blob: c61787b15f27b2b0bd0ed7d448fd6ba2d73ca07a [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
Stephen Smalley7efbb602017-08-17 13:32:36 -04006 * Authors: Stephen Smalley, <sds@tycho.nsa.gov>
Eric Paris828dfe12008-04-17 13:17:49 -04007 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070010 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
Eric Paris2069f452008-07-04 09:47:13 +100012 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070014 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
Eric Paris828dfe12008-04-17 13:17:49 -040015 * <dgoeddel@trustedcs.com>
Paul Mooreed6d76e2009-08-28 18:12:49 -040016 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
Paul Moore82c21bf2011-08-01 11:10:33 +000017 * Paul Moore <paul@paul-moore.com>
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +090018 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
Eric Paris828dfe12008-04-17 13:17:49 -040019 * Yuichi Nakamura <ynakam@hitachisoft.jp>
Daniel Jurgens3a976fa2017-05-19 15:48:56 +030020 * Copyright (C) 2016 Mellanox Technologies
Linus Torvalds1da177e2005-04-16 15:20:36 -070021 *
22 * This program is free software; you can redistribute it and/or modify
23 * it under the terms of the GNU General Public License version 2,
Eric Paris828dfe12008-04-17 13:17:49 -040024 * as published by the Free Software Foundation.
Linus Torvalds1da177e2005-04-16 15:20:36 -070025 */
26
Linus Torvalds1da177e2005-04-16 15:20:36 -070027#include <linux/init.h>
Eric Paris0b24dcb2011-02-25 15:39:20 -050028#include <linux/kd.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070029#include <linux/kernel.h>
Roland McGrath0d094ef2008-07-25 19:45:49 -070030#include <linux/tracehook.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070031#include <linux/errno.h>
Ingo Molnar3f07c012017-02-08 18:51:30 +010032#include <linux/sched/signal.h>
Ingo Molnar29930022017-02-08 18:51:36 +010033#include <linux/sched/task.h>
Casey Schaufler3c4ed7b2015-05-02 15:10:46 -070034#include <linux/lsm_hooks.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070035#include <linux/xattr.h>
36#include <linux/capability.h>
37#include <linux/unistd.h>
38#include <linux/mm.h>
39#include <linux/mman.h>
40#include <linux/slab.h>
41#include <linux/pagemap.h>
Eric Paris0b24dcb2011-02-25 15:39:20 -050042#include <linux/proc_fs.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070043#include <linux/swap.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070044#include <linux/spinlock.h>
45#include <linux/syscalls.h>
Eric Paris2a7dba32011-02-01 11:05:39 -050046#include <linux/dcache.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070047#include <linux/file.h>
Al Viro9f3acc32008-04-24 07:44:08 -040048#include <linux/fdtable.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070049#include <linux/namei.h>
50#include <linux/mount.h>
David Howells442155c2018-11-01 23:07:24 +000051#include <linux/fs_context.h>
52#include <linux/fs_parser.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070053#include <linux/netfilter_ipv4.h>
54#include <linux/netfilter_ipv6.h>
55#include <linux/tty.h>
56#include <net/icmp.h>
Stephen Hemminger227b60f2007-10-10 17:30:46 -070057#include <net/ip.h> /* for local_port_range[] */
Linus Torvalds1da177e2005-04-16 15:20:36 -070058#include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
Paul Moore47180062013-12-04 16:10:45 -050059#include <net/inet_connection_sock.h>
Paul Moore220deb92008-01-29 08:38:23 -050060#include <net/net_namespace.h>
Paul Moored621d352008-01-29 08:43:36 -050061#include <net/netlabel.h>
Eric Parisf5269712008-05-14 11:27:45 -040062#include <linux/uaccess.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070063#include <asm/ioctls.h>
Arun Sharma600634972011-07-26 16:09:06 -070064#include <linux/atomic.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070065#include <linux/bitops.h>
66#include <linux/interrupt.h>
67#include <linux/netdevice.h> /* for network interface checks */
Hong zhi guo77954982013-03-27 06:49:35 +000068#include <net/netlink.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070069#include <linux/tcp.h>
70#include <linux/udp.h>
James Morris2ee92d42006-11-13 16:09:01 -080071#include <linux/dccp.h>
Richard Hainesd4529302018-02-13 20:57:18 +000072#include <linux/sctp.h>
73#include <net/sctp/structs.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070074#include <linux/quota.h>
75#include <linux/un.h> /* for Unix socket types */
76#include <net/af_unix.h> /* for Unix socket types */
77#include <linux/parser.h>
78#include <linux/nfs_mount.h>
79#include <net/ipv6.h>
80#include <linux/hugetlb.h>
81#include <linux/personality.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070082#include <linux/audit.h>
Eric Paris6931dfc2005-06-30 02:58:51 -070083#include <linux/string.h>
Eric Paris23970742006-09-25 23:32:01 -070084#include <linux/mutex.h>
Frank Mayharf06febc2008-09-12 09:54:39 -070085#include <linux/posix-timers.h>
Kees Cook00234592010-02-03 15:36:43 -080086#include <linux/syslog.h>
Serge E. Hallyn34867402011-03-23 16:43:17 -070087#include <linux/user_namespace.h>
Paul Gortmaker44fc7ea2011-05-26 20:52:10 -040088#include <linux/export.h>
Al Viro40401532012-02-13 03:58:52 +000089#include <linux/msg.h>
90#include <linux/shm.h>
Chenbo Fengec27c352017-10-18 13:00:25 -070091#include <linux/bpf.h>
Ondrej Mosnacekec882da2019-02-22 15:57:17 +010092#include <linux/kernfs.h>
93#include <linux/stringhash.h> /* for hashlen_string() */
David Howellse262e32d2018-11-01 23:07:23 +000094#include <uapi/linux/mount.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070095
96#include "avc.h"
97#include "objsec.h"
98#include "netif.h"
Paul Moore224dfbd2008-01-29 08:38:13 -050099#include "netnode.h"
Paul Moore3e1121722008-04-10 10:48:14 -0400100#include "netport.h"
Daniel Jurgens409dcf32017-05-19 15:48:59 +0300101#include "ibpkey.h"
Trent Jaegerd28d1e02005-12-13 23:12:40 -0800102#include "xfrm.h"
Paul Moorec60475b2007-02-28 15:14:23 -0500103#include "netlabel.h"
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +0200104#include "audit.h"
James Morris7b98a582011-08-30 12:52:32 +1000105#include "avc_ss.h"
Linus Torvalds1da177e2005-04-16 15:20:36 -0700106
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500107struct selinux_state selinux_state;
108
Paul Moored621d352008-01-29 08:43:36 -0500109/* SECMARK reference count */
James Morris56a4ca92011-08-17 11:08:43 +1000110static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
Paul Moored621d352008-01-29 08:43:36 -0500111
Linus Torvalds1da177e2005-04-16 15:20:36 -0700112#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500113static int selinux_enforcing_boot;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700114
115static int __init enforcing_setup(char *str)
116{
Eric Parisf5269712008-05-14 11:27:45 -0400117 unsigned long enforcing;
Jingoo Han29707b22014-02-05 15:13:14 +0900118 if (!kstrtoul(str, 0, &enforcing))
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500119 selinux_enforcing_boot = enforcing ? 1 : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700120 return 1;
121}
122__setup("enforcing=", enforcing_setup);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500123#else
124#define selinux_enforcing_boot 1
Linus Torvalds1da177e2005-04-16 15:20:36 -0700125#endif
126
Kees Cookbe6ec882018-10-01 17:08:57 -0700127int selinux_enabled __lsm_ro_after_init = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700128#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
Linus Torvalds1da177e2005-04-16 15:20:36 -0700129static int __init selinux_enabled_setup(char *str)
130{
Eric Parisf5269712008-05-14 11:27:45 -0400131 unsigned long enabled;
Jingoo Han29707b22014-02-05 15:13:14 +0900132 if (!kstrtoul(str, 0, &enabled))
Eric Parisf5269712008-05-14 11:27:45 -0400133 selinux_enabled = enabled ? 1 : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700134 return 1;
135}
136__setup("selinux=", selinux_enabled_setup);
137#endif
138
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500139static unsigned int selinux_checkreqprot_boot =
140 CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
141
142static int __init checkreqprot_setup(char *str)
143{
144 unsigned long checkreqprot;
145
146 if (!kstrtoul(str, 0, &checkreqprot))
147 selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
148 return 1;
149}
150__setup("checkreqprot=", checkreqprot_setup);
151
Paul Moored621d352008-01-29 08:43:36 -0500152/**
153 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
154 *
155 * Description:
156 * This function checks the SECMARK reference counter to see if any SECMARK
157 * targets are currently configured, if the reference counter is greater than
158 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
Chris PeBenito2be4d742013-05-03 09:05:39 -0400159 * enabled, false (0) if SECMARK is disabled. If the always_check_network
160 * policy capability is enabled, SECMARK is always considered enabled.
Paul Moored621d352008-01-29 08:43:36 -0500161 *
162 */
163static int selinux_secmark_enabled(void)
164{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500165 return (selinux_policycap_alwaysnetwork() ||
166 atomic_read(&selinux_secmark_refcount));
Chris PeBenito2be4d742013-05-03 09:05:39 -0400167}
168
169/**
170 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
171 *
172 * Description:
173 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
174 * (1) if any are enabled or false (0) if neither are enabled. If the
175 * always_check_network policy capability is enabled, peer labeling
176 * is always considered enabled.
177 *
178 */
179static int selinux_peerlbl_enabled(void)
180{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500181 return (selinux_policycap_alwaysnetwork() ||
182 netlbl_enabled() || selinux_xfrm_enabled());
Paul Moored621d352008-01-29 08:43:36 -0500183}
184
Paul Moore615e51f2014-06-26 14:33:56 -0400185static int selinux_netcache_avc_callback(u32 event)
186{
187 if (event == AVC_CALLBACK_RESET) {
188 sel_netif_flush();
189 sel_netnode_flush();
190 sel_netport_flush();
191 synchronize_net();
192 }
193 return 0;
194}
195
Daniel Jurgens8f408ab2017-05-19 15:48:53 +0300196static int selinux_lsm_notifier_avc_callback(u32 event)
197{
Daniel Jurgens409dcf32017-05-19 15:48:59 +0300198 if (event == AVC_CALLBACK_RESET) {
199 sel_ib_pkey_flush();
Daniel Jurgens8f408ab2017-05-19 15:48:53 +0300200 call_lsm_notifier(LSM_POLICY_CHANGE, NULL);
Daniel Jurgens409dcf32017-05-19 15:48:59 +0300201 }
Daniel Jurgens8f408ab2017-05-19 15:48:53 +0300202
203 return 0;
204}
205
David Howellsd84f4f92008-11-14 10:39:23 +1100206/*
207 * initialise the security for the init task
208 */
209static void cred_init_security(void)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700210{
David Howells3b11a1d2008-11-14 10:39:26 +1100211 struct cred *cred = (struct cred *) current->real_cred;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700212 struct task_security_struct *tsec;
213
Casey Schauflerbbd36622018-11-12 09:30:56 -0800214 tsec = selinux_cred(cred);
David Howellsd84f4f92008-11-14 10:39:23 +1100215 tsec->osid = tsec->sid = SECINITSID_KERNEL;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700216}
217
David Howells275bb412008-11-14 10:39:19 +1100218/*
David Howells88e67f32008-11-14 10:39:21 +1100219 * get the security ID of a set of credentials
220 */
221static inline u32 cred_sid(const struct cred *cred)
222{
223 const struct task_security_struct *tsec;
224
Casey Schaufler0c6cfa62018-09-21 17:17:16 -0700225 tsec = selinux_cred(cred);
David Howells88e67f32008-11-14 10:39:21 +1100226 return tsec->sid;
227}
228
229/*
David Howells3b11a1d2008-11-14 10:39:26 +1100230 * get the objective security ID of a task
David Howells275bb412008-11-14 10:39:19 +1100231 */
232static inline u32 task_sid(const struct task_struct *task)
233{
David Howells275bb412008-11-14 10:39:19 +1100234 u32 sid;
235
236 rcu_read_lock();
David Howells88e67f32008-11-14 10:39:21 +1100237 sid = cred_sid(__task_cred(task));
David Howells275bb412008-11-14 10:39:19 +1100238 rcu_read_unlock();
239 return sid;
240}
241
David Howells88e67f32008-11-14 10:39:21 +1100242/* Allocate and free functions for each kind of security blob. */
243
Linus Torvalds1da177e2005-04-16 15:20:36 -0700244static int inode_alloc_security(struct inode *inode)
245{
Casey Schauflerafb1cbe32018-09-21 17:19:29 -0700246 struct inode_security_struct *isec = selinux_inode(inode);
David Howells275bb412008-11-14 10:39:19 +1100247 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700248
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +0100249 spin_lock_init(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700250 INIT_LIST_HEAD(&isec->list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700251 isec->inode = inode;
252 isec->sid = SECINITSID_UNLABELED;
253 isec->sclass = SECCLASS_FILE;
David Howells275bb412008-11-14 10:39:19 +1100254 isec->task_sid = sid;
Andreas Gruenbacher42059112016-11-10 22:18:27 +0100255 isec->initialized = LABEL_INVALID;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700256
257 return 0;
258}
259
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500260static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
261
262/*
263 * Try reloading inode security labels that have been marked as invalid. The
264 * @may_sleep parameter indicates when sleeping and thus reloading labels is
Andreas Gruenbacher42059112016-11-10 22:18:27 +0100265 * allowed; when set to false, returns -ECHILD when the label is
Al Viroe9193282018-04-24 21:31:02 -0400266 * invalid. The @dentry parameter should be set to a dentry of the inode.
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500267 */
268static int __inode_security_revalidate(struct inode *inode,
Al Viroe9193282018-04-24 21:31:02 -0400269 struct dentry *dentry,
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500270 bool may_sleep)
271{
Casey Schaufler80788c22018-09-21 17:19:11 -0700272 struct inode_security_struct *isec = selinux_inode(inode);
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500273
274 might_sleep_if(may_sleep);
275
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500276 if (selinux_state.initialized &&
277 isec->initialized != LABEL_INITIALIZED) {
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500278 if (!may_sleep)
279 return -ECHILD;
280
281 /*
282 * Try reloading the inode security label. This will fail if
283 * @opt_dentry is NULL and no dentry for this inode can be
284 * found; in that case, continue using the old label.
285 */
Al Viroe9193282018-04-24 21:31:02 -0400286 inode_doinit_with_dentry(inode, dentry);
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500287 }
288 return 0;
289}
290
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500291static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
292{
Casey Schaufler80788c22018-09-21 17:19:11 -0700293 return selinux_inode(inode);
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500294}
295
296static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
297{
298 int error;
299
300 error = __inode_security_revalidate(inode, NULL, !rcu);
301 if (error)
302 return ERR_PTR(error);
Casey Schaufler80788c22018-09-21 17:19:11 -0700303 return selinux_inode(inode);
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500304}
305
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500306/*
307 * Get the security label of an inode.
308 */
309static struct inode_security_struct *inode_security(struct inode *inode)
310{
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500311 __inode_security_revalidate(inode, NULL, true);
Casey Schaufler80788c22018-09-21 17:19:11 -0700312 return selinux_inode(inode);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500313}
314
Paul Moore2c971652016-04-19 16:36:28 -0400315static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
316{
317 struct inode *inode = d_backing_inode(dentry);
318
Casey Schaufler80788c22018-09-21 17:19:11 -0700319 return selinux_inode(inode);
Paul Moore2c971652016-04-19 16:36:28 -0400320}
321
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500322/*
323 * Get the security label of a dentry's backing inode.
324 */
325static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
326{
327 struct inode *inode = d_backing_inode(dentry);
328
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500329 __inode_security_revalidate(inode, dentry, true);
Casey Schaufler80788c22018-09-21 17:19:11 -0700330 return selinux_inode(inode);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500331}
332
Linus Torvalds1da177e2005-04-16 15:20:36 -0700333static void inode_free_security(struct inode *inode)
334{
Casey Schaufler80788c22018-09-21 17:19:11 -0700335 struct inode_security_struct *isec = selinux_inode(inode);
Casey Schauflerafb1cbe32018-09-21 17:19:29 -0700336 struct superblock_security_struct *sbsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700337
Casey Schauflerafb1cbe32018-09-21 17:19:29 -0700338 if (!isec)
339 return;
340 sbsec = inode->i_sb->s_security;
Waiman Long9629d042015-07-10 17:19:56 -0400341 /*
342 * As not all inode security structures are in a list, we check for
343 * empty list outside of the lock to make sure that we won't waste
344 * time taking a lock doing nothing.
345 *
346 * The list_del_init() function can be safely called more than once.
347 * It should not be possible for this function to be called with
348 * concurrent list_add(), but for better safety against future changes
349 * in the code, we use list_empty_careful() here.
