2118
2119 } else {
2120 if (mask & MAY_EXEC)
2121 av |= DIR__SEARCH;
2122 if (mask & MAY_WRITE)
2123 av |= DIR__WRITE;
2124 if (mask & MAY_READ)
2125 av |= DIR__READ;
2126 }
2127
2128 return av;
2129}
2130
2131/* Convert a Linux file to an access vector. */
2132static inline u32 file_to_av(struct file *file)
2133{
2134 u32 av = 0;
2135
2136 if (file->f_mode & FMODE_READ)
2137 av |= FILE__READ;
2138 if (file->f_mode & FMODE_WRITE) {
2139 if (file->f_flags & O_APPEND)
2140 av |= FILE__APPEND;
2141 else
2142 av |= FILE__WRITE;
2143 }
Stephen Smalley0794c662008-03-17 08:55:18 -04002144 if (!av) {
2145 /*
2146 * Special file opened with flags 3 for ioctl-only use.
2147 */
2148 av = FILE__IOCTL;
2149 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002150
2151 return av;
2152}
2153
Eric Paris8b6a5a32008-10-29 17:06:46 -04002154/*
2155 * Convert a file to an access vector and include the correct open
2156 * open permission.
2157 */
2158static inline u32 open_file_to_av(struct file *file)
2159{
2160 u32 av = file_to_av(file);
Stephen Smalleyccb54472017-05-12 12:41:24 -04002161 struct inode *inode = file_inode(file);
Eric Paris8b6a5a32008-10-29 17:06:46 -04002162
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002163 if (selinux_policycap_openperm() &&
2164 inode->i_sb->s_magic != SOCKFS_MAGIC)
Eric Paris49b7b8d2010-07-23 11:44:09 -04002165 av |= FILE__OPEN;
2166
Eric Paris8b6a5a32008-10-29 17:06:46 -04002167 return av;
2168}
2169
Linus Torvalds1da177e2005-04-16 15:20:36 -07002170/* Hook functions begin here. */
2171
Stephen Smalley79af7302015-01-21 10:54:10 -05002172static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2173{
2174 u32 mysid = current_sid();
2175 u32 mgrsid = task_sid(mgr);
2176
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002177 return avc_has_perm(&selinux_state,
2178 mysid, mgrsid, SECCLASS_BINDER,
Stephen Smalley79af7302015-01-21 10:54:10 -05002179 BINDER__SET_CONTEXT_MGR, NULL);
2180}
2181
2182static int selinux_binder_transaction(struct task_struct *from,
2183 struct task_struct *to)
2184{
2185 u32 mysid = current_sid();
2186 u32 fromsid = task_sid(from);
2187 u32 tosid = task_sid(to);
2188 int rc;
2189
2190 if (mysid != fromsid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002191 rc = avc_has_perm(&selinux_state,
2192 mysid, fromsid, SECCLASS_BINDER,
Stephen Smalley79af7302015-01-21 10:54:10 -05002193 BINDER__IMPERSONATE, NULL);
2194 if (rc)
2195 return rc;
2196 }
2197
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002198 return avc_has_perm(&selinux_state,
2199 fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
Stephen Smalley79af7302015-01-21 10:54:10 -05002200 NULL);
2201}
2202
2203static int selinux_binder_transfer_binder(struct task_struct *from,
2204 struct task_struct *to)
2205{
2206 u32 fromsid = task_sid(from);
2207 u32 tosid = task_sid(to);
2208
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002209 return avc_has_perm(&selinux_state,
2210 fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
Stephen Smalley79af7302015-01-21 10:54:10 -05002211 NULL);
2212}
2213
2214static int selinux_binder_transfer_file(struct task_struct *from,
2215 struct task_struct *to,
2216 struct file *file)
2217{
2218 u32 sid = task_sid(to);
2219 struct file_security_struct *fsec = file->f_security;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002220 struct dentry *dentry = file->f_path.dentry;
Paul Moore20cdef82016-04-04 14:14:42 -04002221 struct inode_security_struct *isec;
Stephen Smalley79af7302015-01-21 10:54:10 -05002222 struct common_audit_data ad;
2223 int rc;
2224
2225 ad.type = LSM_AUDIT_DATA_PATH;
2226 ad.u.path = file->f_path;
2227
2228 if (sid != fsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002229 rc = avc_has_perm(&selinux_state,
2230 sid, fsec->sid,
Stephen Smalley79af7302015-01-21 10:54:10 -05002231 SECCLASS_FD,
2232 FD__USE,
2233 &ad);
2234 if (rc)
2235 return rc;
2236 }
2237
Chenbo Fengf66e4482017-10-18 13:00:26 -07002238#ifdef CONFIG_BPF_SYSCALL
2239 rc = bpf_fd_pass(file, sid);
2240 if (rc)
2241 return rc;
2242#endif
2243
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002244 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
Stephen Smalley79af7302015-01-21 10:54:10 -05002245 return 0;
2246
Paul Moore20cdef82016-04-04 14:14:42 -04002247 isec = backing_inode_security(dentry);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002248 return avc_has_perm(&selinux_state,
2249 sid, isec->sid, isec->sclass, file_to_av(file),
Stephen Smalley79af7302015-01-21 10:54:10 -05002250 &ad);
2251}
2252
Ingo Molnar9e488582009-05-07 19:26:19 +10002253static int selinux_ptrace_access_check(struct task_struct *child,
David Howells5cd9c582008-08-14 11:37:28 +01002254 unsigned int mode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002255{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002256 u32 sid = current_sid();
2257 u32 csid = task_sid(child);
Stephen Smalley006ebb42008-05-19 08:32:49 -04002258
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002259 if (mode & PTRACE_MODE_READ)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002260 return avc_has_perm(&selinux_state,
2261 sid, csid, SECCLASS_FILE, FILE__READ, NULL);
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002262
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002263 return avc_has_perm(&selinux_state,
2264 sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
David Howells5cd9c582008-08-14 11:37:28 +01002265}
2266
2267static int selinux_ptrace_traceme(struct task_struct *parent)
2268{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002269 return avc_has_perm(&selinux_state,
2270 task_sid(parent), current_sid(), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002271 PROCESS__PTRACE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002272}
2273
2274static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
Eric Paris828dfe12008-04-17 13:17:49 -04002275 kernel_cap_t *inheritable, kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002276{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002277 return avc_has_perm(&selinux_state,
2278 current_sid(), task_sid(target), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002279 PROCESS__GETCAP, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002280}
2281
David Howellsd84f4f92008-11-14 10:39:23 +11002282static int selinux_capset(struct cred *new, const struct cred *old,
2283 const kernel_cap_t *effective,
2284 const kernel_cap_t *inheritable,
2285 const kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002286{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002287 return avc_has_perm(&selinux_state,
2288 cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002289 PROCESS__SETCAP, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002290}
2291
James Morris5626d3e2009-01-30 10:05:06 +11002292/*
2293 * (This comment used to live with the selinux_task_setuid hook,
2294 * which was removed).
2295 *
2296 * Since setuid only affects the current process, and since the SELinux
2297 * controls are not based on the Linux identity attributes, SELinux does not
2298 * need to control this operation. However, SELinux does control the use of
2299 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2300 */
2301
Eric Paris6a9de492012-01-03 12:25:14 -05002302static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2303 int cap, int audit)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002304{
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04002305 return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002306}
2307
Linus Torvalds1da177e2005-04-16 15:20:36 -07002308static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2309{
David Howells88e67f32008-11-14 10:39:21 +11002310 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002311 int rc = 0;
2312
2313 if (!sb)
2314 return 0;
2315
2316 switch (cmds) {
Eric Paris828dfe12008-04-17 13:17:49 -04002317 case Q_SYNC:
2318 case Q_QUOTAON:
2319 case Q_QUOTAOFF:
2320 case Q_SETINFO:
2321 case Q_SETQUOTA:
David Howells88e67f32008-11-14 10:39:21 +11002322 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04002323 break;
2324 case Q_GETFMT:
2325 case Q_GETINFO:
2326 case Q_GETQUOTA:
David Howells88e67f32008-11-14 10:39:21 +11002327 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04002328 break;
2329 default:
2330 rc = 0; /* let the kernel handle invalid cmds */
2331 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002332 }
2333 return rc;
2334}
2335
2336static int selinux_quota_on(struct dentry *dentry)
2337{
David Howells88e67f32008-11-14 10:39:21 +11002338 const struct cred *cred = current_cred();
2339
Eric Paris2875fa02011-04-28 16:04:24 -04002340 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002341}
2342
Eric Paris12b30522010-11-15 18:36:29 -05002343static int selinux_syslog(int type)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002344{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002345 switch (type) {
Kees Cookd78ca3c2010-02-03 15:37:13 -08002346 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2347 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002348 return avc_has_perm(&selinux_state,
2349 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002350 SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
Kees Cookd78ca3c2010-02-03 15:37:13 -08002351 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2352 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2353 /* Set level of messages printed to console */
2354 case SYSLOG_ACTION_CONSOLE_LEVEL:
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002355 return avc_has_perm(&selinux_state,
2356 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002357 SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2358 NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002359 }
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002360 /* All other syslog types */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002361 return avc_has_perm(&selinux_state,
2362 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002363 SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002364}
2365
2366/*
2367 * Check that a process has enough memory to allocate a new virtual
2368 * mapping. 0 means there is enough memory for the allocation to
2369 * succeed and -ENOMEM implies there is not.
2370 *
Linus Torvalds1da177e2005-04-16 15:20:36 -07002371 * Do not audit the selinux permission check, as this is applied to all
2372 * processes that allocate mappings.
2373 */
Alan Cox34b4e4a2007-08-22 14:01:28 -07002374static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002375{
2376 int rc, cap_sys_admin = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002377
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07002378 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04002379 SECURITY_CAP_NOAUDIT, true);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002380 if (rc == 0)
2381 cap_sys_admin = 1;
2382
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07002383 return cap_sys_admin;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002384}
2385
2386/* binprm security operations */
2387
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002388static u32 ptrace_parent_sid(void)
Paul Moore0c6181c2016-03-30 21:41:21 -04002389{
2390 u32 sid = 0;
2391 struct task_struct *tracer;
2392
2393 rcu_read_lock();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002394 tracer = ptrace_parent(current);
Paul Moore0c6181c2016-03-30 21:41:21 -04002395 if (tracer)
2396 sid = task_sid(tracer);
2397 rcu_read_unlock();
2398
2399 return sid;
2400}
2401
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002402static int check_nnp_nosuid(const struct linux_binprm *bprm,
2403 const struct task_security_struct *old_tsec,
2404 const struct task_security_struct *new_tsec)
2405{
2406 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
Andy Lutomirski380cf5b2016-06-23 16:41:05 -05002407 int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002408 int rc;
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002409 u32 av;
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002410
2411 if (!nnp && !nosuid)
2412 return 0; /* neither NNP nor nosuid */
2413
2414 if (new_tsec->sid == old_tsec->sid)
2415 return 0; /* No change in credentials */
2416
2417 /*
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002418 * If the policy enables the nnp_nosuid_transition policy capability,
2419 * then we permit transitions under NNP or nosuid if the
2420 * policy allows the corresponding permission between
2421 * the old and new contexts.
2422 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002423 if (selinux_policycap_nnp_nosuid_transition()) {
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002424 av = 0;
2425 if (nnp)
2426 av |= PROCESS2__NNP_TRANSITION;
2427 if (nosuid)
2428 av |= PROCESS2__NOSUID_TRANSITION;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002429 rc = avc_has_perm(&selinux_state,
2430 old_tsec->sid, new_tsec->sid,
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002431 SECCLASS_PROCESS2, av, NULL);
2432 if (!rc)
2433 return 0;
2434 }
2435
2436 /*
2437 * We also permit NNP or nosuid transitions to bounded SIDs,
2438 * i.e. SIDs that are guaranteed to only be allowed a subset
2439 * of the permissions of the current SID.
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002440 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002441 rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2442 new_tsec->sid);
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002443 if (!rc)
2444 return 0;
2445
2446 /*
2447 * On failure, preserve the errno values for NNP vs nosuid.
2448 * NNP: Operation not permitted for caller.
2449 * nosuid: Permission denied to file.
2450 */
2451 if (nnp)
2452 return -EPERM;
2453 return -EACCES;
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002454}
2455
David Howellsa6f76f22008-11-14 10:39:24 +11002456static int selinux_bprm_set_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002457{
David Howellsa6f76f22008-11-14 10:39:24 +11002458 const struct task_security_struct *old_tsec;
2459 struct task_security_struct *new_tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002460 struct inode_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04002461 struct common_audit_data ad;
Al Viro496ad9a2013-01-23 17:07:38 -05002462 struct inode *inode = file_inode(bprm->file);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002463 int rc;
2464
David Howellsa6f76f22008-11-14 10:39:24 +11002465 /* SELinux context only depends on initial program or script and not
2466 * the script interpreter */
Kees Cookddb4a142017-07-18 15:25:23 -07002467 if (bprm->called_set_creds)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002468 return 0;
2469
David Howellsa6f76f22008-11-14 10:39:24 +11002470 old_tsec = current_security();
2471 new_tsec = bprm->cred->security;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002472 isec = inode_security(inode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002473
2474 /* Default to the current task SID. */
David Howellsa6f76f22008-11-14 10:39:24 +11002475 new_tsec->sid = old_tsec->sid;
2476 new_tsec->osid = old_tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002477
Michael LeMay28eba5b2006-06-27 02:53:42 -07002478 /* Reset fs, key, and sock SIDs on execve. */
David Howellsa6f76f22008-11-14 10:39:24 +11002479 new_tsec->create_sid = 0;
2480 new_tsec->keycreate_sid = 0;
2481 new_tsec->sockcreate_sid = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002482
David Howellsa6f76f22008-11-14 10:39:24 +11002483 if (old_tsec->exec_sid) {
2484 new_tsec->sid = old_tsec->exec_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002485 /* Reset exec SID on execve. */
David Howellsa6f76f22008-11-14 10:39:24 +11002486 new_tsec->exec_sid = 0;
Andy Lutomirski259e5e62012-04-12 16:47:50 -05002487
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002488 /* Fail on NNP or nosuid if not an allowed transition. */
2489 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2490 if (rc)
2491 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002492 } else {
2493 /* Check for a default transition on this program. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002494 rc = security_transition_sid(&selinux_state, old_tsec->sid,
2495 isec->sid, SECCLASS_PROCESS, NULL,
Eric Paris652bb9b2011-02-01 11:05:40 -05002496 &new_tsec->sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002497 if (rc)
2498 return rc;
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002499
2500 /*
2501 * Fallback to old SID on NNP or nosuid if not an allowed
2502 * transition.
2503 */
2504 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2505 if (rc)
2506 new_tsec->sid = old_tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002507 }
2508
Vivek Goyal43af5de2016-09-09 11:37:49 -04002509 ad.type = LSM_AUDIT_DATA_FILE;
2510 ad.u.file = bprm->file;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002511
David Howellsa6f76f22008-11-14 10:39:24 +11002512 if (new_tsec->sid == old_tsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002513 rc = avc_has_perm(&selinux_state,
2514 old_tsec->sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002515 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2516 if (rc)
2517 return rc;
2518 } else {
2519 /* Check permissions for the transition. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002520 rc = avc_has_perm(&selinux_state,
2521 old_tsec->sid, new_tsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002522 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2523 if (rc)
2524 return rc;
2525
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002526 rc = avc_has_perm(&selinux_state,
2527 new_tsec->sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002528 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2529 if (rc)
2530 return rc;
2531
David Howellsa6f76f22008-11-14 10:39:24 +11002532 /* Check for shared state */
2533 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002534 rc = avc_has_perm(&selinux_state,
2535 old_tsec->sid, new_tsec->sid,
David Howellsa6f76f22008-11-14 10:39:24 +11002536 SECCLASS_PROCESS, PROCESS__SHARE,
2537 NULL);
2538 if (rc)
2539 return -EPERM;
2540 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002541
David Howellsa6f76f22008-11-14 10:39:24 +11002542 /* Make sure that anyone attempting to ptrace over a task that
2543 * changes its SID has the appropriate permit */
Eric W. Biederman9227dd22017-01-23 17:26:31 +13002544 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002545 u32 ptsid = ptrace_parent_sid();
David Howellsa6f76f22008-11-14 10:39:24 +11002546 if (ptsid != 0) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002547 rc = avc_has_perm(&selinux_state,
2548 ptsid, new_tsec->sid,
David Howellsa6f76f22008-11-14 10:39:24 +11002549 SECCLASS_PROCESS,
2550 PROCESS__PTRACE, NULL);
2551 if (rc)
2552 return -EPERM;
2553 }
2554 }
2555
2556 /* Clear any possibly unsafe personality bits on exec: */
2557 bprm->per_clear |= PER_CLEAR_ON_SETID;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002558
Linus Torvalds1da177e2005-04-16 15:20:36 -07002559 /* Enable secure mode for SIDs transitions unless
2560 the noatsecure permission is granted between
2561 the two SIDs, i.e. ahp returns 0. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002562 rc = avc_has_perm(&selinux_state,
2563 old_tsec->sid, new_tsec->sid,
Kees Cook62874c32017-07-18 15:25:25 -07002564 SECCLASS_PROCESS, PROCESS__NOATSECURE,
2565 NULL);
2566 bprm->secureexec |= !!rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002567 }
2568
Kees Cook62874c32017-07-18 15:25:25 -07002569 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002570}
2571
Al Viroc3c073f2012-08-21 22:32:06 -04002572static int match_file(const void *p, struct file *file, unsigned fd)
2573{
2574 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2575}
2576
Linus Torvalds1da177e2005-04-16 15:20:36 -07002577/* Derived from fs/exec.c:flush_old_files. */
David Howells745ca242008-11-14 10:39:22 +11002578static inline void flush_unauthorized_files(const struct cred *cred,
2579 struct files_struct *files)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002580{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002581 struct file *file, *devnull = NULL;
Stephen Smalleyb20c8122006-09-25 23:32:03 -07002582 struct tty_struct *tty;
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002583 int drop_tty = 0;
Al Viroc3c073f2012-08-21 22:32:06 -04002584 unsigned n;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002585
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002586 tty = get_current_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002587 if (tty) {
Peter Hurley4a510962016-01-09 21:35:23 -08002588 spin_lock(&tty->files_lock);
Eric Paris37dd0bd2008-10-31 17:40:00 -04002589 if (!list_empty(&tty->tty_files)) {
Nick Piggind996b622010-08-18 04:37:36 +10002590 struct tty_file_private *file_priv;
Eric Paris37dd0bd2008-10-31 17:40:00 -04002591
Linus Torvalds1da177e2005-04-16 15:20:36 -07002592 /* Revalidate access to controlling tty.
David Howells13f8e982013-06-13 23:37:55 +01002593 Use file_path_has_perm on the tty path directly
2594 rather than using file_has_perm, as this particular
2595 open file may belong to another process and we are
2596 only interested in the inode-based check here. */
Nick Piggind996b622010-08-18 04:37:36 +10002597 file_priv = list_first_entry(&tty->tty_files,
2598 struct tty_file_private, list);
2599 file = file_priv->file;
David Howells13f8e982013-06-13 23:37:55 +01002600 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002601 drop_tty = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002602 }
Peter Hurley4a510962016-01-09 21:35:23 -08002603 spin_unlock(&tty->files_lock);
Alan Cox452a00d2008-10-13 10:39:13 +01002604 tty_kref_put(tty);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002605 }
Eric W. Biederman98a27ba2007-05-08 00:26:56 -07002606 /* Reset controlling tty. */
2607 if (drop_tty)
2608 no_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002609
2610 /* Revalidate access to inherited open files. */
Al Viroc3c073f2012-08-21 22:32:06 -04002611 n = iterate_fd(files, 0, match_file, cred);
2612 if (!n) /* none found? */
2613 return;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002614
Al Viroc3c073f2012-08-21 22:32:06 -04002615 devnull = dentry_open(&selinux_null, O_RDWR, cred);
Al Viro45525b22012-10-16 13:30:07 -04002616 if (IS_ERR(devnull))
2617 devnull = NULL;
2618 /* replace all the matching ones with this */
2619 do {
2620 replace_fd(n - 1, devnull, 0);
2621 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2622 if (devnull)
Al Viroc3c073f2012-08-21 22:32:06 -04002623 fput(devnull);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002624}
2625
Linus Torvalds1da177e2005-04-16 15:20:36 -07002626/*
David Howellsa6f76f22008-11-14 10:39:24 +11002627 * Prepare a process for imminent new credential changes due to exec
Linus Torvalds1da177e2005-04-16 15:20:36 -07002628 */
David Howellsa6f76f22008-11-14 10:39:24 +11002629static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002630{
David Howellsa6f76f22008-11-14 10:39:24 +11002631 struct task_security_struct *new_tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002632 struct rlimit *rlim, *initrlim;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002633 int rc, i;
2634
David Howellsa6f76f22008-11-14 10:39:24 +11002635 new_tsec = bprm->cred->security;
2636 if (new_tsec->sid == new_tsec->osid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002637 return;
2638
2639 /* Close files for which the new task SID is not authorized. */
David Howellsa6f76f22008-11-14 10:39:24 +11002640 flush_unauthorized_files(bprm->cred, current->files);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002641
David Howellsa6f76f22008-11-14 10:39:24 +11002642 /* Always clear parent death signal on SID transitions. */
2643 current->pdeath_signal = 0;
2644
2645 /* Check whether the new SID can inherit resource limits from the old
2646 * SID. If not, reset all soft limits to the lower of the current
2647 * task's hard limit and the init task's soft limit.
2648 *
2649 * Note that the setting of hard limits (even to lower them) can be
2650 * controlled by the setrlimit check. The inclusion of the init task's
2651 * soft limit into the computation is to avoid resetting soft limits
2652 * higher than the default soft limit for cases where the default is
2653 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2654 */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002655 rc = avc_has_perm(&selinux_state,
2656 new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
David Howellsa6f76f22008-11-14 10:39:24 +11002657 PROCESS__RLIMITINH, NULL);
2658 if (rc) {
Oleg Nesteroveb2d55a2010-06-23 22:43:32 +02002659 /* protect against do_prlimit() */
2660 task_lock(current);
David Howellsa6f76f22008-11-14 10:39:24 +11002661 for (i = 0; i < RLIM_NLIMITS; i++) {
2662 rlim = current->signal->rlim + i;
2663 initrlim = init_task.signal->rlim + i;
2664 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2665 }
Oleg Nesteroveb2d55a2010-06-23 22:43:32 +02002666 task_unlock(current);
Nicolas Pitrebaa73d92016-11-11 00:10:10 -05002667 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2668 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
David Howellsa6f76f22008-11-14 10:39:24 +11002669 }
2670}
2671
2672/*
2673 * Clean up the process immediately after the installation of new credentials
2674 * due to exec
2675 */
2676static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2677{
2678 const struct task_security_struct *tsec = current_security();
2679 struct itimerval itimer;
David Howellsa6f76f22008-11-14 10:39:24 +11002680 u32 osid, sid;
2681 int rc, i;
David Howellsa6f76f22008-11-14 10:39:24 +11002682
David Howellsa6f76f22008-11-14 10:39:24 +11002683 osid = tsec->osid;
2684 sid = tsec->sid;
2685
2686 if (sid == osid)
2687 return;
2688
2689 /* Check whether the new SID can inherit signal state from the old SID.
2690 * If not, clear itimers to avoid subsequent signal generation and
2691 * flush and unblock signals.
2692 *
2693 * This must occur _after_ the task SID has been updated so that any
2694 * kill done after the flush will be checked against the new SID.