350 */
351 if (!list_empty_careful(&isec->list)) {
352 spin_lock(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700353 list_del_init(&isec->list);
Waiman Long9629d042015-07-10 17:19:56 -0400354 spin_unlock(&sbsec->isec_lock);
355 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700356}
357
358static int file_alloc_security(struct file *file)
359{
Casey Schaufler33bf60c2018-11-12 12:02:49 -0800360 struct file_security_struct *fsec = selinux_file(file);
David Howells275bb412008-11-14 10:39:19 +1100361 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700362
David Howells275bb412008-11-14 10:39:19 +1100363 fsec->sid = sid;
364 fsec->fown_sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700365
366 return 0;
367}
368
Linus Torvalds1da177e2005-04-16 15:20:36 -0700369static int superblock_alloc_security(struct super_block *sb)
370{
371 struct superblock_security_struct *sbsec;
372
James Morris89d155e2005-10-30 14:59:21 -0800373 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700374 if (!sbsec)
375 return -ENOMEM;
376
Eric Parisbc7e9822006-09-25 23:32:02 -0700377 mutex_init(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700378 INIT_LIST_HEAD(&sbsec->isec_head);
379 spin_lock_init(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700380 sbsec->sb = sb;
381 sbsec->sid = SECINITSID_UNLABELED;
382 sbsec->def_sid = SECINITSID_FILE;
Eric Parisc312feb2006-07-10 04:43:53 -0700383 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700384 sb->s_security = sbsec;
385
386 return 0;
387}
388
389static void superblock_free_security(struct super_block *sb)
390{
391 struct superblock_security_struct *sbsec = sb->s_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700392 sb->s_security = NULL;
393 kfree(sbsec);
394}
395
Al Virobd323652018-12-13 15:04:59 -0500396struct selinux_mnt_opts {
397 const char *fscontext, *context, *rootcontext, *defcontext;
398};
399
Al Viro204cc0c2018-12-13 13:41:47 -0500400static void selinux_free_mnt_opts(void *mnt_opts)
401{
Al Virobd323652018-12-13 15:04:59 -0500402 struct selinux_mnt_opts *opts = mnt_opts;
403 kfree(opts->fscontext);
404 kfree(opts->context);
405 kfree(opts->rootcontext);
406 kfree(opts->defcontext);
Al Viro204cc0c2018-12-13 13:41:47 -0500407 kfree(opts);
408}
409
Linus Torvalds1da177e2005-04-16 15:20:36 -0700410static inline int inode_doinit(struct inode *inode)
411{
412 return inode_doinit_with_dentry(inode, NULL);
413}
414
415enum {
Eric Paris31e87932007-09-19 17:19:12 -0400416 Opt_error = -1,
David Howells442155c2018-11-01 23:07:24 +0000417 Opt_context = 0,
418 Opt_defcontext = 1,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700419 Opt_fscontext = 2,
David Howells442155c2018-11-01 23:07:24 +0000420 Opt_rootcontext = 3,
421 Opt_seclabel = 4,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700422};
423
Al Viroda3d76a2018-12-17 10:14:16 -0500424#define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg}
Al Viro169d68efb2018-12-14 22:44:50 -0500425static struct {
426 const char *name;
427 int len;
428 int opt;
429 bool has_arg;
430} tokens[] = {
Al Viroda3d76a2018-12-17 10:14:16 -0500431 A(context, true),
432 A(fscontext, true),
433 A(defcontext, true),
434 A(rootcontext, true),
435 A(seclabel, false),
Linus Torvalds1da177e2005-04-16 15:20:36 -0700436};
Al Viro169d68efb2018-12-14 22:44:50 -0500437#undef A
438
439static int match_opt_prefix(char *s, int l, char **arg)
440{
441 int i;
442
443 for (i = 0; i < ARRAY_SIZE(tokens); i++) {
444 size_t len = tokens[i].len;
445 if (len > l || memcmp(s, tokens[i].name, len))
446 continue;
447 if (tokens[i].has_arg) {
448 if (len == l || s[len] != '=')
449 continue;
450 *arg = s + len + 1;
451 } else if (len != l)
452 continue;
453 return tokens[i].opt;
454 }
455 return Opt_error;
456}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700457
458#define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
459
Eric Parisc312feb2006-07-10 04:43:53 -0700460static int may_context_mount_sb_relabel(u32 sid,
461 struct superblock_security_struct *sbsec,
David Howells275bb412008-11-14 10:39:19 +1100462 const struct cred *cred)
Eric Parisc312feb2006-07-10 04:43:53 -0700463{
Casey Schaufler0c6cfa62018-09-21 17:17:16 -0700464 const struct task_security_struct *tsec = selinux_cred(cred);
Eric Parisc312feb2006-07-10 04:43:53 -0700465 int rc;
466
Stephen Smalley6b6bc622018-03-05 11:47:56 -0500467 rc = avc_has_perm(&selinux_state,
468 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
Eric Parisc312feb2006-07-10 04:43:53 -0700469 FILESYSTEM__RELABELFROM, NULL);
470 if (rc)
471 return rc;
472
Stephen Smalley6b6bc622018-03-05 11:47:56 -0500473 rc = avc_has_perm(&selinux_state,
474 tsec->sid, sid, SECCLASS_FILESYSTEM,
Eric Parisc312feb2006-07-10 04:43:53 -0700475 FILESYSTEM__RELABELTO, NULL);
476 return rc;
477}
478
Eric Paris08089252006-07-10 04:43:55 -0700479static int may_context_mount_inode_relabel(u32 sid,
480 struct superblock_security_struct *sbsec,
David Howells275bb412008-11-14 10:39:19 +1100481 const struct cred *cred)
Eric Paris08089252006-07-10 04:43:55 -0700482{
Casey Schaufler0c6cfa62018-09-21 17:17:16 -0700483 const struct task_security_struct *tsec = selinux_cred(cred);
Eric Paris08089252006-07-10 04:43:55 -0700484 int rc;
Stephen Smalley6b6bc622018-03-05 11:47:56 -0500485 rc = avc_has_perm(&selinux_state,
486 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
Eric Paris08089252006-07-10 04:43:55 -0700487 FILESYSTEM__RELABELFROM, NULL);
488 if (rc)
489 return rc;
490
Stephen Smalley6b6bc622018-03-05 11:47:56 -0500491 rc = avc_has_perm(&selinux_state,
492 sid, sbsec->sid, SECCLASS_FILESYSTEM,
Eric Paris08089252006-07-10 04:43:55 -0700493 FILESYSTEM__ASSOCIATE, NULL);
494 return rc;
495}
496
Ondrej Mosnaceka83d6dd2018-12-21 21:18:52 +0100497static int selinux_is_genfs_special_handling(struct super_block *sb)
Eric Parisb43e7252012-10-10 14:27:35 -0400498{
Ondrej Mosnaceka83d6dd2018-12-21 21:18:52 +0100499 /* Special handling. Genfs but also in-core setxattr handler */
500 return !strcmp(sb->s_type->name, "sysfs") ||
Mark Salyzynd5f3a5f2015-02-04 11:34:30 -0500501 !strcmp(sb->s_type->name, "pstore") ||
502 !strcmp(sb->s_type->name, "debugfs") ||
Yongqin Liua2c7c6f2017-01-09 10:07:30 -0500503 !strcmp(sb->s_type->name, "tracefs") ||
Stephen Smalley2651225b2017-02-28 10:35:56 -0500504 !strcmp(sb->s_type->name, "rootfs") ||
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500505 (selinux_policycap_cgroupseclabel() &&
Stephen Smalley2651225b2017-02-28 10:35:56 -0500506 (!strcmp(sb->s_type->name, "cgroup") ||
507 !strcmp(sb->s_type->name, "cgroup2")));
Eric Parisb43e7252012-10-10 14:27:35 -0400508}
509
Ondrej Mosnaceka83d6dd2018-12-21 21:18:52 +0100510static int selinux_is_sblabel_mnt(struct super_block *sb)
511{
512 struct superblock_security_struct *sbsec = sb->s_security;
513
514 /*
515 * IMPORTANT: Double-check logic in this function when adding a new
516 * SECURITY_FS_USE_* definition!
517 */
518 BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
519
520 switch (sbsec->behavior) {
521 case SECURITY_FS_USE_XATTR:
522 case SECURITY_FS_USE_TRANS:
523 case SECURITY_FS_USE_TASK:
524 case SECURITY_FS_USE_NATIVE:
525 return 1;
526
527 case SECURITY_FS_USE_GENFS:
528 return selinux_is_genfs_special_handling(sb);
529
530 /* Never allow relabeling on context mounts */
531 case SECURITY_FS_USE_MNTPOINT:
532 case SECURITY_FS_USE_NONE:
533 default:
534 return 0;
535 }
536}
537
Eric Parisc9180a52007-11-30 13:00:35 -0500538static int sb_finish_set_opts(struct super_block *sb)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700539{
540 struct superblock_security_struct *sbsec = sb->s_security;
541 struct dentry *root = sb->s_root;
David Howellsc6f493d2015-03-17 22:26:22 +0000542 struct inode *root_inode = d_backing_inode(root);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700543 int rc = 0;
544
Linus Torvalds1da177e2005-04-16 15:20:36 -0700545 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
546 /* Make sure that the xattr handler exists and that no
547 error other than -ENODATA is returned by getxattr on
548 the root directory. -ENODATA is ok, as this may be
549 the first boot of the SELinux kernel before we have
550 assigned xattr values to the filesystem. */
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +0200551 if (!(root_inode->i_opflags & IOP_XATTR)) {
peter enderborgc103a912018-06-12 10:09:03 +0200552 pr_warn("SELinux: (dev %s, type %s) has no "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800553 "xattr support\n", sb->s_id, sb->s_type->name);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700554 rc = -EOPNOTSUPP;
555 goto out;
556 }
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +0200557
558 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700559 if (rc < 0 && rc != -ENODATA) {
560 if (rc == -EOPNOTSUPP)
peter enderborgc103a912018-06-12 10:09:03 +0200561 pr_warn("SELinux: (dev %s, type "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800562 "%s) has no security xattr handler\n",
563 sb->s_id, sb->s_type->name);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700564 else
peter enderborgc103a912018-06-12 10:09:03 +0200565 pr_warn("SELinux: (dev %s, type "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800566 "%s) getxattr errno %d\n", sb->s_id,
567 sb->s_type->name, -rc);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700568 goto out;
569 }
570 }
571
Eric Pariseadcabc2012-08-24 15:59:14 -0400572 sbsec->flags |= SE_SBINITIALIZED;
Scott Mayhew0b4d3452017-06-05 11:45:04 -0400573
574 /*
575 * Explicitly set or clear SBLABEL_MNT. It's not sufficient to simply
576 * leave the flag untouched because sb_clone_mnt_opts might be handing
577 * us a superblock that needs the flag to be cleared.
578 */
Eric Parisb43e7252012-10-10 14:27:35 -0400579 if (selinux_is_sblabel_mnt(sb))
Eric Paris12f348b2012-10-09 10:56:25 -0400580 sbsec->flags |= SBLABEL_MNT;
Scott Mayhew0b4d3452017-06-05 11:45:04 -0400581 else
582 sbsec->flags &= ~SBLABEL_MNT;
David P. Quigleyddd29ec2009-09-09 14:25:37 -0400583
Linus Torvalds1da177e2005-04-16 15:20:36 -0700584 /* Initialize the root inode. */
Eric Parisc9180a52007-11-30 13:00:35 -0500585 rc = inode_doinit_with_dentry(root_inode, root);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700586
587 /* Initialize any other inodes associated with the superblock, e.g.
588 inodes created prior to initial policy load or inodes created
589 during get_sb by a pseudo filesystem that directly
590 populates itself. */
591 spin_lock(&sbsec->isec_lock);
Al Viro8d641242018-12-10 15:34:12 -0500592 while (!list_empty(&sbsec->isec_head)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700593 struct inode_security_struct *isec =
Al Viro8d641242018-12-10 15:34:12 -0500594 list_first_entry(&sbsec->isec_head,
Eric Parisc9180a52007-11-30 13:00:35 -0500595 struct inode_security_struct, list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700596 struct inode *inode = isec->inode;
Stephen Smalley923190d2014-10-06 16:32:52 -0400597 list_del_init(&isec->list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700598 spin_unlock(&sbsec->isec_lock);
599 inode = igrab(inode);
600 if (inode) {
Eric Parisc9180a52007-11-30 13:00:35 -0500601 if (!IS_PRIVATE(inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700602 inode_doinit(inode);
603 iput(inode);
604 }
605 spin_lock(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700606 }
607 spin_unlock(&sbsec->isec_lock);
608out:
Eric Parisc9180a52007-11-30 13:00:35 -0500609 return rc;
610}
611
Eric Parisc9180a52007-11-30 13:00:35 -0500612static int bad_option(struct superblock_security_struct *sbsec, char flag,
613 u32 old_sid, u32 new_sid)
614{
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500615 char mnt_flags = sbsec->flags & SE_MNTMASK;
616
Eric Parisc9180a52007-11-30 13:00:35 -0500617 /* check if the old mount command had the same options */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500618 if (sbsec->flags & SE_SBINITIALIZED)
Eric Parisc9180a52007-11-30 13:00:35 -0500619 if (!(sbsec->flags & flag) ||
620 (old_sid != new_sid))
621 return 1;
622
623 /* check if we were passed the same options twice,
624 * aka someone passed context=a,context=b
625 */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500626 if (!(sbsec->flags & SE_SBINITIALIZED))
627 if (mnt_flags & flag)
Eric Parisc9180a52007-11-30 13:00:35 -0500628 return 1;
629 return 0;
630}
Eric Parise0007522008-03-05 10:31:54 -0500631
Al Virobd323652018-12-13 15:04:59 -0500632static int parse_sid(struct super_block *sb, const char *s, u32 *sid)
633{
634 int rc = security_context_str_to_sid(&selinux_state, s,
635 sid, GFP_KERNEL);
636 if (rc)
637 pr_warn("SELinux: security_context_str_to_sid"
638 "(%s) failed for (dev %s, type %s) errno=%d\n",
639 s, sb->s_id, sb->s_type->name, rc);
640 return rc;
641}
642
Eric Parisc9180a52007-11-30 13:00:35 -0500643/*
644 * Allow filesystems with binary mount data to explicitly set mount point
645 * labeling information.
646 */
Eric Parise0007522008-03-05 10:31:54 -0500647static int selinux_set_mnt_opts(struct super_block *sb,
Al Viro204cc0c2018-12-13 13:41:47 -0500648 void *mnt_opts,
David Quigley649f6e72013-05-22 12:50:36 -0400649 unsigned long kern_flags,
650 unsigned long *set_kern_flags)
Eric Parisc9180a52007-11-30 13:00:35 -0500651{
David Howells275bb412008-11-14 10:39:19 +1100652 const struct cred *cred = current_cred();
Eric Parisc9180a52007-11-30 13:00:35 -0500653 struct superblock_security_struct *sbsec = sb->s_security;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500654 struct dentry *root = sbsec->sb->s_root;
Al Virobd323652018-12-13 15:04:59 -0500655 struct selinux_mnt_opts *opts = mnt_opts;
Paul Moore2c971652016-04-19 16:36:28 -0400656 struct inode_security_struct *root_isec;
Eric Parisc9180a52007-11-30 13:00:35 -0500657 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
658 u32 defcontext_sid = 0;
Al Virobd323652018-12-13 15:04:59 -0500659 int rc = 0;
Eric Parisc9180a52007-11-30 13:00:35 -0500660
661 mutex_lock(&sbsec->lock);
662
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500663 if (!selinux_state.initialized) {
Al Virobd323652018-12-13 15:04:59 -0500664 if (!opts) {
Eric Parisc9180a52007-11-30 13:00:35 -0500665 /* Defer initialization until selinux_complete_init,
666 after the initial policy is loaded and the security
667 server is ready to handle calls. */
Eric Parisc9180a52007-11-30 13:00:35 -0500668 goto out;
669 }
670 rc = -EINVAL;
peter enderborgc103a912018-06-12 10:09:03 +0200671 pr_warn("SELinux: Unable to set superblock options "
Eric Paris744ba352008-04-17 11:52:44 -0400672 "before the security server is initialized\n");
Eric Parisc9180a52007-11-30 13:00:35 -0500673 goto out;
674 }
David Quigley649f6e72013-05-22 12:50:36 -0400675 if (kern_flags && !set_kern_flags) {
676 /* Specifying internal flags without providing a place to
677 * place the results is not allowed */
678 rc = -EINVAL;
679 goto out;
680 }
Eric Parisc9180a52007-11-30 13:00:35 -0500681
682 /*
Eric Parise0007522008-03-05 10:31:54 -0500683 * Binary mount data FS will come through this function twice. Once
684 * from an explicit call and once from the generic calls from the vfs.
685 * Since the generic VFS calls will not contain any security mount data
686 * we need to skip the double mount verification.
687 *
688 * This does open a hole in which we will not notice if the first
689 * mount using this sb set explict options and a second mount using
690 * this sb does not set any security options. (The first options
691 * will be used for both mounts)
692 */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500693 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
Al Virobd323652018-12-13 15:04:59 -0500694 && !opts)
Eric Parisf5269712008-05-14 11:27:45 -0400695 goto out;
Eric Parise0007522008-03-05 10:31:54 -0500696
Paul Moore2c971652016-04-19 16:36:28 -0400697 root_isec = backing_inode_security_novalidate(root);
698
Eric Parise0007522008-03-05 10:31:54 -0500699 /*
Eric Parisc9180a52007-11-30 13:00:35 -0500700 * parse the mount options, check if they are valid sids.
701 * also check if someone is trying to mount the same sb more
702 * than once with different security options.
703 */
Al Virobd323652018-12-13 15:04:59 -0500704 if (opts) {
705 if (opts->fscontext) {
706 rc = parse_sid(sb, opts->fscontext, &fscontext_sid);
707 if (rc)
708 goto out;
Eric Parisc9180a52007-11-30 13:00:35 -0500709 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
710 fscontext_sid))
711 goto out_double_mount;
Eric Parisc9180a52007-11-30 13:00:35 -0500712 sbsec->flags |= FSCONTEXT_MNT;
Al Virobd323652018-12-13 15:04:59 -0500713 }
714 if (opts->context) {
715 rc = parse_sid(sb, opts->context, &context_sid);
716 if (rc)
717 goto out;
Eric Parisc9180a52007-11-30 13:00:35 -0500718 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
719 context_sid))
720 goto out_double_mount;
Eric Parisc9180a52007-11-30 13:00:35 -0500721 sbsec->flags |= CONTEXT_MNT;
Al Virobd323652018-12-13 15:04:59 -0500722 }
723 if (opts->rootcontext) {
724 rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid);
725 if (rc)
726 goto out;
Eric Parisc9180a52007-11-30 13:00:35 -0500727 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
728 rootcontext_sid))
729 goto out_double_mount;
Eric Parisc9180a52007-11-30 13:00:35 -0500730 sbsec->flags |= ROOTCONTEXT_MNT;
Al Virobd323652018-12-13 15:04:59 -0500731 }
732 if (opts->defcontext) {
733 rc = parse_sid(sb, opts->defcontext, &defcontext_sid);
734 if (rc)
735 goto out;
Eric Parisc9180a52007-11-30 13:00:35 -0500736 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
737 defcontext_sid))
738 goto out_double_mount;
Eric Parisc9180a52007-11-30 13:00:35 -0500739 sbsec->flags |= DEFCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500740 }
741 }
742
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500743 if (sbsec->flags & SE_SBINITIALIZED) {
Eric Parisc9180a52007-11-30 13:00:35 -0500744 /* previously mounted with options, but not on this attempt? */
Al Virobd323652018-12-13 15:04:59 -0500745 if ((sbsec->flags & SE_MNTMASK) && !opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500746 goto out_double_mount;
747 rc = 0;
748 goto out;
749 }
750
James Morris089be432008-07-15 18:32:49 +1000751 if (strcmp(sb->s_type->name, "proc") == 0)
Stephen Smalley134509d2015-06-04 16:22:17 -0400752 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
753
Stephen Smalley8e014722015-06-04 16:22:17 -0400754 if (!strcmp(sb->s_type->name, "debugfs") ||
Jeff Vander Stoep6a391182017-06-20 09:35:33 -0700755 !strcmp(sb->s_type->name, "tracefs") ||
Ondrej Mosnacekb7540262019-02-22 15:57:14 +0100756 !strcmp(sb->s_type->name, "pstore"))
757 sbsec->flags |= SE_SBGENFS;
758
759 if (!strcmp(sb->s_type->name, "sysfs") ||
Antonio Murdaca901ef842017-02-09 17:02:42 +0100760 !strcmp(sb->s_type->name, "cgroup") ||
761 !strcmp(sb->s_type->name, "cgroup2"))
Ondrej Mosnacekb7540262019-02-22 15:57:14 +0100762 sbsec->flags |= SE_SBGENFS | SE_SBGENFS_XATTR;
Eric Parisc9180a52007-11-30 13:00:35 -0500763
David Quigleyeb9ae682013-05-22 12:50:37 -0400764 if (!sbsec->behavior) {
765 /*
766 * Determine the labeling behavior to use for this
767 * filesystem type.
768 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500769 rc = security_fs_use(&selinux_state, sb);
David Quigleyeb9ae682013-05-22 12:50:37 -0400770 if (rc) {
peter enderborgc103a912018-06-12 10:09:03 +0200771 pr_warn("%s: security_fs_use(%s) returned %d\n",
David Quigleyeb9ae682013-05-22 12:50:37 -0400772 __func__, sb->s_type->name, rc);
773 goto out;
774 }
Eric Parisc9180a52007-11-30 13:00:35 -0500775 }
Seth Forsheeaad82892016-04-26 14:36:20 -0500776
777 /*
Stephen Smalley01593d32017-01-09 10:07:31 -0500778 * If this is a user namespace mount and the filesystem type is not
779 * explicitly whitelisted, then no contexts are allowed on the command
780 * line and security labels must be ignored.
Seth Forsheeaad82892016-04-26 14:36:20 -0500781 */
Stephen Smalley01593d32017-01-09 10:07:31 -0500782 if (sb->s_user_ns != &init_user_ns &&
783 strcmp(sb->s_type->name, "tmpfs") &&
784 strcmp(sb->s_type->name, "ramfs") &&
785 strcmp(sb->s_type->name, "devpts")) {
Seth Forsheeaad82892016-04-26 14:36:20 -0500786 if (context_sid || fscontext_sid || rootcontext_sid ||
787 defcontext_sid) {
788 rc = -EACCES;
789 goto out;
790 }
791 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
792 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500793 rc = security_transition_sid(&selinux_state,
794 current_sid(),
795 current_sid(),
Seth Forsheeaad82892016-04-26 14:36:20 -0500796 SECCLASS_FILE, NULL,
797 &sbsec->mntpoint_sid);
798 if (rc)
799 goto out;
800 }
801 goto out_set_opts;
802 }
803
Eric Parisc9180a52007-11-30 13:00:35 -0500804 /* sets the context of the superblock for the fs being mounted. */
805 if (fscontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100806 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500807 if (rc)
808 goto out;
809
810 sbsec->sid = fscontext_sid;
811 }
812
813 /*
814 * Switch to using mount point labeling behavior.
815 * sets the label used on all file below the mountpoint, and will set
816 * the superblock context if not already set.