2695 */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002696 rc = avc_has_perm(&selinux_state,
2697 osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002698 if (rc) {
Nicolas Pitrebaa73d92016-11-11 00:10:10 -05002699 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) {
2700 memset(&itimer, 0, sizeof itimer);
2701 for (i = 0; i < 3; i++)
2702 do_setitimer(i, &itimer, NULL);
2703 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002704 spin_lock_irq(&current->sighand->siglock);
Oleg Nesterov9e7c8f82015-06-04 16:22:16 -04002705 if (!fatal_signal_pending(current)) {
2706 flush_sigqueue(&current->pending);
2707 flush_sigqueue(&current->signal->shared_pending);
David Howells3bcac022009-04-29 13:45:05 +01002708 flush_signal_handlers(current, 1);
2709 sigemptyset(&current->blocked);
Oleg Nesterov9e7c8f82015-06-04 16:22:16 -04002710 recalc_sigpending();
David Howells3bcac022009-04-29 13:45:05 +01002711 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002712 spin_unlock_irq(&current->sighand->siglock);
2713 }
2714
David Howellsa6f76f22008-11-14 10:39:24 +11002715 /* Wake up the parent if it is waiting so that it can recheck
2716 * wait permission to the new task SID. */
Oleg Nesterovecd6de32009-04-29 16:02:24 +02002717 read_lock(&tasklist_lock);
Oleg Nesterov0b7570e2009-09-23 15:56:46 -07002718 __wake_up_parent(current, current->real_parent);
Oleg Nesterovecd6de32009-04-29 16:02:24 +02002719 read_unlock(&tasklist_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002720}
2721
2722/* superblock security operations */
2723
2724static int selinux_sb_alloc_security(struct super_block *sb)
2725{
2726 return superblock_alloc_security(sb);
2727}
2728
2729static void selinux_sb_free_security(struct super_block *sb)
2730{
2731 superblock_free_security(sb);
2732}
2733
2734static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2735{
2736 if (plen > olen)
2737 return 0;
2738
2739 return !memcmp(prefix, option, plen);
2740}
2741
2742static inline int selinux_option(char *option, int len)
2743{
Eric Paris832cbd92008-04-01 13:24:09 -04002744 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2745 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2746 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
David P. Quigley11689d42009-01-16 09:22:03 -05002747 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2748 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
Linus Torvalds1da177e2005-04-16 15:20:36 -07002749}
2750
2751static inline void take_option(char **to, char *from, int *first, int len)
2752{
2753 if (!*first) {
2754 **to = ',';
2755 *to += 1;
Cory Olmo3528a952006-09-29 01:58:44 -07002756 } else
Linus Torvalds1da177e2005-04-16 15:20:36 -07002757 *first = 0;
2758 memcpy(*to, from, len);
2759 *to += len;
2760}
2761
Eric Paris828dfe12008-04-17 13:17:49 -04002762static inline void take_selinux_option(char **to, char *from, int *first,
2763 int len)
Cory Olmo3528a952006-09-29 01:58:44 -07002764{
2765 int current_size = 0;
2766
2767 if (!*first) {
2768 **to = '|';
2769 *to += 1;
Eric Paris828dfe12008-04-17 13:17:49 -04002770 } else
Cory Olmo3528a952006-09-29 01:58:44 -07002771 *first = 0;
2772
2773 while (current_size < len) {
2774 if (*from != '"') {
2775 **to = *from;
2776 *to += 1;
2777 }
2778 from += 1;
2779 current_size += 1;
2780 }
2781}
2782
Eric Parise0007522008-03-05 10:31:54 -05002783static int selinux_sb_copy_data(char *orig, char *copy)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002784{
2785 int fnosec, fsec, rc = 0;
2786 char *in_save, *in_curr, *in_end;
2787 char *sec_curr, *nosec_save, *nosec;
Cory Olmo3528a952006-09-29 01:58:44 -07002788 int open_quote = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002789
2790 in_curr = orig;
2791 sec_curr = copy;
2792
Linus Torvalds1da177e2005-04-16 15:20:36 -07002793 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2794 if (!nosec) {
2795 rc = -ENOMEM;
2796 goto out;
2797 }
2798
2799 nosec_save = nosec;
2800 fnosec = fsec = 1;
2801 in_save = in_end = orig;
2802
2803 do {
Cory Olmo3528a952006-09-29 01:58:44 -07002804 if (*in_end == '"')
2805 open_quote = !open_quote;
2806 if ((*in_end == ',' && open_quote == 0) ||
2807 *in_end == '\0') {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002808 int len = in_end - in_curr;
2809
2810 if (selinux_option(in_curr, len))
Cory Olmo3528a952006-09-29 01:58:44 -07002811 take_selinux_option(&sec_curr, in_curr, &fsec, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002812 else
2813 take_option(&nosec, in_curr, &fnosec, len);
2814
2815 in_curr = in_end + 1;
2816 }
2817 } while (*in_end++);
2818
Eric Paris6931dfc2005-06-30 02:58:51 -07002819 strcpy(in_save, nosec_save);
Gerald Schaeferda3caa22005-06-21 17:15:18 -07002820 free_page((unsigned long)nosec_save);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002821out:
2822 return rc;
2823}
2824
Eric Paris026eb162011-03-03 16:09:14 -05002825static int selinux_sb_remount(struct super_block *sb, void *data)
2826{
2827 int rc, i, *flags;
2828 struct security_mnt_opts opts;
2829 char *secdata, **mount_options;
2830 struct superblock_security_struct *sbsec = sb->s_security;
2831
2832 if (!(sbsec->flags & SE_SBINITIALIZED))
2833 return 0;
2834
2835 if (!data)
2836 return 0;
2837
2838 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2839 return 0;
2840
2841 security_init_mnt_opts(&opts);
2842 secdata = alloc_secdata();
2843 if (!secdata)
2844 return -ENOMEM;
2845 rc = selinux_sb_copy_data(data, secdata);
2846 if (rc)
2847 goto out_free_secdata;
2848
2849 rc = selinux_parse_opts_str(secdata, &opts);
2850 if (rc)
2851 goto out_free_secdata;
2852
2853 mount_options = opts.mnt_opts;
2854 flags = opts.mnt_opts_flags;
2855
2856 for (i = 0; i < opts.num_mnt_opts; i++) {
2857 u32 sid;
Eric Paris026eb162011-03-03 16:09:14 -05002858
Eric Paris12f348b2012-10-09 10:56:25 -04002859 if (flags[i] == SBLABEL_MNT)
Eric Paris026eb162011-03-03 16:09:14 -05002860 continue;
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002861 rc = security_context_str_to_sid(&selinux_state,
2862 mount_options[i], &sid,
2863 GFP_KERNEL);
Eric Paris026eb162011-03-03 16:09:14 -05002864 if (rc) {
Rasmus Villemoes44be2f62015-10-21 17:44:25 -04002865 printk(KERN_WARNING "SELinux: security_context_str_to_sid"
Linus Torvalds29b1deb2013-12-15 11:17:45 -08002866 "(%s) failed for (dev %s, type %s) errno=%d\n",
2867 mount_options[i], sb->s_id, sb->s_type->name, rc);
Eric Paris026eb162011-03-03 16:09:14 -05002868 goto out_free_opts;
2869 }
2870 rc = -EINVAL;
2871 switch (flags[i]) {
2872 case FSCONTEXT_MNT:
2873 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2874 goto out_bad_option;
2875 break;
2876 case CONTEXT_MNT:
2877 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2878 goto out_bad_option;
2879 break;
2880 case ROOTCONTEXT_MNT: {
2881 struct inode_security_struct *root_isec;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002882 root_isec = backing_inode_security(sb->s_root);
Eric Paris026eb162011-03-03 16:09:14 -05002883
2884 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2885 goto out_bad_option;
2886 break;
2887 }
2888 case DEFCONTEXT_MNT:
2889 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2890 goto out_bad_option;
2891 break;
2892 default:
2893 goto out_free_opts;
2894 }
2895 }
2896
2897 rc = 0;
2898out_free_opts:
2899 security_free_mnt_opts(&opts);
2900out_free_secdata:
2901 free_secdata(secdata);
2902 return rc;
2903out_bad_option:
2904 printk(KERN_WARNING "SELinux: unable to change security options "
Linus Torvalds29b1deb2013-12-15 11:17:45 -08002905 "during remount (dev %s, type=%s)\n", sb->s_id,
2906 sb->s_type->name);
Eric Paris026eb162011-03-03 16:09:14 -05002907 goto out_free_opts;
2908}
2909
James Morris12204e22008-12-19 10:44:42 +11002910static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002911{
David Howells88e67f32008-11-14 10:39:21 +11002912 const struct cred *cred = current_cred();
Thomas Liu2bf49692009-07-14 12:14:09 -04002913 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002914 int rc;
2915
2916 rc = superblock_doinit(sb, data);
2917 if (rc)
2918 return rc;
2919
James Morris74192242008-12-19 11:41:10 +11002920 /* Allow all mounts performed by the kernel */
2921 if (flags & MS_KERNMOUNT)
2922 return 0;
2923
Eric Paris50c205f2012-04-04 15:01:43 -04002924 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04002925 ad.u.dentry = sb->s_root;
David Howells88e67f32008-11-14 10:39:21 +11002926 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002927}
2928
David Howells726c3342006-06-23 02:02:58 -07002929static int selinux_sb_statfs(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002930{
David Howells88e67f32008-11-14 10:39:21 +11002931 const struct cred *cred = current_cred();
Thomas Liu2bf49692009-07-14 12:14:09 -04002932 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002933
Eric Paris50c205f2012-04-04 15:01:43 -04002934 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04002935 ad.u.dentry = dentry->d_sb->s_root;
David Howells88e67f32008-11-14 10:39:21 +11002936 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002937}
2938
Al Viro808d4e32012-10-11 11:42:01 -04002939static int selinux_mount(const char *dev_name,
Al Viro8a04c432016-03-25 14:52:53 -04002940 const struct path *path,
Al Viro808d4e32012-10-11 11:42:01 -04002941 const char *type,
Eric Paris828dfe12008-04-17 13:17:49 -04002942 unsigned long flags,
2943 void *data)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002944{
David Howells88e67f32008-11-14 10:39:21 +11002945 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002946
2947 if (flags & MS_REMOUNT)
Al Virod8c95842011-12-07 18:16:57 -05002948 return superblock_has_perm(cred, path->dentry->d_sb,
Eric Paris828dfe12008-04-17 13:17:49 -04002949 FILESYSTEM__REMOUNT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002950 else
Eric Paris2875fa02011-04-28 16:04:24 -04002951 return path_has_perm(cred, path, FILE__MOUNTON);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002952}
2953
2954static int selinux_umount(struct vfsmount *mnt, int flags)
2955{
David Howells88e67f32008-11-14 10:39:21 +11002956 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002957
David Howells88e67f32008-11-14 10:39:21 +11002958 return superblock_has_perm(cred, mnt->mnt_sb,
Eric Paris828dfe12008-04-17 13:17:49 -04002959 FILESYSTEM__UNMOUNT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002960}
2961
2962/* inode security operations */
2963
2964static int selinux_inode_alloc_security(struct inode *inode)
2965{
2966 return inode_alloc_security(inode);
2967}
2968
2969static void selinux_inode_free_security(struct inode *inode)
2970{
2971 inode_free_security(inode);
2972}
2973
David Quigleyd47be3d2013-05-22 12:50:34 -04002974static int selinux_dentry_init_security(struct dentry *dentry, int mode,
Al Viro4f3ccd72016-07-20 16:06:15 -04002975 const struct qstr *name, void **ctx,
David Quigleyd47be3d2013-05-22 12:50:34 -04002976 u32 *ctxlen)
2977{
David Quigleyd47be3d2013-05-22 12:50:34 -04002978 u32 newsid;
2979 int rc;
2980
Vivek Goyalc957f6d2016-07-13 10:44:51 -04002981 rc = selinux_determine_inode_label(current_security(),
2982 d_inode(dentry->d_parent), name,
David Howellsc3c188b2015-07-10 17:19:58 -04002983 inode_mode_to_security_class(mode),
2984 &newsid);
2985 if (rc)
2986 return rc;
David Quigleyd47be3d2013-05-22 12:50:34 -04002987
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002988 return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
2989 ctxlen);
David Quigleyd47be3d2013-05-22 12:50:34 -04002990}
2991
Vivek Goyala518b0a2016-07-13 10:44:53 -04002992static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2993 struct qstr *name,
2994 const struct cred *old,
2995 struct cred *new)
2996{
2997 u32 newsid;
2998 int rc;
2999 struct task_security_struct *tsec;
3000
3001 rc = selinux_determine_inode_label(old->security,
3002 d_inode(dentry->d_parent), name,
3003 inode_mode_to_security_class(mode),
3004 &newsid);
3005 if (rc)
3006 return rc;
3007
3008 tsec = new->security;
3009 tsec->create_sid = newsid;
3010 return 0;
3011}
3012
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003013static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
Tetsuo Handa95489062013-07-25 05:44:02 +09003014 const struct qstr *qstr,
3015 const char **name,
Eric Paris2a7dba32011-02-01 11:05:39 -05003016 void **value, size_t *len)
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003017{
Paul Moore5fb49872010-04-22 14:46:19 -04003018 const struct task_security_struct *tsec = current_security();
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003019 struct superblock_security_struct *sbsec;
Corentin LABBEc0d4f462017-10-04 20:32:17 +02003020 u32 newsid, clen;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003021 int rc;
Tetsuo Handa95489062013-07-25 05:44:02 +09003022 char *context;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003023
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003024 sbsec = dir->i_sb->s_security;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003025
David Howells275bb412008-11-14 10:39:19 +11003026 newsid = tsec->create_sid;
3027
Vivek Goyalc957f6d2016-07-13 10:44:51 -04003028 rc = selinux_determine_inode_label(current_security(),
David Howellsc3c188b2015-07-10 17:19:58 -04003029 dir, qstr,
3030 inode_mode_to_security_class(inode->i_mode),
3031 &newsid);
3032 if (rc)
3033 return rc;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003034
Eric Paris296fddf2006-09-25 23:32:00 -07003035 /* Possibly defer initialization to selinux_complete_init. */
David P. Quigley0d90a7e2009-01-16 09:22:02 -05003036 if (sbsec->flags & SE_SBINITIALIZED) {
Eric Paris296fddf2006-09-25 23:32:00 -07003037 struct inode_security_struct *isec = inode->i_security;
3038 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3039 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05003040 isec->initialized = LABEL_INITIALIZED;
Eric Paris296fddf2006-09-25 23:32:00 -07003041 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003042
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003043 if (!selinux_state.initialized || !(sbsec->flags & SBLABEL_MNT))
Stephen Smalley25a74f32005-11-08 21:34:33 -08003044 return -EOPNOTSUPP;
3045
Tetsuo Handa95489062013-07-25 05:44:02 +09003046 if (name)
3047 *name = XATTR_SELINUX_SUFFIX;
Stephen Smalley570bc1c2005-09-09 13:01:43 -07003048
3049 if (value && len) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003050 rc = security_sid_to_context_force(&selinux_state, newsid,
3051 &context, &clen);
Tetsuo Handa95489062013-07-25 05:44:02 +09003052 if (rc)
Stephen Smalley570bc1c2005-09-09 13:01:43 -07003053 return rc;
Stephen Smalley570bc1c2005-09-09 13:01:43 -07003054 *value = context;
3055 *len = clen;
3056 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003057
Stephen Smalley5e41ff92005-09-09 13:01:35 -07003058 return 0;
3059}
3060
Al Viro4acdaf22011-07-26 01:42:34 -04003061static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003062{
3063 return may_create(dir, dentry, SECCLASS_FILE);
3064}
3065
Linus Torvalds1da177e2005-04-16 15:20:36 -07003066static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
3067{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003068 return may_link(dir, old_dentry, MAY_LINK);
3069}
3070
Linus Torvalds1da177e2005-04-16 15:20:36 -07003071static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
3072{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003073 return may_link(dir, dentry, MAY_UNLINK);
3074}
3075
3076static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
3077{
3078 return may_create(dir, dentry, SECCLASS_LNK_FILE);
3079}
3080
Al Viro18bb1db2011-07-26 01:41:39 -04003081static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003082{
3083 return may_create(dir, dentry, SECCLASS_DIR);
3084}
3085
Linus Torvalds1da177e2005-04-16 15:20:36 -07003086static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
3087{
3088 return may_link(dir, dentry, MAY_RMDIR);
3089}
3090
Al Viro1a67aaf2011-07-26 01:52:52 -04003091static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003092{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003093 return may_create(dir, dentry, inode_mode_to_security_class(mode));
3094}
3095
Linus Torvalds1da177e2005-04-16 15:20:36 -07003096static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
Eric Paris828dfe12008-04-17 13:17:49 -04003097 struct inode *new_inode, struct dentry *new_dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003098{
3099 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
3100}
3101
Linus Torvalds1da177e2005-04-16 15:20:36 -07003102static int selinux_inode_readlink(struct dentry *dentry)
3103{
David Howells88e67f32008-11-14 10:39:21 +11003104 const struct cred *cred = current_cred();
3105
Eric Paris2875fa02011-04-28 16:04:24 -04003106 return dentry_has_perm(cred, dentry, FILE__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003107}
3108
NeilBrownbda0be72015-03-23 13:37:39 +11003109static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
3110 bool rcu)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003111{
David Howells88e67f32008-11-14 10:39:21 +11003112 const struct cred *cred = current_cred();
NeilBrownbda0be72015-03-23 13:37:39 +11003113 struct common_audit_data ad;
3114 struct inode_security_struct *isec;
3115 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003116
NeilBrownbda0be72015-03-23 13:37:39 +11003117 validate_creds(cred);
3118
3119 ad.type = LSM_AUDIT_DATA_DENTRY;
3120 ad.u.dentry = dentry;
3121 sid = cred_sid(cred);
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05003122 isec = inode_security_rcu(inode, rcu);
3123 if (IS_ERR(isec))
3124 return PTR_ERR(isec);
NeilBrownbda0be72015-03-23 13:37:39 +11003125
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003126 return avc_has_perm_flags(&selinux_state,
3127 sid, isec->sid, isec->sclass, FILE__READ, &ad,
NeilBrownbda0be72015-03-23 13:37:39 +11003128 rcu ? MAY_NOT_BLOCK : 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003129}
3130
Eric Parisd4cf970d2012-04-04 15:01:42 -04003131static noinline int audit_inode_permission(struct inode *inode,
3132 u32 perms, u32 audited, u32 denied,
Stephen Smalley626b9742014-04-29 11:29:04 -07003133 int result,
Eric Parisd4cf970d2012-04-04 15:01:42 -04003134 unsigned flags)
3135{
3136 struct common_audit_data ad;
Eric Parisd4cf970d2012-04-04 15:01:42 -04003137 struct inode_security_struct *isec = inode->i_security;
3138 int rc;
3139
Eric Paris50c205f2012-04-04 15:01:43 -04003140 ad.type = LSM_AUDIT_DATA_INODE;
Eric Parisd4cf970d2012-04-04 15:01:42 -04003141 ad.u.inode = inode;
3142
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003143 rc = slow_avc_audit(&selinux_state,
3144 current_sid(), isec->sid, isec->sclass, perms,
Stephen Smalley626b9742014-04-29 11:29:04 -07003145 audited, denied, result, &ad, flags);
Eric Parisd4cf970d2012-04-04 15:01:42 -04003146 if (rc)
3147 return rc;
3148 return 0;
3149}
3150
Al Viroe74f71e2011-06-20 19:38:15 -04003151static int selinux_inode_permission(struct inode *inode, int mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003152{
David Howells88e67f32008-11-14 10:39:21 +11003153 const struct cred *cred = current_cred();
Eric Parisb782e0a2010-07-23 11:44:03 -04003154 u32 perms;
3155 bool from_access;
Al Virocf1dd1d2011-06-20 19:44:08 -04003156 unsigned flags = mask & MAY_NOT_BLOCK;
Eric Paris2e334052012-04-04 15:01:42 -04003157 struct inode_security_struct *isec;
3158 u32 sid;
3159 struct av_decision avd;
3160 int rc, rc2;
3161 u32 audited, denied;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003162
Eric Parisb782e0a2010-07-23 11:44:03 -04003163 from_access = mask & MAY_ACCESS;
Eric Parisd09ca732010-07-23 11:43:57 -04003164 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3165
Eric Parisb782e0a2010-07-23 11:44:03 -04003166 /* No permission to check. Existence test. */
3167 if (!mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003168 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003169
Eric Paris2e334052012-04-04 15:01:42 -04003170 validate_creds(cred);
Eric Parisb782e0a2010-07-23 11:44:03 -04003171
Eric Paris2e334052012-04-04 15:01:42 -04003172 if (unlikely(IS_PRIVATE(inode)))
3173 return 0;
Eric Parisb782e0a2010-07-23 11:44:03 -04003174
3175 perms = file_mask_to_av(inode->i_mode, mask);
3176
Eric Paris2e334052012-04-04 15:01:42 -04003177 sid = cred_sid(cred);
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05003178 isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3179 if (IS_ERR(isec))
3180 return PTR_ERR(isec);
Eric Paris2e334052012-04-04 15:01:42 -04003181
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003182 rc = avc_has_perm_noaudit(&selinux_state,
3183 sid, isec->sid, isec->sclass, perms, 0, &avd);
Eric Paris2e334052012-04-04 15:01:42 -04003184 audited = avc_audit_required(perms, &avd, rc,
3185 from_access ? FILE__AUDIT_ACCESS : 0,
3186 &denied);
3187 if (likely(!audited))
3188 return rc;
3189
Stephen Smalley626b9742014-04-29 11:29:04 -07003190 rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
Eric Paris2e334052012-04-04 15:01:42 -04003191 if (rc2)
3192 return rc2;
3193 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003194}
3195
3196static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3197{
David Howells88e67f32008-11-14 10:39:21 +11003198 const struct cred *cred = current_cred();
Stephen Smalleyccb54472017-05-12 12:41:24 -04003199 struct inode *inode = d_backing_inode(dentry);
Amerigo Wangbc6a6002009-08-20 19:29:02 -07003200 unsigned int ia_valid = iattr->ia_valid;
Eric Paris95dbf732012-04-04 13:45:34 -04003201 __u32 av = FILE__WRITE;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003202
Amerigo Wangbc6a6002009-08-20 19:29:02 -07003203 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3204 if (ia_valid & ATTR_FORCE) {
3205 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3206 ATTR_FORCE);
3207 if (!ia_valid)
3208 return 0;
3209 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003210
Amerigo Wangbc6a6002009-08-20 19:29:02 -07003211 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3212 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
Eric Paris2875fa02011-04-28 16:04:24 -04003213 return dentry_has_perm(cred, dentry, FILE__SETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003214
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003215 if (selinux_policycap_openperm() &&
Stephen Smalleyccb54472017-05-12 12:41:24 -04003216 inode->i_sb->s_magic != SOCKFS_MAGIC &&
3217 (ia_valid & ATTR_SIZE) &&
3218 !(ia_valid & ATTR_FILE))
Eric Paris95dbf732012-04-04 13:45:34 -04003219 av |= FILE__OPEN;
3220
3221 return dentry_has_perm(cred, dentry, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003222}
3223
Al Viro3f7036a2015-03-08 19:28:30 -04003224static int selinux_inode_getattr(const struct path *path)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003225{
Al Viro3f7036a2015-03-08 19:28:30 -04003226 return path_has_perm(current_cred(), path, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003227}
3228
Stephen Smalleydb590002017-04-20 11:31:30 -04003229static bool has_cap_mac_admin(bool audit)
3230{
3231 const struct cred *cred = current_cred();
3232 int cap_audit = audit ? SECURITY_CAP_AUDIT : SECURITY_CAP_NOAUDIT;
3233
3234 if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, cap_audit))
3235 return false;
3236 if (cred_has_capability(cred, CAP_MAC_ADMIN, cap_audit, true))
3237 return false;
3238 return true;
3239}
3240
David Howells8f0cfa52008-04-29 00:59:41 -07003241static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3242 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003243{
David Howellsc6f493d2015-03-17 22:26:22 +00003244 struct inode *inode = d_backing_inode(dentry);
Paul Moore20cdef82016-04-04 14:14:42 -04003245 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003246 struct superblock_security_struct *sbsec;
Thomas Liu2bf49692009-07-14 12:14:09 -04003247 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11003248 u32 newsid, sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003249 int rc = 0;
3250
Eric W. Biederman6b240302017-10-02 09:38:20 -05003251 if (strcmp(name, XATTR_NAME_SELINUX)) {
3252 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3253 if (rc)
3254 return rc;
3255
3256 /* Not an attribute we recognize, so just check the
3257 ordinary setattr permission. */
3258 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3259 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003260
3261 sbsec = inode->i_sb->s_security;
Eric Paris12f348b2012-10-09 10:56:25 -04003262 if (!(sbsec->flags & SBLABEL_MNT))
Linus Torvalds1da177e2005-04-16 15:20:36 -07003263 return -EOPNOTSUPP;
3264
Serge E. Hallyn2e149672011-03-23 16:43:26 -07003265 if (!inode_owner_or_capable(inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -07003266 return -EPERM;
3267
Eric Paris50c205f2012-04-04 15:01:43 -04003268 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04003269 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003270
Paul Moore20cdef82016-04-04 14:14:42 -04003271 isec = backing_inode_security(dentry);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003272 rc = avc_has_perm(&selinux_state,
3273 sid, isec->sid, isec->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003274 FILE__RELABELFROM, &ad);
3275 if (rc)
3276 return rc;
3277
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003278 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3279 GFP_KERNEL);
Stephen Smalley12b29f32008-05-07 13:03:20 -04003280 if (rc == -EINVAL) {
Stephen Smalleydb590002017-04-20 11:31:30 -04003281 if (!has_cap_mac_admin(true)) {
Eric Parisd6ea83e2012-04-04 13:45:49 -04003282 struct audit_buffer *ab;
3283 size_t audit_size;
Eric Parisd6ea83e2012-04-04 13:45:49 -04003284
3285 /* We strip a nul only if it is at the end, otherwise the
3286 * context contains a nul and we should audit that */
Al Viroe3fea3f2012-06-09 08:15:16 +01003287 if (value) {
Colin Ian Kingadd24372017-10-14 13:46:55 +01003288 const char *str = value;
3289
Al Viroe3fea3f2012-06-09 08:15:16 +01003290 if (str[size - 1] == '\0')
3291 audit_size = size - 1;
3292 else
3293 audit_size = size;
3294 } else {
Al Viroe3fea3f2012-06-09 08:15:16 +01003295 audit_size = 0;
3296 }
Richard Guy Briggscdfb6b32018-05-12 21:58:20 -04003297 ab = audit_log_start(audit_context(),
3298 GFP_ATOMIC, AUDIT_SELINUX_ERR);
Eric Parisd6ea83e2012-04-04 13:45:49 -04003299 audit_log_format(ab, "op=setxattr invalid_context=");
3300 audit_log_n_untrustedstring(ab, value, audit_size);
3301 audit_log_end(ab);
3302
Stephen Smalley12b29f32008-05-07 13:03:20 -04003303 return rc;
Eric Parisd6ea83e2012-04-04 13:45:49 -04003304 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003305 rc = security_context_to_sid_force(&selinux_state, value,
3306 size, &newsid);
Stephen Smalley12b29f32008-05-07 13:03:20 -04003307 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003308 if (rc)
3309 return rc;
3310
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003311 rc = avc_has_perm(&selinux_state,
3312 sid, newsid, isec->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003313 FILE__RELABELTO, &ad);
3314 if (rc)
3315 return rc;
3316
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003317 rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3318 sid, isec->sclass);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003319 if (rc)
3320 return rc;
3321
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003322 return avc_has_perm(&selinux_state,
3323 newsid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003324 sbsec->sid,
3325 SECCLASS_FILESYSTEM,
3326 FILESYSTEM__ASSOCIATE,
3327 &ad);
3328}
3329
David Howells8f0cfa52008-04-29 00:59:41 -07003330static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
Eric Parisf5269712008-05-14 11:27:45 -04003331 const void *value, size_t size,
David Howells8f0cfa52008-04-29 00:59:41 -07003332 int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003333{
David Howellsc6f493d2015-03-17 22:26:22 +00003334 struct inode *inode = d_backing_inode(dentry);
Paul Moore20cdef82016-04-04 14:14:42 -04003335 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003336 u32 newsid;
3337 int rc;
3338
3339 if (strcmp(name, XATTR_NAME_SELINUX)) {
3340 /* Not an attribute we recognize, so nothing to do. */
3341 return;
3342 }
3343
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003344 rc = security_context_to_sid_force(&selinux_state, value, size,
3345 &newsid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003346 if (rc) {
Stephen Smalley12b29f32008-05-07 13:03:20 -04003347 printk(KERN_ERR "SELinux: unable to map context to SID"
3348 "for (%s, %lu), rc=%d\n",
3349 inode->i_sb->s_id, inode->i_ino, -rc);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003350 return;
3351 }
3352
Paul Moore20cdef82016-04-04 14:14:42 -04003353 isec = backing_inode_security(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003354 spin_lock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003355 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003356 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05003357 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003358 spin_unlock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003359
Linus Torvalds1da177e2005-04-16 15:20:36 -07003360 return;
3361}
3362
David Howells8f0cfa52008-04-29 00:59:41 -07003363static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003364{
David Howells88e67f32008-11-14 10:39:21 +11003365 const struct cred *cred = current_cred();
3366
Eric Paris2875fa02011-04-28 16:04:24 -04003367 return dentry_has_perm(cred, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003368}
3369
Eric Paris828dfe12008-04-17 13:17:49 -04003370static int selinux_inode_listxattr(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003371{
David Howells88e67f32008-11-14 10:39:21 +11003372 const struct cred *cred = current_cred();
3373
Eric Paris2875fa02011-04-28 16:04:24 -04003374 return dentry_has_perm(cred, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003375}
3376
David Howells8f0cfa52008-04-29 00:59:41 -07003377static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003378{
Eric W. Biederman6b240302017-10-02 09:38:20 -05003379 if (strcmp(name, XATTR_NAME_SELINUX)) {
3380 int rc = cap_inode_removexattr(dentry, name);
3381 if (rc)
3382 return rc;
3383
3384 /* Not an attribute we recognize, so just check the
3385 ordinary setattr permission. */
3386 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3387 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003388
3389 /* No one is allowed to remove a SELinux security label.
3390 You can change the label, but all data must be labeled. */
3391 return -EACCES;
3392}
3393
James Morrisd381d8a2005-10-30 14:59:22 -08003394/*
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003395 * Copy the inode security context value to the user.
James Morrisd381d8a2005-10-30 14:59:22 -08003396 *
3397 * Permission check is handled by selinux_inode_getxattr hook.
3398 */
Andreas Gruenbacherea861df2015-12-24 11:09:39 -05003399static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003400{
David P. Quigley42492592008-02-04 22:29:39 -08003401 u32 size;
3402 int error;
3403 char *context = NULL;
Paul Moore20cdef82016-04-04 14:14:42 -04003404 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003405
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00003406 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3407 return -EOPNOTSUPP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003408
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003409 /*
3410 * If the caller has CAP_MAC_ADMIN, then get the raw context
3411 * value even if it is not defined by current policy; otherwise,
3412 * use the in-core value under current policy.
3413 * Use the non-auditing forms of the permission checks since
3414 * getxattr may be called by unprivileged processes commonly
3415 * and lack of permission just means that we fall back to the
3416 * in-core context value, not a denial.
3417 */
Paul Moore20cdef82016-04-04 14:14:42 -04003418 isec = inode_security(inode);
Stephen Smalleydb590002017-04-20 11:31:30 -04003419 if (has_cap_mac_admin(false))
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003420 error = security_sid_to_context_force(&selinux_state,
3421 isec->sid, &context,
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003422 &size);
3423 else
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003424 error = security_sid_to_context(&selinux_state, isec->sid,
3425 &context, &size);
David P. Quigley42492592008-02-04 22:29:39 -08003426 if (error)
3427 return error;
3428 error = size;
3429 if (alloc) {
3430 *buffer = context;
3431 goto out_nofree;
3432 }
3433 kfree(context);
3434out_nofree:
3435 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003436}
3437
3438static int selinux_inode_setsecurity(struct inode *inode, const char *name,
Eric Paris828dfe12008-04-17 13:17:49 -04003439 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003440{
Paul Moore2c971652016-04-19 16:36:28 -04003441 struct inode_security_struct *isec = inode_security_novalidate(inode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003442 u32 newsid;
3443 int rc;
3444
3445 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3446 return -EOPNOTSUPP;
3447
3448 if (!value || !size)
3449 return -EACCES;
3450
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003451 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3452 GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003453 if (rc)
3454 return rc;
3455
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003456 spin_lock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003457 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003458 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05003459 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003460 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003461 return 0;
3462}
3463
3464static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3465{
3466 const int len = sizeof(XATTR_NAME_SELINUX);
3467 if (buffer && len <= buffer_size)
3468 memcpy(buffer, XATTR_NAME_SELINUX, len);
3469 return len;
3470}
3471
Andreas Gruenbacherd6335d72015-12-24 11:09:39 -05003472static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02003473{
Andreas Gruenbachere817c2f2016-02-18 12:04:08 +01003474 struct inode_security_struct *isec = inode_security_novalidate(inode);
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02003475 *secid = isec->sid;
3476}
3477
Vivek Goyal56909eb2016-07-13 10:44:48 -04003478static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3479{
3480 u32 sid;
3481 struct task_security_struct *tsec;
3482 struct cred *new_creds = *new;
3483
3484 if (new_creds == NULL) {
3485 new_creds = prepare_creds();
3486 if (!new_creds)
3487 return -ENOMEM;
3488 }
3489
3490 tsec = new_creds->security;
3491 /* Get label from overlay inode and set it in create_sid */
3492 selinux_inode_getsecid(d_inode(src), &sid);
3493 tsec->create_sid = sid;
3494 *new = new_creds;
3495 return 0;
3496}
3497
Vivek Goyal19472b62016-07-13 10:44:50 -04003498static int selinux_inode_copy_up_xattr(const char *name)
3499{
3500 /* The copy_up hook above sets the initial context on an inode, but we
3501 * don't then want to overwrite it by blindly copying all the lower
3502 * xattrs up. Instead, we have to filter out SELinux-related xattrs.
3503 */
3504 if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3505 return 1; /* Discard */
3506 /*
3507 * Any other attribute apart from SELINUX is not claimed, supported
3508 * by selinux.
3509 */
3510 return -EOPNOTSUPP;
3511}
3512
Linus Torvalds1da177e2005-04-16 15:20:36 -07003513/* file security operations */
3514
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003515static int selinux_revalidate_file_permission(struct file *file, int mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003516{
David Howells88e67f32008-11-14 10:39:21 +11003517 const struct cred *cred = current_cred();
Al Viro496ad9a2013-01-23 17:07:38 -05003518 struct inode *inode = file_inode(file);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003519
Linus Torvalds1da177e2005-04-16 15:20:36 -07003520 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3521 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3522 mask |= MAY_APPEND;
3523
Paul Moore389fb8002009-03-27 17:10:34 -04003524 return file_has_perm(cred, file,
3525 file_mask_to_av(inode->i_mode, mask));
Linus Torvalds1da177e2005-04-16 15:20:36 -07003526}
3527
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003528static int selinux_file_permission(struct file *file, int mask)
3529{
Al Viro496ad9a2013-01-23 17:07:38 -05003530 struct inode *inode = file_inode(file);
Stephen Smalley20dda182009-06-22 14:54:53 -04003531 struct file_security_struct *fsec = file->f_security;
Andreas Gruenbacherb1973672016-01-05 23:12:33 +01003532 struct inode_security_struct *isec;
Stephen Smalley20dda182009-06-22 14:54:53 -04003533 u32 sid = current_sid();
3534
Paul Moore389fb8002009-03-27 17:10:34 -04003535 if (!mask)
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003536 /* No permission to check. Existence test. */
3537 return 0;
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003538
Andreas Gruenbacherb1973672016-01-05 23:12:33 +01003539 isec = inode_security(inode);
Stephen Smalley20dda182009-06-22 14:54:53 -04003540 if (sid == fsec->sid && fsec->isid == isec->sid &&
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003541 fsec->pseqno == avc_policy_seqno(&selinux_state))
Eric Paris83d49852012-04-04 13:45:40 -04003542 /* No change since file_open check. */
Stephen Smalley20dda182009-06-22 14:54:53 -04003543 return 0;
3544
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003545 return selinux_revalidate_file_permission(file, mask);
3546}
3547
Linus Torvalds1da177e2005-04-16 15:20:36 -07003548static int selinux_file_alloc_security(struct file *file)
3549{
3550 return file_alloc_security(file);
3551}
3552
3553static void selinux_file_free_security(struct file *file)
3554{
3555 file_free_security(file);
3556}
3557
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003558/*
3559 * Check whether a task has the ioctl permission and cmd
3560 * operation to an inode.
3561 */
Geliang Tang1d2a1682015-10-21 17:44:27 -04003562static int ioctl_has_perm(const struct cred *cred, struct file *file,
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003563 u32 requested, u16 cmd)
3564{
3565 struct common_audit_data ad;
3566 struct file_security_struct *fsec = file->f_security;
3567 struct inode *inode = file_inode(file);
Paul Moore20cdef82016-04-04 14:14:42 -04003568 struct inode_security_struct *isec;
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003569 struct lsm_ioctlop_audit ioctl;
3570 u32 ssid = cred_sid(cred);
3571 int rc;
3572 u8 driver = cmd >> 8;
3573 u8 xperm = cmd & 0xff;
3574
3575 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3576 ad.u.op = &ioctl;
3577 ad.u.op->cmd = cmd;
3578 ad.u.op->path = file->f_path;
3579
3580 if (ssid != fsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003581 rc = avc_has_perm(&selinux_state,
3582 ssid, fsec->sid,
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003583 SECCLASS_FD,
3584 FD__USE,
3585 &ad);
3586 if (rc)
3587 goto out;
3588 }
3589
3590 if (unlikely(IS_PRIVATE(inode)))
3591 return 0;
3592
Paul Moore20cdef82016-04-04 14:14:42 -04003593 isec = inode_security(inode);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003594 rc = avc_has_extended_perms(&selinux_state,
3595 ssid, isec->sid, isec->sclass,
3596 requested, driver, xperm, &ad);
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003597out:
3598 return rc;
3599}
3600
Linus Torvalds1da177e2005-04-16 15:20:36 -07003601static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3602 unsigned long arg)
3603{
David Howells88e67f32008-11-14 10:39:21 +11003604 const struct cred *cred = current_cred();
Eric Paris0b24dcb2011-02-25 15:39:20 -05003605 int error = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003606
Eric Paris0b24dcb2011-02-25 15:39:20 -05003607 switch (cmd) {
3608 case FIONREAD:
3609 /* fall through */
3610 case FIBMAP:
3611 /* fall through */
3612 case FIGETBSZ:
3613 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003614 case FS_IOC_GETFLAGS:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003615 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003616 case FS_IOC_GETVERSION:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003617 error = file_has_perm(cred, file, FILE__GETATTR);
3618 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003619
Al Viro2f99c362012-03-23 16:04:05 -04003620 case FS_IOC_SETFLAGS:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003621 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003622 case FS_IOC_SETVERSION:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003623 error = file_has_perm(cred, file, FILE__SETATTR);
3624 break;
3625
3626 /* sys_ioctl() checks */
3627 case FIONBIO:
3628 /* fall through */
3629 case FIOASYNC:
3630 error = file_has_perm(cred, file, 0);
3631 break;
3632
3633 case KDSKBENT:
3634 case KDSKBSENT:
Eric Paris6a9de492012-01-03 12:25:14 -05003635 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04003636 SECURITY_CAP_AUDIT, true);
Eric Paris0b24dcb2011-02-25 15:39:20 -05003637 break;
3638
3639 /* default case assumes that the command will go
3640 * to the file's ioctl() function.
3641 */
3642 default:
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003643 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
Eric Paris0b24dcb2011-02-25 15:39:20 -05003644 }
3645 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003646}
3647
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003648static int default_noexec;
3649
Linus Torvalds1da177e2005-04-16 15:20:36 -07003650static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3651{
David Howells88e67f32008-11-14 10:39:21 +11003652 const struct cred *cred = current_cred();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003653 u32 sid = cred_sid(cred);
David Howellsd84f4f92008-11-14 10:39:23 +11003654 int rc = 0;
David Howells88e67f32008-11-14 10:39:21 +11003655
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003656 if (default_noexec &&
Stephen Smalley892e8ca2015-07-10 09:40:59 -04003657 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3658 (!shared && (prot & PROT_WRITE)))) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07003659 /*
3660 * We are making executable an anonymous mapping or a
3661 * private file mapping that will also be writable.
3662 * This has an additional check.
3663 */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003664 rc = avc_has_perm(&selinux_state,
3665 sid, sid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003666 PROCESS__EXECMEM, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003667 if (rc)
David Howellsd84f4f92008-11-14 10:39:23 +11003668 goto error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003669 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003670
3671 if (file) {
3672 /* read access is always possible with a mapping */
3673 u32 av = FILE__READ;
3674
3675 /* write access only matters if the mapping is shared */
3676 if (shared && (prot & PROT_WRITE))
3677 av |= FILE__WRITE;
3678
3679 if (prot & PROT_EXEC)
3680 av |= FILE__EXECUTE;
3681
David Howells88e67f32008-11-14 10:39:21 +11003682 return file_has_perm(cred, file, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003683 }
David Howellsd84f4f92008-11-14 10:39:23 +11003684
3685error:
3686 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003687}
3688
Al Viroe5467852012-05-30 13:30:51 -04003689static int selinux_mmap_addr(unsigned long addr)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003690{
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07003691 int rc = 0;
Paul Moore98883bf2014-03-19 16:46:11 -04003692
3693 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3694 u32 sid = current_sid();
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003695 rc = avc_has_perm(&selinux_state,
3696 sid, sid, SECCLASS_MEMPROTECT,
Paul Moore98883bf2014-03-19 16:46:11 -04003697 MEMPROTECT__MMAP_ZERO, NULL);
3698 }
3699
3700 return rc;
Al Viroe5467852012-05-30 13:30:51 -04003701}
Linus Torvalds1da177e2005-04-16 15:20:36 -07003702
Al Viroe5467852012-05-30 13:30:51 -04003703static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3704 unsigned long prot, unsigned long flags)
3705{
Stephen Smalley3ba4bf52017-05-05 09:14:48 -04003706 struct common_audit_data ad;
3707 int rc;
3708
3709 if (file) {
3710 ad.type = LSM_AUDIT_DATA_FILE;
3711 ad.u.file = file;
3712 rc = inode_has_perm(current_cred(), file_inode(file),
3713 FILE__MAP, &ad);
3714 if (rc)
3715 return rc;
3716 }
3717
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003718 if (selinux_state.checkreqprot)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003719 prot = reqprot;
3720
3721 return file_map_prot_check(file, prot,
3722 (flags & MAP_TYPE) == MAP_SHARED);
3723}
3724
3725static int selinux_file_mprotect(struct vm_area_struct *vma,
3726 unsigned long reqprot,
3727 unsigned long prot)
3728{
David Howells88e67f32008-11-14 10:39:21 +11003729 const struct cred *cred = current_cred();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003730 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003731
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003732 if (selinux_state.checkreqprot)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003733 prot = reqprot;
3734
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003735 if (default_noexec &&
3736 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
James Morrisd541bbe2009-01-29 12:19:51 +11003737 int rc = 0;
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003738 if (vma->vm_start >= vma->vm_mm->start_brk &&
3739 vma->vm_end <= vma->vm_mm->brk) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003740 rc = avc_has_perm(&selinux_state,
3741 sid, sid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003742 PROCESS__EXECHEAP, NULL);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003743 } else if (!vma->vm_file &&
Stephen Smalleyc2316db2016-04-08 13:55:03 -04003744 ((vma->vm_start <= vma->vm_mm->start_stack &&
3745 vma->vm_end >= vma->vm_mm->start_stack) ||
Andy Lutomirskid17af502016-09-30 10:58:58 -07003746 vma_is_stack_for_current(vma))) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003747 rc = avc_has_perm(&selinux_state,
3748 sid, sid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003749 PROCESS__EXECSTACK, NULL);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003750 } else if (vma->vm_file && vma->anon_vma) {
3751 /*
3752 * We are making executable a file mapping that has
3753 * had some COW done. Since pages might have been
3754 * written, check ability to execute the possibly
3755 * modified content. This typically should only
3756 * occur for text relocations.
3757 */
David Howellsd84f4f92008-11-14 10:39:23 +11003758 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003759 }
Lorenzo Hernandez García-Hierro6b992192005-06-25 14:54:34 -07003760 if (rc)
3761 return rc;
3762 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003763
3764 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3765}
3766
3767static int selinux_file_lock(struct file *file, unsigned int cmd)
3768{
David Howells88e67f32008-11-14 10:39:21 +11003769 const struct cred *cred = current_cred();
3770
3771 return file_has_perm(cred, file, FILE__LOCK);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003772}
3773
3774static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3775 unsigned long arg)
3776{
David Howells88e67f32008-11-14 10:39:21 +11003777 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003778 int err = 0;
3779
3780 switch (cmd) {
Eric Paris828dfe12008-04-17 13:17:49 -04003781 case F_SETFL:
Eric Paris828dfe12008-04-17 13:17:49 -04003782 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
David Howells88e67f32008-11-14 10:39:21 +11003783 err = file_has_perm(cred, file, FILE__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003784 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003785 }
3786 /* fall through */
3787 case F_SETOWN:
3788 case F_SETSIG:
3789 case F_GETFL:
3790 case F_GETOWN:
3791 case F_GETSIG:
Cyrill Gorcunov1d151c32012-07-30 14:43:00 -07003792 case F_GETOWNER_UIDS:
Eric Paris828dfe12008-04-17 13:17:49 -04003793 /* Just check FD__USE permission */
David Howells88e67f32008-11-14 10:39:21 +11003794 err = file_has_perm(cred, file, 0);
Eric Paris828dfe12008-04-17 13:17:49 -04003795 break;
3796 case F_GETLK:
3797 case F_SETLK:
3798 case F_SETLKW:
Jeff Layton0d3f7a22014-04-22 08:23:58 -04003799 case F_OFD_GETLK:
3800 case F_OFD_SETLK:
3801 case F_OFD_SETLKW:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003802#if BITS_PER_LONG == 32
Eric Paris828dfe12008-04-17 13:17:49 -04003803 case F_GETLK64:
3804 case F_SETLK64:
3805 case F_SETLKW64:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003806#endif
David Howells88e67f32008-11-14 10:39:21 +11003807 err = file_has_perm(cred, file, FILE__LOCK);
Eric Paris828dfe12008-04-17 13:17:49 -04003808 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003809 }
3810
3811 return err;
3812}
3813
Jeff Laytone0b93ed2014-08-22 11:27:32 -04003814static void selinux_file_set_fowner(struct file *file)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003815{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003816 struct file_security_struct *fsec;
3817
Linus Torvalds1da177e2005-04-16 15:20:36 -07003818 fsec = file->f_security;
David Howells275bb412008-11-14 10:39:19 +11003819 fsec->fown_sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003820}
3821
3822static int selinux_file_send_sigiotask(struct task_struct *tsk,
3823 struct fown_struct *fown, int signum)
3824{
Eric Paris828dfe12008-04-17 13:17:49 -04003825 struct file *file;
Stephen Smalley65c90bc2009-05-04 15:43:18 -04003826 u32 sid = task_sid(tsk);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003827 u32 perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003828 struct file_security_struct *fsec;
3829
3830 /* struct fown_struct is never outside the context of a struct file */
Eric Paris828dfe12008-04-17 13:17:49 -04003831 file = container_of(fown, struct file, f_owner);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003832
Linus Torvalds1da177e2005-04-16 15:20:36 -07003833 fsec = file->f_security;
3834
3835 if (!signum)
3836 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3837 else
3838 perm = signal_to_av(signum);
3839
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003840 return avc_has_perm(&selinux_state,
3841 fsec->fown_sid, sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003842 SECCLASS_PROCESS, perm, NULL);
3843}
3844
3845static int selinux_file_receive(struct file *file)
3846{
David Howells88e67f32008-11-14 10:39:21 +11003847 const struct cred *cred = current_cred();
3848
3849 return file_has_perm(cred, file, file_to_av(file));
Linus Torvalds1da177e2005-04-16 15:20:36 -07003850}
3851
Eric Paris83d49852012-04-04 13:45:40 -04003852static int selinux_file_open(struct file *file, const struct cred *cred)
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003853{
3854 struct file_security_struct *fsec;
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003855 struct inode_security_struct *isec;
David Howellsd84f4f92008-11-14 10:39:23 +11003856
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003857 fsec = file->f_security;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05003858 isec = inode_security(file_inode(file));
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003859 /*
3860 * Save inode label and policy sequence number
3861 * at open-time so that selinux_file_permission
3862 * can determine whether revalidation is necessary.
3863 * Task label is already saved in the file security
3864 * struct as its SID.
3865 */
3866 fsec->isid = isec->sid;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003867 fsec->pseqno = avc_policy_seqno(&selinux_state);
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003868 /*
3869 * Since the inode label or policy seqno may have changed
3870 * between the selinux_inode_permission check and the saving
3871 * of state above, recheck that access is still permitted.
3872 * Otherwise, access might never be revalidated against the
3873 * new inode label or new policy.
3874 * This check is not redundant - do not remove.
3875 */
David Howells13f8e982013-06-13 23:37:55 +01003876 return file_path_has_perm(cred, file, open_file_to_av(file));
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003877}
3878
Linus Torvalds1da177e2005-04-16 15:20:36 -07003879/* task security operations */
3880
Tetsuo Handaa79be232017-03-28 23:08:45 +09003881static int selinux_task_alloc(struct task_struct *task,
3882 unsigned long clone_flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003883{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003884 u32 sid = current_sid();
3885
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003886 return avc_has_perm(&selinux_state,
3887 sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003888}
3889
David Howellsf1752ee2008-11-14 10:39:17 +11003890/*
David Howellsee18d642009-09-02 09:14:21 +01003891 * allocate the SELinux part of blank credentials
3892 */
3893static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3894{
3895 struct task_security_struct *tsec;
3896
3897 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3898 if (!tsec)
3899 return -ENOMEM;
3900
3901 cred->security = tsec;
3902 return 0;
3903}
3904
3905/*
David Howellsf1752ee2008-11-14 10:39:17 +11003906 * detach and free the LSM part of a set of credentials
3907 */
3908static void selinux_cred_free(struct cred *cred)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003909{
David Howellsf1752ee2008-11-14 10:39:17 +11003910 struct task_security_struct *tsec = cred->security;
David Howellse0e81732009-09-02 09:13:40 +01003911
Tetsuo Handa2edeaa32011-02-07 13:36:10 +00003912 /*
3913 * cred->security == NULL if security_cred_alloc_blank() or
3914 * security_prepare_creds() returned an error.