817 */
David Quigleyeb9ae682013-05-22 12:50:37 -0400818 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
819 sbsec->behavior = SECURITY_FS_USE_NATIVE;
820 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
821 }
822
Eric Parisc9180a52007-11-30 13:00:35 -0500823 if (context_sid) {
824 if (!fscontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100825 rc = may_context_mount_sb_relabel(context_sid, sbsec,
826 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500827 if (rc)
828 goto out;
829 sbsec->sid = context_sid;
830 } else {
David Howells275bb412008-11-14 10:39:19 +1100831 rc = may_context_mount_inode_relabel(context_sid, sbsec,
832 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500833 if (rc)
834 goto out;
835 }
836 if (!rootcontext_sid)
837 rootcontext_sid = context_sid;
838
839 sbsec->mntpoint_sid = context_sid;
840 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
841 }
842
843 if (rootcontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100844 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
845 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500846 if (rc)
847 goto out;
848
849 root_isec->sid = rootcontext_sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -0500850 root_isec->initialized = LABEL_INITIALIZED;
Eric Parisc9180a52007-11-30 13:00:35 -0500851 }
852
853 if (defcontext_sid) {
David Quigleyeb9ae682013-05-22 12:50:37 -0400854 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
855 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
Eric Parisc9180a52007-11-30 13:00:35 -0500856 rc = -EINVAL;
peter enderborgc103a912018-06-12 10:09:03 +0200857 pr_warn("SELinux: defcontext option is "
Eric Parisc9180a52007-11-30 13:00:35 -0500858 "invalid for this filesystem type\n");
859 goto out;
860 }
861
862 if (defcontext_sid != sbsec->def_sid) {
863 rc = may_context_mount_inode_relabel(defcontext_sid,
David Howells275bb412008-11-14 10:39:19 +1100864 sbsec, cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500865 if (rc)
866 goto out;
867 }
868
869 sbsec->def_sid = defcontext_sid;
870 }
871
Seth Forsheeaad82892016-04-26 14:36:20 -0500872out_set_opts:
Eric Parisc9180a52007-11-30 13:00:35 -0500873 rc = sb_finish_set_opts(sb);
874out:
Eric Parisbc7e9822006-09-25 23:32:02 -0700875 mutex_unlock(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700876 return rc;
Eric Parisc9180a52007-11-30 13:00:35 -0500877out_double_mount:
878 rc = -EINVAL;
peter enderborgc103a912018-06-12 10:09:03 +0200879 pr_warn("SELinux: mount invalid. Same superblock, different "
Al Virobd323652018-12-13 15:04:59 -0500880 "security settings for (dev %s, type %s)\n", sb->s_id,
881 sb->s_type->name);
Eric Parisc9180a52007-11-30 13:00:35 -0500882 goto out;
883}
884
Jeff Layton094f7b62013-04-01 08:14:24 -0400885static int selinux_cmp_sb_context(const struct super_block *oldsb,
886 const struct super_block *newsb)
887{
888 struct superblock_security_struct *old = oldsb->s_security;
889 struct superblock_security_struct *new = newsb->s_security;
890 char oldflags = old->flags & SE_MNTMASK;
891 char newflags = new->flags & SE_MNTMASK;
892
893 if (oldflags != newflags)
894 goto mismatch;
895 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
896 goto mismatch;
897 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
898 goto mismatch;
899 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
900 goto mismatch;
901 if (oldflags & ROOTCONTEXT_MNT) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500902 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
903 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
Jeff Layton094f7b62013-04-01 08:14:24 -0400904 if (oldroot->sid != newroot->sid)
905 goto mismatch;
906 }
907 return 0;
908mismatch:
peter enderborgc103a912018-06-12 10:09:03 +0200909 pr_warn("SELinux: mount invalid. Same superblock, "
Jeff Layton094f7b62013-04-01 08:14:24 -0400910 "different security settings for (dev %s, "
911 "type %s)\n", newsb->s_id, newsb->s_type->name);
912 return -EBUSY;
913}
914
915static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
Scott Mayhew0b4d3452017-06-05 11:45:04 -0400916 struct super_block *newsb,
917 unsigned long kern_flags,
918 unsigned long *set_kern_flags)
Eric Parisc9180a52007-11-30 13:00:35 -0500919{
Scott Mayhew0b4d3452017-06-05 11:45:04 -0400920 int rc = 0;
Eric Parisc9180a52007-11-30 13:00:35 -0500921 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
922 struct superblock_security_struct *newsbsec = newsb->s_security;
923
924 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
925 int set_context = (oldsbsec->flags & CONTEXT_MNT);
926 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
927
Eric Paris0f5e6422008-04-21 16:24:11 -0400928 /*
929 * if the parent was able to be mounted it clearly had no special lsm
Al Viroe8c26252010-03-23 06:36:54 -0400930 * mount options. thus we can safely deal with this superblock later
Eric Paris0f5e6422008-04-21 16:24:11 -0400931 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500932 if (!selinux_state.initialized)
Jeff Layton094f7b62013-04-01 08:14:24 -0400933 return 0;
Eric Parisc9180a52007-11-30 13:00:35 -0500934
Scott Mayhew0b4d3452017-06-05 11:45:04 -0400935 /*
936 * Specifying internal flags without providing a place to
937 * place the results is not allowed.
938 */
939 if (kern_flags && !set_kern_flags)
940 return -EINVAL;
941
Eric Parisc9180a52007-11-30 13:00:35 -0500942 /* how can we clone if the old one wasn't set up?? */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500943 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
Eric Parisc9180a52007-11-30 13:00:35 -0500944
Jeff Layton094f7b62013-04-01 08:14:24 -0400945 /* if fs is reusing a sb, make sure that the contexts match */
J. Bruce Fields3815a242019-03-05 16:17:58 -0500946 if (newsbsec->flags & SE_SBINITIALIZED) {
947 if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
948 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
Jeff Layton094f7b62013-04-01 08:14:24 -0400949 return selinux_cmp_sb_context(oldsb, newsb);
J. Bruce Fields3815a242019-03-05 16:17:58 -0500950 }
Eric Paris5a552612008-04-09 14:08:35 -0400951
Eric Parisc9180a52007-11-30 13:00:35 -0500952 mutex_lock(&newsbsec->lock);
953
954 newsbsec->flags = oldsbsec->flags;
955
956 newsbsec->sid = oldsbsec->sid;
957 newsbsec->def_sid = oldsbsec->def_sid;
958 newsbsec->behavior = oldsbsec->behavior;
959
Scott Mayhew0b4d3452017-06-05 11:45:04 -0400960 if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
961 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -0500962 rc = security_fs_use(&selinux_state, newsb);
Scott Mayhew0b4d3452017-06-05 11:45:04 -0400963 if (rc)
964 goto out;
965 }
966
967 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
968 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
969 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
970 }
971
Eric Parisc9180a52007-11-30 13:00:35 -0500972 if (set_context) {
973 u32 sid = oldsbsec->mntpoint_sid;
974
975 if (!set_fscontext)
976 newsbsec->sid = sid;
977 if (!set_rootcontext) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500978 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
Eric Parisc9180a52007-11-30 13:00:35 -0500979 newisec->sid = sid;
980 }
981 newsbsec->mntpoint_sid = sid;
982 }
983 if (set_rootcontext) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500984 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
985 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
Eric Parisc9180a52007-11-30 13:00:35 -0500986
987 newisec->sid = oldisec->sid;
988 }
989
990 sb_finish_set_opts(newsb);
Scott Mayhew0b4d3452017-06-05 11:45:04 -0400991out:
Eric Parisc9180a52007-11-30 13:00:35 -0500992 mutex_unlock(&newsbsec->lock);
Scott Mayhew0b4d3452017-06-05 11:45:04 -0400993 return rc;
Eric Parisc9180a52007-11-30 13:00:35 -0500994}
995
Al Viroba641862018-12-14 20:28:15 -0500996static int selinux_add_opt(int token, const char *s, void **mnt_opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500997{
Al Viroba641862018-12-14 20:28:15 -0500998 struct selinux_mnt_opts *opts = *mnt_opts;
Eric Parisc9180a52007-11-30 13:00:35 -0500999
Al Viroda3d76a2018-12-17 10:14:16 -05001000 if (token == Opt_seclabel) /* eaten and completely ignored */
Al Viro169d68efb2018-12-14 22:44:50 -05001001 return 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001002
Al Viroba641862018-12-14 20:28:15 -05001003 if (!opts) {
1004 opts = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
1005 if (!opts)
1006 return -ENOMEM;
1007 *mnt_opts = opts;
1008 }
1009 if (!s)
1010 return -ENOMEM;
1011 switch (token) {
1012 case Opt_context:
1013 if (opts->context || opts->defcontext)
1014 goto Einval;
1015 opts->context = s;
1016 break;
1017 case Opt_fscontext:
1018 if (opts->fscontext)
1019 goto Einval;
1020 opts->fscontext = s;
1021 break;
1022 case Opt_rootcontext:
1023 if (opts->rootcontext)
1024 goto Einval;
1025 opts->rootcontext = s;
1026 break;
1027 case Opt_defcontext:
1028 if (opts->context || opts->defcontext)
1029 goto Einval;
1030 opts->defcontext = s;
1031 break;
1032 }
1033 return 0;
1034Einval:
1035 pr_warn(SEL_MOUNT_FAIL_MSG);
Al Viroba641862018-12-14 20:28:15 -05001036 return -EINVAL;
1037}
Eric Parisc9180a52007-11-30 13:00:35 -05001038
Al Viro757cbe52018-12-14 23:42:21 -05001039static int selinux_add_mnt_opt(const char *option, const char *val, int len,
1040 void **mnt_opts)
Eric Parisc9180a52007-11-30 13:00:35 -05001041{
Al Viro757cbe52018-12-14 23:42:21 -05001042 int token = Opt_error;
1043 int rc, i;
Eric Parisc9180a52007-11-30 13:00:35 -05001044
Al Viro757cbe52018-12-14 23:42:21 -05001045 for (i = 0; i < ARRAY_SIZE(tokens); i++) {
1046 if (strcmp(option, tokens[i].name) == 0) {
1047 token = tokens[i].opt;
Eric Parisc9180a52007-11-30 13:00:35 -05001048 break;
Eric Parisc9180a52007-11-30 13:00:35 -05001049 }
1050 }
1051
Al Viro757cbe52018-12-14 23:42:21 -05001052 if (token == Opt_error)
1053 return -EINVAL;
Eric Parise0007522008-03-05 10:31:54 -05001054
Al Viro757cbe52018-12-14 23:42:21 -05001055 if (token != Opt_seclabel)
1056 val = kmemdup_nul(val, len, GFP_KERNEL);
1057 rc = selinux_add_opt(token, val, mnt_opts);
1058 if (unlikely(rc)) {
1059 kfree(val);
1060 if (*mnt_opts) {
1061 selinux_free_mnt_opts(*mnt_opts);
1062 *mnt_opts = NULL;
1063 }
1064 }
1065 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001066}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001067
Al Viroe3489f82018-12-13 00:24:36 -05001068static int show_sid(struct seq_file *m, u32 sid)
Eric Paris2069f452008-07-04 09:47:13 +10001069{
Al Viroe3489f82018-12-13 00:24:36 -05001070 char *context = NULL;
1071 u32 len;
1072 int rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001073
Al Viroe3489f82018-12-13 00:24:36 -05001074 rc = security_sid_to_context(&selinux_state, sid,
1075 &context, &len);
1076 if (!rc) {
1077 bool has_comma = context && strchr(context, ',');
Linus Torvalds1da177e2005-04-16 15:20:36 -07001078
David Howells442155c2018-11-01 23:07:24 +00001079 seq_putc(m, '=');
Eric Paris2069f452008-07-04 09:47:13 +10001080 if (has_comma)
1081 seq_putc(m, '\"');
Al Viroe3489f82018-12-13 00:24:36 -05001082 seq_escape(m, context, "\"\n\\");
Eric Paris2069f452008-07-04 09:47:13 +10001083 if (has_comma)
1084 seq_putc(m, '\"');
1085 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001086 kfree(context);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001087 return rc;
1088}
Eric Paris2069f452008-07-04 09:47:13 +10001089
1090static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1091{
Al Viroe3489f82018-12-13 00:24:36 -05001092 struct superblock_security_struct *sbsec = sb->s_security;
Eric Paris2069f452008-07-04 09:47:13 +10001093 int rc;
1094
Al Viroe3489f82018-12-13 00:24:36 -05001095 if (!(sbsec->flags & SE_SBINITIALIZED))
1096 return 0;
1097
1098 if (!selinux_state.initialized)
1099 return 0;
1100
1101 if (sbsec->flags & FSCONTEXT_MNT) {
1102 seq_putc(m, ',');
1103 seq_puts(m, FSCONTEXT_STR);
1104 rc = show_sid(m, sbsec->sid);
1105 if (rc)
1106 return rc;
Eric Paris383795c2008-07-29 17:07:26 -04001107 }
Al Viroe3489f82018-12-13 00:24:36 -05001108 if (sbsec->flags & CONTEXT_MNT) {
1109 seq_putc(m, ',');
1110 seq_puts(m, CONTEXT_STR);
1111 rc = show_sid(m, sbsec->mntpoint_sid);
1112 if (rc)
1113 return rc;
1114 }
1115 if (sbsec->flags & DEFCONTEXT_MNT) {
1116 seq_putc(m, ',');
1117 seq_puts(m, DEFCONTEXT_STR);
1118 rc = show_sid(m, sbsec->def_sid);
1119 if (rc)
1120 return rc;
1121 }
1122 if (sbsec->flags & ROOTCONTEXT_MNT) {
1123 struct dentry *root = sbsec->sb->s_root;
1124 struct inode_security_struct *isec = backing_inode_security(root);
1125 seq_putc(m, ',');
1126 seq_puts(m, ROOTCONTEXT_STR);
1127 rc = show_sid(m, isec->sid);
1128 if (rc)
1129 return rc;
1130 }
1131 if (sbsec->flags & SBLABEL_MNT) {
1132 seq_putc(m, ',');
David Howells442155c2018-11-01 23:07:24 +00001133 seq_puts(m, SECLABEL_STR);
Al Viroe3489f82018-12-13 00:24:36 -05001134 }
1135 return 0;
Eric Paris2069f452008-07-04 09:47:13 +10001136}
1137
Linus Torvalds1da177e2005-04-16 15:20:36 -07001138static inline u16 inode_mode_to_security_class(umode_t mode)
1139{
1140 switch (mode & S_IFMT) {
1141 case S_IFSOCK:
1142 return SECCLASS_SOCK_FILE;
1143 case S_IFLNK:
1144 return SECCLASS_LNK_FILE;
1145 case S_IFREG:
1146 return SECCLASS_FILE;
1147 case S_IFBLK:
1148 return SECCLASS_BLK_FILE;
1149 case S_IFDIR:
1150 return SECCLASS_DIR;
1151 case S_IFCHR:
1152 return SECCLASS_CHR_FILE;
1153 case S_IFIFO:
1154 return SECCLASS_FIFO_FILE;
1155
1156 }
1157
1158 return SECCLASS_FILE;
1159}
1160
James Morris13402582005-09-30 14:24:34 -04001161static inline int default_protocol_stream(int protocol)
1162{
1163 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1164}
1165
1166static inline int default_protocol_dgram(int protocol)
1167{
1168 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1169}
1170
Linus Torvalds1da177e2005-04-16 15:20:36 -07001171static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1172{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001173 int extsockclass = selinux_policycap_extsockclass();
Stephen Smalleyda69a532017-01-09 10:07:30 -05001174
Linus Torvalds1da177e2005-04-16 15:20:36 -07001175 switch (family) {
1176 case PF_UNIX:
1177 switch (type) {
1178 case SOCK_STREAM:
1179 case SOCK_SEQPACKET:
1180 return SECCLASS_UNIX_STREAM_SOCKET;
1181 case SOCK_DGRAM:
Luis Ressel2a764b52017-07-25 15:13:41 -04001182 case SOCK_RAW:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001183 return SECCLASS_UNIX_DGRAM_SOCKET;
1184 }
1185 break;
1186 case PF_INET:
1187 case PF_INET6:
1188 switch (type) {
1189 case SOCK_STREAM:
Stephen Smalleyda69a532017-01-09 10:07:30 -05001190 case SOCK_SEQPACKET:
James Morris13402582005-09-30 14:24:34 -04001191 if (default_protocol_stream(protocol))
1192 return SECCLASS_TCP_SOCKET;
Stephen Smalleyda69a532017-01-09 10:07:30 -05001193 else if (extsockclass && protocol == IPPROTO_SCTP)
1194 return SECCLASS_SCTP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001195 else
1196 return SECCLASS_RAWIP_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001197 case SOCK_DGRAM:
James Morris13402582005-09-30 14:24:34 -04001198 if (default_protocol_dgram(protocol))
1199 return SECCLASS_UDP_SOCKET;
Stephen Smalleyef379792017-01-09 10:07:31 -05001200 else if (extsockclass && (protocol == IPPROTO_ICMP ||
1201 protocol == IPPROTO_ICMPV6))
Stephen Smalleyda69a532017-01-09 10:07:30 -05001202 return SECCLASS_ICMP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001203 else
1204 return SECCLASS_RAWIP_SOCKET;
James Morris2ee92d42006-11-13 16:09:01 -08001205 case SOCK_DCCP:
1206 return SECCLASS_DCCP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001207 default:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001208 return SECCLASS_RAWIP_SOCKET;
1209 }
1210 break;
1211 case PF_NETLINK:
1212 switch (protocol) {
1213 case NETLINK_ROUTE:
1214 return SECCLASS_NETLINK_ROUTE_SOCKET;
Pavel Emelyanov7f1fb602011-12-06 07:56:43 +00001215 case NETLINK_SOCK_DIAG:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001216 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1217 case NETLINK_NFLOG:
1218 return SECCLASS_NETLINK_NFLOG_SOCKET;
1219 case NETLINK_XFRM:
1220 return SECCLASS_NETLINK_XFRM_SOCKET;
1221 case NETLINK_SELINUX:
1222 return SECCLASS_NETLINK_SELINUX_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001223 case NETLINK_ISCSI:
1224 return SECCLASS_NETLINK_ISCSI_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001225 case NETLINK_AUDIT:
1226 return SECCLASS_NETLINK_AUDIT_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001227 case NETLINK_FIB_LOOKUP:
1228 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1229 case NETLINK_CONNECTOR:
1230 return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1231 case NETLINK_NETFILTER:
1232 return SECCLASS_NETLINK_NETFILTER_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001233 case NETLINK_DNRTMSG:
1234 return SECCLASS_NETLINK_DNRT_SOCKET;
James Morris0c9b7942005-04-16 15:24:13 -07001235 case NETLINK_KOBJECT_UEVENT:
1236 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001237 case NETLINK_GENERIC:
1238 return SECCLASS_NETLINK_GENERIC_SOCKET;
1239 case NETLINK_SCSITRANSPORT:
1240 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1241 case NETLINK_RDMA:
1242 return SECCLASS_NETLINK_RDMA_SOCKET;
1243 case NETLINK_CRYPTO:
1244 return SECCLASS_NETLINK_CRYPTO_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001245 default:
1246 return SECCLASS_NETLINK_SOCKET;
1247 }
1248 case PF_PACKET:
1249 return SECCLASS_PACKET_SOCKET;
1250 case PF_KEY:
1251 return SECCLASS_KEY_SOCKET;
Christopher J. PeBenito3e3ff152006-06-09 00:25:03 -07001252 case PF_APPLETALK:
1253 return SECCLASS_APPLETALK_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001254 }
1255
Stephen Smalleyda69a532017-01-09 10:07:30 -05001256 if (extsockclass) {
1257 switch (family) {
1258 case PF_AX25:
1259 return SECCLASS_AX25_SOCKET;
1260 case PF_IPX:
1261 return SECCLASS_IPX_SOCKET;
1262 case PF_NETROM:
1263 return SECCLASS_NETROM_SOCKET;
Stephen Smalleyda69a532017-01-09 10:07:30 -05001264 case PF_ATMPVC:
1265 return SECCLASS_ATMPVC_SOCKET;
1266 case PF_X25:
1267 return SECCLASS_X25_SOCKET;
1268 case PF_ROSE:
1269 return SECCLASS_ROSE_SOCKET;
1270 case PF_DECnet:
1271 return SECCLASS_DECNET_SOCKET;
1272 case PF_ATMSVC:
1273 return SECCLASS_ATMSVC_SOCKET;
1274 case PF_RDS:
1275 return SECCLASS_RDS_SOCKET;
1276 case PF_IRDA:
1277 return SECCLASS_IRDA_SOCKET;
1278 case PF_PPPOX:
1279 return SECCLASS_PPPOX_SOCKET;
1280 case PF_LLC:
1281 return SECCLASS_LLC_SOCKET;
Stephen Smalleyda69a532017-01-09 10:07:30 -05001282 case PF_CAN:
1283 return SECCLASS_CAN_SOCKET;
1284 case PF_TIPC:
1285 return SECCLASS_TIPC_SOCKET;
1286 case PF_BLUETOOTH:
1287 return SECCLASS_BLUETOOTH_SOCKET;
1288 case PF_IUCV:
1289 return SECCLASS_IUCV_SOCKET;
1290 case PF_RXRPC:
1291 return SECCLASS_RXRPC_SOCKET;
1292 case PF_ISDN:
1293 return SECCLASS_ISDN_SOCKET;
1294 case PF_PHONET:
1295 return SECCLASS_PHONET_SOCKET;
1296 case PF_IEEE802154:
1297 return SECCLASS_IEEE802154_SOCKET;
1298 case PF_CAIF:
1299 return SECCLASS_CAIF_SOCKET;
1300 case PF_ALG:
1301 return SECCLASS_ALG_SOCKET;
1302 case PF_NFC:
1303 return SECCLASS_NFC_SOCKET;
1304 case PF_VSOCK:
1305 return SECCLASS_VSOCK_SOCKET;
1306 case PF_KCM:
1307 return SECCLASS_KCM_SOCKET;
1308 case PF_QIPCRTR:
1309 return SECCLASS_QIPCRTR_SOCKET;
Linus Torvalds3051bf32017-02-22 10:15:09 -08001310 case PF_SMC:
1311 return SECCLASS_SMC_SOCKET;
Björn Töpel68e8b842018-05-02 13:01:22 +02001312 case PF_XDP:
1313 return SECCLASS_XDP_SOCKET;
1314#if PF_MAX > 45
Stephen Smalleyda69a532017-01-09 10:07:30 -05001315#error New address family defined, please update this function.
1316#endif
1317 }
1318 }
1319
Linus Torvalds1da177e2005-04-16 15:20:36 -07001320 return SECCLASS_SOCKET;
1321}
1322
Stephen Smalley134509d2015-06-04 16:22:17 -04001323static int selinux_genfs_get_sid(struct dentry *dentry,
1324 u16 tclass,
1325 u16 flags,
1326 u32 *sid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001327{
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001328 int rc;
Al Virofc640052016-04-10 01:33:30 -04001329 struct super_block *sb = dentry->d_sb;
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001330 char *buffer, *path;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001331
Eric Paris828dfe12008-04-17 13:17:49 -04001332 buffer = (char *)__get_free_page(GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001333 if (!buffer)
1334 return -ENOMEM;
1335
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001336 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1337 if (IS_ERR(path))
1338 rc = PTR_ERR(path);
1339 else {
Stephen Smalley134509d2015-06-04 16:22:17 -04001340 if (flags & SE_SBPROC) {
1341 /* each process gets a /proc/PID/ entry. Strip off the
1342 * PID part to get a valid selinux labeling.
1343 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1344 while (path[1] >= '0' && path[1] <= '9') {
1345 path[1] = '/';
1346 path++;
1347 }
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001348 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001349 rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1350 path, tclass, sid);
Stephen Smalley7bb185e2018-09-04 16:51:36 -04001351 if (rc == -ENOENT) {
1352 /* No match in policy, mark as unlabeled. */
1353 *sid = SECINITSID_UNLABELED;
1354 rc = 0;
1355 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001356 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001357 free_page((unsigned long)buffer);
1358 return rc;
1359}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001360
Ondrej Mosnacekb7540262019-02-22 15:57:14 +01001361static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry,
1362 u32 def_sid, u32 *sid)
1363{
1364#define INITCONTEXTLEN 255
1365 char *context;
1366 unsigned int len;
1367 int rc;
1368
1369 len = INITCONTEXTLEN;
1370 context = kmalloc(len + 1, GFP_NOFS);
1371 if (!context)
1372 return -ENOMEM;
1373
1374 context[len] = '\0';
1375 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1376 if (rc == -ERANGE) {
1377 kfree(context);
1378
1379 /* Need a larger buffer. Query for the right size. */
1380 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1381 if (rc < 0)
1382 return rc;
1383
1384 len = rc;
1385 context = kmalloc(len + 1, GFP_NOFS);
1386 if (!context)
1387 return -ENOMEM;
1388
1389 context[len] = '\0';
1390 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX,
1391 context, len);
1392 }
1393 if (rc < 0) {
1394 kfree(context);
1395 if (rc != -ENODATA) {
1396 pr_warn("SELinux: %s: getxattr returned %d for dev=%s ino=%ld\n",
1397 __func__, -rc, inode->i_sb->s_id, inode->i_ino);
1398 return rc;
1399 }
1400 *sid = def_sid;
1401 return 0;
1402 }
1403
1404 rc = security_context_to_sid_default(&selinux_state, context, rc, sid,
1405 def_sid, GFP_NOFS);
1406 if (rc) {
1407 char *dev = inode->i_sb->s_id;
1408 unsigned long ino = inode->i_ino;
1409
1410 if (rc == -EINVAL) {
1411 pr_notice_ratelimited("SELinux: inode=%lu on dev=%s was found to have an invalid context=%s. This indicates you may need to relabel the inode or the filesystem in question.\n",
1412 ino, dev, context);
1413 } else {
1414 pr_warn("SELinux: %s: context_to_sid(%s) returned %d for dev=%s ino=%ld\n",
1415 __func__, context, -rc, dev, ino);
1416 }
1417 }
1418 kfree(context);
1419 return 0;
1420}
1421
Linus Torvalds1da177e2005-04-16 15:20:36 -07001422/* The inode's security attributes must be initialized before first use. */
1423static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1424{
1425 struct superblock_security_struct *sbsec = NULL;
Casey Schaufler80788c22018-09-21 17:19:11 -07001426 struct inode_security_struct *isec = selinux_inode(inode);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001427 u32 task_sid, sid = 0;
1428 u16 sclass;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001429 struct dentry *dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001430 int rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001431
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05001432 if (isec->initialized == LABEL_INITIALIZED)
Andreas Gruenbacher13457d02016-11-10 22:18:29 +01001433 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001434
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001435 spin_lock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05001436 if (isec->initialized == LABEL_INITIALIZED)
Eric Paris23970742006-09-25 23:32:01 -07001437 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001438
Andreas Gruenbacher13457d02016-11-10 22:18:29 +01001439 if (isec->sclass == SECCLASS_FILE)
1440 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1441
Linus Torvalds1da177e2005-04-16 15:20:36 -07001442 sbsec = inode->i_sb->s_security;
David P. Quigley0d90a7e2009-01-16 09:22:02 -05001443 if (!(sbsec->flags & SE_SBINITIALIZED)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001444 /* Defer initialization until selinux_complete_init,
1445 after the initial policy is loaded and the security
1446 server is ready to handle calls. */
1447 spin_lock(&sbsec->isec_lock);
1448 if (list_empty(&isec->list))
1449 list_add(&isec->list, &sbsec->isec_head);
1450 spin_unlock(&sbsec->isec_lock);
Eric Paris23970742006-09-25 23:32:01 -07001451 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001452 }
1453
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001454 sclass = isec->sclass;
1455 task_sid = isec->task_sid;
1456 sid = isec->sid;
1457 isec->initialized = LABEL_PENDING;
1458 spin_unlock(&isec->lock);
1459
Linus Torvalds1da177e2005-04-16 15:20:36 -07001460 switch (sbsec->behavior) {
David Quigleyeb9ae682013-05-22 12:50:37 -04001461 case SECURITY_FS_USE_NATIVE:
1462 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001463 case SECURITY_FS_USE_XATTR:
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001464 if (!(inode->i_opflags & IOP_XATTR)) {
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001465 sid = sbsec->def_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001466 break;
1467 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001468 /* Need a dentry, since the xattr API requires one.
1469 Life would be simpler if we could just pass the inode. */
1470 if (opt_dentry) {
1471 /* Called from d_instantiate or d_splice_alias. */
1472 dentry = dget(opt_dentry);
1473 } else {
Al Virob1271252018-04-25 10:28:38 -04001474 /*
1475 * Called from selinux_complete_init, try to find a dentry.
1476 * Some filesystems really want a connected one, so try
1477 * that first. We could split SECURITY_FS_USE_XATTR in
1478 * two, depending upon that...
1479 */
Linus Torvalds1da177e2005-04-16 15:20:36 -07001480 dentry = d_find_alias(inode);
Al Virob1271252018-04-25 10:28:38 -04001481 if (!dentry)
1482 dentry = d_find_any_alias(inode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001483 }
1484 if (!dentry) {
Eric Parisdf7f54c2009-03-09 14:35:58 -04001485 /*
1486 * this is can be hit on boot when a file is accessed
1487 * before the policy is loaded. When we load policy we
1488 * may find inodes that have no dentry on the
1489 * sbsec->isec_head list. No reason to complain as these
1490 * will get fixed up the next time we go through
1491 * inode_doinit with a dentry, before these inodes could
1492 * be used again by userspace.
1493 */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001494 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001495 }
1496
Ondrej Mosnacekb7540262019-02-22 15:57:14 +01001497 rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
1498 &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001499 dput(dentry);
Ondrej Mosnacekb7540262019-02-22 15:57:14 +01001500 if (rc)
1501 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001502 break;
1503 case SECURITY_FS_USE_TASK:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001504 sid = task_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001505 break;
1506 case SECURITY_FS_USE_TRANS:
1507 /* Default to the fs SID. */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001508 sid = sbsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001509
1510 /* Try to obtain a transition SID. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001511 rc = security_transition_sid(&selinux_state, task_sid, sid,
1512 sclass, NULL, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001513 if (rc)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001514 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001515 break;
Eric Parisc312feb2006-07-10 04:43:53 -07001516 case SECURITY_FS_USE_MNTPOINT:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001517 sid = sbsec->mntpoint_sid;
Eric Parisc312feb2006-07-10 04:43:53 -07001518 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001519 default:
Eric Parisc312feb2006-07-10 04:43:53 -07001520 /* Default to the fs superblock SID. */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001521 sid = sbsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001522
Stephen Smalley134509d2015-06-04 16:22:17 -04001523 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
Paul Mooref64410e2014-03-19 16:46:18 -04001524 /* We must have a dentry to determine the label on
1525 * procfs inodes */
Al Virob1271252018-04-25 10:28:38 -04001526 if (opt_dentry) {
Paul Mooref64410e2014-03-19 16:46:18 -04001527 /* Called from d_instantiate or
1528 * d_splice_alias. */
1529 dentry = dget(opt_dentry);
Al Virob1271252018-04-25 10:28:38 -04001530 } else {
Paul Mooref64410e2014-03-19 16:46:18 -04001531 /* Called from selinux_complete_init, try to
Al Virob1271252018-04-25 10:28:38 -04001532 * find a dentry. Some filesystems really want
1533 * a connected one, so try that first.
1534 */
Paul Mooref64410e2014-03-19 16:46:18 -04001535 dentry = d_find_alias(inode);
Al Virob1271252018-04-25 10:28:38 -04001536 if (!dentry)
1537 dentry = d_find_any_alias(inode);
1538 }
Paul Mooref64410e2014-03-19 16:46:18 -04001539 /*
1540 * This can be hit on boot when a file is accessed
1541 * before the policy is loaded. When we load policy we
1542 * may find inodes that have no dentry on the
1543 * sbsec->isec_head list. No reason to complain as
1544 * these will get fixed up the next time we go through
1545 * inode_doinit() with a dentry, before these inodes
1546 * could be used again by userspace.
1547 */
1548 if (!dentry)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001549 goto out;
1550 rc = selinux_genfs_get_sid(dentry, sclass,
Stephen Smalley134509d2015-06-04 16:22:17 -04001551 sbsec->flags, &sid);
Ondrej Mosnacekb7540262019-02-22 15:57:14 +01001552 if (rc) {
1553 dput(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001554 goto out;
Ondrej Mosnacekb7540262019-02-22 15:57:14 +01001555 }
1556
1557 if ((sbsec->flags & SE_SBGENFS_XATTR) &&
1558 (inode->i_opflags & IOP_XATTR)) {
1559 rc = inode_doinit_use_xattr(inode, dentry,
1560 sid, &sid);
1561 if (rc) {
1562 dput(dentry);
1563 goto out;
1564 }
1565 }
1566 dput(dentry);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001567 }
1568 break;
1569 }
1570
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001571out:
1572 spin_lock(&isec->lock);
1573 if (isec->initialized == LABEL_PENDING) {
1574 if (!sid || rc) {
1575 isec->initialized = LABEL_INVALID;
1576 goto out_unlock;
1577 }
1578
1579 isec->initialized = LABEL_INITIALIZED;
1580 isec->sid = sid;
1581 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001582
Eric Paris23970742006-09-25 23:32:01 -07001583out_unlock:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001584 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001585 return rc;
1586}
1587
1588/* Convert a Linux signal to an access vector. */
1589static inline u32 signal_to_av(int sig)
1590{
1591 u32 perm = 0;
1592
1593 switch (sig) {
1594 case SIGCHLD:
1595 /* Commonly granted from child to parent. */
1596 perm = PROCESS__SIGCHLD;
1597 break;
1598 case SIGKILL:
1599 /* Cannot be caught or ignored */
1600 perm = PROCESS__SIGKILL;
1601 break;
1602 case SIGSTOP:
1603 /* Cannot be caught or ignored */
1604 perm = PROCESS__SIGSTOP;
1605 break;
1606 default:
1607 /* All other signals. */
1608 perm = PROCESS__SIGNAL;
1609 break;
1610 }
1611
1612 return perm;
1613}
1614
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001615#if CAP_LAST_CAP > 63
1616#error Fix SELinux to handle capabilities > 63.
1617#endif
1618
Linus Torvalds1da177e2005-04-16 15:20:36 -07001619/* Check whether a task is allowed to use a capability. */
Eric Paris6a9de492012-01-03 12:25:14 -05001620static int cred_has_capability(const struct cred *cred,
Micah Mortonc1a85a02019-01-07 16:10:53 -08001621 int cap, unsigned int opts, bool initns)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001622{
Thomas Liu2bf49692009-07-14 12:14:09 -04001623 struct common_audit_data ad;
Eric Paris06112162008-11-11 22:02:50 +11001624 struct av_decision avd;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001625 u16 sclass;
David Howells3699c532009-01-06 22:27:01 +00001626 u32 sid = cred_sid(cred);
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001627 u32 av = CAP_TO_MASK(cap);
Eric Paris06112162008-11-11 22:02:50 +11001628 int rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001629
Eric Paris50c205f2012-04-04 15:01:43 -04001630 ad.type = LSM_AUDIT_DATA_CAP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001631 ad.u.cap = cap;
1632
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001633 switch (CAP_TO_INDEX(cap)) {
1634 case 0:
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001635 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001636 break;
1637 case 1:
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001638 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001639 break;
1640 default:
peter enderborgc103a912018-06-12 10:09:03 +02001641 pr_err("SELinux: out of range capability %d\n", cap);
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001642 BUG();
Eric Parisa35c6c832011-04-20 10:21:28 -04001643 return -EINVAL;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001644 }
Eric Paris06112162008-11-11 22:02:50 +11001645
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001646 rc = avc_has_perm_noaudit(&selinux_state,
1647 sid, sid, sclass, av, 0, &avd);
Micah Mortonc1a85a02019-01-07 16:10:53 -08001648 if (!(opts & CAP_OPT_NOAUDIT)) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001649 int rc2 = avc_audit(&selinux_state,
1650 sid, sid, sclass, av, &avd, rc, &ad, 0);
Eric Paris9ade0cf2011-04-25 16:26:29 -04001651 if (rc2)
1652 return rc2;
1653 }
Eric Paris06112162008-11-11 22:02:50 +11001654 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001655}
1656
Linus Torvalds1da177e2005-04-16 15:20:36 -07001657/* Check whether a task has a particular permission to an inode.
1658 The 'adp' parameter is optional and allows other audit
1659 data to be passed (e.g. the dentry). */
David Howells88e67f32008-11-14 10:39:21 +11001660static int inode_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001661 struct inode *inode,
1662 u32 perms,
Linus Torvalds19e49832013-10-04 12:54:11 -07001663 struct common_audit_data *adp)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001664{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001665 struct inode_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +11001666 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001667
David Howellse0e81732009-09-02 09:13:40 +01001668 validate_creds(cred);
1669
Eric Paris828dfe12008-04-17 13:17:49 -04001670 if (unlikely(IS_PRIVATE(inode)))
Stephen Smalleybbaca6c2007-02-14 00:34:16 -08001671 return 0;
1672
David Howells88e67f32008-11-14 10:39:21 +11001673 sid = cred_sid(cred);
Casey Schaufler80788c22018-09-21 17:19:11 -07001674 isec = selinux_inode(inode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001675
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001676 return avc_has_perm(&selinux_state,
1677 sid, isec->sid, isec->sclass, perms, adp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001678}
1679
1680/* Same as inode_has_perm, but pass explicit audit data containing
1681 the dentry to help the auditing code to more easily generate the
1682 pathname if needed. */
David Howells88e67f32008-11-14 10:39:21 +11001683static inline int dentry_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001684 struct dentry *dentry,
1685 u32 av)
1686{
David Howellsc6f493d2015-03-17 22:26:22 +00001687 struct inode *inode = d_backing_inode(dentry);
Thomas Liu2bf49692009-07-14 12:14:09 -04001688 struct common_audit_data ad;
David Howells88e67f32008-11-14 10:39:21 +11001689
Eric Paris50c205f2012-04-04 15:01:43 -04001690 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Paris2875fa02011-04-28 16:04:24 -04001691 ad.u.dentry = dentry;
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05001692 __inode_security_revalidate(inode, dentry, true);
Linus Torvalds19e49832013-10-04 12:54:11 -07001693 return inode_has_perm(cred, inode, av, &ad);
Eric Paris2875fa02011-04-28 16:04:24 -04001694}
1695
1696/* Same as inode_has_perm, but pass explicit audit data containing
1697 the path to help the auditing code to more easily generate the
1698 pathname if needed. */
1699static inline int path_has_perm(const struct cred *cred,
Al Viro3f7036a2015-03-08 19:28:30 -04001700 const struct path *path,
Eric Paris2875fa02011-04-28 16:04:24 -04001701 u32 av)
1702{
David Howellsc6f493d2015-03-17 22:26:22 +00001703 struct inode *inode = d_backing_inode(path->dentry);
Eric Paris2875fa02011-04-28 16:04:24 -04001704 struct common_audit_data ad;
1705
Eric Paris50c205f2012-04-04 15:01:43 -04001706 ad.type = LSM_AUDIT_DATA_PATH;
Eric Paris2875fa02011-04-28 16:04:24 -04001707 ad.u.path = *path;
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05001708 __inode_security_revalidate(inode, path->dentry, true);
Linus Torvalds19e49832013-10-04 12:54:11 -07001709 return inode_has_perm(cred, inode, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001710}
1711
David Howells13f8e982013-06-13 23:37:55 +01001712/* Same as path_has_perm, but uses the inode from the file struct. */
1713static inline int file_path_has_perm(const struct cred *cred,
1714 struct file *file,
1715 u32 av)
1716{
1717 struct common_audit_data ad;
1718
Vivek Goyal43af5de2016-09-09 11:37:49 -04001719 ad.type = LSM_AUDIT_DATA_FILE;
1720 ad.u.file = file;
Linus Torvalds19e49832013-10-04 12:54:11 -07001721 return inode_has_perm(cred, file_inode(file), av, &ad);
David Howells13f8e982013-06-13 23:37:55 +01001722}
1723
Chenbo Fengf66e4482017-10-18 13:00:26 -07001724#ifdef CONFIG_BPF_SYSCALL
1725static int bpf_fd_pass(struct file *file, u32 sid);
1726#endif
1727
Linus Torvalds1da177e2005-04-16 15:20:36 -07001728/* Check whether a task can use an open file descriptor to
1729 access an inode in a given way. Check access to the
1730 descriptor itself, and then use dentry_has_perm to
1731 check a particular permission to the file.