3915 */
3916 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
David Howellse0e81732009-09-02 09:13:40 +01003917 cred->security = (void *) 0x7UL;
David Howellsf1752ee2008-11-14 10:39:17 +11003918 kfree(tsec);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003919}
3920
David Howellsd84f4f92008-11-14 10:39:23 +11003921/*
3922 * prepare a new set of credentials for modification
3923 */
3924static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3925 gfp_t gfp)
3926{
3927 const struct task_security_struct *old_tsec;
3928 struct task_security_struct *tsec;
3929
3930 old_tsec = old->security;
3931
3932 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3933 if (!tsec)
3934 return -ENOMEM;
3935
3936 new->security = tsec;
3937 return 0;
3938}
3939
3940/*
David Howellsee18d642009-09-02 09:14:21 +01003941 * transfer the SELinux data to a blank set of creds
3942 */
3943static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3944{
3945 const struct task_security_struct *old_tsec = old->security;
3946 struct task_security_struct *tsec = new->security;
3947
3948 *tsec = *old_tsec;
3949}
3950
Matthew Garrett3ec30112018-01-08 13:36:19 -08003951static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
3952{
3953 *secid = cred_sid(c);
3954}
3955
David Howellsee18d642009-09-02 09:14:21 +01003956/*
David Howells3a3b7ce2008-11-14 10:39:28 +11003957 * set the security data for a kernel service
3958 * - all the creation contexts are set to unlabelled
3959 */
3960static int selinux_kernel_act_as(struct cred *new, u32 secid)
3961{
3962 struct task_security_struct *tsec = new->security;
3963 u32 sid = current_sid();
3964 int ret;
3965
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003966 ret = avc_has_perm(&selinux_state,
3967 sid, secid,
David Howells3a3b7ce2008-11-14 10:39:28 +11003968 SECCLASS_KERNEL_SERVICE,
3969 KERNEL_SERVICE__USE_AS_OVERRIDE,
3970 NULL);
3971 if (ret == 0) {
3972 tsec->sid = secid;
3973 tsec->create_sid = 0;
3974 tsec->keycreate_sid = 0;
3975 tsec->sockcreate_sid = 0;
3976 }
3977 return ret;
3978}
3979
3980/*
3981 * set the file creation context in a security record to the same as the
3982 * objective context of the specified inode
3983 */
3984static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3985{
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05003986 struct inode_security_struct *isec = inode_security(inode);
David Howells3a3b7ce2008-11-14 10:39:28 +11003987 struct task_security_struct *tsec = new->security;
3988 u32 sid = current_sid();
3989 int ret;
3990
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003991 ret = avc_has_perm(&selinux_state,
3992 sid, isec->sid,
David Howells3a3b7ce2008-11-14 10:39:28 +11003993 SECCLASS_KERNEL_SERVICE,
3994 KERNEL_SERVICE__CREATE_FILES_AS,
3995 NULL);
3996
3997 if (ret == 0)
3998 tsec->create_sid = isec->sid;
David Howellsef574712010-02-26 01:56:16 +00003999 return ret;
David Howells3a3b7ce2008-11-14 10:39:28 +11004000}
4001
Eric Parisdd8dbf22009-11-03 16:35:32 +11004002static int selinux_kernel_module_request(char *kmod_name)
Eric Paris25354c42009-08-13 09:45:03 -04004003{
Eric Parisdd8dbf22009-11-03 16:35:32 +11004004 struct common_audit_data ad;
4005
Eric Paris50c205f2012-04-04 15:01:43 -04004006 ad.type = LSM_AUDIT_DATA_KMOD;
Eric Parisdd8dbf22009-11-03 16:35:32 +11004007 ad.u.kmod_name = kmod_name;
4008
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004009 return avc_has_perm(&selinux_state,
4010 current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
Eric Parisdd8dbf22009-11-03 16:35:32 +11004011 SYSTEM__MODULE_REQUEST, &ad);
Eric Paris25354c42009-08-13 09:45:03 -04004012}
4013
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07004014static int selinux_kernel_module_from_file(struct file *file)
4015{
4016 struct common_audit_data ad;
4017 struct inode_security_struct *isec;
4018 struct file_security_struct *fsec;
4019 u32 sid = current_sid();
4020 int rc;
4021
4022 /* init_module */
4023 if (file == NULL)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004024 return avc_has_perm(&selinux_state,
4025 sid, sid, SECCLASS_SYSTEM,
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07004026 SYSTEM__MODULE_LOAD, NULL);
4027
4028 /* finit_module */
Paul Moore20cdef82016-04-04 14:14:42 -04004029
Vivek Goyal43af5de2016-09-09 11:37:49 -04004030 ad.type = LSM_AUDIT_DATA_FILE;
4031 ad.u.file = file;
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07004032
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07004033 fsec = file->f_security;
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07004034 if (sid != fsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004035 rc = avc_has_perm(&selinux_state,
4036 sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07004037 if (rc)
4038 return rc;
4039 }
4040
Paul Moore20cdef82016-04-04 14:14:42 -04004041 isec = inode_security(file_inode(file));
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004042 return avc_has_perm(&selinux_state,
4043 sid, isec->sid, SECCLASS_SYSTEM,
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07004044 SYSTEM__MODULE_LOAD, &ad);
4045}
4046
4047static int selinux_kernel_read_file(struct file *file,
4048 enum kernel_read_file_id id)
4049{
4050 int rc = 0;
4051
4052 switch (id) {
4053 case READING_MODULE:
4054 rc = selinux_kernel_module_from_file(file);
4055 break;
4056 default:
4057 break;
4058 }
4059
4060 return rc;
4061}
4062
Linus Torvalds1da177e2005-04-16 15:20:36 -07004063static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
4064{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004065 return avc_has_perm(&selinux_state,
4066 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004067 PROCESS__SETPGID, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004068}
4069
4070static int selinux_task_getpgid(struct task_struct *p)
4071{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004072 return avc_has_perm(&selinux_state,
4073 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004074 PROCESS__GETPGID, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004075}
4076
4077static int selinux_task_getsid(struct task_struct *p)
4078{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004079 return avc_has_perm(&selinux_state,
4080 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004081 PROCESS__GETSESSION, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004082}
4083
David Quigleyf9008e4c2006-06-30 01:55:46 -07004084static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
4085{
David Howells275bb412008-11-14 10:39:19 +11004086 *secid = task_sid(p);
David Quigleyf9008e4c2006-06-30 01:55:46 -07004087}
4088
Linus Torvalds1da177e2005-04-16 15:20:36 -07004089static int selinux_task_setnice(struct task_struct *p, int nice)
4090{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004091 return avc_has_perm(&selinux_state,
4092 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004093 PROCESS__SETSCHED, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004094}
4095
James Morris03e68062006-06-23 02:03:58 -07004096static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4097{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004098 return avc_has_perm(&selinux_state,
4099 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004100 PROCESS__SETSCHED, NULL);
James Morris03e68062006-06-23 02:03:58 -07004101}
4102
David Quigleya1836a42006-06-30 01:55:49 -07004103static int selinux_task_getioprio(struct task_struct *p)
4104{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004105 return avc_has_perm(&selinux_state,
4106 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004107 PROCESS__GETSCHED, NULL);
David Quigleya1836a42006-06-30 01:55:49 -07004108}
4109
Corentin LABBE42985552017-10-04 20:32:18 +02004110static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4111 unsigned int flags)
Stephen Smalley791ec492017-02-17 07:57:00 -05004112{
4113 u32 av = 0;
4114
Stephen Smalley84e68852017-02-28 09:35:08 -05004115 if (!flags)
4116 return 0;
Stephen Smalley791ec492017-02-17 07:57:00 -05004117 if (flags & LSM_PRLIMIT_WRITE)
4118 av |= PROCESS__SETRLIMIT;
4119 if (flags & LSM_PRLIMIT_READ)
4120 av |= PROCESS__GETRLIMIT;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004121 return avc_has_perm(&selinux_state,
4122 cred_sid(cred), cred_sid(tcred),
Stephen Smalley791ec492017-02-17 07:57:00 -05004123 SECCLASS_PROCESS, av, NULL);
4124}
4125
Jiri Slaby8fd00b42009-08-26 18:41:16 +02004126static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4127 struct rlimit *new_rlim)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004128{
Jiri Slaby8fd00b42009-08-26 18:41:16 +02004129 struct rlimit *old_rlim = p->signal->rlim + resource;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004130
4131 /* Control the ability to change the hard limit (whether
4132 lowering or raising it), so that the hard limit can
4133 later be used as a safe reset point for the soft limit
David Howellsd84f4f92008-11-14 10:39:23 +11004134 upon context transitions. See selinux_bprm_committing_creds. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07004135 if (old_rlim->rlim_max != new_rlim->rlim_max)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004136 return avc_has_perm(&selinux_state,
4137 current_sid(), task_sid(p),
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004138 SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004139
4140 return 0;
4141}
4142
KOSAKI Motohirob0ae1982010-10-15 04:21:18 +09004143static int selinux_task_setscheduler(struct task_struct *p)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004144{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004145 return avc_has_perm(&selinux_state,
4146 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004147 PROCESS__SETSCHED, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004148}
4149
4150static int selinux_task_getscheduler(struct task_struct *p)
4151{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004152 return avc_has_perm(&selinux_state,
4153 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004154 PROCESS__GETSCHED, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004155}
4156
David Quigley35601542006-06-23 02:04:01 -07004157static int selinux_task_movememory(struct task_struct *p)
4158{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004159 return avc_has_perm(&selinux_state,
4160 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004161 PROCESS__SETSCHED, NULL);
David Quigley35601542006-06-23 02:04:01 -07004162}
4163
David Quigleyf9008e4c2006-06-30 01:55:46 -07004164static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
Stephen Smalley6b4f3d02017-09-08 12:40:01 -04004165 int sig, const struct cred *cred)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004166{
Stephen Smalley6b4f3d02017-09-08 12:40:01 -04004167 u32 secid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004168 u32 perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004169
Linus Torvalds1da177e2005-04-16 15:20:36 -07004170 if (!sig)
4171 perm = PROCESS__SIGNULL; /* null signal; existence test */
4172 else
4173 perm = signal_to_av(sig);
Stephen Smalley6b4f3d02017-09-08 12:40:01 -04004174 if (!cred)
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004175 secid = current_sid();
Stephen Smalley6b4f3d02017-09-08 12:40:01 -04004176 else
4177 secid = cred_sid(cred);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004178 return avc_has_perm(&selinux_state,
4179 secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004180}
4181
Linus Torvalds1da177e2005-04-16 15:20:36 -07004182static void selinux_task_to_inode(struct task_struct *p,
4183 struct inode *inode)
4184{
Linus Torvalds1da177e2005-04-16 15:20:36 -07004185 struct inode_security_struct *isec = inode->i_security;
David Howells275bb412008-11-14 10:39:19 +11004186 u32 sid = task_sid(p);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004187
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004188 spin_lock(&isec->lock);
Andreas Gruenbacherdb978da2016-11-10 22:18:28 +01004189 isec->sclass = inode_mode_to_security_class(inode->i_mode);
David Howells275bb412008-11-14 10:39:19 +11004190 isec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05004191 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004192 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004193}
4194
Linus Torvalds1da177e2005-04-16 15:20:36 -07004195/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004196static int selinux_parse_skb_ipv4(struct sk_buff *skb,
Thomas Liu2bf49692009-07-14 12:14:09 -04004197 struct common_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004198{
4199 int offset, ihlen, ret = -EINVAL;
4200 struct iphdr _iph, *ih;
4201
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03004202 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004203 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4204 if (ih == NULL)
4205 goto out;
4206
4207 ihlen = ih->ihl * 4;
4208 if (ihlen < sizeof(_iph))
4209 goto out;
4210
Eric Paris48c62af2012-04-02 13:15:44 -04004211 ad->u.net->v4info.saddr = ih->saddr;
4212 ad->u.net->v4info.daddr = ih->daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004213 ret = 0;
4214
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004215 if (proto)
4216 *proto = ih->protocol;
4217
Linus Torvalds1da177e2005-04-16 15:20:36 -07004218 switch (ih->protocol) {
Eric Paris828dfe12008-04-17 13:17:49 -04004219 case IPPROTO_TCP: {
4220 struct tcphdr _tcph, *th;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004221
Eric Paris828dfe12008-04-17 13:17:49 -04004222 if (ntohs(ih->frag_off) & IP_OFFSET)
4223 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004224
4225 offset += ihlen;
4226 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4227 if (th == NULL)
4228 break;
4229
Eric Paris48c62af2012-04-02 13:15:44 -04004230 ad->u.net->sport = th->source;
4231 ad->u.net->dport = th->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004232 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004233 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004234
Eric Paris828dfe12008-04-17 13:17:49 -04004235 case IPPROTO_UDP: {
4236 struct udphdr _udph, *uh;
4237
4238 if (ntohs(ih->frag_off) & IP_OFFSET)
4239 break;
4240
4241 offset += ihlen;
4242 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4243 if (uh == NULL)
4244 break;
4245
Eric Paris48c62af2012-04-02 13:15:44 -04004246 ad->u.net->sport = uh->source;
4247 ad->u.net->dport = uh->dest;
Eric Paris828dfe12008-04-17 13:17:49 -04004248 break;
4249 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004250
James Morris2ee92d42006-11-13 16:09:01 -08004251 case IPPROTO_DCCP: {
4252 struct dccp_hdr _dccph, *dh;
4253
4254 if (ntohs(ih->frag_off) & IP_OFFSET)
4255 break;
4256
4257 offset += ihlen;
4258 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4259 if (dh == NULL)
4260 break;
4261
Eric Paris48c62af2012-04-02 13:15:44 -04004262 ad->u.net->sport = dh->dccph_sport;
4263 ad->u.net->dport = dh->dccph_dport;
James Morris2ee92d42006-11-13 16:09:01 -08004264 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004265 }
James Morris2ee92d42006-11-13 16:09:01 -08004266
Richard Hainesd4529302018-02-13 20:57:18 +00004267#if IS_ENABLED(CONFIG_IP_SCTP)
4268 case IPPROTO_SCTP: {
4269 struct sctphdr _sctph, *sh;
4270
4271 if (ntohs(ih->frag_off) & IP_OFFSET)
4272 break;
4273
4274 offset += ihlen;
4275 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4276 if (sh == NULL)
4277 break;
4278
4279 ad->u.net->sport = sh->source;
4280 ad->u.net->dport = sh->dest;
4281 break;
4282 }
4283#endif
Eric Paris828dfe12008-04-17 13:17:49 -04004284 default:
4285 break;
4286 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004287out:
4288 return ret;
4289}
4290
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04004291#if IS_ENABLED(CONFIG_IPV6)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004292
4293/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004294static int selinux_parse_skb_ipv6(struct sk_buff *skb,
Thomas Liu2bf49692009-07-14 12:14:09 -04004295 struct common_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004296{
4297 u8 nexthdr;
4298 int ret = -EINVAL, offset;
4299 struct ipv6hdr _ipv6h, *ip6;
Jesse Gross75f28112011-11-30 17:05:51 -08004300 __be16 frag_off;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004301
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03004302 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004303 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4304 if (ip6 == NULL)
4305 goto out;
4306
Eric Paris48c62af2012-04-02 13:15:44 -04004307 ad->u.net->v6info.saddr = ip6->saddr;
4308 ad->u.net->v6info.daddr = ip6->daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004309 ret = 0;
4310
4311 nexthdr = ip6->nexthdr;
4312 offset += sizeof(_ipv6h);
Jesse Gross75f28112011-11-30 17:05:51 -08004313 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004314 if (offset < 0)
4315 goto out;
4316
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004317 if (proto)
4318 *proto = nexthdr;
4319
Linus Torvalds1da177e2005-04-16 15:20:36 -07004320 switch (nexthdr) {
4321 case IPPROTO_TCP: {
Eric Paris828dfe12008-04-17 13:17:49 -04004322 struct tcphdr _tcph, *th;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004323
4324 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4325 if (th == NULL)
4326 break;
4327
Eric Paris48c62af2012-04-02 13:15:44 -04004328 ad->u.net->sport = th->source;
4329 ad->u.net->dport = th->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004330 break;
4331 }
4332
4333 case IPPROTO_UDP: {
4334 struct udphdr _udph, *uh;
4335
4336 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4337 if (uh == NULL)
4338 break;
4339
Eric Paris48c62af2012-04-02 13:15:44 -04004340 ad->u.net->sport = uh->source;
4341 ad->u.net->dport = uh->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004342 break;
4343 }
4344
James Morris2ee92d42006-11-13 16:09:01 -08004345 case IPPROTO_DCCP: {
4346 struct dccp_hdr _dccph, *dh;
4347
4348 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4349 if (dh == NULL)
4350 break;
4351
Eric Paris48c62af2012-04-02 13:15:44 -04004352 ad->u.net->sport = dh->dccph_sport;
4353 ad->u.net->dport = dh->dccph_dport;
James Morris2ee92d42006-11-13 16:09:01 -08004354 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004355 }
James Morris2ee92d42006-11-13 16:09:01 -08004356
Richard Hainesd4529302018-02-13 20:57:18 +00004357#if IS_ENABLED(CONFIG_IP_SCTP)
4358 case IPPROTO_SCTP: {
4359 struct sctphdr _sctph, *sh;
4360
4361 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4362 if (sh == NULL)
4363 break;
4364
4365 ad->u.net->sport = sh->source;
4366 ad->u.net->dport = sh->dest;
4367 break;
4368 }
4369#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07004370 /* includes fragments */
4371 default:
4372 break;
4373 }
4374out:
4375 return ret;
4376}
4377
4378#endif /* IPV6 */
4379
Thomas Liu2bf49692009-07-14 12:14:09 -04004380static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
David Howellscf9481e2008-07-27 21:31:07 +10004381 char **_addrp, int src, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004382{
David Howellscf9481e2008-07-27 21:31:07 +10004383 char *addrp;
4384 int ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004385
Eric Paris48c62af2012-04-02 13:15:44 -04004386 switch (ad->u.net->family) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07004387 case PF_INET:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004388 ret = selinux_parse_skb_ipv4(skb, ad, proto);
David Howellscf9481e2008-07-27 21:31:07 +10004389 if (ret)
4390 goto parse_error;
Eric Paris48c62af2012-04-02 13:15:44 -04004391 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4392 &ad->u.net->v4info.daddr);
David Howellscf9481e2008-07-27 21:31:07 +10004393 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004394
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04004395#if IS_ENABLED(CONFIG_IPV6)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004396 case PF_INET6:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004397 ret = selinux_parse_skb_ipv6(skb, ad, proto);
David Howellscf9481e2008-07-27 21:31:07 +10004398 if (ret)
4399 goto parse_error;
Eric Paris48c62af2012-04-02 13:15:44 -04004400 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4401 &ad->u.net->v6info.daddr);
David Howellscf9481e2008-07-27 21:31:07 +10004402 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004403#endif /* IPV6 */
4404 default:
David Howellscf9481e2008-07-27 21:31:07 +10004405 addrp = NULL;
4406 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004407 }
4408
David Howellscf9481e2008-07-27 21:31:07 +10004409parse_error:
4410 printk(KERN_WARNING
4411 "SELinux: failure in selinux_parse_skb(),"
4412 " unable to parse packet\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07004413 return ret;
David Howellscf9481e2008-07-27 21:31:07 +10004414
4415okay:
4416 if (_addrp)
4417 *_addrp = addrp;
4418 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004419}
4420
Paul Moore4f6a9932007-03-01 14:35:22 -05004421/**
Paul Moore220deb92008-01-29 08:38:23 -05004422 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
Paul Moore4f6a9932007-03-01 14:35:22 -05004423 * @skb: the packet
Paul Moore75e22912008-01-29 08:38:04 -05004424 * @family: protocol family
Paul Moore220deb92008-01-29 08:38:23 -05004425 * @sid: the packet's peer label SID
Paul Moore4f6a9932007-03-01 14:35:22 -05004426 *
4427 * Description:
Paul Moore220deb92008-01-29 08:38:23 -05004428 * Check the various different forms of network peer labeling and determine
4429 * the peer label/SID for the packet; most of the magic actually occurs in
4430 * the security server function security_net_peersid_cmp(). The function
4431 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4432 * or -EACCES if @sid is invalid due to inconsistencies with the different
4433 * peer labels.
Paul Moore4f6a9932007-03-01 14:35:22 -05004434 *
4435 */
Paul Moore220deb92008-01-29 08:38:23 -05004436static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
Paul Moore4f6a9932007-03-01 14:35:22 -05004437{
Paul Moore71f1cb02008-01-29 08:51:16 -05004438 int err;
Paul Moore4f6a9932007-03-01 14:35:22 -05004439 u32 xfrm_sid;
4440 u32 nlbl_sid;
Paul Moore220deb92008-01-29 08:38:23 -05004441 u32 nlbl_type;
Paul Moore4f6a9932007-03-01 14:35:22 -05004442
Paul Moore817eff72013-12-10 14:57:54 -05004443 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
Paul Moorebed4d7e2013-07-23 17:38:40 -04004444 if (unlikely(err))
4445 return -EACCES;
4446 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4447 if (unlikely(err))
4448 return -EACCES;
Paul Moore220deb92008-01-29 08:38:23 -05004449
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004450 err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4451 nlbl_type, xfrm_sid, sid);
Paul Moore71f1cb02008-01-29 08:51:16 -05004452 if (unlikely(err)) {
4453 printk(KERN_WARNING
4454 "SELinux: failure in selinux_skb_peerlbl_sid(),"
4455 " unable to determine packet's peer label\n");
Paul Moore220deb92008-01-29 08:38:23 -05004456 return -EACCES;
Paul Moore71f1cb02008-01-29 08:51:16 -05004457 }
Paul Moore220deb92008-01-29 08:38:23 -05004458
4459 return 0;
Paul Moore4f6a9932007-03-01 14:35:22 -05004460}
4461
Paul Moore446b8022013-12-04 16:10:51 -05004462/**
4463 * selinux_conn_sid - Determine the child socket label for a connection
4464 * @sk_sid: the parent socket's SID
4465 * @skb_sid: the packet's SID
4466 * @conn_sid: the resulting connection SID
4467 *
4468 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4469 * combined with the MLS information from @skb_sid in order to create
4470 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
4471 * of @sk_sid. Returns zero on success, negative values on failure.
4472 *
4473 */
4474static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4475{
4476 int err = 0;
4477
4478 if (skb_sid != SECSID_NULL)
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004479 err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4480 conn_sid);
Paul Moore446b8022013-12-04 16:10:51 -05004481 else
4482 *conn_sid = sk_sid;
4483
4484 return err;
4485}
4486
Linus Torvalds1da177e2005-04-16 15:20:36 -07004487/* socket security operations */
Paul Moored4f2d972010-04-22 14:46:18 -04004488
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004489static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4490 u16 secclass, u32 *socksid)
Paul Moored4f2d972010-04-22 14:46:18 -04004491{
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004492 if (tsec->sockcreate_sid > SECSID_NULL) {
4493 *socksid = tsec->sockcreate_sid;
4494 return 0;
4495 }
4496
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004497 return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4498 secclass, NULL, socksid);
Paul Moored4f2d972010-04-22 14:46:18 -04004499}
4500
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004501static int sock_has_perm(struct sock *sk, u32 perms)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004502{
Paul Moore253bfae2010-04-22 14:46:19 -04004503 struct sk_security_struct *sksec = sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004504 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004505 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004506
Paul Moore253bfae2010-04-22 14:46:19 -04004507 if (sksec->sid == SECINITSID_KERNEL)
4508 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004509
Eric Paris50c205f2012-04-04 15:01:43 -04004510 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004511 ad.u.net = &net;
4512 ad.u.net->sk = sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004513
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004514 return avc_has_perm(&selinux_state,
4515 current_sid(), sksec->sid, sksec->sclass, perms,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004516 &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004517}
4518
4519static int selinux_socket_create(int family, int type,
4520 int protocol, int kern)
4521{
Paul Moore5fb49872010-04-22 14:46:19 -04004522 const struct task_security_struct *tsec = current_security();
Paul Moored4f2d972010-04-22 14:46:18 -04004523 u32 newsid;
David Howells275bb412008-11-14 10:39:19 +11004524 u16 secclass;
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004525 int rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004526
4527 if (kern)
Paul Moored4f2d972010-04-22 14:46:18 -04004528 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004529
David Howells275bb412008-11-14 10:39:19 +11004530 secclass = socket_type_to_security_class(family, type, protocol);
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004531 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4532 if (rc)
4533 return rc;
4534
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004535 return avc_has_perm(&selinux_state,
4536 tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004537}
4538
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07004539static int selinux_socket_post_create(struct socket *sock, int family,
4540 int type, int protocol, int kern)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004541{
Paul Moore5fb49872010-04-22 14:46:19 -04004542 const struct task_security_struct *tsec = current_security();
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05004543 struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004544 struct sk_security_struct *sksec;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004545 u16 sclass = socket_type_to_security_class(family, type, protocol);
4546 u32 sid = SECINITSID_KERNEL;
David Howells275bb412008-11-14 10:39:19 +11004547 int err = 0;
4548
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004549 if (!kern) {
4550 err = socket_sockcreate_sid(tsec, sclass, &sid);
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004551 if (err)
4552 return err;
4553 }
David Howells275bb412008-11-14 10:39:19 +11004554
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004555 isec->sclass = sclass;
4556 isec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05004557 isec->initialized = LABEL_INITIALIZED;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004558
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004559 if (sock->sk) {
4560 sksec = sock->sk->sk_security;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004561 sksec->sclass = sclass;
4562 sksec->sid = sid;
Richard Hainesd4529302018-02-13 20:57:18 +00004563 /* Allows detection of the first association on this socket */
4564 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4565 sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4566
Paul Moore389fb8002009-03-27 17:10:34 -04004567 err = selinux_netlbl_socket_post_create(sock->sk, family);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004568 }
4569
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07004570 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004571}
4572
4573/* Range of port numbers used to automatically bind.
4574 Need to determine whether we should perform a name_bind
4575 permission check between the socket and the port number. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07004576
4577static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4578{
Paul Moore253bfae2010-04-22 14:46:19 -04004579 struct sock *sk = sock->sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004580 u16 family;
4581 int err;
4582
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004583 err = sock_has_perm(sk, SOCKET__BIND);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004584 if (err)
4585 goto out;
4586
Richard Hainesd4529302018-02-13 20:57:18 +00004587 /* If PF_INET or PF_INET6, check name_bind permission for the port. */
Paul Moore253bfae2010-04-22 14:46:19 -04004588 family = sk->sk_family;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004589 if (family == PF_INET || family == PF_INET6) {
4590 char *addrp;
Paul Moore253bfae2010-04-22 14:46:19 -04004591 struct sk_security_struct *sksec = sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004592 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004593 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004594 struct sockaddr_in *addr4 = NULL;
4595 struct sockaddr_in6 *addr6 = NULL;
4596 unsigned short snum;
James Morrise399f982008-06-12 01:39:58 +10004597 u32 sid, node_perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004598
Richard Hainesd4529302018-02-13 20:57:18 +00004599 /*
4600 * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4601 * that validates multiple binding addresses. Because of this
4602 * need to check address->sa_family as it is possible to have
4603 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4604 */
Richard Haines68741a8a2018-03-02 19:54:34 +00004605 switch (address->sa_family) {
4606 case AF_INET:
4607 if (addrlen < sizeof(struct sockaddr_in))
4608 return -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004609 addr4 = (struct sockaddr_in *)address;
4610 snum = ntohs(addr4->sin_port);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004611 addrp = (char *)&addr4->sin_addr.s_addr;
Richard Haines68741a8a2018-03-02 19:54:34 +00004612 break;
4613 case AF_INET6:
4614 if (addrlen < SIN6_LEN_RFC2133)
4615 return -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004616 addr6 = (struct sockaddr_in6 *)address;
4617 snum = ntohs(addr6->sin6_port);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004618 addrp = (char *)&addr6->sin6_addr.s6_addr;
Richard Haines68741a8a2018-03-02 19:54:34 +00004619 break;
4620 default:
4621 /* Note that SCTP services expect -EINVAL, whereas
4622 * others expect -EAFNOSUPPORT.
4623 */
4624 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4625 return -EINVAL;
4626 else
4627 return -EAFNOSUPPORT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004628 }
4629
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004630 if (snum) {
4631 int low, high;
4632
Eric W. Biederman0bbf87d2013-09-28 14:10:59 -07004633 inet_get_local_port_range(sock_net(sk), &low, &high);
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004634
Krister Johansen4548b682017-01-20 17:49:11 -08004635 if (snum < max(inet_prot_sock(sock_net(sk)), low) ||
4636 snum > high) {
Paul Moore3e1121722008-04-10 10:48:14 -04004637 err = sel_netport_sid(sk->sk_protocol,
4638 snum, &sid);
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004639 if (err)
4640 goto out;
Eric Paris50c205f2012-04-04 15:01:43 -04004641 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004642 ad.u.net = &net;
4643 ad.u.net->sport = htons(snum);
4644 ad.u.net->family = family;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004645 err = avc_has_perm(&selinux_state,
4646 sksec->sid, sid,
Paul Moore253bfae2010-04-22 14:46:19 -04004647 sksec->sclass,
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004648 SOCKET__NAME_BIND, &ad);
4649 if (err)
4650 goto out;
4651 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004652 }
Eric Paris828dfe12008-04-17 13:17:49 -04004653
Paul Moore253bfae2010-04-22 14:46:19 -04004654 switch (sksec->sclass) {
James Morris13402582005-09-30 14:24:34 -04004655 case SECCLASS_TCP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004656 node_perm = TCP_SOCKET__NODE_BIND;
4657 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004658
James Morris13402582005-09-30 14:24:34 -04004659 case SECCLASS_UDP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004660 node_perm = UDP_SOCKET__NODE_BIND;
4661 break;
James Morris2ee92d42006-11-13 16:09:01 -08004662
4663 case SECCLASS_DCCP_SOCKET:
4664 node_perm = DCCP_SOCKET__NODE_BIND;
4665 break;
4666
Richard Hainesd4529302018-02-13 20:57:18 +00004667 case SECCLASS_SCTP_SOCKET:
4668 node_perm = SCTP_SOCKET__NODE_BIND;
4669 break;
4670
Linus Torvalds1da177e2005-04-16 15:20:36 -07004671 default:
4672 node_perm = RAWIP_SOCKET__NODE_BIND;
4673 break;
4674 }
Eric Paris828dfe12008-04-17 13:17:49 -04004675
Paul Moore224dfbd2008-01-29 08:38:13 -05004676 err = sel_netnode_sid(addrp, family, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004677 if (err)
4678 goto out;
Eric Paris828dfe12008-04-17 13:17:49 -04004679
Eric Paris50c205f2012-04-04 15:01:43 -04004680 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004681 ad.u.net = &net;
4682 ad.u.net->sport = htons(snum);
4683 ad.u.net->family = family;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004684
Richard Hainesd4529302018-02-13 20:57:18 +00004685 if (address->sa_family == AF_INET)
Eric Paris48c62af2012-04-02 13:15:44 -04004686 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004687 else
Eric Paris48c62af2012-04-02 13:15:44 -04004688 ad.u.net->v6info.saddr = addr6->sin6_addr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004689
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004690 err = avc_has_perm(&selinux_state,
4691 sksec->sid, sid,
Paul Moore253bfae2010-04-22 14:46:19 -04004692 sksec->sclass, node_perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004693 if (err)
4694 goto out;
4695 }
4696out:
4697 return err;
4698}
4699
Richard Hainesd4529302018-02-13 20:57:18 +00004700/* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4701 * and sctp_sendmsg(3) as described in Documentation/security/LSM-sctp.txt
4702 */
4703static int selinux_socket_connect_helper(struct socket *sock,
4704 struct sockaddr *address, int addrlen)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004705{
Paul Moore014ab192008-10-10 10:16:33 -04004706 struct sock *sk = sock->sk;
Paul Moore253bfae2010-04-22 14:46:19 -04004707 struct sk_security_struct *sksec = sk->sk_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004708 int err;
4709
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004710 err = sock_has_perm(sk, SOCKET__CONNECT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004711 if (err)
4712 return err;
4713
4714 /*
Richard Hainesd4529302018-02-13 20:57:18 +00004715 * If a TCP, DCCP or SCTP socket, check name_connect permission
4716 * for the port.
Linus Torvalds1da177e2005-04-16 15:20:36 -07004717 */
Paul Moore253bfae2010-04-22 14:46:19 -04004718 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
Richard Hainesd4529302018-02-13 20:57:18 +00004719 sksec->sclass == SECCLASS_DCCP_SOCKET ||
4720 sksec->sclass == SECCLASS_SCTP_SOCKET) {
Thomas Liu2bf49692009-07-14 12:14:09 -04004721 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004722 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004723 struct sockaddr_in *addr4 = NULL;
4724 struct sockaddr_in6 *addr6 = NULL;
4725 unsigned short snum;
James Morris2ee92d42006-11-13 16:09:01 -08004726 u32 sid, perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004727
Richard Hainesd4529302018-02-13 20:57:18 +00004728 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4729 * that validates multiple connect addresses. Because of this
4730 * need to check address->sa_family as it is possible to have
4731 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4732 */
Richard Haines68741a8a2018-03-02 19:54:34 +00004733 switch (address->sa_family) {
4734 case AF_INET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004735 addr4 = (struct sockaddr_in *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07004736 if (addrlen < sizeof(struct sockaddr_in))
Linus Torvalds1da177e2005-04-16 15:20:36 -07004737 return -EINVAL;
4738 snum = ntohs(addr4->sin_port);
Richard Haines68741a8a2018-03-02 19:54:34 +00004739 break;
4740 case AF_INET6:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004741 addr6 = (struct sockaddr_in6 *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07004742 if (addrlen < SIN6_LEN_RFC2133)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004743 return -EINVAL;
4744 snum = ntohs(addr6->sin6_port);
Richard Haines68741a8a2018-03-02 19:54:34 +00004745 break;
4746 default:
4747 /* Note that SCTP services expect -EINVAL, whereas
4748 * others expect -EAFNOSUPPORT.
4749 */
4750 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4751 return -EINVAL;
4752 else
4753 return -EAFNOSUPPORT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004754 }
4755
Paul Moore3e1121722008-04-10 10:48:14 -04004756 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004757 if (err)
Richard Hainesd4529302018-02-13 20:57:18 +00004758 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004759
Richard Hainesd4529302018-02-13 20:57:18 +00004760 switch (sksec->sclass) {
4761 case SECCLASS_TCP_SOCKET:
4762 perm = TCP_SOCKET__NAME_CONNECT;
4763 break;
4764 case SECCLASS_DCCP_SOCKET:
4765 perm = DCCP_SOCKET__NAME_CONNECT;
4766 break;
4767 case SECCLASS_SCTP_SOCKET:
4768 perm = SCTP_SOCKET__NAME_CONNECT;
4769 break;
4770 }
James Morris2ee92d42006-11-13 16:09:01 -08004771
Eric Paris50c205f2012-04-04 15:01:43 -04004772 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004773 ad.u.net = &net;
4774 ad.u.net->dport = htons(snum);
4775 ad.u.net->family = sk->sk_family;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004776 err = avc_has_perm(&selinux_state,
4777 sksec->sid, sid, sksec->sclass, perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004778 if (err)
Richard Hainesd4529302018-02-13 20:57:18 +00004779 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004780 }
4781
Richard Hainesd4529302018-02-13 20:57:18 +00004782 return 0;
4783}
Paul Moore014ab192008-10-10 10:16:33 -04004784
Richard Hainesd4529302018-02-13 20:57:18 +00004785/* Supports connect(2), see comments in selinux_socket_connect_helper() */
4786static int selinux_socket_connect(struct socket *sock,
4787 struct sockaddr *address, int addrlen)
4788{
4789 int err;
4790 struct sock *sk = sock->sk;
4791
4792 err = selinux_socket_connect_helper(sock, address, addrlen);
4793 if (err)
4794 return err;
4795
4796 return selinux_netlbl_socket_connect(sk, address);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004797}
4798
4799static int selinux_socket_listen(struct socket *sock, int backlog)
4800{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004801 return sock_has_perm(sock->sk, SOCKET__LISTEN);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004802}
4803
4804static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4805{
4806 int err;
4807 struct inode_security_struct *isec;
4808 struct inode_security_struct *newisec;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004809 u16 sclass;
4810 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004811
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004812 err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004813 if (err)
4814 return err;
4815
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05004816 isec = inode_security_novalidate(SOCK_INODE(sock));
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004817 spin_lock(&isec->lock);
4818 sclass = isec->sclass;
4819 sid = isec->sid;
4820 spin_unlock(&isec->lock);
4821
4822 newisec = inode_security_novalidate(SOCK_INODE(newsock));
4823 newisec->sclass = sclass;
4824 newisec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05004825 newisec->initialized = LABEL_INITIALIZED;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004826
4827 return 0;
4828}
4829
4830static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
Eric Paris828dfe12008-04-17 13:17:49 -04004831 int size)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004832{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004833 return sock_has_perm(sock->sk, SOCKET__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004834}
4835
4836static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4837 int size, int flags)
4838{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004839 return sock_has_perm(sock->sk, SOCKET__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004840}
4841
4842static int selinux_socket_getsockname(struct socket *sock)
4843{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004844 return sock_has_perm(sock->sk, SOCKET__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004845}
4846
4847static int selinux_socket_getpeername(struct socket *sock)
4848{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004849 return sock_has_perm(sock->sk, SOCKET__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004850}
4851
Eric Paris828dfe12008-04-17 13:17:49 -04004852static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004853{
Paul Mooref8687af2006-10-30 15:22:15 -08004854 int err;
4855
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004856 err = sock_has_perm(sock->sk, SOCKET__SETOPT);
Paul Mooref8687af2006-10-30 15:22:15 -08004857 if (err)
4858 return err;
4859
4860 return selinux_netlbl_socket_setsockopt(sock, level, optname);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004861}
4862
4863static int selinux_socket_getsockopt(struct socket *sock, int level,
4864 int optname)
4865{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004866 return sock_has_perm(sock->sk, SOCKET__GETOPT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004867}
4868
4869static int selinux_socket_shutdown(struct socket *sock, int how)
4870{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004871 return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004872}
4873
David S. Miller3610cda2011-01-05 15:38:53 -08004874static int selinux_socket_unix_stream_connect(struct sock *sock,
4875 struct sock *other,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004876 struct sock *newsk)
4877{
David S. Miller3610cda2011-01-05 15:38:53 -08004878 struct sk_security_struct *sksec_sock = sock->sk_security;
4879 struct sk_security_struct *sksec_other = other->sk_security;
Paul Moore4d1e2452010-04-22 14:46:18 -04004880 struct sk_security_struct *sksec_new = newsk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004881 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004882 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004883 int err;
4884
Eric Paris50c205f2012-04-04 15:01:43 -04004885 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004886 ad.u.net = &net;
4887 ad.u.net->sk = other;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004888
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004889 err = avc_has_perm(&selinux_state,
4890 sksec_sock->sid, sksec_other->sid,
Paul Moore4d1e2452010-04-22 14:46:18 -04004891 sksec_other->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004892 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4893 if (err)
4894 return err;
4895
Linus Torvalds1da177e2005-04-16 15:20:36 -07004896 /* server child socket */
Paul Moore4d1e2452010-04-22 14:46:18 -04004897 sksec_new->peer_sid = sksec_sock->sid;
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004898 err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
4899 sksec_sock->sid, &sksec_new->sid);
Paul Moore4d1e2452010-04-22 14:46:18 -04004900 if (err)
4901 return err;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004902
Paul Moore4d1e2452010-04-22 14:46:18 -04004903 /* connecting socket */
4904 sksec_sock->peer_sid = sksec_new->sid;
4905
4906 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004907}
4908
4909static int selinux_socket_unix_may_send(struct socket *sock,
4910 struct socket *other)
4911{
Paul Moore253bfae2010-04-22 14:46:19 -04004912 struct sk_security_struct *ssec = sock->sk->sk_security;
4913 struct sk_security_struct *osec = other->sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004914 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004915 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004916
Eric Paris50c205f2012-04-04 15:01:43 -04004917 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004918 ad.u.net = &net;
4919 ad.u.net->sk = other->sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004920
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004921 return avc_has_perm(&selinux_state,
4922 ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
Paul Moore253bfae2010-04-22 14:46:19 -04004923 &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004924}
4925
Paul Moorecbe0d6e2014-09-10 17:09:57 -04004926static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4927 char *addrp, u16 family, u32 peer_sid,
Thomas Liu2bf49692009-07-14 12:14:09 -04004928 struct common_audit_data *ad)
Paul Mooreeffad8d2008-01-29 08:49:27 -05004929{
4930 int err;
4931 u32 if_sid;
4932 u32 node_sid;
4933
Paul Moorecbe0d6e2014-09-10 17:09:57 -04004934 err = sel_netif_sid(ns, ifindex, &if_sid);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004935 if (err)
4936 return err;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004937 err = avc_has_perm(&selinux_state,
4938 peer_sid, if_sid,
Paul Mooreeffad8d2008-01-29 08:49:27 -05004939 SECCLASS_NETIF, NETIF__INGRESS, ad);
4940 if (err)
4941 return err;
4942
4943 err = sel_netnode_sid(addrp, family, &node_sid);
4944 if (err)
4945 return err;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004946 return avc_has_perm(&selinux_state,
4947 peer_sid, node_sid,
Paul Mooreeffad8d2008-01-29 08:49:27 -05004948 SECCLASS_NODE, NODE__RECVFROM, ad);
4949}
4950
Paul Moore220deb92008-01-29 08:38:23 -05004951static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
Paul Moored8395c82008-10-10 10:16:30 -04004952 u16 family)
Paul Moore220deb92008-01-29 08:38:23 -05004953{
Paul Moore277d3422008-12-31 12:54:11 -05004954 int err = 0;
Paul Moore220deb92008-01-29 08:38:23 -05004955 struct sk_security_struct *sksec = sk->sk_security;
Paul Moore220deb92008-01-29 08:38:23 -05004956 u32 sk_sid = sksec->sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04004957 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004958 struct lsm_network_audit net = {0,};
Paul Moored8395c82008-10-10 10:16:30 -04004959 char *addrp;
4960
Eric Paris50c205f2012-04-04 15:01:43 -04004961 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004962 ad.u.net = &net;
4963 ad.u.net->netif = skb->skb_iif;
4964 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04004965 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4966 if (err)
4967 return err;
Paul Moore220deb92008-01-29 08:38:23 -05004968
Paul Moore58bfbb52009-03-27 17:10:41 -04004969 if (selinux_secmark_enabled()) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004970 err = avc_has_perm(&selinux_state,
4971 sk_sid, skb->secmark, SECCLASS_PACKET,
Paul Moored8395c82008-10-10 10:16:30 -04004972 PACKET__RECV, &ad);
Paul Moore58bfbb52009-03-27 17:10:41 -04004973 if (err)
4974 return err;
4975 }
Paul Moore220deb92008-01-29 08:38:23 -05004976
Steffen Klassertb9679a72011-02-23 12:55:21 +01004977 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4978 if (err)
4979 return err;
4980 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004981
James Morris4e5ab4c2006-06-09 00:33:33 -07004982 return err;
4983}
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004984
James Morris4e5ab4c2006-06-09 00:33:33 -07004985static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4986{
Paul Moore220deb92008-01-29 08:38:23 -05004987 int err;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004988 struct sk_security_struct *sksec = sk->sk_security;
Paul Moore220deb92008-01-29 08:38:23 -05004989 u16 family = sk->sk_family;
4990 u32 sk_sid = sksec->sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04004991 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004992 struct lsm_network_audit net = {0,};
Paul Moore220deb92008-01-29 08:38:23 -05004993 char *addrp;
Paul Moored8395c82008-10-10 10:16:30 -04004994 u8 secmark_active;
4995 u8 peerlbl_active;
James Morris4e5ab4c2006-06-09 00:33:33 -07004996
James Morris4e5ab4c2006-06-09 00:33:33 -07004997 if (family != PF_INET && family != PF_INET6)
Paul Moore220deb92008-01-29 08:38:23 -05004998 return 0;
James Morris4e5ab4c2006-06-09 00:33:33 -07004999
5000 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
Al Viro87fcd702006-12-04 22:00:55 +00005001 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
James Morris4e5ab4c2006-06-09 00:33:33 -07005002 family = PF_INET;
5003
Paul Moored8395c82008-10-10 10:16:30 -04005004 /* If any sort of compatibility mode is enabled then handoff processing
5005 * to the selinux_sock_rcv_skb_compat() function to deal with the
5006 * special handling. We do this in an attempt to keep this function
5007 * as fast and as clean as possible. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005008 if (!selinux_policycap_netpeer())
Paul Moored8395c82008-10-10 10:16:30 -04005009 return selinux_sock_rcv_skb_compat(sk, skb, family);
5010
5011 secmark_active = selinux_secmark_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04005012 peerlbl_active = selinux_peerlbl_enabled();
Paul Moored8395c82008-10-10 10:16:30 -04005013 if (!secmark_active && !peerlbl_active)
5014 return 0;
5015
Eric Paris50c205f2012-04-04 15:01:43 -04005016 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005017 ad.u.net = &net;
5018 ad.u.net->netif = skb->skb_iif;
5019 ad.u.net->family = family;
Paul Moore224dfbd2008-01-29 08:38:13 -05005020 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
James Morris4e5ab4c2006-06-09 00:33:33 -07005021 if (err)
Paul Moore220deb92008-01-29 08:38:23 -05005022 return err;
James Morris4e5ab4c2006-06-09 00:33:33 -07005023
Paul Moored8395c82008-10-10 10:16:30 -04005024 if (peerlbl_active) {
Paul Moored621d352008-01-29 08:43:36 -05005025 u32 peer_sid;
5026
5027 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
5028 if (err)
5029 return err;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005030 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
5031 addrp, family, peer_sid, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04005032 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04005033 selinux_netlbl_err(skb, family, err, 0);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005034 return err;
Paul Mooredfaebe92008-10-10 10:16:31 -04005035 }
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005036 err = avc_has_perm(&selinux_state,
5037 sk_sid, peer_sid, SECCLASS_PEER,
Paul Moored621d352008-01-29 08:43:36 -05005038 PEER__RECV, &ad);
Chad Hanson46d01d62013-12-23 17:45:01 -05005039 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04005040 selinux_netlbl_err(skb, family, err, 0);
Chad Hanson46d01d62013-12-23 17:45:01 -05005041 return err;
5042 }
Paul Moored621d352008-01-29 08:43:36 -05005043 }
5044
Paul Moored8395c82008-10-10 10:16:30 -04005045 if (secmark_active) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005046 err = avc_has_perm(&selinux_state,
5047 sk_sid, skb->secmark, SECCLASS_PACKET,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005048 PACKET__RECV, &ad);
5049 if (err)
5050 return err;
5051 }
5052
Paul Moored621d352008-01-29 08:43:36 -05005053 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005054}
5055
Catherine Zhang2c7946a2006-03-20 22:41:23 -08005056static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
5057 int __user *optlen, unsigned len)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005058{
5059 int err = 0;
5060 char *scontext;
5061 u32 scontext_len;
Paul Moore253bfae2010-04-22 14:46:19 -04005062 struct sk_security_struct *sksec = sock->sk->sk_security;
Paul Moore3de4bab2006-11-17 17:38:54 -05005063 u32 peer_sid = SECSID_NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005064
Paul Moore253bfae2010-04-22 14:46:19 -04005065 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
Richard Hainesd4529302018-02-13 20:57:18 +00005066 sksec->sclass == SECCLASS_TCP_SOCKET ||
5067 sksec->sclass == SECCLASS_SCTP_SOCKET)
Eric Parisdd3e7832010-04-07 15:08:46 -04005068 peer_sid = sksec->peer_sid;
Paul Moore253bfae2010-04-22 14:46:19 -04005069 if (peer_sid == SECSID_NULL)
5070 return -ENOPROTOOPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005071
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005072 err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
5073 &scontext_len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005074 if (err)
Paul Moore253bfae2010-04-22 14:46:19 -04005075 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005076
5077 if (scontext_len > len) {
5078 err = -ERANGE;
5079 goto out_len;
5080 }
5081
5082 if (copy_to_user(optval, scontext, scontext_len))
5083 err = -EFAULT;
5084
5085out_len:
5086 if (put_user(scontext_len, optlen))
5087 err = -EFAULT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005088 kfree(scontext);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005089 return err;
5090}
5091
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005092static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
Catherine Zhang2c7946a2006-03-20 22:41:23 -08005093{
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005094 u32 peer_secid = SECSID_NULL;
Paul Moore75e22912008-01-29 08:38:04 -05005095 u16 family;
Paul Moore899134f2016-03-28 15:19:10 -04005096 struct inode_security_struct *isec;
Catherine Zhang877ce7c2006-06-29 12:27:47 -07005097
Paul Mooreaa862902008-10-10 10:16:29 -04005098 if (skb && skb->protocol == htons(ETH_P_IP))
5099 family = PF_INET;
5100 else if (skb && skb->protocol == htons(ETH_P_IPV6))
5101 family = PF_INET6;
5102 else if (sock)
Paul Moore75e22912008-01-29 08:38:04 -05005103 family = sock->sk->sk_family;
Paul Moore75e22912008-01-29 08:38:04 -05005104 else
5105 goto out;
5106
Paul Moore899134f2016-03-28 15:19:10 -04005107 if (sock && family == PF_UNIX) {
5108 isec = inode_security_novalidate(SOCK_INODE(sock));
5109 peer_secid = isec->sid;
5110 } else if (skb)
Paul Moore220deb92008-01-29 08:38:23 -05005111 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
Catherine Zhang2c7946a2006-03-20 22:41:23 -08005112
Paul Moore75e22912008-01-29 08:38:04 -05005113out:
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005114 *secid = peer_secid;
Paul Moore75e22912008-01-29 08:38:04 -05005115 if (peer_secid == SECSID_NULL)
5116 return -EINVAL;
5117 return 0;
Catherine Zhang2c7946a2006-03-20 22:41:23 -08005118}
5119
Al Viro7d877f32005-10-21 03:20:43 -04005120static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005121{
Paul Moore84914b72010-04-22 14:46:18 -04005122 struct sk_security_struct *sksec;
5123
5124 sksec = kzalloc(sizeof(*sksec), priority);
5125 if (!sksec)
5126 return -ENOMEM;
5127
5128 sksec->peer_sid = SECINITSID_UNLABELED;
5129 sksec->sid = SECINITSID_UNLABELED;
Stephen Smalley5dee25d2015-07-10 17:19:57 -04005130 sksec->sclass = SECCLASS_SOCKET;
Paul Moore84914b72010-04-22 14:46:18 -04005131 selinux_netlbl_sk_security_reset(sksec);
5132 sk->sk_security = sksec;
5133
5134 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005135}
5136
5137static void selinux_sk_free_security(struct sock *sk)
5138{
Paul Moore84914b72010-04-22 14:46:18 -04005139 struct sk_security_struct *sksec = sk->sk_security;
5140
5141 sk->sk_security = NULL;
5142 selinux_netlbl_sk_security_free(sksec);
5143 kfree(sksec);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005144}
5145
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005146static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5147{
Eric Parisdd3e7832010-04-07 15:08:46 -04005148 struct sk_security_struct *sksec = sk->sk_security;
5149 struct sk_security_struct *newsksec = newsk->sk_security;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005150
Eric Parisdd3e7832010-04-07 15:08:46 -04005151 newsksec->sid = sksec->sid;
5152 newsksec->peer_sid = sksec->peer_sid;
5153 newsksec->sclass = sksec->sclass;
Paul Moore99f59ed2006-08-29 17:53:48 -07005154
Eric Parisdd3e7832010-04-07 15:08:46 -04005155 selinux_netlbl_sk_security_reset(newsksec);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005156}
5157
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07005158static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005159{
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005160 if (!sk)
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07005161 *secid = SECINITSID_ANY_SOCKET;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005162 else {
5163 struct sk_security_struct *sksec = sk->sk_security;
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005164
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07005165 *secid = sksec->sid;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005166 }
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005167}
5168
Eric Paris828dfe12008-04-17 13:17:49 -04005169static void selinux_sock_graft(struct sock *sk, struct socket *parent)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005170{
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05005171 struct inode_security_struct *isec =
5172 inode_security_novalidate(SOCK_INODE(parent));
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005173 struct sk_security_struct *sksec = sk->sk_security;
5174
Paul Moore2873ead2014-07-28 10:42:48 -04005175 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5176 sk->sk_family == PF_UNIX)
David Woodhouse2148ccc2006-09-29 15:50:25 -07005177 isec->sid = sksec->sid;
Paul Moore220deb92008-01-29 08:38:23 -05005178 sksec->sclass = isec->sclass;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005179}
5180
Richard Hainesd4529302018-02-13 20:57:18 +00005181/* Called whenever SCTP receives an INIT chunk. This happens when an incoming
5182 * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
5183 * already present).
5184 */
5185static int selinux_sctp_assoc_request(struct sctp_endpoint *ep,
5186 struct sk_buff *skb)
5187{
5188 struct sk_security_struct *sksec = ep->base.sk->sk_security;
5189 struct common_audit_data ad;
5190 struct lsm_network_audit net = {0,};
5191 u8 peerlbl_active;
5192 u32 peer_sid = SECINITSID_UNLABELED;
5193 u32 conn_sid;
5194 int err = 0;
5195
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005196 if (!selinux_policycap_extsockclass())
Richard Hainesd4529302018-02-13 20:57:18 +00005197 return 0;
5198
5199 peerlbl_active = selinux_peerlbl_enabled();
5200
5201 if (peerlbl_active) {
5202 /* This will return peer_sid = SECSID_NULL if there are
5203 * no peer labels, see security_net_peersid_resolve().
5204 */
5205 err = selinux_skb_peerlbl_sid(skb, ep->base.sk->sk_family,
5206 &peer_sid);
5207 if (err)
5208 return err;
5209
5210 if (peer_sid == SECSID_NULL)
5211 peer_sid = SECINITSID_UNLABELED;
5212 }
5213
5214 if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5215 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5216
5217 /* Here as first association on socket. As the peer SID
5218 * was allowed by peer recv (and the netif/node checks),
5219 * then it is approved by policy and used as the primary
5220 * peer SID for getpeercon(3).
5221 */
5222 sksec->peer_sid = peer_sid;
5223 } else if (sksec->peer_sid != peer_sid) {
5224 /* Other association peer SIDs are checked to enforce
5225 * consistency among the peer SIDs.
5226 */
5227 ad.type = LSM_AUDIT_DATA_NET;
5228 ad.u.net = &net;
5229 ad.u.net->sk = ep->base.sk;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005230 err = avc_has_perm(&selinux_state,
5231 sksec->peer_sid, peer_sid, sksec->sclass,
Richard Hainesd4529302018-02-13 20:57:18 +00005232 SCTP_SOCKET__ASSOCIATION, &ad);
5233 if (err)
5234 return err;
5235 }
5236
5237 /* Compute the MLS component for the connection and store
5238 * the information in ep. This will be used by SCTP TCP type
5239 * sockets and peeled off connections as they cause a new
5240 * socket to be generated. selinux_sctp_sk_clone() will then
5241 * plug this into the new socket.
5242 */
5243 err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
5244 if (err)
5245 return err;
5246
5247 ep->secid = conn_sid;
5248 ep->peer_secid = peer_sid;
5249
5250 /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5251 return selinux_netlbl_sctp_assoc_request(ep, skb);
5252}
5253
5254/* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5255 * based on their @optname.