1732 Access to the descriptor is implicitly granted if it
1733 has the same SID as the process. If av is zero, then
1734 access to the file is not checked, e.g. for cases
1735 where only the descriptor is affected like seek. */
David Howells88e67f32008-11-14 10:39:21 +11001736static int file_has_perm(const struct cred *cred,
1737 struct file *file,
1738 u32 av)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001739{
Casey Schauflerbb6c6b02018-09-21 17:22:32 -07001740 struct file_security_struct *fsec = selinux_file(file);
Al Viro496ad9a2013-01-23 17:07:38 -05001741 struct inode *inode = file_inode(file);
Thomas Liu2bf49692009-07-14 12:14:09 -04001742 struct common_audit_data ad;
David Howells88e67f32008-11-14 10:39:21 +11001743 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001744 int rc;
1745
Vivek Goyal43af5de2016-09-09 11:37:49 -04001746 ad.type = LSM_AUDIT_DATA_FILE;
1747 ad.u.file = file;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001748
David Howells275bb412008-11-14 10:39:19 +11001749 if (sid != fsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001750 rc = avc_has_perm(&selinux_state,
1751 sid, fsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001752 SECCLASS_FD,
1753 FD__USE,
1754 &ad);
1755 if (rc)
David Howells88e67f32008-11-14 10:39:21 +11001756 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001757 }
1758
Chenbo Fengf66e4482017-10-18 13:00:26 -07001759#ifdef CONFIG_BPF_SYSCALL
1760 rc = bpf_fd_pass(file, cred_sid(cred));
1761 if (rc)
1762 return rc;
1763#endif
1764
Linus Torvalds1da177e2005-04-16 15:20:36 -07001765 /* av is zero if only checking access to the descriptor. */
David Howells88e67f32008-11-14 10:39:21 +11001766 rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001767 if (av)
Linus Torvalds19e49832013-10-04 12:54:11 -07001768 rc = inode_has_perm(cred, inode, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001769
David Howells88e67f32008-11-14 10:39:21 +11001770out:
1771 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001772}
1773
David Howellsc3c188b2015-07-10 17:19:58 -04001774/*
1775 * Determine the label for an inode that might be unioned.
1776 */
Vivek Goyalc957f6d2016-07-13 10:44:51 -04001777static int
1778selinux_determine_inode_label(const struct task_security_struct *tsec,
1779 struct inode *dir,
1780 const struct qstr *name, u16 tclass,
1781 u32 *_new_isid)
David Howellsc3c188b2015-07-10 17:19:58 -04001782{
1783 const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
David Howellsc3c188b2015-07-10 17:19:58 -04001784
1785 if ((sbsec->flags & SE_SBINITIALIZED) &&
1786 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1787 *_new_isid = sbsec->mntpoint_sid;
1788 } else if ((sbsec->flags & SBLABEL_MNT) &&
1789 tsec->create_sid) {
1790 *_new_isid = tsec->create_sid;
1791 } else {
Paul Moore20cdef82016-04-04 14:14:42 -04001792 const struct inode_security_struct *dsec = inode_security(dir);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05001793 return security_transition_sid(&selinux_state, tsec->sid,
1794 dsec->sid, tclass,
David Howellsc3c188b2015-07-10 17:19:58 -04001795 name, _new_isid);
1796 }
1797
1798 return 0;
1799}
1800
Linus Torvalds1da177e2005-04-16 15:20:36 -07001801/* Check whether a task can create a file. */
1802static int may_create(struct inode *dir,
1803 struct dentry *dentry,
1804 u16 tclass)
1805{
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07001806 const struct task_security_struct *tsec = selinux_cred(current_cred());
Linus Torvalds1da177e2005-04-16 15:20:36 -07001807 struct inode_security_struct *dsec;
1808 struct superblock_security_struct *sbsec;
David Howells275bb412008-11-14 10:39:19 +11001809 u32 sid, newsid;
Thomas Liu2bf49692009-07-14 12:14:09 -04001810 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001811 int rc;
1812
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001813 dsec = inode_security(dir);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001814 sbsec = dir->i_sb->s_security;
1815
David Howells275bb412008-11-14 10:39:19 +11001816 sid = tsec->sid;
David Howells275bb412008-11-14 10:39:19 +11001817
Eric Paris50c205f2012-04-04 15:01:43 -04001818 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04001819 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001820
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001821 rc = avc_has_perm(&selinux_state,
1822 sid, dsec->sid, SECCLASS_DIR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001823 DIR__ADD_NAME | DIR__SEARCH,
1824 &ad);
1825 if (rc)
1826 return rc;
1827
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07001828 rc = selinux_determine_inode_label(selinux_cred(current_cred()), dir,
Vivek Goyalc957f6d2016-07-13 10:44:51 -04001829 &dentry->d_name, tclass, &newsid);
David Howellsc3c188b2015-07-10 17:19:58 -04001830 if (rc)
1831 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001832
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001833 rc = avc_has_perm(&selinux_state,
1834 sid, newsid, tclass, FILE__CREATE, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001835 if (rc)
1836 return rc;
1837
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001838 return avc_has_perm(&selinux_state,
1839 newsid, sbsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001840 SECCLASS_FILESYSTEM,
1841 FILESYSTEM__ASSOCIATE, &ad);
1842}
1843
Eric Paris828dfe12008-04-17 13:17:49 -04001844#define MAY_LINK 0
1845#define MAY_UNLINK 1
1846#define MAY_RMDIR 2
Linus Torvalds1da177e2005-04-16 15:20:36 -07001847
1848/* Check whether a task can link, unlink, or rmdir a file/directory. */
1849static int may_link(struct inode *dir,
1850 struct dentry *dentry,
1851 int kind)
1852
1853{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001854 struct inode_security_struct *dsec, *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04001855 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11001856 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001857 u32 av;
1858 int rc;
1859
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001860 dsec = inode_security(dir);
1861 isec = backing_inode_security(dentry);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001862
Eric Paris50c205f2012-04-04 15:01:43 -04001863 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04001864 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001865
1866 av = DIR__SEARCH;
1867 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001868 rc = avc_has_perm(&selinux_state,
1869 sid, dsec->sid, SECCLASS_DIR, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001870 if (rc)
1871 return rc;
1872
1873 switch (kind) {
1874 case MAY_LINK:
1875 av = FILE__LINK;
1876 break;
1877 case MAY_UNLINK:
1878 av = FILE__UNLINK;
1879 break;
1880 case MAY_RMDIR:
1881 av = DIR__RMDIR;
1882 break;
1883 default:
peter enderborgc103a912018-06-12 10:09:03 +02001884 pr_warn("SELinux: %s: unrecognized kind %d\n",
Eric Paris744ba352008-04-17 11:52:44 -04001885 __func__, kind);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001886 return 0;
1887 }
1888
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001889 rc = avc_has_perm(&selinux_state,
1890 sid, isec->sid, isec->sclass, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001891 return rc;
1892}
1893
1894static inline int may_rename(struct inode *old_dir,
1895 struct dentry *old_dentry,
1896 struct inode *new_dir,
1897 struct dentry *new_dentry)
1898{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001899 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04001900 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11001901 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001902 u32 av;
1903 int old_is_dir, new_is_dir;
1904 int rc;
1905
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001906 old_dsec = inode_security(old_dir);
1907 old_isec = backing_inode_security(old_dentry);
David Howellse36cb0b2015-01-29 12:02:35 +00001908 old_is_dir = d_is_dir(old_dentry);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001909 new_dsec = inode_security(new_dir);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001910
Eric Paris50c205f2012-04-04 15:01:43 -04001911 ad.type = LSM_AUDIT_DATA_DENTRY;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001912
Eric Parisa2694342011-04-25 13:10:27 -04001913 ad.u.dentry = old_dentry;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001914 rc = avc_has_perm(&selinux_state,
1915 sid, old_dsec->sid, SECCLASS_DIR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001916 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1917 if (rc)
1918 return rc;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001919 rc = avc_has_perm(&selinux_state,
1920 sid, old_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001921 old_isec->sclass, FILE__RENAME, &ad);
1922 if (rc)
1923 return rc;
1924 if (old_is_dir && new_dir != old_dir) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001925 rc = avc_has_perm(&selinux_state,
1926 sid, old_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001927 old_isec->sclass, DIR__REPARENT, &ad);
1928 if (rc)
1929 return rc;
1930 }
1931
Eric Parisa2694342011-04-25 13:10:27 -04001932 ad.u.dentry = new_dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001933 av = DIR__ADD_NAME | DIR__SEARCH;
David Howells2c616d42015-01-29 12:02:33 +00001934 if (d_is_positive(new_dentry))
Linus Torvalds1da177e2005-04-16 15:20:36 -07001935 av |= DIR__REMOVE_NAME;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001936 rc = avc_has_perm(&selinux_state,
1937 sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001938 if (rc)
1939 return rc;
David Howells2c616d42015-01-29 12:02:33 +00001940 if (d_is_positive(new_dentry)) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001941 new_isec = backing_inode_security(new_dentry);
David Howellse36cb0b2015-01-29 12:02:35 +00001942 new_is_dir = d_is_dir(new_dentry);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001943 rc = avc_has_perm(&selinux_state,
1944 sid, new_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001945 new_isec->sclass,
1946 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1947 if (rc)
1948 return rc;
1949 }
1950
1951 return 0;
1952}
1953
1954/* Check whether a task can perform a filesystem operation. */
David Howells88e67f32008-11-14 10:39:21 +11001955static int superblock_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001956 struct super_block *sb,
1957 u32 perms,
Thomas Liu2bf49692009-07-14 12:14:09 -04001958 struct common_audit_data *ad)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001959{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001960 struct superblock_security_struct *sbsec;
David Howells88e67f32008-11-14 10:39:21 +11001961 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001962
Linus Torvalds1da177e2005-04-16 15:20:36 -07001963 sbsec = sb->s_security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05001964 return avc_has_perm(&selinux_state,
1965 sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001966}
1967
1968/* Convert a Linux mode and permission mask to an access vector. */
1969static inline u32 file_mask_to_av(int mode, int mask)
1970{
1971 u32 av = 0;
1972
Al Virodba19c62011-07-25 20:49:29 -04001973 if (!S_ISDIR(mode)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001974 if (mask & MAY_EXEC)
1975 av |= FILE__EXECUTE;
1976 if (mask & MAY_READ)
1977 av |= FILE__READ;
1978
1979 if (mask & MAY_APPEND)
1980 av |= FILE__APPEND;
1981 else if (mask & MAY_WRITE)
1982 av |= FILE__WRITE;
1983
1984 } else {
1985 if (mask & MAY_EXEC)
1986 av |= DIR__SEARCH;
1987 if (mask & MAY_WRITE)
1988 av |= DIR__WRITE;
1989 if (mask & MAY_READ)
1990 av |= DIR__READ;
1991 }
1992
1993 return av;
1994}
1995
1996/* Convert a Linux file to an access vector. */
1997static inline u32 file_to_av(struct file *file)
1998{
1999 u32 av = 0;
2000
2001 if (file->f_mode & FMODE_READ)
2002 av |= FILE__READ;
2003 if (file->f_mode & FMODE_WRITE) {
2004 if (file->f_flags & O_APPEND)
2005 av |= FILE__APPEND;
2006 else
2007 av |= FILE__WRITE;
2008 }
Stephen Smalley0794c662008-03-17 08:55:18 -04002009 if (!av) {
2010 /*
2011 * Special file opened with flags 3 for ioctl-only use.
2012 */
2013 av = FILE__IOCTL;
2014 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002015
2016 return av;
2017}
2018
Eric Paris8b6a5a32008-10-29 17:06:46 -04002019/*
2020 * Convert a file to an access vector and include the correct open
2021 * open permission.
2022 */
2023static inline u32 open_file_to_av(struct file *file)
2024{
2025 u32 av = file_to_av(file);
Stephen Smalleyccb54472017-05-12 12:41:24 -04002026 struct inode *inode = file_inode(file);
Eric Paris8b6a5a32008-10-29 17:06:46 -04002027
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002028 if (selinux_policycap_openperm() &&
2029 inode->i_sb->s_magic != SOCKFS_MAGIC)
Eric Paris49b7b8d2010-07-23 11:44:09 -04002030 av |= FILE__OPEN;
2031
Eric Paris8b6a5a32008-10-29 17:06:46 -04002032 return av;
2033}
2034
Linus Torvalds1da177e2005-04-16 15:20:36 -07002035/* Hook functions begin here. */
2036
Stephen Smalley79af7302015-01-21 10:54:10 -05002037static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2038{
2039 u32 mysid = current_sid();
2040 u32 mgrsid = task_sid(mgr);
2041
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002042 return avc_has_perm(&selinux_state,
2043 mysid, mgrsid, SECCLASS_BINDER,
Stephen Smalley79af7302015-01-21 10:54:10 -05002044 BINDER__SET_CONTEXT_MGR, NULL);
2045}
2046
2047static int selinux_binder_transaction(struct task_struct *from,
2048 struct task_struct *to)
2049{
2050 u32 mysid = current_sid();
2051 u32 fromsid = task_sid(from);
2052 u32 tosid = task_sid(to);
2053 int rc;
2054
2055 if (mysid != fromsid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002056 rc = avc_has_perm(&selinux_state,
2057 mysid, fromsid, SECCLASS_BINDER,
Stephen Smalley79af7302015-01-21 10:54:10 -05002058 BINDER__IMPERSONATE, NULL);
2059 if (rc)
2060 return rc;
2061 }
2062
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002063 return avc_has_perm(&selinux_state,
2064 fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
Stephen Smalley79af7302015-01-21 10:54:10 -05002065 NULL);
2066}
2067
2068static int selinux_binder_transfer_binder(struct task_struct *from,
2069 struct task_struct *to)
2070{
2071 u32 fromsid = task_sid(from);
2072 u32 tosid = task_sid(to);
2073
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002074 return avc_has_perm(&selinux_state,
2075 fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
Stephen Smalley79af7302015-01-21 10:54:10 -05002076 NULL);
2077}
2078
2079static int selinux_binder_transfer_file(struct task_struct *from,
2080 struct task_struct *to,
2081 struct file *file)
2082{
2083 u32 sid = task_sid(to);
Casey Schauflerbb6c6b02018-09-21 17:22:32 -07002084 struct file_security_struct *fsec = selinux_file(file);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002085 struct dentry *dentry = file->f_path.dentry;
Paul Moore20cdef82016-04-04 14:14:42 -04002086 struct inode_security_struct *isec;
Stephen Smalley79af7302015-01-21 10:54:10 -05002087 struct common_audit_data ad;
2088 int rc;
2089
2090 ad.type = LSM_AUDIT_DATA_PATH;
2091 ad.u.path = file->f_path;
2092
2093 if (sid != fsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002094 rc = avc_has_perm(&selinux_state,
2095 sid, fsec->sid,
Stephen Smalley79af7302015-01-21 10:54:10 -05002096 SECCLASS_FD,
2097 FD__USE,
2098 &ad);
2099 if (rc)
2100 return rc;
2101 }
2102
Chenbo Fengf66e4482017-10-18 13:00:26 -07002103#ifdef CONFIG_BPF_SYSCALL
2104 rc = bpf_fd_pass(file, sid);
2105 if (rc)
2106 return rc;
2107#endif
2108
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002109 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
Stephen Smalley79af7302015-01-21 10:54:10 -05002110 return 0;
2111
Paul Moore20cdef82016-04-04 14:14:42 -04002112 isec = backing_inode_security(dentry);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002113 return avc_has_perm(&selinux_state,
2114 sid, isec->sid, isec->sclass, file_to_av(file),
Stephen Smalley79af7302015-01-21 10:54:10 -05002115 &ad);
2116}
2117
Ingo Molnar9e488582009-05-07 19:26:19 +10002118static int selinux_ptrace_access_check(struct task_struct *child,
David Howells5cd9c582008-08-14 11:37:28 +01002119 unsigned int mode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002120{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002121 u32 sid = current_sid();
2122 u32 csid = task_sid(child);
Stephen Smalley006ebb42008-05-19 08:32:49 -04002123
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002124 if (mode & PTRACE_MODE_READ)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002125 return avc_has_perm(&selinux_state,
2126 sid, csid, SECCLASS_FILE, FILE__READ, NULL);
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002127
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002128 return avc_has_perm(&selinux_state,
2129 sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
David Howells5cd9c582008-08-14 11:37:28 +01002130}
2131
2132static int selinux_ptrace_traceme(struct task_struct *parent)
2133{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002134 return avc_has_perm(&selinux_state,
2135 task_sid(parent), current_sid(), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002136 PROCESS__PTRACE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002137}
2138
2139static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
Eric Paris828dfe12008-04-17 13:17:49 -04002140 kernel_cap_t *inheritable, kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002141{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002142 return avc_has_perm(&selinux_state,
2143 current_sid(), task_sid(target), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002144 PROCESS__GETCAP, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002145}
2146
David Howellsd84f4f92008-11-14 10:39:23 +11002147static int selinux_capset(struct cred *new, const struct cred *old,
2148 const kernel_cap_t *effective,
2149 const kernel_cap_t *inheritable,
2150 const kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002151{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002152 return avc_has_perm(&selinux_state,
2153 cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002154 PROCESS__SETCAP, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002155}
2156
James Morris5626d3e2009-01-30 10:05:06 +11002157/*
2158 * (This comment used to live with the selinux_task_setuid hook,
2159 * which was removed).
2160 *
2161 * Since setuid only affects the current process, and since the SELinux
2162 * controls are not based on the Linux identity attributes, SELinux does not
2163 * need to control this operation. However, SELinux does control the use of
2164 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2165 */
2166
Eric Paris6a9de492012-01-03 12:25:14 -05002167static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
Micah Mortonc1a85a02019-01-07 16:10:53 -08002168 int cap, unsigned int opts)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002169{
Micah Mortonc1a85a02019-01-07 16:10:53 -08002170 return cred_has_capability(cred, cap, opts, ns == &init_user_ns);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002171}
2172
Linus Torvalds1da177e2005-04-16 15:20:36 -07002173static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2174{
David Howells88e67f32008-11-14 10:39:21 +11002175 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002176 int rc = 0;
2177
2178 if (!sb)
2179 return 0;
2180
2181 switch (cmds) {
Eric Paris828dfe12008-04-17 13:17:49 -04002182 case Q_SYNC:
2183 case Q_QUOTAON:
2184 case Q_QUOTAOFF:
2185 case Q_SETINFO:
2186 case Q_SETQUOTA:
David Howells88e67f32008-11-14 10:39:21 +11002187 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04002188 break;
2189 case Q_GETFMT:
2190 case Q_GETINFO:
2191 case Q_GETQUOTA:
David Howells88e67f32008-11-14 10:39:21 +11002192 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04002193 break;
2194 default:
2195 rc = 0; /* let the kernel handle invalid cmds */
2196 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002197 }
2198 return rc;
2199}
2200
2201static int selinux_quota_on(struct dentry *dentry)
2202{
David Howells88e67f32008-11-14 10:39:21 +11002203 const struct cred *cred = current_cred();
2204
Eric Paris2875fa02011-04-28 16:04:24 -04002205 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002206}
2207
Eric Paris12b30522010-11-15 18:36:29 -05002208static int selinux_syslog(int type)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002209{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002210 switch (type) {
Kees Cookd78ca3c2010-02-03 15:37:13 -08002211 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2212 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002213 return avc_has_perm(&selinux_state,
2214 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002215 SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
Kees Cookd78ca3c2010-02-03 15:37:13 -08002216 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2217 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2218 /* Set level of messages printed to console */
2219 case SYSLOG_ACTION_CONSOLE_LEVEL:
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002220 return avc_has_perm(&selinux_state,
2221 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002222 SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2223 NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002224 }
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002225 /* All other syslog types */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002226 return avc_has_perm(&selinux_state,
2227 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002228 SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002229}
2230
2231/*
2232 * Check that a process has enough memory to allocate a new virtual
2233 * mapping. 0 means there is enough memory for the allocation to
2234 * succeed and -ENOMEM implies there is not.