5256 */
5257static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5258 struct sockaddr *address,
5259 int addrlen)
5260{
5261 int len, err = 0, walk_size = 0;
5262 void *addr_buf;
5263 struct sockaddr *addr;
5264 struct socket *sock;
5265
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005266 if (!selinux_policycap_extsockclass())
Richard Hainesd4529302018-02-13 20:57:18 +00005267 return 0;
5268
5269 /* Process one or more addresses that may be IPv4 or IPv6 */
5270 sock = sk->sk_socket;
5271 addr_buf = address;
5272
5273 while (walk_size < addrlen) {
5274 addr = addr_buf;
5275 switch (addr->sa_family) {
5276 case AF_INET:
5277 len = sizeof(struct sockaddr_in);
5278 break;
5279 case AF_INET6:
5280 len = sizeof(struct sockaddr_in6);
5281 break;
5282 default:
5283 return -EAFNOSUPPORT;
5284 }
5285
5286 err = -EINVAL;
5287 switch (optname) {
5288 /* Bind checks */
5289 case SCTP_PRIMARY_ADDR:
5290 case SCTP_SET_PEER_PRIMARY_ADDR:
5291 case SCTP_SOCKOPT_BINDX_ADD:
5292 err = selinux_socket_bind(sock, addr, len);
5293 break;
5294 /* Connect checks */
5295 case SCTP_SOCKOPT_CONNECTX:
5296 case SCTP_PARAM_SET_PRIMARY:
5297 case SCTP_PARAM_ADD_IP:
5298 case SCTP_SENDMSG_CONNECT:
5299 err = selinux_socket_connect_helper(sock, addr, len);
5300 if (err)
5301 return err;
5302
5303 /* As selinux_sctp_bind_connect() is called by the
5304 * SCTP protocol layer, the socket is already locked,
5305 * therefore selinux_netlbl_socket_connect_locked() is
5306 * is called here. The situations handled are:
5307 * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5308 * whenever a new IP address is added or when a new
5309 * primary address is selected.
5310 * Note that an SCTP connect(2) call happens before
5311 * the SCTP protocol layer and is handled via
5312 * selinux_socket_connect().
5313 */
5314 err = selinux_netlbl_socket_connect_locked(sk, addr);
5315 break;
5316 }
5317
5318 if (err)
5319 return err;
5320
5321 addr_buf += len;
5322 walk_size += len;
5323 }
5324
5325 return 0;
5326}
5327
5328/* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5329static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
5330 struct sock *newsk)
5331{
5332 struct sk_security_struct *sksec = sk->sk_security;
5333 struct sk_security_struct *newsksec = newsk->sk_security;
5334
5335 /* If policy does not support SECCLASS_SCTP_SOCKET then call
5336 * the non-sctp clone version.
5337 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005338 if (!selinux_policycap_extsockclass())
Richard Hainesd4529302018-02-13 20:57:18 +00005339 return selinux_sk_clone_security(sk, newsk);
5340
5341 newsksec->sid = ep->secid;
5342 newsksec->peer_sid = ep->peer_secid;
5343 newsksec->sclass = sksec->sclass;
5344 selinux_netlbl_sctp_sk_clone(sk, newsk);
5345}
5346
Adrian Bunk9a673e52006-08-15 00:03:53 -07005347static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
5348 struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005349{
5350 struct sk_security_struct *sksec = sk->sk_security;
5351 int err;
Paul Moore0b1f24e2013-12-03 11:39:13 -05005352 u16 family = req->rsk_ops->family;
Paul Moore446b8022013-12-04 16:10:51 -05005353 u32 connsid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005354 u32 peersid;
5355
Paul Mooreaa862902008-10-10 10:16:29 -04005356 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
Paul Moore220deb92008-01-29 08:38:23 -05005357 if (err)
5358 return err;
Paul Moore446b8022013-12-04 16:10:51 -05005359 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5360 if (err)
5361 return err;
5362 req->secid = connsid;
5363 req->peer_secid = peersid;
Venkat Yekkiralaa51c64f2006-07-27 22:01:34 -07005364
Paul Moore389fb8002009-03-27 17:10:34 -04005365 return selinux_netlbl_inet_conn_request(req, family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005366}
5367
Adrian Bunk9a673e52006-08-15 00:03:53 -07005368static void selinux_inet_csk_clone(struct sock *newsk,
5369 const struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005370{
5371 struct sk_security_struct *newsksec = newsk->sk_security;
5372
5373 newsksec->sid = req->secid;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005374 newsksec->peer_sid = req->peer_secid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005375 /* NOTE: Ideally, we should also get the isec->sid for the
5376 new socket in sync, but we don't have the isec available yet.
5377 So we will wait until sock_graft to do it, by which
5378 time it will have been created and available. */
Paul Moore99f59ed2006-08-29 17:53:48 -07005379
Paul Moore9f2ad662006-11-17 17:38:53 -05005380 /* We don't need to take any sort of lock here as we are the only
5381 * thread with access to newsksec */
Paul Moore389fb8002009-03-27 17:10:34 -04005382 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005383}
5384
Paul Moore014ab192008-10-10 10:16:33 -04005385static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005386{
Paul Mooreaa862902008-10-10 10:16:29 -04005387 u16 family = sk->sk_family;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005388 struct sk_security_struct *sksec = sk->sk_security;
5389
Paul Mooreaa862902008-10-10 10:16:29 -04005390 /* handle mapped IPv4 packets arriving via IPv6 sockets */
5391 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5392 family = PF_INET;
5393
5394 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005395}
5396
Eric Paris2606fd12010-10-13 16:24:41 -04005397static int selinux_secmark_relabel_packet(u32 sid)
5398{
5399 const struct task_security_struct *__tsec;
5400 u32 tsid;
5401
5402 __tsec = current_security();
5403 tsid = __tsec->sid;
5404
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005405 return avc_has_perm(&selinux_state,
5406 tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5407 NULL);
Eric Paris2606fd12010-10-13 16:24:41 -04005408}
5409
5410static void selinux_secmark_refcount_inc(void)
5411{
5412 atomic_inc(&selinux_secmark_refcount);
5413}
5414
5415static void selinux_secmark_refcount_dec(void)
5416{
5417 atomic_dec(&selinux_secmark_refcount);
5418}
5419
Adrian Bunk9a673e52006-08-15 00:03:53 -07005420static void selinux_req_classify_flow(const struct request_sock *req,
5421 struct flowi *fl)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005422{
David S. Miller1d28f422011-03-12 00:29:39 -05005423 fl->flowi_secid = req->secid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005424}
5425
Paul Moore5dbbaf22013-01-14 07:12:19 +00005426static int selinux_tun_dev_alloc_security(void **security)
5427{
5428 struct tun_security_struct *tunsec;
5429
5430 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5431 if (!tunsec)
5432 return -ENOMEM;
5433 tunsec->sid = current_sid();
5434
5435 *security = tunsec;
5436 return 0;
5437}
5438
5439static void selinux_tun_dev_free_security(void *security)
5440{
5441 kfree(security);
5442}
5443
Paul Mooreed6d76e2009-08-28 18:12:49 -04005444static int selinux_tun_dev_create(void)
5445{
5446 u32 sid = current_sid();
5447
5448 /* we aren't taking into account the "sockcreate" SID since the socket
5449 * that is being created here is not a socket in the traditional sense,
5450 * instead it is a private sock, accessible only to the kernel, and
5451 * representing a wide range of network traffic spanning multiple
5452 * connections unlike traditional sockets - check the TUN driver to
5453 * get a better understanding of why this socket is special */
5454
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005455 return avc_has_perm(&selinux_state,
5456 sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
Paul Mooreed6d76e2009-08-28 18:12:49 -04005457 NULL);
5458}
5459
Paul Moore5dbbaf22013-01-14 07:12:19 +00005460static int selinux_tun_dev_attach_queue(void *security)
Paul Mooreed6d76e2009-08-28 18:12:49 -04005461{
Paul Moore5dbbaf22013-01-14 07:12:19 +00005462 struct tun_security_struct *tunsec = security;
5463
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005464 return avc_has_perm(&selinux_state,
5465 current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
Paul Moore5dbbaf22013-01-14 07:12:19 +00005466 TUN_SOCKET__ATTACH_QUEUE, NULL);
5467}
5468
5469static int selinux_tun_dev_attach(struct sock *sk, void *security)
5470{
5471 struct tun_security_struct *tunsec = security;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005472 struct sk_security_struct *sksec = sk->sk_security;
5473
5474 /* we don't currently perform any NetLabel based labeling here and it
5475 * isn't clear that we would want to do so anyway; while we could apply
5476 * labeling without the support of the TUN user the resulting labeled
5477 * traffic from the other end of the connection would almost certainly
5478 * cause confusion to the TUN user that had no idea network labeling
5479 * protocols were being used */
5480
Paul Moore5dbbaf22013-01-14 07:12:19 +00005481 sksec->sid = tunsec->sid;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005482 sksec->sclass = SECCLASS_TUN_SOCKET;
Paul Moore5dbbaf22013-01-14 07:12:19 +00005483
5484 return 0;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005485}
5486
Paul Moore5dbbaf22013-01-14 07:12:19 +00005487static int selinux_tun_dev_open(void *security)
Paul Mooreed6d76e2009-08-28 18:12:49 -04005488{
Paul Moore5dbbaf22013-01-14 07:12:19 +00005489 struct tun_security_struct *tunsec = security;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005490 u32 sid = current_sid();
5491 int err;
5492
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005493 err = avc_has_perm(&selinux_state,
5494 sid, tunsec->sid, SECCLASS_TUN_SOCKET,
Paul Mooreed6d76e2009-08-28 18:12:49 -04005495 TUN_SOCKET__RELABELFROM, NULL);
5496 if (err)
5497 return err;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005498 err = avc_has_perm(&selinux_state,
5499 sid, sid, SECCLASS_TUN_SOCKET,
Paul Mooreed6d76e2009-08-28 18:12:49 -04005500 TUN_SOCKET__RELABELTO, NULL);
5501 if (err)
5502 return err;
Paul Moore5dbbaf22013-01-14 07:12:19 +00005503 tunsec->sid = sid;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005504
5505 return 0;
5506}
5507
Linus Torvalds1da177e2005-04-16 15:20:36 -07005508static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5509{
5510 int err = 0;
5511 u32 perm;
5512 struct nlmsghdr *nlh;
Paul Moore253bfae2010-04-22 14:46:19 -04005513 struct sk_security_struct *sksec = sk->sk_security;
Eric Paris828dfe12008-04-17 13:17:49 -04005514
Hong zhi guo77954982013-03-27 06:49:35 +00005515 if (skb->len < NLMSG_HDRLEN) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005516 err = -EINVAL;
5517 goto out;
5518 }
Arnaldo Carvalho de Melob529ccf2007-04-25 19:08:35 -07005519 nlh = nlmsg_hdr(skb);
Eric Paris828dfe12008-04-17 13:17:49 -04005520
Paul Moore253bfae2010-04-22 14:46:19 -04005521 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005522 if (err) {
5523 if (err == -EINVAL) {
Vladis Dronov76319942015-12-24 11:09:41 -05005524 pr_warn_ratelimited("SELinux: unrecognized netlink"
5525 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5526 " pig=%d comm=%s\n",
Marek Milkoviccded3ff2015-06-04 16:22:16 -04005527 sk->sk_protocol, nlh->nlmsg_type,
Vladis Dronov76319942015-12-24 11:09:41 -05005528 secclass_map[sksec->sclass - 1].name,
5529 task_pid_nr(current), current->comm);
Paul Mooree5a5ca92018-03-01 17:38:30 -05005530 if (!enforcing_enabled(&selinux_state) ||
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005531 security_get_allow_unknown(&selinux_state))
Linus Torvalds1da177e2005-04-16 15:20:36 -07005532 err = 0;
5533 }
5534
5535 /* Ignore */
5536 if (err == -ENOENT)
5537 err = 0;
5538 goto out;
5539 }
5540
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005541 err = sock_has_perm(sk, perm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005542out:
5543 return err;
5544}
5545
5546#ifdef CONFIG_NETFILTER
5547
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005548static unsigned int selinux_ip_forward(struct sk_buff *skb,
5549 const struct net_device *indev,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005550 u16 family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005551{
Paul Mooredfaebe92008-10-10 10:16:31 -04005552 int err;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005553 char *addrp;
5554 u32 peer_sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04005555 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005556 struct lsm_network_audit net = {0,};
Paul Mooreeffad8d2008-01-29 08:49:27 -05005557 u8 secmark_active;
Paul Moore948bf852008-10-10 10:16:32 -04005558 u8 netlbl_active;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005559 u8 peerlbl_active;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005560
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005561 if (!selinux_policycap_netpeer())
Paul Mooreeffad8d2008-01-29 08:49:27 -05005562 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005563
Paul Mooreeffad8d2008-01-29 08:49:27 -05005564 secmark_active = selinux_secmark_enabled();
Paul Moore948bf852008-10-10 10:16:32 -04005565 netlbl_active = netlbl_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04005566 peerlbl_active = selinux_peerlbl_enabled();
Paul Mooreeffad8d2008-01-29 08:49:27 -05005567 if (!secmark_active && !peerlbl_active)
5568 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005569
Paul Moored8395c82008-10-10 10:16:30 -04005570 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5571 return NF_DROP;
5572
Eric Paris50c205f2012-04-04 15:01:43 -04005573 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005574 ad.u.net = &net;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005575 ad.u.net->netif = indev->ifindex;
Eric Paris48c62af2012-04-02 13:15:44 -04005576 ad.u.net->family = family;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005577 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5578 return NF_DROP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005579
Paul Mooredfaebe92008-10-10 10:16:31 -04005580 if (peerlbl_active) {
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005581 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5582 addrp, family, peer_sid, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04005583 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04005584 selinux_netlbl_err(skb, family, err, 1);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005585 return NF_DROP;
Paul Mooredfaebe92008-10-10 10:16:31 -04005586 }
5587 }
Paul Mooreeffad8d2008-01-29 08:49:27 -05005588
5589 if (secmark_active)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005590 if (avc_has_perm(&selinux_state,
5591 peer_sid, skb->secmark,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005592 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5593 return NF_DROP;
5594
Paul Moore948bf852008-10-10 10:16:32 -04005595 if (netlbl_active)
5596 /* we do this in the FORWARD path and not the POST_ROUTING
5597 * path because we want to make sure we apply the necessary
5598 * labeling before IPsec is applied so we can leverage AH
5599 * protection */
5600 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5601 return NF_DROP;
5602
Paul Mooreeffad8d2008-01-29 08:49:27 -05005603 return NF_ACCEPT;
5604}
5605
Eric W. Biederman06198b32015-09-18 14:33:06 -05005606static unsigned int selinux_ipv4_forward(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005607 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005608 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005609{
David S. Miller238e54c2015-04-03 20:32:56 -04005610 return selinux_ip_forward(skb, state->in, PF_INET);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005611}
5612
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005613#if IS_ENABLED(CONFIG_IPV6)
Eric W. Biederman06198b32015-09-18 14:33:06 -05005614static unsigned int selinux_ipv6_forward(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005615 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005616 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005617{
David S. Miller238e54c2015-04-03 20:32:56 -04005618 return selinux_ip_forward(skb, state->in, PF_INET6);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005619}
5620#endif /* IPV6 */
5621
Paul Moore948bf852008-10-10 10:16:32 -04005622static unsigned int selinux_ip_output(struct sk_buff *skb,
5623 u16 family)
5624{
Paul Moore47180062013-12-04 16:10:45 -05005625 struct sock *sk;
Paul Moore948bf852008-10-10 10:16:32 -04005626 u32 sid;
5627
5628 if (!netlbl_enabled())
5629 return NF_ACCEPT;
5630
5631 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5632 * because we want to make sure we apply the necessary labeling
5633 * before IPsec is applied so we can leverage AH protection */
Paul Moore47180062013-12-04 16:10:45 -05005634 sk = skb->sk;
5635 if (sk) {
5636 struct sk_security_struct *sksec;
5637
Eric Dumazete446f9d2015-10-08 05:01:55 -07005638 if (sk_listener(sk))
Paul Moore47180062013-12-04 16:10:45 -05005639 /* if the socket is the listening state then this
5640 * packet is a SYN-ACK packet which means it needs to
5641 * be labeled based on the connection/request_sock and
5642 * not the parent socket. unfortunately, we can't
5643 * lookup the request_sock yet as it isn't queued on
5644 * the parent socket until after the SYN-ACK is sent.
5645 * the "solution" is to simply pass the packet as-is
5646 * as any IP option based labeling should be copied
5647 * from the initial connection request (in the IP
5648 * layer). it is far from ideal, but until we get a
5649 * security label in the packet itself this is the
5650 * best we can do. */
5651 return NF_ACCEPT;
5652
5653 /* standard practice, label using the parent socket */
5654 sksec = sk->sk_security;
Paul Moore948bf852008-10-10 10:16:32 -04005655 sid = sksec->sid;
5656 } else
5657 sid = SECINITSID_KERNEL;
5658 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5659 return NF_DROP;
5660
5661 return NF_ACCEPT;
5662}
5663
Eric W. Biederman06198b32015-09-18 14:33:06 -05005664static unsigned int selinux_ipv4_output(void *priv,
Paul Moore948bf852008-10-10 10:16:32 -04005665 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005666 const struct nf_hook_state *state)
Paul Moore948bf852008-10-10 10:16:32 -04005667{
5668 return selinux_ip_output(skb, PF_INET);
5669}
5670
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005671#if IS_ENABLED(CONFIG_IPV6)
Huw Davies2917f572016-06-27 15:06:15 -04005672static unsigned int selinux_ipv6_output(void *priv,
5673 struct sk_buff *skb,
5674 const struct nf_hook_state *state)
5675{
5676 return selinux_ip_output(skb, PF_INET6);
5677}
5678#endif /* IPV6 */
5679
Paul Mooreeffad8d2008-01-29 08:49:27 -05005680static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5681 int ifindex,
Paul Moored8395c82008-10-10 10:16:30 -04005682 u16 family)
James Morris4e5ab4c2006-06-09 00:33:33 -07005683{
Eric Dumazet54abc682015-11-08 10:54:07 -08005684 struct sock *sk = skb_to_full_sk(skb);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005685 struct sk_security_struct *sksec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005686 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005687 struct lsm_network_audit net = {0,};
Paul Moored8395c82008-10-10 10:16:30 -04005688 char *addrp;
5689 u8 proto;
James Morris4e5ab4c2006-06-09 00:33:33 -07005690
Paul Mooreeffad8d2008-01-29 08:49:27 -05005691 if (sk == NULL)
5692 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005693 sksec = sk->sk_security;
James Morris4e5ab4c2006-06-09 00:33:33 -07005694
Eric Paris50c205f2012-04-04 15:01:43 -04005695 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005696 ad.u.net = &net;
5697 ad.u.net->netif = ifindex;
5698 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04005699 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5700 return NF_DROP;
5701
Paul Moore58bfbb52009-03-27 17:10:41 -04005702 if (selinux_secmark_enabled())
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005703 if (avc_has_perm(&selinux_state,
5704 sksec->sid, skb->secmark,
Paul Moored8395c82008-10-10 10:16:30 -04005705 SECCLASS_PACKET, PACKET__SEND, &ad))
Eric Paris2fe66ec2010-11-23 06:28:08 +00005706 return NF_DROP_ERR(-ECONNREFUSED);
James Morris4e5ab4c2006-06-09 00:33:33 -07005707
Steffen Klassertb9679a72011-02-23 12:55:21 +01005708 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5709 return NF_DROP_ERR(-ECONNREFUSED);
James Morris4e5ab4c2006-06-09 00:33:33 -07005710
Paul Mooreeffad8d2008-01-29 08:49:27 -05005711 return NF_ACCEPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005712}
5713
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005714static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5715 const struct net_device *outdev,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005716 u16 family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005717{
Paul Mooreeffad8d2008-01-29 08:49:27 -05005718 u32 secmark_perm;
5719 u32 peer_sid;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005720 int ifindex = outdev->ifindex;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005721 struct sock *sk;
Thomas Liu2bf49692009-07-14 12:14:09 -04005722 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005723 struct lsm_network_audit net = {0,};
Paul Mooreeffad8d2008-01-29 08:49:27 -05005724 char *addrp;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005725 u8 secmark_active;
5726 u8 peerlbl_active;
5727
Paul Mooreeffad8d2008-01-29 08:49:27 -05005728 /* If any sort of compatibility mode is enabled then handoff processing
5729 * to the selinux_ip_postroute_compat() function to deal with the
5730 * special handling. We do this in an attempt to keep this function
5731 * as fast and as clean as possible. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005732 if (!selinux_policycap_netpeer())
Paul Moored8395c82008-10-10 10:16:30 -04005733 return selinux_ip_postroute_compat(skb, ifindex, family);
Paul Moorec0828e52013-12-10 14:58:01 -05005734
Paul Mooreeffad8d2008-01-29 08:49:27 -05005735 secmark_active = selinux_secmark_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04005736 peerlbl_active = selinux_peerlbl_enabled();
Paul Mooreeffad8d2008-01-29 08:49:27 -05005737 if (!secmark_active && !peerlbl_active)
5738 return NF_ACCEPT;
5739
Eric Dumazet54abc682015-11-08 10:54:07 -08005740 sk = skb_to_full_sk(skb);
Paul Moorec0828e52013-12-10 14:58:01 -05005741
Paul Mooreeffad8d2008-01-29 08:49:27 -05005742#ifdef CONFIG_XFRM
5743 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5744 * packet transformation so allow the packet to pass without any checks
5745 * since we'll have another chance to perform access control checks
5746 * when the packet is on it's final way out.
5747 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
Paul Moorec0828e52013-12-10 14:58:01 -05005748 * is NULL, in this case go ahead and apply access control.
5749 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5750 * TCP listening state we cannot wait until the XFRM processing
5751 * is done as we will miss out on the SA label if we do;
5752 * unfortunately, this means more work, but it is only once per
5753 * connection. */
5754 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
Eric Dumazete446f9d2015-10-08 05:01:55 -07005755 !(sk && sk_listener(sk)))
Paul Mooreeffad8d2008-01-29 08:49:27 -05005756 return NF_ACCEPT;
5757#endif
Paul Mooreeffad8d2008-01-29 08:49:27 -05005758
Paul Moored8395c82008-10-10 10:16:30 -04005759 if (sk == NULL) {
Paul Moore446b8022013-12-04 16:10:51 -05005760 /* Without an associated socket the packet is either coming
5761 * from the kernel or it is being forwarded; check the packet
5762 * to determine which and if the packet is being forwarded
5763 * query the packet directly to determine the security label. */
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005764 if (skb->skb_iif) {
5765 secmark_perm = PACKET__FORWARD_OUT;
Paul Moored8395c82008-10-10 10:16:30 -04005766 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005767 return NF_DROP;
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005768 } else {
5769 secmark_perm = PACKET__SEND;
Paul Moored8395c82008-10-10 10:16:30 -04005770 peer_sid = SECINITSID_KERNEL;
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005771 }
Eric Dumazete446f9d2015-10-08 05:01:55 -07005772 } else if (sk_listener(sk)) {
Paul Moore446b8022013-12-04 16:10:51 -05005773 /* Locally generated packet but the associated socket is in the
5774 * listening state which means this is a SYN-ACK packet. In
5775 * this particular case the correct security label is assigned
5776 * to the connection/request_sock but unfortunately we can't
5777 * query the request_sock as it isn't queued on the parent
5778 * socket until after the SYN-ACK packet is sent; the only
5779 * viable choice is to regenerate the label like we do in
5780 * selinux_inet_conn_request(). See also selinux_ip_output()
5781 * for similar problems. */
5782 u32 skb_sid;
Eric Dumazete446f9d2015-10-08 05:01:55 -07005783 struct sk_security_struct *sksec;
5784
Eric Dumazete446f9d2015-10-08 05:01:55 -07005785 sksec = sk->sk_security;
Paul Moore446b8022013-12-04 16:10:51 -05005786 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5787 return NF_DROP;
Paul Moorec0828e52013-12-10 14:58:01 -05005788 /* At this point, if the returned skb peerlbl is SECSID_NULL
5789 * and the packet has been through at least one XFRM
5790 * transformation then we must be dealing with the "final"
5791 * form of labeled IPsec packet; since we've already applied
5792 * all of our access controls on this packet we can safely
5793 * pass the packet. */
5794 if (skb_sid == SECSID_NULL) {
5795 switch (family) {
5796 case PF_INET:
5797 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5798 return NF_ACCEPT;
5799 break;
5800 case PF_INET6:
5801 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5802 return NF_ACCEPT;
Paul Moorea7a91a12014-09-03 10:51:59 -04005803 break;
Paul Moorec0828e52013-12-10 14:58:01 -05005804 default:
5805 return NF_DROP_ERR(-ECONNREFUSED);
5806 }
5807 }
Paul Moore446b8022013-12-04 16:10:51 -05005808 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5809 return NF_DROP;
5810 secmark_perm = PACKET__SEND;
Paul Moored8395c82008-10-10 10:16:30 -04005811 } else {
Paul Moore446b8022013-12-04 16:10:51 -05005812 /* Locally generated packet, fetch the security label from the
5813 * associated socket. */
Paul Mooreeffad8d2008-01-29 08:49:27 -05005814 struct sk_security_struct *sksec = sk->sk_security;
5815 peer_sid = sksec->sid;
5816 secmark_perm = PACKET__SEND;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005817 }
5818
Eric Paris50c205f2012-04-04 15:01:43 -04005819 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005820 ad.u.net = &net;
5821 ad.u.net->netif = ifindex;
5822 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04005823 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
Eric Paris04f6d702010-11-23 06:28:02 +00005824 return NF_DROP;
Paul Moored8395c82008-10-10 10:16:30 -04005825
Paul Mooreeffad8d2008-01-29 08:49:27 -05005826 if (secmark_active)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005827 if (avc_has_perm(&selinux_state,
5828 peer_sid, skb->secmark,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005829 SECCLASS_PACKET, secmark_perm, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005830 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005831
5832 if (peerlbl_active) {
5833 u32 if_sid;
5834 u32 node_sid;
5835
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005836 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005837 return NF_DROP;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005838 if (avc_has_perm(&selinux_state,
5839 peer_sid, if_sid,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005840 SECCLASS_NETIF, NETIF__EGRESS, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005841 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005842
5843 if (sel_netnode_sid(addrp, family, &node_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005844 return NF_DROP;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005845 if (avc_has_perm(&selinux_state,
5846 peer_sid, node_sid,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005847 SECCLASS_NODE, NODE__SENDTO, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005848 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005849 }
5850
5851 return NF_ACCEPT;
5852}
5853
Eric W. Biederman06198b32015-09-18 14:33:06 -05005854static unsigned int selinux_ipv4_postroute(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005855 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005856 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005857{
David S. Miller238e54c2015-04-03 20:32:56 -04005858 return selinux_ip_postroute(skb, state->out, PF_INET);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005859}
5860
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005861#if IS_ENABLED(CONFIG_IPV6)
Eric W. Biederman06198b32015-09-18 14:33:06 -05005862static unsigned int selinux_ipv6_postroute(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005863 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005864 const struct nf_hook_state *state)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005865{
David S. Miller238e54c2015-04-03 20:32:56 -04005866 return selinux_ip_postroute(skb, state->out, PF_INET6);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005867}
Linus Torvalds1da177e2005-04-16 15:20:36 -07005868#endif /* IPV6 */
5869
5870#endif /* CONFIG_NETFILTER */
5871
Linus Torvalds1da177e2005-04-16 15:20:36 -07005872static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5873{
Stephen Smalley941fc5b2009-10-01 14:48:23 -04005874 return selinux_nlmsg_perm(sk, skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005875}
5876
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005877static int ipc_alloc_security(struct kern_ipc_perm *perm,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005878 u16 sclass)
5879{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005880 struct ipc_security_struct *isec;
5881
James Morris89d155e2005-10-30 14:59:21 -08005882 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005883 if (!isec)
5884 return -ENOMEM;
5885
Linus Torvalds1da177e2005-04-16 15:20:36 -07005886 isec->sclass = sclass;
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005887 isec->sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005888 perm->security = isec;
5889
5890 return 0;
5891}
5892
5893static void ipc_free_security(struct kern_ipc_perm *perm)
5894{
5895 struct ipc_security_struct *isec = perm->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005896 perm->security = NULL;
5897 kfree(isec);
5898}
5899
5900static int msg_msg_alloc_security(struct msg_msg *msg)
5901{
5902 struct msg_security_struct *msec;
5903
James Morris89d155e2005-10-30 14:59:21 -08005904 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005905 if (!msec)
5906 return -ENOMEM;
5907
Linus Torvalds1da177e2005-04-16 15:20:36 -07005908 msec->sid = SECINITSID_UNLABELED;
5909 msg->security = msec;
5910
5911 return 0;
5912}
5913
5914static void msg_msg_free_security(struct msg_msg *msg)
5915{
5916 struct msg_security_struct *msec = msg->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005917
5918 msg->security = NULL;
5919 kfree(msec);
5920}
5921
5922static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
Stephen Smalley6af963f2005-05-01 08:58:39 -07005923 u32 perms)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005924{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005925 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005926 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005927 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005928
Linus Torvalds1da177e2005-04-16 15:20:36 -07005929 isec = ipc_perms->security;
5930
Eric Paris50c205f2012-04-04 15:01:43 -04005931 ad.type = LSM_AUDIT_DATA_IPC;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005932 ad.u.ipc_id = ipc_perms->key;
5933
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005934 return avc_has_perm(&selinux_state,
5935 sid, isec->sid, isec->sclass, perms, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005936}
5937
5938static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5939{
5940 return msg_msg_alloc_security(msg);
5941}
5942
5943static void selinux_msg_msg_free_security(struct msg_msg *msg)
5944{
5945 msg_msg_free_security(msg);
5946}
5947
5948/* message queue security operations */
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005949static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005950{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005951 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005952 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005953 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005954 int rc;
5955
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005956 rc = ipc_alloc_security(msq, SECCLASS_MSGQ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005957 if (rc)
5958 return rc;
5959
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005960 isec = msq->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005961
Eric Paris50c205f2012-04-04 15:01:43 -04005962 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005963 ad.u.ipc_id = msq->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005964
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005965 rc = avc_has_perm(&selinux_state,
5966 sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005967 MSGQ__CREATE, &ad);
5968 if (rc) {
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005969 ipc_free_security(msq);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005970 return rc;
5971 }
5972 return 0;
5973}
5974
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005975static void selinux_msg_queue_free_security(struct kern_ipc_perm *msq)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005976{
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005977 ipc_free_security(msq);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005978}
5979
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005980static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005981{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005982 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005983 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005984 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005985
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005986 isec = msq->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005987
Eric Paris50c205f2012-04-04 15:01:43 -04005988 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005989 ad.u.ipc_id = msq->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005990
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005991 return avc_has_perm(&selinux_state,
5992 sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005993 MSGQ__ASSOCIATE, &ad);
5994}
5995
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005996static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005997{
5998 int err;
5999 int perms;
6000
Eric Paris828dfe12008-04-17 13:17:49 -04006001 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006002 case IPC_INFO:
6003 case MSG_INFO:
6004 /* No specific object, just general system-wide information. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006005 return avc_has_perm(&selinux_state,
6006 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006007 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006008 case IPC_STAT:
6009 case MSG_STAT:
Davidlohr Bueso23c8cec2018-04-10 16:35:30 -07006010 case MSG_STAT_ANY:
Linus Torvalds1da177e2005-04-16 15:20:36 -07006011 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
6012 break;
6013 case IPC_SET:
6014 perms = MSGQ__SETATTR;
6015 break;
6016 case IPC_RMID:
6017 perms = MSGQ__DESTROY;
6018 break;
6019 default:
6020 return 0;
6021 }
6022
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006023 err = ipc_has_perm(msq, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006024 return err;
6025}
6026
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006027static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006028{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006029 struct ipc_security_struct *isec;
6030 struct msg_security_struct *msec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006031 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006032 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006033 int rc;
6034
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006035 isec = msq->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006036 msec = msg->security;
6037
6038 /*
6039 * First time through, need to assign label to the message
6040 */
6041 if (msec->sid == SECINITSID_UNLABELED) {
6042 /*
6043 * Compute new sid based on current process and
6044 * message queue this message will be stored in
6045 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006046 rc = security_transition_sid(&selinux_state, sid, isec->sid,
6047 SECCLASS_MSG, NULL, &msec->sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006048 if (rc)
6049 return rc;
6050 }
6051
Eric Paris50c205f2012-04-04 15:01:43 -04006052 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006053 ad.u.ipc_id = msq->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006054
6055 /* Can this process write to the queue? */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006056 rc = avc_has_perm(&selinux_state,
6057 sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006058 MSGQ__WRITE, &ad);
6059 if (!rc)
6060 /* Can this process send the message */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006061 rc = avc_has_perm(&selinux_state,
6062 sid, msec->sid, SECCLASS_MSG,
David Howells275bb412008-11-14 10:39:19 +11006063 MSG__SEND, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006064 if (!rc)
6065 /* Can the message be put in the queue? */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006066 rc = avc_has_perm(&selinux_state,
6067 msec->sid, isec->sid, SECCLASS_MSGQ,
David Howells275bb412008-11-14 10:39:19 +11006068 MSGQ__ENQUEUE, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006069
6070 return rc;
6071}
6072
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006073static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006074 struct task_struct *target,
6075 long type, int mode)
6076{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006077 struct ipc_security_struct *isec;
6078 struct msg_security_struct *msec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006079 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006080 u32 sid = task_sid(target);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006081 int rc;
6082
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006083 isec = msq->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006084 msec = msg->security;
6085
Eric Paris50c205f2012-04-04 15:01:43 -04006086 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05006087 ad.u.ipc_id = msq->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006088
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006089 rc = avc_has_perm(&selinux_state,
6090 sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006091 SECCLASS_MSGQ, MSGQ__READ, &ad);
6092 if (!rc)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006093 rc = avc_has_perm(&selinux_state,
6094 sid, msec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006095 SECCLASS_MSG, MSG__RECEIVE, &ad);
6096 return rc;
6097}
6098
6099/* Shared Memory security operations */
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006100static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006101{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006102 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006103 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006104 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006105 int rc;
6106
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006107 rc = ipc_alloc_security(shp, SECCLASS_SHM);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006108 if (rc)
6109 return rc;
6110
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006111 isec = shp->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006112
Eric Paris50c205f2012-04-04 15:01:43 -04006113 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006114 ad.u.ipc_id = shp->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006115
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006116 rc = avc_has_perm(&selinux_state,
6117 sid, isec->sid, SECCLASS_SHM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006118 SHM__CREATE, &ad);
6119 if (rc) {
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006120 ipc_free_security(shp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006121 return rc;
6122 }
6123 return 0;
6124}
6125
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006126static void selinux_shm_free_security(struct kern_ipc_perm *shp)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006127{
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006128 ipc_free_security(shp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006129}
6130
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006131static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006132{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006133 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006134 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006135 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006136
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006137 isec = shp->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006138
Eric Paris50c205f2012-04-04 15:01:43 -04006139 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006140 ad.u.ipc_id = shp->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006141
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006142 return avc_has_perm(&selinux_state,
6143 sid, isec->sid, SECCLASS_SHM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006144 SHM__ASSOCIATE, &ad);
6145}
6146
6147/* Note, at this point, shp is locked down */
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006148static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006149{
6150 int perms;
6151 int err;
6152
Eric Paris828dfe12008-04-17 13:17:49 -04006153 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006154 case IPC_INFO:
6155 case SHM_INFO:
6156 /* No specific object, just general system-wide information. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006157 return avc_has_perm(&selinux_state,
6158 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006159 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006160 case IPC_STAT:
6161 case SHM_STAT:
Davidlohr Buesoc21a6972018-04-10 16:35:23 -07006162 case SHM_STAT_ANY:
Linus Torvalds1da177e2005-04-16 15:20:36 -07006163 perms = SHM__GETATTR | SHM__ASSOCIATE;
6164 break;
6165 case IPC_SET:
6166 perms = SHM__SETATTR;
6167 break;
6168 case SHM_LOCK:
6169 case SHM_UNLOCK:
6170 perms = SHM__LOCK;
6171 break;
6172 case IPC_RMID:
6173 perms = SHM__DESTROY;
6174 break;
6175 default:
6176 return 0;
6177 }
6178
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006179 err = ipc_has_perm(shp, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006180 return err;
6181}
6182
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006183static int selinux_shm_shmat(struct kern_ipc_perm *shp,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006184 char __user *shmaddr, int shmflg)
6185{
6186 u32 perms;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006187
6188 if (shmflg & SHM_RDONLY)
6189 perms = SHM__READ;
6190 else
6191 perms = SHM__READ | SHM__WRITE;
6192
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006193 return ipc_has_perm(shp, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006194}
6195
6196/* Semaphore security operations */
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006197static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006198{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006199 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006200 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006201 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006202 int rc;
6203
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006204 rc = ipc_alloc_security(sma, SECCLASS_SEM);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006205 if (rc)
6206 return rc;
6207
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006208 isec = sma->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006209
Eric Paris50c205f2012-04-04 15:01:43 -04006210 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006211 ad.u.ipc_id = sma->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006212
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006213 rc = avc_has_perm(&selinux_state,
6214 sid, isec->sid, SECCLASS_SEM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006215 SEM__CREATE, &ad);
6216 if (rc) {
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006217 ipc_free_security(sma);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006218 return rc;
6219 }
6220 return 0;
6221}
6222
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006223static void selinux_sem_free_security(struct kern_ipc_perm *sma)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006224{
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006225 ipc_free_security(sma);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006226}
6227
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006228static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006229{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006230 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006231 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006232 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006233
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006234 isec = sma->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006235
Eric Paris50c205f2012-04-04 15:01:43 -04006236 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006237 ad.u.ipc_id = sma->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006238
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006239 return avc_has_perm(&selinux_state,
6240 sid, isec->sid, SECCLASS_SEM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006241 SEM__ASSOCIATE, &ad);
6242}
6243
6244/* Note, at this point, sma is locked down */
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006245static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006246{
6247 int err;
6248 u32 perms;
6249
Eric Paris828dfe12008-04-17 13:17:49 -04006250 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006251 case IPC_INFO:
6252 case SEM_INFO:
6253 /* No specific object, just general system-wide information. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006254 return avc_has_perm(&selinux_state,
6255 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006256 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006257 case GETPID:
6258 case GETNCNT:
6259 case GETZCNT:
6260 perms = SEM__GETATTR;
6261 break;
6262 case GETVAL:
6263 case GETALL:
6264 perms = SEM__READ;
6265 break;
6266 case SETVAL:
6267 case SETALL:
6268 perms = SEM__WRITE;
6269 break;
6270 case IPC_RMID:
6271 perms = SEM__DESTROY;
6272 break;
6273 case IPC_SET:
6274 perms = SEM__SETATTR;
6275 break;
6276 case IPC_STAT:
6277 case SEM_STAT:
Davidlohr Buesoa280d6d2018-04-10 16:35:26 -07006278 case SEM_STAT_ANY:
Linus Torvalds1da177e2005-04-16 15:20:36 -07006279 perms = SEM__GETATTR | SEM__ASSOCIATE;
6280 break;
6281 default:
6282 return 0;
6283 }
6284
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006285 err = ipc_has_perm(sma, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006286 return err;
6287}
6288
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006289static int selinux_sem_semop(struct kern_ipc_perm *sma,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006290 struct sembuf *sops, unsigned nsops, int alter)
6291{
6292 u32 perms;
6293
6294 if (alter)
6295 perms = SEM__READ | SEM__WRITE;
6296 else
6297 perms = SEM__READ;
6298
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006299 return ipc_has_perm(sma, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006300}
6301
6302static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6303{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006304 u32 av = 0;
6305
Linus Torvalds1da177e2005-04-16 15:20:36 -07006306 av = 0;
6307 if (flag & S_IRUGO)
6308 av |= IPC__UNIX_READ;
6309 if (flag & S_IWUGO)
6310 av |= IPC__UNIX_WRITE;
6311
6312 if (av == 0)
6313 return 0;
6314
Stephen Smalley6af963f2005-05-01 08:58:39 -07006315 return ipc_has_perm(ipcp, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006316}
6317
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02006318static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6319{
6320 struct ipc_security_struct *isec = ipcp->security;
6321 *secid = isec->sid;
6322}
6323
Eric Paris828dfe12008-04-17 13:17:49 -04006324static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006325{
6326 if (inode)
6327 inode_doinit_with_dentry(inode, dentry);
6328}
6329
6330static int selinux_getprocattr(struct task_struct *p,
Al Viro04ff9702007-03-12 16:17:58 +00006331 char *name, char **value)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006332{
David Howells275bb412008-11-14 10:39:19 +11006333 const struct task_security_struct *__tsec;
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00006334 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006335 int error;
Al Viro04ff9702007-03-12 16:17:58 +00006336 unsigned len;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006337
David Howells275bb412008-11-14 10:39:19 +11006338 rcu_read_lock();
6339 __tsec = __task_cred(p)->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006340
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006341 if (current != p) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006342 error = avc_has_perm(&selinux_state,
6343 current_sid(), __tsec->sid,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006344 SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6345 if (error)
6346 goto bad;
6347 }
6348
Linus Torvalds1da177e2005-04-16 15:20:36 -07006349 if (!strcmp(name, "current"))
David Howells275bb412008-11-14 10:39:19 +11006350 sid = __tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006351 else if (!strcmp(name, "prev"))
David Howells275bb412008-11-14 10:39:19 +11006352 sid = __tsec->osid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006353 else if (!strcmp(name, "exec"))
David Howells275bb412008-11-14 10:39:19 +11006354 sid = __tsec->exec_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006355 else if (!strcmp(name, "fscreate"))
David Howells275bb412008-11-14 10:39:19 +11006356 sid = __tsec->create_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07006357 else if (!strcmp(name, "keycreate"))
David Howells275bb412008-11-14 10:39:19 +11006358 sid = __tsec->keycreate_sid;
Eric Paris42c3e032006-06-26 00:26:03 -07006359 else if (!strcmp(name, "sockcreate"))
David Howells275bb412008-11-14 10:39:19 +11006360 sid = __tsec->sockcreate_sid;
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006361 else {
6362 error = -EINVAL;
6363 goto bad;
6364 }
David Howells275bb412008-11-14 10:39:19 +11006365 rcu_read_unlock();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006366
6367 if (!sid)
6368 return 0;
6369
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006370 error = security_sid_to_context(&selinux_state, sid, value, &len);
Al Viro04ff9702007-03-12 16:17:58 +00006371 if (error)
6372 return error;
6373 return len;
David Howells275bb412008-11-14 10:39:19 +11006374
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006375bad:
David Howells275bb412008-11-14 10:39:19 +11006376 rcu_read_unlock();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006377 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006378}
6379
Stephen Smalleyb21507e2017-01-09 10:07:31 -05006380static int selinux_setprocattr(const char *name, void *value, size_t size)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006381{
6382 struct task_security_struct *tsec;
David Howellsd84f4f92008-11-14 10:39:23 +11006383 struct cred *new;
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006384 u32 mysid = current_sid(), sid = 0, ptsid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006385 int error;
6386 char *str = value;
6387
Linus Torvalds1da177e2005-04-16 15:20:36 -07006388 /*
6389 * Basic control over ability to set these attributes at all.
Linus Torvalds1da177e2005-04-16 15:20:36 -07006390 */
6391 if (!strcmp(name, "exec"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006392 error = avc_has_perm(&selinux_state,
6393 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006394 PROCESS__SETEXEC, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006395 else if (!strcmp(name, "fscreate"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006396 error = avc_has_perm(&selinux_state,
6397 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006398 PROCESS__SETFSCREATE, NULL);
Michael LeMay4eb582c2006-06-26 00:24:57 -07006399 else if (!strcmp(name, "keycreate"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006400 error = avc_has_perm(&selinux_state,
6401 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006402 PROCESS__SETKEYCREATE, NULL);
Eric Paris42c3e032006-06-26 00:26:03 -07006403 else if (!strcmp(name, "sockcreate"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006404 error = avc_has_perm(&selinux_state,
6405 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006406 PROCESS__SETSOCKCREATE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006407 else if (!strcmp(name, "current"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006408 error = avc_has_perm(&selinux_state,
6409 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006410 PROCESS__SETCURRENT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006411 else
6412 error = -EINVAL;
6413 if (error)
6414 return error;
6415
6416 /* Obtain a SID for the context, if one was specified. */
Stephen Smalleya050a572017-01-31 11:54:04 -05006417 if (size && str[0] && str[0] != '\n') {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006418 if (str[size-1] == '\n') {
6419 str[size-1] = 0;
6420 size--;
6421 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006422 error = security_context_to_sid(&selinux_state, value, size,
6423 &sid, GFP_KERNEL);
Stephen Smalley12b29f32008-05-07 13:03:20 -04006424 if (error == -EINVAL && !strcmp(name, "fscreate")) {
Stephen Smalleydb590002017-04-20 11:31:30 -04006425 if (!has_cap_mac_admin(true)) {
Eric Parisd6ea83e2012-04-04 13:45:49 -04006426 struct audit_buffer *ab;
6427 size_t audit_size;
6428
6429 /* We strip a nul only if it is at the end, otherwise the
6430 * context contains a nul and we should audit that */
6431 if (str[size - 1] == '\0')
6432 audit_size = size - 1;
6433 else
6434 audit_size = size;
Richard Guy Briggscdfb6b32018-05-12 21:58:20 -04006435 ab = audit_log_start(audit_context(),
6436 GFP_ATOMIC,
6437 AUDIT_SELINUX_ERR);
Eric Parisd6ea83e2012-04-04 13:45:49 -04006438 audit_log_format(ab, "op=fscreate invalid_context=");
6439 audit_log_n_untrustedstring(ab, value, audit_size);
6440 audit_log_end(ab);
6441
Stephen Smalley12b29f32008-05-07 13:03:20 -04006442 return error;
Eric Parisd6ea83e2012-04-04 13:45:49 -04006443 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006444 error = security_context_to_sid_force(
6445 &selinux_state,
6446 value, size, &sid);
Stephen Smalley12b29f32008-05-07 13:03:20 -04006447 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07006448 if (error)
6449 return error;
6450 }
6451
David Howellsd84f4f92008-11-14 10:39:23 +11006452 new = prepare_creds();
6453 if (!new)
6454 return -ENOMEM;
6455
Linus Torvalds1da177e2005-04-16 15:20:36 -07006456 /* Permission checking based on the specified context is
6457 performed during the actual operation (execve,
6458 open/mkdir/...), when we know the full context of the
David Howellsd84f4f92008-11-14 10:39:23 +11006459 operation. See selinux_bprm_set_creds for the execve
Linus Torvalds1da177e2005-04-16 15:20:36 -07006460 checks and may_create for the file creation checks. The
6461 operation will then fail if the context is not permitted. */
David Howellsd84f4f92008-11-14 10:39:23 +11006462 tsec = new->security;
6463 if (!strcmp(name, "exec")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006464 tsec->exec_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006465 } else if (!strcmp(name, "fscreate")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006466 tsec->create_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006467 } else if (!strcmp(name, "keycreate")) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006468 error = avc_has_perm(&selinux_state,
6469 mysid, sid, SECCLASS_KEY, KEY__CREATE,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006470 NULL);
Michael LeMay4eb582c2006-06-26 00:24:57 -07006471 if (error)
David Howellsd84f4f92008-11-14 10:39:23 +11006472 goto abort_change;
Michael LeMay4eb582c2006-06-26 00:24:57 -07006473 tsec->keycreate_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006474 } else if (!strcmp(name, "sockcreate")) {
Eric Paris42c3e032006-06-26 00:26:03 -07006475 tsec->sockcreate_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006476 } else if (!strcmp(name, "current")) {
6477 error = -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006478 if (sid == 0)
David Howellsd84f4f92008-11-14 10:39:23 +11006479 goto abort_change;
KaiGai Koheid9250de2008-08-28 16:35:57 +09006480
David Howellsd84f4f92008-11-14 10:39:23 +11006481 /* Only allow single threaded processes to change context */
6482 error = -EPERM;
Oleg Nesterov5bb459b2009-07-10 03:48:23 +02006483 if (!current_is_single_threaded()) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006484 error = security_bounded_transition(&selinux_state,
6485 tsec->sid, sid);
David Howellsd84f4f92008-11-14 10:39:23 +11006486 if (error)
6487 goto abort_change;
Eric Paris828dfe12008-04-17 13:17:49 -04006488 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07006489
6490 /* Check permissions for the transition. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006491 error = avc_has_perm(&selinux_state,
6492 tsec->sid, sid, SECCLASS_PROCESS,
Eric Paris828dfe12008-04-17 13:17:49 -04006493 PROCESS__DYNTRANSITION, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006494 if (error)
David Howellsd84f4f92008-11-14 10:39:23 +11006495 goto abort_change;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006496
6497 /* Check for ptracing, and update the task SID if ok.