2235 *
Linus Torvalds1da177e2005-04-16 15:20:36 -07002236 * Do not audit the selinux permission check, as this is applied to all
2237 * processes that allocate mappings.
2238 */
Alan Cox34b4e4a2007-08-22 14:01:28 -07002239static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002240{
2241 int rc, cap_sys_admin = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002242
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07002243 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
Micah Mortonc1a85a02019-01-07 16:10:53 -08002244 CAP_OPT_NOAUDIT, true);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002245 if (rc == 0)
2246 cap_sys_admin = 1;
2247
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07002248 return cap_sys_admin;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002249}
2250
2251/* binprm security operations */
2252
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002253static u32 ptrace_parent_sid(void)
Paul Moore0c6181c2016-03-30 21:41:21 -04002254{
2255 u32 sid = 0;
2256 struct task_struct *tracer;
2257
2258 rcu_read_lock();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002259 tracer = ptrace_parent(current);
Paul Moore0c6181c2016-03-30 21:41:21 -04002260 if (tracer)
2261 sid = task_sid(tracer);
2262 rcu_read_unlock();
2263
2264 return sid;
2265}
2266
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002267static int check_nnp_nosuid(const struct linux_binprm *bprm,
2268 const struct task_security_struct *old_tsec,
2269 const struct task_security_struct *new_tsec)
2270{
2271 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
Andy Lutomirski380cf5b2016-06-23 16:41:05 -05002272 int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002273 int rc;
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002274 u32 av;
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002275
2276 if (!nnp && !nosuid)
2277 return 0; /* neither NNP nor nosuid */
2278
2279 if (new_tsec->sid == old_tsec->sid)
2280 return 0; /* No change in credentials */
2281
2282 /*
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002283 * If the policy enables the nnp_nosuid_transition policy capability,
2284 * then we permit transitions under NNP or nosuid if the
2285 * policy allows the corresponding permission between
2286 * the old and new contexts.
2287 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002288 if (selinux_policycap_nnp_nosuid_transition()) {
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002289 av = 0;
2290 if (nnp)
2291 av |= PROCESS2__NNP_TRANSITION;
2292 if (nosuid)
2293 av |= PROCESS2__NOSUID_TRANSITION;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002294 rc = avc_has_perm(&selinux_state,
2295 old_tsec->sid, new_tsec->sid,
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002296 SECCLASS_PROCESS2, av, NULL);
2297 if (!rc)
2298 return 0;
2299 }
2300
2301 /*
2302 * We also permit NNP or nosuid transitions to bounded SIDs,
2303 * i.e. SIDs that are guaranteed to only be allowed a subset
2304 * of the permissions of the current SID.
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002305 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002306 rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2307 new_tsec->sid);
Stephen Smalleyaf63f412017-07-31 10:12:46 -04002308 if (!rc)
2309 return 0;
2310
2311 /*
2312 * On failure, preserve the errno values for NNP vs nosuid.
2313 * NNP: Operation not permitted for caller.
2314 * nosuid: Permission denied to file.
2315 */
2316 if (nnp)
2317 return -EPERM;
2318 return -EACCES;
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002319}
2320
David Howellsa6f76f22008-11-14 10:39:24 +11002321static int selinux_bprm_set_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002322{
David Howellsa6f76f22008-11-14 10:39:24 +11002323 const struct task_security_struct *old_tsec;
2324 struct task_security_struct *new_tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002325 struct inode_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04002326 struct common_audit_data ad;
Al Viro496ad9a2013-01-23 17:07:38 -05002327 struct inode *inode = file_inode(bprm->file);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002328 int rc;
2329
David Howellsa6f76f22008-11-14 10:39:24 +11002330 /* SELinux context only depends on initial program or script and not
2331 * the script interpreter */
Kees Cookddb4a142017-07-18 15:25:23 -07002332 if (bprm->called_set_creds)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002333 return 0;
2334
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07002335 old_tsec = selinux_cred(current_cred());
2336 new_tsec = selinux_cred(bprm->cred);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002337 isec = inode_security(inode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002338
2339 /* Default to the current task SID. */
David Howellsa6f76f22008-11-14 10:39:24 +11002340 new_tsec->sid = old_tsec->sid;
2341 new_tsec->osid = old_tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002342
Michael LeMay28eba5b2006-06-27 02:53:42 -07002343 /* Reset fs, key, and sock SIDs on execve. */
David Howellsa6f76f22008-11-14 10:39:24 +11002344 new_tsec->create_sid = 0;
2345 new_tsec->keycreate_sid = 0;
2346 new_tsec->sockcreate_sid = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002347
David Howellsa6f76f22008-11-14 10:39:24 +11002348 if (old_tsec->exec_sid) {
2349 new_tsec->sid = old_tsec->exec_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002350 /* Reset exec SID on execve. */
David Howellsa6f76f22008-11-14 10:39:24 +11002351 new_tsec->exec_sid = 0;
Andy Lutomirski259e5e62012-04-12 16:47:50 -05002352
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002353 /* Fail on NNP or nosuid if not an allowed transition. */
2354 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2355 if (rc)
2356 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002357 } else {
2358 /* Check for a default transition on this program. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002359 rc = security_transition_sid(&selinux_state, old_tsec->sid,
2360 isec->sid, SECCLASS_PROCESS, NULL,
Eric Paris652bb9b2011-02-01 11:05:40 -05002361 &new_tsec->sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002362 if (rc)
2363 return rc;
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002364
2365 /*
2366 * Fallback to old SID on NNP or nosuid if not an allowed
2367 * transition.
2368 */
2369 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2370 if (rc)
2371 new_tsec->sid = old_tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002372 }
2373
Vivek Goyal43af5de2016-09-09 11:37:49 -04002374 ad.type = LSM_AUDIT_DATA_FILE;
2375 ad.u.file = bprm->file;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002376
David Howellsa6f76f22008-11-14 10:39:24 +11002377 if (new_tsec->sid == old_tsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002378 rc = avc_has_perm(&selinux_state,
2379 old_tsec->sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002380 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2381 if (rc)
2382 return rc;
2383 } else {
2384 /* Check permissions for the transition. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002385 rc = avc_has_perm(&selinux_state,
2386 old_tsec->sid, new_tsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002387 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2388 if (rc)
2389 return rc;
2390
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002391 rc = avc_has_perm(&selinux_state,
2392 new_tsec->sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002393 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2394 if (rc)
2395 return rc;
2396
David Howellsa6f76f22008-11-14 10:39:24 +11002397 /* Check for shared state */
2398 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002399 rc = avc_has_perm(&selinux_state,
2400 old_tsec->sid, new_tsec->sid,
David Howellsa6f76f22008-11-14 10:39:24 +11002401 SECCLASS_PROCESS, PROCESS__SHARE,
2402 NULL);
2403 if (rc)
2404 return -EPERM;
2405 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002406
David Howellsa6f76f22008-11-14 10:39:24 +11002407 /* Make sure that anyone attempting to ptrace over a task that
2408 * changes its SID has the appropriate permit */
Eric W. Biederman9227dd22017-01-23 17:26:31 +13002409 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002410 u32 ptsid = ptrace_parent_sid();
David Howellsa6f76f22008-11-14 10:39:24 +11002411 if (ptsid != 0) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002412 rc = avc_has_perm(&selinux_state,
2413 ptsid, new_tsec->sid,
David Howellsa6f76f22008-11-14 10:39:24 +11002414 SECCLASS_PROCESS,
2415 PROCESS__PTRACE, NULL);
2416 if (rc)
2417 return -EPERM;
2418 }
2419 }
2420
2421 /* Clear any possibly unsafe personality bits on exec: */
2422 bprm->per_clear |= PER_CLEAR_ON_SETID;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002423
Linus Torvalds1da177e2005-04-16 15:20:36 -07002424 /* Enable secure mode for SIDs transitions unless
2425 the noatsecure permission is granted between
2426 the two SIDs, i.e. ahp returns 0. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002427 rc = avc_has_perm(&selinux_state,
2428 old_tsec->sid, new_tsec->sid,
Kees Cook62874c32017-07-18 15:25:25 -07002429 SECCLASS_PROCESS, PROCESS__NOATSECURE,
2430 NULL);
2431 bprm->secureexec |= !!rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002432 }
2433
Kees Cook62874c32017-07-18 15:25:25 -07002434 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002435}
2436
Al Viroc3c073f2012-08-21 22:32:06 -04002437static int match_file(const void *p, struct file *file, unsigned fd)
2438{
2439 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2440}
2441
Linus Torvalds1da177e2005-04-16 15:20:36 -07002442/* Derived from fs/exec.c:flush_old_files. */
David Howells745ca242008-11-14 10:39:22 +11002443static inline void flush_unauthorized_files(const struct cred *cred,
2444 struct files_struct *files)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002445{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002446 struct file *file, *devnull = NULL;
Stephen Smalleyb20c8122006-09-25 23:32:03 -07002447 struct tty_struct *tty;
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002448 int drop_tty = 0;
Al Viroc3c073f2012-08-21 22:32:06 -04002449 unsigned n;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002450
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002451 tty = get_current_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002452 if (tty) {
Peter Hurley4a510962016-01-09 21:35:23 -08002453 spin_lock(&tty->files_lock);
Eric Paris37dd0bd2008-10-31 17:40:00 -04002454 if (!list_empty(&tty->tty_files)) {
Nick Piggind996b622010-08-18 04:37:36 +10002455 struct tty_file_private *file_priv;
Eric Paris37dd0bd2008-10-31 17:40:00 -04002456
Linus Torvalds1da177e2005-04-16 15:20:36 -07002457 /* Revalidate access to controlling tty.
David Howells13f8e982013-06-13 23:37:55 +01002458 Use file_path_has_perm on the tty path directly
2459 rather than using file_has_perm, as this particular
2460 open file may belong to another process and we are
2461 only interested in the inode-based check here. */
Nick Piggind996b622010-08-18 04:37:36 +10002462 file_priv = list_first_entry(&tty->tty_files,
2463 struct tty_file_private, list);
2464 file = file_priv->file;
David Howells13f8e982013-06-13 23:37:55 +01002465 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002466 drop_tty = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002467 }
Peter Hurley4a510962016-01-09 21:35:23 -08002468 spin_unlock(&tty->files_lock);
Alan Cox452a00d2008-10-13 10:39:13 +01002469 tty_kref_put(tty);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002470 }
Eric W. Biederman98a27ba2007-05-08 00:26:56 -07002471 /* Reset controlling tty. */
2472 if (drop_tty)
2473 no_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002474
2475 /* Revalidate access to inherited open files. */
Al Viroc3c073f2012-08-21 22:32:06 -04002476 n = iterate_fd(files, 0, match_file, cred);
2477 if (!n) /* none found? */
2478 return;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002479
Al Viroc3c073f2012-08-21 22:32:06 -04002480 devnull = dentry_open(&selinux_null, O_RDWR, cred);
Al Viro45525b22012-10-16 13:30:07 -04002481 if (IS_ERR(devnull))
2482 devnull = NULL;
2483 /* replace all the matching ones with this */
2484 do {
2485 replace_fd(n - 1, devnull, 0);
2486 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2487 if (devnull)
Al Viroc3c073f2012-08-21 22:32:06 -04002488 fput(devnull);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002489}
2490
Linus Torvalds1da177e2005-04-16 15:20:36 -07002491/*
David Howellsa6f76f22008-11-14 10:39:24 +11002492 * Prepare a process for imminent new credential changes due to exec
Linus Torvalds1da177e2005-04-16 15:20:36 -07002493 */
David Howellsa6f76f22008-11-14 10:39:24 +11002494static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002495{
David Howellsa6f76f22008-11-14 10:39:24 +11002496 struct task_security_struct *new_tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002497 struct rlimit *rlim, *initrlim;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002498 int rc, i;
2499
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07002500 new_tsec = selinux_cred(bprm->cred);
David Howellsa6f76f22008-11-14 10:39:24 +11002501 if (new_tsec->sid == new_tsec->osid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002502 return;
2503
2504 /* Close files for which the new task SID is not authorized. */
David Howellsa6f76f22008-11-14 10:39:24 +11002505 flush_unauthorized_files(bprm->cred, current->files);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002506
David Howellsa6f76f22008-11-14 10:39:24 +11002507 /* Always clear parent death signal on SID transitions. */
2508 current->pdeath_signal = 0;
2509
2510 /* Check whether the new SID can inherit resource limits from the old
2511 * SID. If not, reset all soft limits to the lower of the current
2512 * task's hard limit and the init task's soft limit.
2513 *
2514 * Note that the setting of hard limits (even to lower them) can be
2515 * controlled by the setrlimit check. The inclusion of the init task's
2516 * soft limit into the computation is to avoid resetting soft limits
2517 * higher than the default soft limit for cases where the default is
2518 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2519 */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002520 rc = avc_has_perm(&selinux_state,
2521 new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
David Howellsa6f76f22008-11-14 10:39:24 +11002522 PROCESS__RLIMITINH, NULL);
2523 if (rc) {
Oleg Nesteroveb2d55a2010-06-23 22:43:32 +02002524 /* protect against do_prlimit() */
2525 task_lock(current);
David Howellsa6f76f22008-11-14 10:39:24 +11002526 for (i = 0; i < RLIM_NLIMITS; i++) {
2527 rlim = current->signal->rlim + i;
2528 initrlim = init_task.signal->rlim + i;
2529 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2530 }
Oleg Nesteroveb2d55a2010-06-23 22:43:32 +02002531 task_unlock(current);
Nicolas Pitrebaa73d92016-11-11 00:10:10 -05002532 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2533 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
David Howellsa6f76f22008-11-14 10:39:24 +11002534 }
2535}
2536
2537/*
2538 * Clean up the process immediately after the installation of new credentials
2539 * due to exec
2540 */
2541static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2542{
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07002543 const struct task_security_struct *tsec = selinux_cred(current_cred());
David Howellsa6f76f22008-11-14 10:39:24 +11002544 struct itimerval itimer;
David Howellsa6f76f22008-11-14 10:39:24 +11002545 u32 osid, sid;
2546 int rc, i;
David Howellsa6f76f22008-11-14 10:39:24 +11002547
David Howellsa6f76f22008-11-14 10:39:24 +11002548 osid = tsec->osid;
2549 sid = tsec->sid;
2550
2551 if (sid == osid)
2552 return;
2553
2554 /* Check whether the new SID can inherit signal state from the old SID.
2555 * If not, clear itimers to avoid subsequent signal generation and
2556 * flush and unblock signals.
2557 *
2558 * This must occur _after_ the task SID has been updated so that any
2559 * kill done after the flush will be checked against the new SID.
2560 */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05002561 rc = avc_has_perm(&selinux_state,
2562 osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002563 if (rc) {
Nicolas Pitrebaa73d92016-11-11 00:10:10 -05002564 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) {
2565 memset(&itimer, 0, sizeof itimer);
2566 for (i = 0; i < 3; i++)
2567 do_setitimer(i, &itimer, NULL);
2568 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002569 spin_lock_irq(&current->sighand->siglock);
Oleg Nesterov9e7c8f82015-06-04 16:22:16 -04002570 if (!fatal_signal_pending(current)) {
2571 flush_sigqueue(&current->pending);
2572 flush_sigqueue(&current->signal->shared_pending);
David Howells3bcac022009-04-29 13:45:05 +01002573 flush_signal_handlers(current, 1);
2574 sigemptyset(&current->blocked);
Oleg Nesterov9e7c8f82015-06-04 16:22:16 -04002575 recalc_sigpending();
David Howells3bcac022009-04-29 13:45:05 +01002576 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002577 spin_unlock_irq(&current->sighand->siglock);
2578 }
2579
David Howellsa6f76f22008-11-14 10:39:24 +11002580 /* Wake up the parent if it is waiting so that it can recheck
2581 * wait permission to the new task SID. */
Oleg Nesterovecd6de32009-04-29 16:02:24 +02002582 read_lock(&tasklist_lock);
Oleg Nesterov0b7570e2009-09-23 15:56:46 -07002583 __wake_up_parent(current, current->real_parent);
Oleg Nesterovecd6de32009-04-29 16:02:24 +02002584 read_unlock(&tasklist_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002585}
2586
2587/* superblock security operations */
2588
2589static int selinux_sb_alloc_security(struct super_block *sb)
2590{
2591 return superblock_alloc_security(sb);
2592}
2593
2594static void selinux_sb_free_security(struct super_block *sb)
2595{
2596 superblock_free_security(sb);
2597}
2598
Al Viro99dbbb52018-12-14 21:56:23 -05002599static inline int opt_len(const char *s)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002600{
Al Viro99dbbb52018-12-14 21:56:23 -05002601 bool open_quote = false;
2602 int len;
2603 char c;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002604
Al Viro99dbbb52018-12-14 21:56:23 -05002605 for (len = 0; (c = s[len]) != '\0'; len++) {
2606 if (c == '"')
Cory Olmo3528a952006-09-29 01:58:44 -07002607 open_quote = !open_quote;
Al Viro99dbbb52018-12-14 21:56:23 -05002608 if (c == ',' && !open_quote)
2609 break;
2610 }
2611 return len;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002612}
2613
Al Viro204cc0c2018-12-13 13:41:47 -05002614static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
Eric Paris026eb162011-03-03 16:09:14 -05002615{
Al Viro99dbbb52018-12-14 21:56:23 -05002616 char *from = options;
2617 char *to = options;
2618 bool first = true;
Al Viro5b400232018-12-12 20:13:29 -05002619
Al Viro99dbbb52018-12-14 21:56:23 -05002620 while (1) {
2621 int len = opt_len(from);
2622 int token, rc;
2623 char *arg = NULL;
2624
2625 token = match_opt_prefix(from, len, &arg);
2626
2627 if (token != Opt_error) {
2628 char *p, *q;
2629
2630 /* strip quotes */
2631 if (arg) {
2632 for (p = q = arg; p < from + len; p++) {
2633 char c = *p;
2634 if (c != '"')
2635 *q++ = c;
2636 }
2637 arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);
2638 }
2639 rc = selinux_add_opt(token, arg, mnt_opts);
2640 if (unlikely(rc)) {
2641 kfree(arg);
2642 if (*mnt_opts) {
2643 selinux_free_mnt_opts(*mnt_opts);
2644 *mnt_opts = NULL;
2645 }
2646 return rc;
2647 }
2648 } else {
2649 if (!first) { // copy with preceding comma
2650 from--;
2651 len++;
2652 }
2653 if (to != from)
2654 memmove(to, from, len);
2655 to += len;
2656 first = false;
2657 }
2658 if (!from[len])
2659 break;
2660 from += len + 1;
2661 }
2662 *to = '\0';
2663 return 0;
Al Viro5b400232018-12-12 20:13:29 -05002664}
2665
Al Viro204cc0c2018-12-13 13:41:47 -05002666static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
Eric Paris026eb162011-03-03 16:09:14 -05002667{
Al Virobd323652018-12-13 15:04:59 -05002668 struct selinux_mnt_opts *opts = mnt_opts;
Eric Paris026eb162011-03-03 16:09:14 -05002669 struct superblock_security_struct *sbsec = sb->s_security;
Al Virobd323652018-12-13 15:04:59 -05002670 u32 sid;
2671 int rc;
Eric Paris026eb162011-03-03 16:09:14 -05002672
2673 if (!(sbsec->flags & SE_SBINITIALIZED))
2674 return 0;
2675
Al Viro204cc0c2018-12-13 13:41:47 -05002676 if (!opts)
Eric Paris026eb162011-03-03 16:09:14 -05002677 return 0;
2678
Al Virobd323652018-12-13 15:04:59 -05002679 if (opts->fscontext) {
2680 rc = parse_sid(sb, opts->fscontext, &sid);
2681 if (rc)
Al Viroc039bc32018-12-01 23:06:57 -05002682 return rc;
Al Virobd323652018-12-13 15:04:59 -05002683 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2684 goto out_bad_option;
Eric Paris026eb162011-03-03 16:09:14 -05002685 }
Al Virobd323652018-12-13 15:04:59 -05002686 if (opts->context) {
2687 rc = parse_sid(sb, opts->context, &sid);
2688 if (rc)
2689 return rc;
2690 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2691 goto out_bad_option;
2692 }
2693 if (opts->rootcontext) {
2694 struct inode_security_struct *root_isec;
2695 root_isec = backing_inode_security(sb->s_root);
2696 rc = parse_sid(sb, opts->rootcontext, &sid);
2697 if (rc)
2698 return rc;
2699 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2700 goto out_bad_option;
2701 }
2702 if (opts->defcontext) {
2703 rc = parse_sid(sb, opts->defcontext, &sid);
2704 if (rc)
2705 return rc;
2706 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2707 goto out_bad_option;
Eric Paris026eb162011-03-03 16:09:14 -05002708 }
Al Viroc039bc32018-12-01 23:06:57 -05002709 return 0;
Eric Paris026eb162011-03-03 16:09:14 -05002710
Eric Paris026eb162011-03-03 16:09:14 -05002711out_bad_option:
peter enderborgc103a912018-06-12 10:09:03 +02002712 pr_warn("SELinux: unable to change security options "
Linus Torvalds29b1deb2013-12-15 11:17:45 -08002713 "during remount (dev %s, type=%s)\n", sb->s_id,
2714 sb->s_type->name);
Al Viroc039bc32018-12-01 23:06:57 -05002715 return -EINVAL;
Eric Paris026eb162011-03-03 16:09:14 -05002716}
2717
Al Viroa10d7c22018-12-05 11:58:35 -05002718static int selinux_sb_kern_mount(struct super_block *sb)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002719{
David Howells88e67f32008-11-14 10:39:21 +11002720 const struct cred *cred = current_cred();
Thomas Liu2bf49692009-07-14 12:14:09 -04002721 struct common_audit_data ad;
James Morris74192242008-12-19 11:41:10 +11002722
Eric Paris50c205f2012-04-04 15:01:43 -04002723 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04002724 ad.u.dentry = sb->s_root;
David Howells88e67f32008-11-14 10:39:21 +11002725 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002726}
2727
David Howells726c3342006-06-23 02:02:58 -07002728static int selinux_sb_statfs(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002729{
David Howells88e67f32008-11-14 10:39:21 +11002730 const struct cred *cred = current_cred();
Thomas Liu2bf49692009-07-14 12:14:09 -04002731 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002732
Eric Paris50c205f2012-04-04 15:01:43 -04002733 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04002734 ad.u.dentry = dentry->d_sb->s_root;
David Howells88e67f32008-11-14 10:39:21 +11002735 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002736}
2737
Al Viro808d4e32012-10-11 11:42:01 -04002738static int selinux_mount(const char *dev_name,
Al Viro8a04c432016-03-25 14:52:53 -04002739 const struct path *path,
Al Viro808d4e32012-10-11 11:42:01 -04002740 const char *type,
Eric Paris828dfe12008-04-17 13:17:49 -04002741 unsigned long flags,
2742 void *data)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002743{
David Howells88e67f32008-11-14 10:39:21 +11002744 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002745
2746 if (flags & MS_REMOUNT)
Al Virod8c95842011-12-07 18:16:57 -05002747 return superblock_has_perm(cred, path->dentry->d_sb,
Eric Paris828dfe12008-04-17 13:17:49 -04002748 FILESYSTEM__REMOUNT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002749 else
Eric Paris2875fa02011-04-28 16:04:24 -04002750 return path_has_perm(cred, path, FILE__MOUNTON);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002751}
2752
2753static int selinux_umount(struct vfsmount *mnt, int flags)
2754{
David Howells88e67f32008-11-14 10:39:21 +11002755 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002756
David Howells88e67f32008-11-14 10:39:21 +11002757 return superblock_has_perm(cred, mnt->mnt_sb,
Eric Paris828dfe12008-04-17 13:17:49 -04002758 FILESYSTEM__UNMOUNT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002759}
2760
Al Viro0b520752018-12-23 16:02:47 -05002761static int selinux_fs_context_dup(struct fs_context *fc,
2762 struct fs_context *src_fc)
2763{
2764 const struct selinux_mnt_opts *src = src_fc->security;
2765 struct selinux_mnt_opts *opts;
2766
2767 if (!src)
2768 return 0;
2769
2770 fc->security = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
2771 if (!fc->security)
2772 return -ENOMEM;
2773
2774 opts = fc->security;
2775
2776 if (src->fscontext) {
2777 opts->fscontext = kstrdup(src->fscontext, GFP_KERNEL);
2778 if (!opts->fscontext)
2779 return -ENOMEM;
2780 }
2781 if (src->context) {
2782 opts->context = kstrdup(src->context, GFP_KERNEL);
2783 if (!opts->context)
2784 return -ENOMEM;
2785 }
2786 if (src->rootcontext) {
2787 opts->rootcontext = kstrdup(src->rootcontext, GFP_KERNEL);
2788 if (!opts->rootcontext)
2789 return -ENOMEM;
2790 }
2791 if (src->defcontext) {
2792 opts->defcontext = kstrdup(src->defcontext, GFP_KERNEL);
2793 if (!opts->defcontext)
2794 return -ENOMEM;
2795 }
2796 return 0;
2797}
2798
David Howells442155c2018-11-01 23:07:24 +00002799static const struct fs_parameter_spec selinux_param_specs[] = {
2800 fsparam_string(CONTEXT_STR, Opt_context),
2801 fsparam_string(DEFCONTEXT_STR, Opt_defcontext),
2802 fsparam_string(FSCONTEXT_STR, Opt_fscontext),
2803 fsparam_string(ROOTCONTEXT_STR, Opt_rootcontext),
2804 fsparam_flag (SECLABEL_STR, Opt_seclabel),
2805 {}
2806};
2807
2808static const struct fs_parameter_description selinux_fs_parameters = {
2809 .name = "SELinux",
2810 .specs = selinux_param_specs,
2811};
2812
2813static int selinux_fs_context_parse_param(struct fs_context *fc,
2814 struct fs_parameter *param)
2815{
2816 struct fs_parse_result result;
2817 int opt, rc;
2818
2819 opt = fs_parse(fc, &selinux_fs_parameters, param, &result);
2820 if (opt < 0)
2821 return opt;
2822
2823 rc = selinux_add_opt(opt, param->string, &fc->security);
2824 if (!rc) {
2825 param->string = NULL;
2826 rc = 1;
2827 }
2828 return rc;
2829}
2830
Linus Torvalds1da177e2005-04-16 15:20:36 -07002831/* inode security operations */
2832
2833static int selinux_inode_alloc_security(struct inode *inode)
2834{
2835 return inode_alloc_security(inode);
2836}
2837
2838static void selinux_inode_free_security(struct inode *inode)
2839{
2840 inode_free_security(inode);
2841}
2842
David Quigleyd47be3d2013-05-22 12:50:34 -04002843static int selinux_dentry_init_security(struct dentry *dentry, int mode,
Al Viro4f3ccd72016-07-20 16:06:15 -04002844 const struct qstr *name, void **ctx,
David Quigleyd47be3d2013-05-22 12:50:34 -04002845 u32 *ctxlen)
2846{
David Quigleyd47be3d2013-05-22 12:50:34 -04002847 u32 newsid;
2848 int rc;
2849
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07002850 rc = selinux_determine_inode_label(selinux_cred(current_cred()),
Vivek Goyalc957f6d2016-07-13 10:44:51 -04002851 d_inode(dentry->d_parent), name,
David Howellsc3c188b2015-07-10 17:19:58 -04002852 inode_mode_to_security_class(mode),
2853 &newsid);
2854 if (rc)
2855 return rc;
David Quigleyd47be3d2013-05-22 12:50:34 -04002856
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002857 return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
2858 ctxlen);
David Quigleyd47be3d2013-05-22 12:50:34 -04002859}
2860
Vivek Goyala518b0a2016-07-13 10:44:53 -04002861static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2862 struct qstr *name,
2863 const struct cred *old,
2864 struct cred *new)
2865{
2866 u32 newsid;
2867 int rc;
2868 struct task_security_struct *tsec;
2869
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07002870 rc = selinux_determine_inode_label(selinux_cred(old),
Vivek Goyala518b0a2016-07-13 10:44:53 -04002871 d_inode(dentry->d_parent), name,
2872 inode_mode_to_security_class(mode),
2873 &newsid);
2874 if (rc)
2875 return rc;
2876
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07002877 tsec = selinux_cred(new);
Vivek Goyala518b0a2016-07-13 10:44:53 -04002878 tsec->create_sid = newsid;
2879 return 0;
2880}
2881
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002882static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
Tetsuo Handa95489062013-07-25 05:44:02 +09002883 const struct qstr *qstr,
2884 const char **name,
Eric Paris2a7dba32011-02-01 11:05:39 -05002885 void **value, size_t *len)
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002886{
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07002887 const struct task_security_struct *tsec = selinux_cred(current_cred());
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002888 struct superblock_security_struct *sbsec;
Corentin LABBEc0d4f462017-10-04 20:32:17 +02002889 u32 newsid, clen;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002890 int rc;
Tetsuo Handa95489062013-07-25 05:44:02 +09002891 char *context;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002892
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002893 sbsec = dir->i_sb->s_security;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002894
David Howells275bb412008-11-14 10:39:19 +11002895 newsid = tsec->create_sid;
2896
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07002897 rc = selinux_determine_inode_label(selinux_cred(current_cred()),
David Howellsc3c188b2015-07-10 17:19:58 -04002898 dir, qstr,
2899 inode_mode_to_security_class(inode->i_mode),
2900 &newsid);
2901 if (rc)
2902 return rc;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002903
Eric Paris296fddf2006-09-25 23:32:00 -07002904 /* Possibly defer initialization to selinux_complete_init. */
David P. Quigley0d90a7e2009-01-16 09:22:02 -05002905 if (sbsec->flags & SE_SBINITIALIZED) {
Casey Schaufler80788c22018-09-21 17:19:11 -07002906 struct inode_security_struct *isec = selinux_inode(inode);
Eric Paris296fddf2006-09-25 23:32:00 -07002907 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2908 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05002909 isec->initialized = LABEL_INITIALIZED;
Eric Paris296fddf2006-09-25 23:32:00 -07002910 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002911
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002912 if (!selinux_state.initialized || !(sbsec->flags & SBLABEL_MNT))
Stephen Smalley25a74f32005-11-08 21:34:33 -08002913 return -EOPNOTSUPP;
2914
Tetsuo Handa95489062013-07-25 05:44:02 +09002915 if (name)
2916 *name = XATTR_SELINUX_SUFFIX;
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002917
2918 if (value && len) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05002919 rc = security_sid_to_context_force(&selinux_state, newsid,
2920 &context, &clen);
Tetsuo Handa95489062013-07-25 05:44:02 +09002921 if (rc)
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002922 return rc;
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002923 *value = context;
2924 *len = clen;
2925 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002926
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002927 return 0;
2928}
2929
Al Viro4acdaf22011-07-26 01:42:34 -04002930static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002931{
2932 return may_create(dir, dentry, SECCLASS_FILE);
2933}
2934
Linus Torvalds1da177e2005-04-16 15:20:36 -07002935static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2936{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002937 return may_link(dir, old_dentry, MAY_LINK);
2938}
2939
Linus Torvalds1da177e2005-04-16 15:20:36 -07002940static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2941{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002942 return may_link(dir, dentry, MAY_UNLINK);
2943}
2944
2945static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2946{
2947 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2948}
2949
Al Viro18bb1db2011-07-26 01:41:39 -04002950static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002951{
2952 return may_create(dir, dentry, SECCLASS_DIR);
2953}
2954
Linus Torvalds1da177e2005-04-16 15:20:36 -07002955static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2956{
2957 return may_link(dir, dentry, MAY_RMDIR);
2958}
2959
Al Viro1a67aaf2011-07-26 01:52:52 -04002960static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002961{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002962 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2963}
2964
Linus Torvalds1da177e2005-04-16 15:20:36 -07002965static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
Eric Paris828dfe12008-04-17 13:17:49 -04002966 struct inode *new_inode, struct dentry *new_dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002967{
2968 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2969}
2970
Linus Torvalds1da177e2005-04-16 15:20:36 -07002971static int selinux_inode_readlink(struct dentry *dentry)
2972{
David Howells88e67f32008-11-14 10:39:21 +11002973 const struct cred *cred = current_cred();
2974
Eric Paris2875fa02011-04-28 16:04:24 -04002975 return dentry_has_perm(cred, dentry, FILE__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002976}
2977
NeilBrownbda0be72015-03-23 13:37:39 +11002978static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2979 bool rcu)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002980{
David Howells88e67f32008-11-14 10:39:21 +11002981 const struct cred *cred = current_cred();
NeilBrownbda0be72015-03-23 13:37:39 +11002982 struct common_audit_data ad;
2983 struct inode_security_struct *isec;
2984 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002985
NeilBrownbda0be72015-03-23 13:37:39 +11002986 validate_creds(cred);
2987
2988 ad.type = LSM_AUDIT_DATA_DENTRY;
2989 ad.u.dentry = dentry;
2990 sid = cred_sid(cred);
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05002991 isec = inode_security_rcu(inode, rcu);
2992 if (IS_ERR(isec))
2993 return PTR_ERR(isec);
NeilBrownbda0be72015-03-23 13:37:39 +11002994
Stephen Smalleye46e01e2018-12-12 10:10:56 -05002995 return avc_has_perm(&selinux_state,
2996 sid, isec->sid, isec->sclass, FILE__READ, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002997}
2998
Eric Parisd4cf970d2012-04-04 15:01:42 -04002999static noinline int audit_inode_permission(struct inode *inode,
3000 u32 perms, u32 audited, u32 denied,
Stephen Smalley626b9742014-04-29 11:29:04 -07003001 int result,
Eric Parisd4cf970d2012-04-04 15:01:42 -04003002 unsigned flags)
3003{
3004 struct common_audit_data ad;
Casey Schaufler80788c22018-09-21 17:19:11 -07003005 struct inode_security_struct *isec = selinux_inode(inode);
Eric Parisd4cf970d2012-04-04 15:01:42 -04003006 int rc;
3007
Eric Paris50c205f2012-04-04 15:01:43 -04003008 ad.type = LSM_AUDIT_DATA_INODE;
Eric Parisd4cf970d2012-04-04 15:01:42 -04003009 ad.u.inode = inode;
3010
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003011 rc = slow_avc_audit(&selinux_state,
3012 current_sid(), isec->sid, isec->sclass, perms,
Stephen Smalley626b9742014-04-29 11:29:04 -07003013 audited, denied, result, &ad, flags);
Eric Parisd4cf970d2012-04-04 15:01:42 -04003014 if (rc)
3015 return rc;
3016 return 0;
3017}
3018
Al Viroe74f71e2011-06-20 19:38:15 -04003019static int selinux_inode_permission(struct inode *inode, int mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003020{
David Howells88e67f32008-11-14 10:39:21 +11003021 const struct cred *cred = current_cred();
Eric Parisb782e0a2010-07-23 11:44:03 -04003022 u32 perms;
3023 bool from_access;
Al Virocf1dd1d2011-06-20 19:44:08 -04003024 unsigned flags = mask & MAY_NOT_BLOCK;
Eric Paris2e334052012-04-04 15:01:42 -04003025 struct inode_security_struct *isec;
3026 u32 sid;
3027 struct av_decision avd;
3028 int rc, rc2;
3029 u32 audited, denied;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003030
Eric Parisb782e0a2010-07-23 11:44:03 -04003031 from_access = mask & MAY_ACCESS;
Eric Parisd09ca732010-07-23 11:43:57 -04003032 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3033
Eric Parisb782e0a2010-07-23 11:44:03 -04003034 /* No permission to check. Existence test. */
3035 if (!mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003036 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003037
Eric Paris2e334052012-04-04 15:01:42 -04003038 validate_creds(cred);
Eric Parisb782e0a2010-07-23 11:44:03 -04003039
Eric Paris2e334052012-04-04 15:01:42 -04003040 if (unlikely(IS_PRIVATE(inode)))
3041 return 0;
Eric Parisb782e0a2010-07-23 11:44:03 -04003042
3043 perms = file_mask_to_av(inode->i_mode, mask);
3044
Eric Paris2e334052012-04-04 15:01:42 -04003045 sid = cred_sid(cred);
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05003046 isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3047 if (IS_ERR(isec))
3048 return PTR_ERR(isec);
Eric Paris2e334052012-04-04 15:01:42 -04003049
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003050 rc = avc_has_perm_noaudit(&selinux_state,
Stephen Smalley3a28cff2018-12-12 10:10:55 -05003051 sid, isec->sid, isec->sclass, perms,
3052 (flags & MAY_NOT_BLOCK) ? AVC_NONBLOCKING : 0,
3053 &avd);
Eric Paris2e334052012-04-04 15:01:42 -04003054 audited = avc_audit_required(perms, &avd, rc,
3055 from_access ? FILE__AUDIT_ACCESS : 0,
3056 &denied);
3057 if (likely(!audited))
3058 return rc;
3059
Stephen Smalley626b9742014-04-29 11:29:04 -07003060 rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
Eric Paris2e334052012-04-04 15:01:42 -04003061 if (rc2)
3062 return rc2;
3063 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003064}
3065
3066static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3067{
David Howells88e67f32008-11-14 10:39:21 +11003068 const struct cred *cred = current_cred();
Stephen Smalleyccb54472017-05-12 12:41:24 -04003069 struct inode *inode = d_backing_inode(dentry);
Amerigo Wangbc6a6002009-08-20 19:29:02 -07003070 unsigned int ia_valid = iattr->ia_valid;
Eric Paris95dbf732012-04-04 13:45:34 -04003071 __u32 av = FILE__WRITE;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003072
Amerigo Wangbc6a6002009-08-20 19:29:02 -07003073 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3074 if (ia_valid & ATTR_FORCE) {
3075 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3076 ATTR_FORCE);
3077 if (!ia_valid)
3078 return 0;
3079 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003080
Amerigo Wangbc6a6002009-08-20 19:29:02 -07003081 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3082 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
Eric Paris2875fa02011-04-28 16:04:24 -04003083 return dentry_has_perm(cred, dentry, FILE__SETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003084
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003085 if (selinux_policycap_openperm() &&
Stephen Smalleyccb54472017-05-12 12:41:24 -04003086 inode->i_sb->s_magic != SOCKFS_MAGIC &&
3087 (ia_valid & ATTR_SIZE) &&
3088 !(ia_valid & ATTR_FILE))
Eric Paris95dbf732012-04-04 13:45:34 -04003089 av |= FILE__OPEN;
3090
3091 return dentry_has_perm(cred, dentry, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003092}
3093
Al Viro3f7036a2015-03-08 19:28:30 -04003094static int selinux_inode_getattr(const struct path *path)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003095{
Al Viro3f7036a2015-03-08 19:28:30 -04003096 return path_has_perm(current_cred(), path, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003097}
3098
Stephen Smalleydb590002017-04-20 11:31:30 -04003099static bool has_cap_mac_admin(bool audit)
3100{
3101 const struct cred *cred = current_cred();
Micah Mortonc1a85a02019-01-07 16:10:53 -08003102 unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT;
Stephen Smalleydb590002017-04-20 11:31:30 -04003103
Micah Mortonc1a85a02019-01-07 16:10:53 -08003104 if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, opts))
Stephen Smalleydb590002017-04-20 11:31:30 -04003105 return false;
Micah Mortonc1a85a02019-01-07 16:10:53 -08003106 if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, true))
Stephen Smalleydb590002017-04-20 11:31:30 -04003107 return false;
3108 return true;
3109}
3110
David Howells8f0cfa52008-04-29 00:59:41 -07003111static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3112 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003113{
David Howellsc6f493d2015-03-17 22:26:22 +00003114 struct inode *inode = d_backing_inode(dentry);
Paul Moore20cdef82016-04-04 14:14:42 -04003115 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003116 struct superblock_security_struct *sbsec;
Thomas Liu2bf49692009-07-14 12:14:09 -04003117 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11003118 u32 newsid, sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003119 int rc = 0;
3120
Eric W. Biederman6b240302017-10-02 09:38:20 -05003121 if (strcmp(name, XATTR_NAME_SELINUX)) {
3122 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3123 if (rc)
3124 return rc;
3125
3126 /* Not an attribute we recognize, so just check the
3127 ordinary setattr permission. */
3128 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3129 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003130
3131 sbsec = inode->i_sb->s_security;
Eric Paris12f348b2012-10-09 10:56:25 -04003132 if (!(sbsec->flags & SBLABEL_MNT))
Linus Torvalds1da177e2005-04-16 15:20:36 -07003133 return -EOPNOTSUPP;
3134
Serge E. Hallyn2e149672011-03-23 16:43:26 -07003135 if (!inode_owner_or_capable(inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -07003136 return -EPERM;
3137
Eric Paris50c205f2012-04-04 15:01:43 -04003138 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04003139 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003140
Paul Moore20cdef82016-04-04 14:14:42 -04003141 isec = backing_inode_security(dentry);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003142 rc = avc_has_perm(&selinux_state,
3143 sid, isec->sid, isec->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003144 FILE__RELABELFROM, &ad);
3145 if (rc)
3146 return rc;
3147
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003148 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3149 GFP_KERNEL);
Stephen Smalley12b29f32008-05-07 13:03:20 -04003150 if (rc == -EINVAL) {
Stephen Smalleydb590002017-04-20 11:31:30 -04003151 if (!has_cap_mac_admin(true)) {
Eric Parisd6ea83e2012-04-04 13:45:49 -04003152 struct audit_buffer *ab;
3153 size_t audit_size;
Eric Parisd6ea83e2012-04-04 13:45:49 -04003154
3155 /* We strip a nul only if it is at the end, otherwise the
3156 * context contains a nul and we should audit that */
Al Viroe3fea3f2012-06-09 08:15:16 +01003157 if (value) {
Colin Ian Kingadd24372017-10-14 13:46:55 +01003158 const char *str = value;
3159
Al Viroe3fea3f2012-06-09 08:15:16 +01003160 if (str[size - 1] == '\0')
3161 audit_size = size - 1;
3162 else
3163 audit_size = size;
3164 } else {
Al Viroe3fea3f2012-06-09 08:15:16 +01003165 audit_size = 0;
3166 }
Richard Guy Briggscdfb6b32018-05-12 21:58:20 -04003167 ab = audit_log_start(audit_context(),
3168 GFP_ATOMIC, AUDIT_SELINUX_ERR);
Eric Parisd6ea83e2012-04-04 13:45:49 -04003169 audit_log_format(ab, "op=setxattr invalid_context=");
3170 audit_log_n_untrustedstring(ab, value, audit_size);
3171 audit_log_end(ab);
3172
Stephen Smalley12b29f32008-05-07 13:03:20 -04003173 return rc;
Eric Parisd6ea83e2012-04-04 13:45:49 -04003174 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003175 rc = security_context_to_sid_force(&selinux_state, value,
3176 size, &newsid);
Stephen Smalley12b29f32008-05-07 13:03:20 -04003177 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003178 if (rc)
3179 return rc;
3180
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003181 rc = avc_has_perm(&selinux_state,
3182 sid, newsid, isec->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003183 FILE__RELABELTO, &ad);
3184 if (rc)
3185 return rc;
3186
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003187 rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3188 sid, isec->sclass);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003189 if (rc)
3190 return rc;
3191
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003192 return avc_has_perm(&selinux_state,
3193 newsid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003194 sbsec->sid,
3195 SECCLASS_FILESYSTEM,
3196 FILESYSTEM__ASSOCIATE,
3197 &ad);
3198}
3199
David Howells8f0cfa52008-04-29 00:59:41 -07003200static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
Eric Parisf5269712008-05-14 11:27:45 -04003201 const void *value, size_t size,
David Howells8f0cfa52008-04-29 00:59:41 -07003202 int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003203{
David Howellsc6f493d2015-03-17 22:26:22 +00003204 struct inode *inode = d_backing_inode(dentry);
Paul Moore20cdef82016-04-04 14:14:42 -04003205 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003206 u32 newsid;
3207 int rc;
3208
3209 if (strcmp(name, XATTR_NAME_SELINUX)) {
3210 /* Not an attribute we recognize, so nothing to do. */
3211 return;
3212 }
3213
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003214 rc = security_context_to_sid_force(&selinux_state, value, size,
3215 &newsid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003216 if (rc) {
peter enderborgc103a912018-06-12 10:09:03 +02003217 pr_err("SELinux: unable to map context to SID"
Stephen Smalley12b29f32008-05-07 13:03:20 -04003218 "for (%s, %lu), rc=%d\n",
3219 inode->i_sb->s_id, inode->i_ino, -rc);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003220 return;
3221 }
3222
Paul Moore20cdef82016-04-04 14:14:42 -04003223 isec = backing_inode_security(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003224 spin_lock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003225 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003226 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05003227 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003228 spin_unlock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003229
Linus Torvalds1da177e2005-04-16 15:20:36 -07003230 return;
3231}
3232
David Howells8f0cfa52008-04-29 00:59:41 -07003233static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003234{
David Howells88e67f32008-11-14 10:39:21 +11003235 const struct cred *cred = current_cred();
3236
Eric Paris2875fa02011-04-28 16:04:24 -04003237 return dentry_has_perm(cred, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003238}
3239
Eric Paris828dfe12008-04-17 13:17:49 -04003240static int selinux_inode_listxattr(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003241{
David Howells88e67f32008-11-14 10:39:21 +11003242 const struct cred *cred = current_cred();
3243
Eric Paris2875fa02011-04-28 16:04:24 -04003244 return dentry_has_perm(cred, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003245}
3246
David Howells8f0cfa52008-04-29 00:59:41 -07003247static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003248{
Eric W. Biederman6b240302017-10-02 09:38:20 -05003249 if (strcmp(name, XATTR_NAME_SELINUX)) {
3250 int rc = cap_inode_removexattr(dentry, name);
3251 if (rc)
3252 return rc;
3253
3254 /* Not an attribute we recognize, so just check the
3255 ordinary setattr permission. */
3256 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3257 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003258
3259 /* No one is allowed to remove a SELinux security label.