6498 Otherwise, leave SID unchanged and fail. */
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006499 ptsid = ptrace_parent_sid();
Paul Moore0c6181c2016-03-30 21:41:21 -04006500 if (ptsid != 0) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006501 error = avc_has_perm(&selinux_state,
6502 ptsid, sid, SECCLASS_PROCESS,
David Howellsd84f4f92008-11-14 10:39:23 +11006503 PROCESS__PTRACE, NULL);
6504 if (error)
6505 goto abort_change;
6506 }
6507
6508 tsec->sid = sid;
6509 } else {
6510 error = -EINVAL;
6511 goto abort_change;
6512 }
6513
6514 commit_creds(new);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006515 return size;
David Howellsd84f4f92008-11-14 10:39:23 +11006516
6517abort_change:
6518 abort_creds(new);
6519 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006520}
6521
David Quigley746df9b2013-05-22 12:50:35 -04006522static int selinux_ismaclabel(const char *name)
6523{
6524 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6525}
6526
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006527static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6528{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006529 return security_sid_to_context(&selinux_state, secid,
6530 secdata, seclen);
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006531}
6532
David Howells7bf570d2008-04-29 20:52:51 +01006533static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
David Howells63cb3442008-01-15 23:47:35 +00006534{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006535 return security_context_to_sid(&selinux_state, secdata, seclen,
6536 secid, GFP_KERNEL);
David Howells63cb3442008-01-15 23:47:35 +00006537}
6538
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006539static void selinux_release_secctx(char *secdata, u32 seclen)
6540{
Paul Moore088999e2007-08-01 11:12:58 -04006541 kfree(secdata);
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006542}
6543
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006544static void selinux_inode_invalidate_secctx(struct inode *inode)
6545{
6546 struct inode_security_struct *isec = inode->i_security;
6547
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01006548 spin_lock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006549 isec->initialized = LABEL_INVALID;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01006550 spin_unlock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006551}
6552
David P. Quigley1ee65e32009-09-03 14:25:57 -04006553/*
6554 * called with inode->i_mutex locked
6555 */
6556static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6557{
6558 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
6559}
6560
6561/*
6562 * called with inode->i_mutex locked
6563 */
6564static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6565{
6566 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6567}
6568
6569static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6570{
6571 int len = 0;
6572 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6573 ctx, true);
6574 if (len < 0)
6575 return len;
6576 *ctxlen = len;
6577 return 0;
6578}
Michael LeMayd7200242006-06-22 14:47:17 -07006579#ifdef CONFIG_KEYS
6580
David Howellsd84f4f92008-11-14 10:39:23 +11006581static int selinux_key_alloc(struct key *k, const struct cred *cred,
David Howells7e047ef2006-06-26 00:24:50 -07006582 unsigned long flags)
Michael LeMayd7200242006-06-22 14:47:17 -07006583{
David Howellsd84f4f92008-11-14 10:39:23 +11006584 const struct task_security_struct *tsec;
Michael LeMayd7200242006-06-22 14:47:17 -07006585 struct key_security_struct *ksec;
6586
6587 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6588 if (!ksec)
6589 return -ENOMEM;
6590
David Howellsd84f4f92008-11-14 10:39:23 +11006591 tsec = cred->security;
6592 if (tsec->keycreate_sid)
6593 ksec->sid = tsec->keycreate_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07006594 else
David Howellsd84f4f92008-11-14 10:39:23 +11006595 ksec->sid = tsec->sid;
Michael LeMayd7200242006-06-22 14:47:17 -07006596
David Howells275bb412008-11-14 10:39:19 +11006597 k->security = ksec;
Michael LeMayd7200242006-06-22 14:47:17 -07006598 return 0;
6599}
6600
6601static void selinux_key_free(struct key *k)
6602{
6603 struct key_security_struct *ksec = k->security;
6604
6605 k->security = NULL;
6606 kfree(ksec);
6607}
6608
6609static int selinux_key_permission(key_ref_t key_ref,
David Howellsd84f4f92008-11-14 10:39:23 +11006610 const struct cred *cred,
David Howellsf5895942014-03-14 17:44:49 +00006611 unsigned perm)
Michael LeMayd7200242006-06-22 14:47:17 -07006612{
6613 struct key *key;
Michael LeMayd7200242006-06-22 14:47:17 -07006614 struct key_security_struct *ksec;
David Howells275bb412008-11-14 10:39:19 +11006615 u32 sid;
Michael LeMayd7200242006-06-22 14:47:17 -07006616
6617 /* if no specific permissions are requested, we skip the
6618 permission check. No serious, additional covert channels
6619 appear to be created. */
6620 if (perm == 0)
6621 return 0;
6622
David Howellsd84f4f92008-11-14 10:39:23 +11006623 sid = cred_sid(cred);
David Howells275bb412008-11-14 10:39:19 +11006624
6625 key = key_ref_to_ptr(key_ref);
6626 ksec = key->security;
6627
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006628 return avc_has_perm(&selinux_state,
6629 sid, ksec->sid, SECCLASS_KEY, perm, NULL);
Michael LeMayd7200242006-06-22 14:47:17 -07006630}
6631
David Howells70a5bb72008-04-29 01:01:26 -07006632static int selinux_key_getsecurity(struct key *key, char **_buffer)
6633{
6634 struct key_security_struct *ksec = key->security;
6635 char *context = NULL;
6636 unsigned len;
6637 int rc;
6638
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006639 rc = security_sid_to_context(&selinux_state, ksec->sid,
6640 &context, &len);
David Howells70a5bb72008-04-29 01:01:26 -07006641 if (!rc)
6642 rc = len;
6643 *_buffer = context;
6644 return rc;
6645}
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03006646#endif
David Howells70a5bb72008-04-29 01:01:26 -07006647
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03006648#ifdef CONFIG_SECURITY_INFINIBAND
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03006649static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6650{
6651 struct common_audit_data ad;
6652 int err;
6653 u32 sid = 0;
6654 struct ib_security_struct *sec = ib_sec;
6655 struct lsm_ibpkey_audit ibpkey;
6656
Daniel Jurgens409dcf32017-05-19 15:48:59 +03006657 err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03006658 if (err)
6659 return err;
6660
6661 ad.type = LSM_AUDIT_DATA_IBPKEY;
6662 ibpkey.subnet_prefix = subnet_prefix;
6663 ibpkey.pkey = pkey_val;
6664 ad.u.ibpkey = &ibpkey;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006665 return avc_has_perm(&selinux_state,
6666 sec->sid, sid,
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03006667 SECCLASS_INFINIBAND_PKEY,
6668 INFINIBAND_PKEY__ACCESS, &ad);
6669}
6670
Daniel Jurgensab861df2017-05-19 15:48:58 +03006671static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6672 u8 port_num)
6673{
6674 struct common_audit_data ad;
6675 int err;
6676 u32 sid = 0;
6677 struct ib_security_struct *sec = ib_sec;
6678 struct lsm_ibendport_audit ibendport;
6679
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006680 err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6681 &sid);
Daniel Jurgensab861df2017-05-19 15:48:58 +03006682
6683 if (err)
6684 return err;
6685
6686 ad.type = LSM_AUDIT_DATA_IBENDPORT;
6687 strncpy(ibendport.dev_name, dev_name, sizeof(ibendport.dev_name));
6688 ibendport.port = port_num;
6689 ad.u.ibendport = &ibendport;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006690 return avc_has_perm(&selinux_state,
6691 sec->sid, sid,
Daniel Jurgensab861df2017-05-19 15:48:58 +03006692 SECCLASS_INFINIBAND_ENDPORT,
6693 INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6694}
6695
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03006696static int selinux_ib_alloc_security(void **ib_sec)
6697{
6698 struct ib_security_struct *sec;
6699
6700 sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6701 if (!sec)
6702 return -ENOMEM;
6703 sec->sid = current_sid();
6704
6705 *ib_sec = sec;
6706 return 0;
6707}
6708
6709static void selinux_ib_free_security(void *ib_sec)
6710{
6711 kfree(ib_sec);
6712}
Michael LeMayd7200242006-06-22 14:47:17 -07006713#endif
6714
Chenbo Fengec27c352017-10-18 13:00:25 -07006715#ifdef CONFIG_BPF_SYSCALL
6716static int selinux_bpf(int cmd, union bpf_attr *attr,
6717 unsigned int size)
6718{
6719 u32 sid = current_sid();
6720 int ret;
6721
6722 switch (cmd) {
6723 case BPF_MAP_CREATE:
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006724 ret = avc_has_perm(&selinux_state,
6725 sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
Chenbo Fengec27c352017-10-18 13:00:25 -07006726 NULL);
6727 break;
6728 case BPF_PROG_LOAD:
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006729 ret = avc_has_perm(&selinux_state,
6730 sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
Chenbo Fengec27c352017-10-18 13:00:25 -07006731 NULL);
6732 break;
6733 default:
6734 ret = 0;
6735 break;
6736 }
6737
6738 return ret;
6739}
6740
6741static u32 bpf_map_fmode_to_av(fmode_t fmode)
6742{
6743 u32 av = 0;
6744
6745 if (fmode & FMODE_READ)
6746 av |= BPF__MAP_READ;
6747 if (fmode & FMODE_WRITE)
6748 av |= BPF__MAP_WRITE;
6749 return av;
6750}
6751
Chenbo Fengf66e4482017-10-18 13:00:26 -07006752/* This function will check the file pass through unix socket or binder to see
6753 * if it is a bpf related object. And apply correspinding checks on the bpf
6754 * object based on the type. The bpf maps and programs, not like other files and
6755 * socket, are using a shared anonymous inode inside the kernel as their inode.
6756 * So checking that inode cannot identify if the process have privilege to
6757 * access the bpf object and that's why we have to add this additional check in
6758 * selinux_file_receive and selinux_binder_transfer_files.
6759 */
6760static int bpf_fd_pass(struct file *file, u32 sid)
6761{
6762 struct bpf_security_struct *bpfsec;
6763 struct bpf_prog *prog;
6764 struct bpf_map *map;
6765 int ret;
6766
6767 if (file->f_op == &bpf_map_fops) {
6768 map = file->private_data;
6769 bpfsec = map->security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006770 ret = avc_has_perm(&selinux_state,
6771 sid, bpfsec->sid, SECCLASS_BPF,
Chenbo Fengf66e4482017-10-18 13:00:26 -07006772 bpf_map_fmode_to_av(file->f_mode), NULL);
6773 if (ret)
6774 return ret;
6775 } else if (file->f_op == &bpf_prog_fops) {
6776 prog = file->private_data;
6777 bpfsec = prog->aux->security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006778 ret = avc_has_perm(&selinux_state,
6779 sid, bpfsec->sid, SECCLASS_BPF,
Chenbo Fengf66e4482017-10-18 13:00:26 -07006780 BPF__PROG_RUN, NULL);
6781 if (ret)
6782 return ret;
6783 }
6784 return 0;
6785}
6786
Chenbo Fengec27c352017-10-18 13:00:25 -07006787static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6788{
6789 u32 sid = current_sid();
6790 struct bpf_security_struct *bpfsec;
6791
6792 bpfsec = map->security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006793 return avc_has_perm(&selinux_state,
6794 sid, bpfsec->sid, SECCLASS_BPF,
Chenbo Fengec27c352017-10-18 13:00:25 -07006795 bpf_map_fmode_to_av(fmode), NULL);
6796}
6797
6798static int selinux_bpf_prog(struct bpf_prog *prog)
6799{
6800 u32 sid = current_sid();
6801 struct bpf_security_struct *bpfsec;
6802
6803 bpfsec = prog->aux->security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006804 return avc_has_perm(&selinux_state,
6805 sid, bpfsec->sid, SECCLASS_BPF,
Chenbo Fengec27c352017-10-18 13:00:25 -07006806 BPF__PROG_RUN, NULL);
6807}
6808
6809static int selinux_bpf_map_alloc(struct bpf_map *map)
6810{
6811 struct bpf_security_struct *bpfsec;
6812
6813 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6814 if (!bpfsec)
6815 return -ENOMEM;
6816
6817 bpfsec->sid = current_sid();
6818 map->security = bpfsec;
6819
6820 return 0;
6821}
6822
6823static void selinux_bpf_map_free(struct bpf_map *map)
6824{
6825 struct bpf_security_struct *bpfsec = map->security;
6826
6827 map->security = NULL;
6828 kfree(bpfsec);
6829}
6830
6831static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6832{
6833 struct bpf_security_struct *bpfsec;
6834
6835 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6836 if (!bpfsec)
6837 return -ENOMEM;
6838
6839 bpfsec->sid = current_sid();
6840 aux->security = bpfsec;
6841
6842 return 0;
6843}
6844
6845static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
6846{
6847 struct bpf_security_struct *bpfsec = aux->security;
6848
6849 aux->security = NULL;
6850 kfree(bpfsec);
6851}
6852#endif
6853
James Morrisca97d932017-02-15 00:18:51 +11006854static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
Casey Schauflere20b0432015-05-02 15:11:36 -07006855 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6856 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6857 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6858 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02006859
Casey Schauflere20b0432015-05-02 15:11:36 -07006860 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6861 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6862 LSM_HOOK_INIT(capget, selinux_capget),
6863 LSM_HOOK_INIT(capset, selinux_capset),
6864 LSM_HOOK_INIT(capable, selinux_capable),
6865 LSM_HOOK_INIT(quotactl, selinux_quotactl),
6866 LSM_HOOK_INIT(quota_on, selinux_quota_on),
6867 LSM_HOOK_INIT(syslog, selinux_syslog),
6868 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
Stephen Smalley79af7302015-01-21 10:54:10 -05006869
Casey Schauflere20b0432015-05-02 15:11:36 -07006870 LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006871
Casey Schauflere20b0432015-05-02 15:11:36 -07006872 LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6873 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6874 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006875
Casey Schauflere20b0432015-05-02 15:11:36 -07006876 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6877 LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6878 LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
6879 LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6880 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6881 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6882 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6883 LSM_HOOK_INIT(sb_mount, selinux_mount),
6884 LSM_HOOK_INIT(sb_umount, selinux_umount),
6885 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6886 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6887 LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006888
Casey Schauflere20b0432015-05-02 15:11:36 -07006889 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
Vivek Goyala518b0a2016-07-13 10:44:53 -04006890 LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
Eric Parise0007522008-03-05 10:31:54 -05006891
Casey Schauflere20b0432015-05-02 15:11:36 -07006892 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6893 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6894 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6895 LSM_HOOK_INIT(inode_create, selinux_inode_create),
6896 LSM_HOOK_INIT(inode_link, selinux_inode_link),
6897 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6898 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6899 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6900 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6901 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6902 LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6903 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6904 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6905 LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6906 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6907 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6908 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6909 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6910 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6911 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6912 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6913 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6914 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6915 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6916 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
Vivek Goyal56909eb2016-07-13 10:44:48 -04006917 LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
Vivek Goyal19472b62016-07-13 10:44:50 -04006918 LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006919
Casey Schauflere20b0432015-05-02 15:11:36 -07006920 LSM_HOOK_INIT(file_permission, selinux_file_permission),
6921 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6922 LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
6923 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6924 LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6925 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6926 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6927 LSM_HOOK_INIT(file_lock, selinux_file_lock),
6928 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6929 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6930 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6931 LSM_HOOK_INIT(file_receive, selinux_file_receive),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006932
Casey Schauflere20b0432015-05-02 15:11:36 -07006933 LSM_HOOK_INIT(file_open, selinux_file_open),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006934
Tetsuo Handaa79be232017-03-28 23:08:45 +09006935 LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
Casey Schauflere20b0432015-05-02 15:11:36 -07006936 LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
6937 LSM_HOOK_INIT(cred_free, selinux_cred_free),
6938 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6939 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
Matthew Garrett3ec30112018-01-08 13:36:19 -08006940 LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
Casey Schauflere20b0432015-05-02 15:11:36 -07006941 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6942 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6943 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07006944 LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
Casey Schauflere20b0432015-05-02 15:11:36 -07006945 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6946 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6947 LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6948 LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6949 LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6950 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6951 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
Stephen Smalley791ec492017-02-17 07:57:00 -05006952 LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
Casey Schauflere20b0432015-05-02 15:11:36 -07006953 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6954 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6955 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6956 LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6957 LSM_HOOK_INIT(task_kill, selinux_task_kill),
Casey Schauflere20b0432015-05-02 15:11:36 -07006958 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09006959
Casey Schauflere20b0432015-05-02 15:11:36 -07006960 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6961 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006962
Casey Schauflere20b0432015-05-02 15:11:36 -07006963 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6964 LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006965
Casey Schauflere20b0432015-05-02 15:11:36 -07006966 LSM_HOOK_INIT(msg_queue_alloc_security,
6967 selinux_msg_queue_alloc_security),
6968 LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6969 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6970 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6971 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6972 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006973
Casey Schauflere20b0432015-05-02 15:11:36 -07006974 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6975 LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6976 LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6977 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6978 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006979
Casey Schauflere20b0432015-05-02 15:11:36 -07006980 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6981 LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6982 LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6983 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6984 LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006985
Casey Schauflere20b0432015-05-02 15:11:36 -07006986 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006987
Casey Schauflere20b0432015-05-02 15:11:36 -07006988 LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6989 LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006990
Casey Schauflere20b0432015-05-02 15:11:36 -07006991 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6992 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6993 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6994 LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006995 LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
Casey Schauflere20b0432015-05-02 15:11:36 -07006996 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6997 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6998 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006999
Casey Schauflere20b0432015-05-02 15:11:36 -07007000 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
7001 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07007002
Casey Schauflere20b0432015-05-02 15:11:36 -07007003 LSM_HOOK_INIT(socket_create, selinux_socket_create),
7004 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
7005 LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
7006 LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
7007 LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
7008 LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
7009 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
7010 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
7011 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
7012 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
7013 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
7014 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
7015 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
7016 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
7017 LSM_HOOK_INIT(socket_getpeersec_stream,
7018 selinux_socket_getpeersec_stream),
7019 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
7020 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
7021 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
7022 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
7023 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
7024 LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
Richard Hainesd4529302018-02-13 20:57:18 +00007025 LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
7026 LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
7027 LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
Casey Schauflere20b0432015-05-02 15:11:36 -07007028 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
7029 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
7030 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
7031 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
7032 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
7033 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
7034 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
7035 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
7036 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
7037 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
7038 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
7039 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
7040 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03007041#ifdef CONFIG_SECURITY_INFINIBAND
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03007042 LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
Daniel Jurgensab861df2017-05-19 15:48:58 +03007043 LSM_HOOK_INIT(ib_endport_manage_subnet,
7044 selinux_ib_endport_manage_subnet),
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03007045 LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
7046 LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
7047#endif
Trent Jaegerd28d1e02005-12-13 23:12:40 -08007048#ifdef CONFIG_SECURITY_NETWORK_XFRM
Casey Schauflere20b0432015-05-02 15:11:36 -07007049 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
7050 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
7051 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
7052 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
7053 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
7054 LSM_HOOK_INIT(xfrm_state_alloc_acquire,
7055 selinux_xfrm_state_alloc_acquire),
7056 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
7057 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
7058 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
7059 LSM_HOOK_INIT(xfrm_state_pol_flow_match,
7060 selinux_xfrm_state_pol_flow_match),
7061 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
Linus Torvalds1da177e2005-04-16 15:20:36 -07007062#endif
Michael LeMayd7200242006-06-22 14:47:17 -07007063
7064#ifdef CONFIG_KEYS
Casey Schauflere20b0432015-05-02 15:11:36 -07007065 LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
7066 LSM_HOOK_INIT(key_free, selinux_key_free),
7067 LSM_HOOK_INIT(key_permission, selinux_key_permission),
7068 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
Michael LeMayd7200242006-06-22 14:47:17 -07007069#endif
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +02007070
7071#ifdef CONFIG_AUDIT
Casey Schauflere20b0432015-05-02 15:11:36 -07007072 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
7073 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
7074 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
7075 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +02007076#endif
Chenbo Fengec27c352017-10-18 13:00:25 -07007077
7078#ifdef CONFIG_BPF_SYSCALL
7079 LSM_HOOK_INIT(bpf, selinux_bpf),
7080 LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
7081 LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
7082 LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
7083 LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
7084 LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
7085 LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
7086#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07007087};
7088
7089static __init int selinux_init(void)
7090{
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07007091 if (!security_module_enable("selinux")) {
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02007092 selinux_enabled = 0;
7093 return 0;
7094 }
7095
Linus Torvalds1da177e2005-04-16 15:20:36 -07007096 if (!selinux_enabled) {
7097 printk(KERN_INFO "SELinux: Disabled at boot.\n");
7098 return 0;
7099 }
7100
7101 printk(KERN_INFO "SELinux: Initializing.\n");
7102
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007103 memset(&selinux_state, 0, sizeof(selinux_state));
Paul Mooree5a5ca92018-03-01 17:38:30 -05007104 enforcing_set(&selinux_state, selinux_enforcing_boot);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007105 selinux_state.checkreqprot = selinux_checkreqprot_boot;
7106 selinux_ss_init(&selinux_state.ss);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05007107 selinux_avc_init(&selinux_state.avc);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007108
Linus Torvalds1da177e2005-04-16 15:20:36 -07007109 /* Set the security state for the initial task. */
David Howellsd84f4f92008-11-14 10:39:23 +11007110 cred_init_security();
Linus Torvalds1da177e2005-04-16 15:20:36 -07007111
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04007112 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
7113
James Morris7cae7e22006-03-22 00:09:22 -08007114 sel_inode_cache = kmem_cache_create("selinux_inode_security",
7115 sizeof(struct inode_security_struct),
Paul Mundt20c2df82007-07-20 10:11:58 +09007116 0, SLAB_PANIC, NULL);
Sangwoo63205652015-10-21 17:44:30 -04007117 file_security_cache = kmem_cache_create("selinux_file_security",
7118 sizeof(struct file_security_struct),
7119 0, SLAB_PANIC, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07007120 avc_init();
7121
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007122 avtab_cache_init();
7123
7124 ebitmap_cache_init();
7125
7126 hashtab_cache_init();
7127
Casey Schauflerd69dece52017-01-18 17:09:05 -08007128 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
Linus Torvalds1da177e2005-04-16 15:20:36 -07007129
Paul Moore615e51f2014-06-26 14:33:56 -04007130 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
7131 panic("SELinux: Unable to register AVC netcache callback\n");
7132
Daniel Jurgens8f408ab2017-05-19 15:48:53 +03007133 if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7134 panic("SELinux: Unable to register AVC LSM notifier callback\n");
7135
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007136 if (selinux_enforcing_boot)
Eric Parisfadcdb42007-02-22 18:11:31 -05007137 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
Eric Paris828dfe12008-04-17 13:17:49 -04007138 else
Eric Parisfadcdb42007-02-22 18:11:31 -05007139 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
Michael LeMayd7200242006-06-22 14:47:17 -07007140
Linus Torvalds1da177e2005-04-16 15:20:36 -07007141 return 0;
7142}
7143
Al Viroe8c26252010-03-23 06:36:54 -04007144static void delayed_superblock_init(struct super_block *sb, void *unused)
7145{
7146 superblock_doinit(sb, NULL);
7147}
7148
Linus Torvalds1da177e2005-04-16 15:20:36 -07007149void selinux_complete_init(void)
7150{
Eric Parisfadcdb42007-02-22 18:11:31 -05007151 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07007152
7153 /* Set up any superblocks initialized prior to the policy load. */
Eric Parisfadcdb42007-02-22 18:11:31 -05007154 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
Al Viroe8c26252010-03-23 06:36:54 -04007155 iterate_supers(delayed_superblock_init, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07007156}
7157
7158/* SELinux requires early initialization in order to label
7159 all processes and objects when they are created. */
7160security_initcall(selinux_init);
7161
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08007162#if defined(CONFIG_NETFILTER)
Linus Torvalds1da177e2005-04-16 15:20:36 -07007163
Florian Westphal591bb2782017-07-26 11:40:52 +02007164static const struct nf_hook_ops selinux_nf_ops[] = {
Paul Mooreeffad8d2008-01-29 08:49:27 -05007165 {
7166 .hook = selinux_ipv4_postroute,
Alban Crequy2597a832012-05-14 03:56:39 +00007167 .pf = NFPROTO_IPV4,
Paul Mooreeffad8d2008-01-29 08:49:27 -05007168 .hooknum = NF_INET_POST_ROUTING,
7169 .priority = NF_IP_PRI_SELINUX_LAST,
7170 },
7171 {
7172 .hook = selinux_ipv4_forward,
Alban Crequy2597a832012-05-14 03:56:39 +00007173 .pf = NFPROTO_IPV4,
Paul Mooreeffad8d2008-01-29 08:49:27 -05007174 .hooknum = NF_INET_FORWARD,
7175 .priority = NF_IP_PRI_SELINUX_FIRST,
Paul Moore948bf852008-10-10 10:16:32 -04007176 },
7177 {
7178 .hook = selinux_ipv4_output,
Alban Crequy2597a832012-05-14 03:56:39 +00007179 .pf = NFPROTO_IPV4,
Paul Moore948bf852008-10-10 10:16:32 -04007180 .hooknum = NF_INET_LOCAL_OUT,
7181 .priority = NF_IP_PRI_SELINUX_FIRST,
Jiri Pirko25db6be2014-09-03 17:42:13 +02007182 },
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04007183#if IS_ENABLED(CONFIG_IPV6)
Paul Mooreeffad8d2008-01-29 08:49:27 -05007184 {
7185 .hook = selinux_ipv6_postroute,
Alban Crequy2597a832012-05-14 03:56:39 +00007186 .pf = NFPROTO_IPV6,
Paul Mooreeffad8d2008-01-29 08:49:27 -05007187 .hooknum = NF_INET_POST_ROUTING,
7188 .priority = NF_IP6_PRI_SELINUX_LAST,
7189 },
7190 {
7191 .hook = selinux_ipv6_forward,
Alban Crequy2597a832012-05-14 03:56:39 +00007192 .pf = NFPROTO_IPV6,
Paul Mooreeffad8d2008-01-29 08:49:27 -05007193 .hooknum = NF_INET_FORWARD,
7194 .priority = NF_IP6_PRI_SELINUX_FIRST,
Jiri Pirko25db6be2014-09-03 17:42:13 +02007195 },
Huw Davies2917f572016-06-27 15:06:15 -04007196 {
7197 .hook = selinux_ipv6_output,
7198 .pf = NFPROTO_IPV6,
7199 .hooknum = NF_INET_LOCAL_OUT,
7200 .priority = NF_IP6_PRI_SELINUX_FIRST,
7201 },
Linus Torvalds1da177e2005-04-16 15:20:36 -07007202#endif /* IPV6 */
Jiri Pirko25db6be2014-09-03 17:42:13 +02007203};
Linus Torvalds1da177e2005-04-16 15:20:36 -07007204
Florian Westphal8e71bf72017-04-21 11:49:09 +02007205static int __net_init selinux_nf_register(struct net *net)
7206{
7207 return nf_register_net_hooks(net, selinux_nf_ops,
7208 ARRAY_SIZE(selinux_nf_ops));
7209}
7210
7211static void __net_exit selinux_nf_unregister(struct net *net)
7212{
7213 nf_unregister_net_hooks(net, selinux_nf_ops,
7214 ARRAY_SIZE(selinux_nf_ops));
7215}
7216
7217static struct pernet_operations selinux_net_ops = {
7218 .init = selinux_nf_register,
7219 .exit = selinux_nf_unregister,
7220};
7221
Linus Torvalds1da177e2005-04-16 15:20:36 -07007222static int __init selinux_nf_ip_init(void)
7223{
Jiri Pirko25db6be2014-09-03 17:42:13 +02007224 int err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07007225
7226 if (!selinux_enabled)
Jiri Pirko25db6be2014-09-03 17:42:13 +02007227 return 0;
Eric Parisfadcdb42007-02-22 18:11:31 -05007228
7229 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
7230
Florian Westphal8e71bf72017-04-21 11:49:09 +02007231 err = register_pernet_subsys(&selinux_net_ops);
Alexey Dobriyan6c5a9d22008-07-26 17:48:15 -07007232 if (err)
Florian Westphal8e71bf72017-04-21 11:49:09 +02007233 panic("SELinux: register_pernet_subsys: error %d\n", err);
Linus Torvalds1da177e2005-04-16 15:20:36 -07007234
Jiri Pirko25db6be2014-09-03 17:42:13 +02007235 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07007236}
Linus Torvalds1da177e2005-04-16 15:20:36 -07007237__initcall(selinux_nf_ip_init);
7238
7239#ifdef CONFIG_SECURITY_SELINUX_DISABLE
7240static void selinux_nf_ip_exit(void)
7241{
Eric Parisfadcdb42007-02-22 18:11:31 -05007242 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07007243
Florian Westphal8e71bf72017-04-21 11:49:09 +02007244 unregister_pernet_subsys(&selinux_net_ops);
Linus Torvalds1da177e2005-04-16 15:20:36 -07007245}
7246#endif
7247
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08007248#else /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07007249
7250#ifdef CONFIG_SECURITY_SELINUX_DISABLE
7251#define selinux_nf_ip_exit()
7252#endif
7253
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08007254#endif /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07007255
7256#ifdef CONFIG_SECURITY_SELINUX_DISABLE
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007257int selinux_disable(struct selinux_state *state)
Linus Torvalds1da177e2005-04-16 15:20:36 -07007258{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007259 if (state->initialized) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07007260 /* Not permitted after initial policy load. */
7261 return -EINVAL;
7262 }
7263
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007264 if (state->disabled) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07007265 /* Only do this once. */
7266 return -EINVAL;
7267 }
7268
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007269 state->disabled = 1;
7270
Linus Torvalds1da177e2005-04-16 15:20:36 -07007271 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
7272
Stephen Smalley30d55282006-05-03 10:52:36 -04007273 selinux_enabled = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07007274
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07007275 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
Linus Torvalds1da177e2005-04-16 15:20:36 -07007276
Eric Parisaf8ff042009-09-20 21:23:01 -04007277 /* Try to destroy the avc node cache */
7278 avc_disable();
7279
Linus Torvalds1da177e2005-04-16 15:20:36 -07007280 /* Unregister netfilter hooks. */
7281 selinux_nf_ip_exit();
7282
7283 /* Unregister selinuxfs. */
7284 exit_sel_fs();
7285
7286 return 0;
7287}
7288#endif