3260 You can change the label, but all data must be labeled. */
3261 return -EACCES;
3262}
3263
James Morrisd381d8a2005-10-30 14:59:22 -08003264/*
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003265 * Copy the inode security context value to the user.
James Morrisd381d8a2005-10-30 14:59:22 -08003266 *
3267 * Permission check is handled by selinux_inode_getxattr hook.
3268 */
Andreas Gruenbacherea861df2015-12-24 11:09:39 -05003269static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003270{
David P. Quigley42492592008-02-04 22:29:39 -08003271 u32 size;
3272 int error;
3273 char *context = NULL;
Paul Moore20cdef82016-04-04 14:14:42 -04003274 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003275
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00003276 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3277 return -EOPNOTSUPP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003278
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003279 /*
3280 * If the caller has CAP_MAC_ADMIN, then get the raw context
3281 * value even if it is not defined by current policy; otherwise,
3282 * use the in-core value under current policy.
3283 * Use the non-auditing forms of the permission checks since
3284 * getxattr may be called by unprivileged processes commonly
3285 * and lack of permission just means that we fall back to the
3286 * in-core context value, not a denial.
3287 */
Paul Moore20cdef82016-04-04 14:14:42 -04003288 isec = inode_security(inode);
Stephen Smalleydb590002017-04-20 11:31:30 -04003289 if (has_cap_mac_admin(false))
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003290 error = security_sid_to_context_force(&selinux_state,
3291 isec->sid, &context,
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003292 &size);
3293 else
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003294 error = security_sid_to_context(&selinux_state, isec->sid,
3295 &context, &size);
David P. Quigley42492592008-02-04 22:29:39 -08003296 if (error)
3297 return error;
3298 error = size;
3299 if (alloc) {
3300 *buffer = context;
3301 goto out_nofree;
3302 }
3303 kfree(context);
3304out_nofree:
3305 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003306}
3307
3308static int selinux_inode_setsecurity(struct inode *inode, const char *name,
Eric Paris828dfe12008-04-17 13:17:49 -04003309 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003310{
Paul Moore2c971652016-04-19 16:36:28 -04003311 struct inode_security_struct *isec = inode_security_novalidate(inode);
Ondrej Mosnacek53e0c2a2018-12-21 21:18:53 +01003312 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003313 u32 newsid;
3314 int rc;
3315
3316 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3317 return -EOPNOTSUPP;
3318
Ondrej Mosnacek53e0c2a2018-12-21 21:18:53 +01003319 if (!(sbsec->flags & SBLABEL_MNT))
3320 return -EOPNOTSUPP;
3321
Linus Torvalds1da177e2005-04-16 15:20:36 -07003322 if (!value || !size)
3323 return -EACCES;
3324
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003325 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3326 GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003327 if (rc)
3328 return rc;
3329
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003330 spin_lock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003331 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003332 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05003333 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003334 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003335 return 0;
3336}
3337
3338static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3339{
3340 const int len = sizeof(XATTR_NAME_SELINUX);
3341 if (buffer && len <= buffer_size)
3342 memcpy(buffer, XATTR_NAME_SELINUX, len);
3343 return len;
3344}
3345
Andreas Gruenbacherd6335d72015-12-24 11:09:39 -05003346static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02003347{
Andreas Gruenbachere817c2f2016-02-18 12:04:08 +01003348 struct inode_security_struct *isec = inode_security_novalidate(inode);
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02003349 *secid = isec->sid;
3350}
3351
Vivek Goyal56909eb2016-07-13 10:44:48 -04003352static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3353{
3354 u32 sid;
3355 struct task_security_struct *tsec;
3356 struct cred *new_creds = *new;
3357
3358 if (new_creds == NULL) {
3359 new_creds = prepare_creds();
3360 if (!new_creds)
3361 return -ENOMEM;
3362 }
3363
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07003364 tsec = selinux_cred(new_creds);
Vivek Goyal56909eb2016-07-13 10:44:48 -04003365 /* Get label from overlay inode and set it in create_sid */
3366 selinux_inode_getsecid(d_inode(src), &sid);
3367 tsec->create_sid = sid;
3368 *new = new_creds;
3369 return 0;
3370}
3371
Vivek Goyal19472b62016-07-13 10:44:50 -04003372static int selinux_inode_copy_up_xattr(const char *name)
3373{
3374 /* The copy_up hook above sets the initial context on an inode, but we
3375 * don't then want to overwrite it by blindly copying all the lower
3376 * xattrs up. Instead, we have to filter out SELinux-related xattrs.
3377 */
3378 if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3379 return 1; /* Discard */
3380 /*
3381 * Any other attribute apart from SELINUX is not claimed, supported
3382 * by selinux.
3383 */
3384 return -EOPNOTSUPP;
3385}
3386
Ondrej Mosnacekec882da2019-02-22 15:57:17 +01003387/* kernfs node operations */
3388
YueHaibingc72c4cd2019-03-22 22:04:00 +08003389static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
3390 struct kernfs_node *kn)
Ondrej Mosnacekec882da2019-02-22 15:57:17 +01003391{
3392 const struct task_security_struct *tsec = current_security();
3393 u32 parent_sid, newsid, clen;
3394 int rc;
3395 char *context;
3396
Ondrej Mosnacek1537ad12019-04-03 09:29:41 +02003397 rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, NULL, 0);
Ondrej Mosnacekec882da2019-02-22 15:57:17 +01003398 if (rc == -ENODATA)
3399 return 0;
3400 else if (rc < 0)
3401 return rc;
3402
3403 clen = (u32)rc;
3404 context = kmalloc(clen, GFP_KERNEL);
3405 if (!context)
3406 return -ENOMEM;
3407
Ondrej Mosnacek1537ad12019-04-03 09:29:41 +02003408 rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, context, clen);
Ondrej Mosnacekec882da2019-02-22 15:57:17 +01003409 if (rc < 0) {
3410 kfree(context);
3411 return rc;
3412 }
3413
3414 rc = security_context_to_sid(&selinux_state, context, clen, &parent_sid,
3415 GFP_KERNEL);
3416 kfree(context);
3417 if (rc)
3418 return rc;
3419
3420 if (tsec->create_sid) {
3421 newsid = tsec->create_sid;
3422 } else {
3423 u16 secclass = inode_mode_to_security_class(kn->mode);
3424 struct qstr q;
3425
3426 q.name = kn->name;
3427 q.hash_len = hashlen_string(kn_dir, kn->name);
3428
3429 rc = security_transition_sid(&selinux_state, tsec->sid,
3430 parent_sid, secclass, &q,
3431 &newsid);
3432 if (rc)
3433 return rc;
3434 }
3435
3436 rc = security_sid_to_context_force(&selinux_state, newsid,
3437 &context, &clen);
3438 if (rc)
3439 return rc;
3440
Ondrej Mosnacek1537ad12019-04-03 09:29:41 +02003441 rc = kernfs_xattr_set(kn, XATTR_NAME_SELINUX, context, clen,
3442 XATTR_CREATE);
Ondrej Mosnacekec882da2019-02-22 15:57:17 +01003443 kfree(context);
3444 return rc;
3445}
3446
3447
Linus Torvalds1da177e2005-04-16 15:20:36 -07003448/* file security operations */
3449
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003450static int selinux_revalidate_file_permission(struct file *file, int mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003451{
David Howells88e67f32008-11-14 10:39:21 +11003452 const struct cred *cred = current_cred();
Al Viro496ad9a2013-01-23 17:07:38 -05003453 struct inode *inode = file_inode(file);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003454
Linus Torvalds1da177e2005-04-16 15:20:36 -07003455 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3456 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3457 mask |= MAY_APPEND;
3458
Paul Moore389fb8002009-03-27 17:10:34 -04003459 return file_has_perm(cred, file,
3460 file_mask_to_av(inode->i_mode, mask));
Linus Torvalds1da177e2005-04-16 15:20:36 -07003461}
3462
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003463static int selinux_file_permission(struct file *file, int mask)
3464{
Al Viro496ad9a2013-01-23 17:07:38 -05003465 struct inode *inode = file_inode(file);
Casey Schauflerbb6c6b02018-09-21 17:22:32 -07003466 struct file_security_struct *fsec = selinux_file(file);
Andreas Gruenbacherb1973672016-01-05 23:12:33 +01003467 struct inode_security_struct *isec;
Stephen Smalley20dda182009-06-22 14:54:53 -04003468 u32 sid = current_sid();
3469
Paul Moore389fb8002009-03-27 17:10:34 -04003470 if (!mask)
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003471 /* No permission to check. Existence test. */
3472 return 0;
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003473
Andreas Gruenbacherb1973672016-01-05 23:12:33 +01003474 isec = inode_security(inode);
Stephen Smalley20dda182009-06-22 14:54:53 -04003475 if (sid == fsec->sid && fsec->isid == isec->sid &&
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003476 fsec->pseqno == avc_policy_seqno(&selinux_state))
Eric Paris83d49852012-04-04 13:45:40 -04003477 /* No change since file_open check. */
Stephen Smalley20dda182009-06-22 14:54:53 -04003478 return 0;
3479
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003480 return selinux_revalidate_file_permission(file, mask);
3481}
3482
Linus Torvalds1da177e2005-04-16 15:20:36 -07003483static int selinux_file_alloc_security(struct file *file)
3484{
3485 return file_alloc_security(file);
3486}
3487
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003488/*
3489 * Check whether a task has the ioctl permission and cmd
3490 * operation to an inode.
3491 */
Geliang Tang1d2a1682015-10-21 17:44:27 -04003492static int ioctl_has_perm(const struct cred *cred, struct file *file,
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003493 u32 requested, u16 cmd)
3494{
3495 struct common_audit_data ad;
Casey Schauflerbb6c6b02018-09-21 17:22:32 -07003496 struct file_security_struct *fsec = selinux_file(file);
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003497 struct inode *inode = file_inode(file);
Paul Moore20cdef82016-04-04 14:14:42 -04003498 struct inode_security_struct *isec;
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003499 struct lsm_ioctlop_audit ioctl;
3500 u32 ssid = cred_sid(cred);
3501 int rc;
3502 u8 driver = cmd >> 8;
3503 u8 xperm = cmd & 0xff;
3504
3505 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3506 ad.u.op = &ioctl;
3507 ad.u.op->cmd = cmd;
3508 ad.u.op->path = file->f_path;
3509
3510 if (ssid != fsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003511 rc = avc_has_perm(&selinux_state,
3512 ssid, fsec->sid,
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003513 SECCLASS_FD,
3514 FD__USE,
3515 &ad);
3516 if (rc)
3517 goto out;
3518 }
3519
3520 if (unlikely(IS_PRIVATE(inode)))
3521 return 0;
3522
Paul Moore20cdef82016-04-04 14:14:42 -04003523 isec = inode_security(inode);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003524 rc = avc_has_extended_perms(&selinux_state,
3525 ssid, isec->sid, isec->sclass,
3526 requested, driver, xperm, &ad);
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003527out:
3528 return rc;
3529}
3530
Linus Torvalds1da177e2005-04-16 15:20:36 -07003531static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3532 unsigned long arg)
3533{
David Howells88e67f32008-11-14 10:39:21 +11003534 const struct cred *cred = current_cred();
Eric Paris0b24dcb2011-02-25 15:39:20 -05003535 int error = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003536
Eric Paris0b24dcb2011-02-25 15:39:20 -05003537 switch (cmd) {
3538 case FIONREAD:
3539 /* fall through */
3540 case FIBMAP:
3541 /* fall through */
3542 case FIGETBSZ:
3543 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003544 case FS_IOC_GETFLAGS:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003545 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003546 case FS_IOC_GETVERSION:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003547 error = file_has_perm(cred, file, FILE__GETATTR);
3548 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003549
Al Viro2f99c362012-03-23 16:04:05 -04003550 case FS_IOC_SETFLAGS:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003551 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003552 case FS_IOC_SETVERSION:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003553 error = file_has_perm(cred, file, FILE__SETATTR);
3554 break;
3555
3556 /* sys_ioctl() checks */
3557 case FIONBIO:
3558 /* fall through */
3559 case FIOASYNC:
3560 error = file_has_perm(cred, file, 0);
3561 break;
3562
3563 case KDSKBENT:
3564 case KDSKBSENT:
Eric Paris6a9de492012-01-03 12:25:14 -05003565 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
Micah Mortonc1a85a02019-01-07 16:10:53 -08003566 CAP_OPT_NONE, true);
Eric Paris0b24dcb2011-02-25 15:39:20 -05003567 break;
3568
3569 /* default case assumes that the command will go
3570 * to the file's ioctl() function.
3571 */
3572 default:
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003573 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
Eric Paris0b24dcb2011-02-25 15:39:20 -05003574 }
3575 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003576}
3577
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003578static int default_noexec;
3579
Linus Torvalds1da177e2005-04-16 15:20:36 -07003580static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3581{
David Howells88e67f32008-11-14 10:39:21 +11003582 const struct cred *cred = current_cred();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003583 u32 sid = cred_sid(cred);
David Howellsd84f4f92008-11-14 10:39:23 +11003584 int rc = 0;
David Howells88e67f32008-11-14 10:39:21 +11003585
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003586 if (default_noexec &&
Stephen Smalley892e8ca2015-07-10 09:40:59 -04003587 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3588 (!shared && (prot & PROT_WRITE)))) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07003589 /*
3590 * We are making executable an anonymous mapping or a
3591 * private file mapping that will also be writable.
3592 * This has an additional check.
3593 */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003594 rc = avc_has_perm(&selinux_state,
3595 sid, sid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003596 PROCESS__EXECMEM, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003597 if (rc)
David Howellsd84f4f92008-11-14 10:39:23 +11003598 goto error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003599 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003600
3601 if (file) {
3602 /* read access is always possible with a mapping */
3603 u32 av = FILE__READ;
3604
3605 /* write access only matters if the mapping is shared */
3606 if (shared && (prot & PROT_WRITE))
3607 av |= FILE__WRITE;
3608
3609 if (prot & PROT_EXEC)
3610 av |= FILE__EXECUTE;
3611
David Howells88e67f32008-11-14 10:39:21 +11003612 return file_has_perm(cred, file, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003613 }
David Howellsd84f4f92008-11-14 10:39:23 +11003614
3615error:
3616 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003617}
3618
Al Viroe5467852012-05-30 13:30:51 -04003619static int selinux_mmap_addr(unsigned long addr)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003620{
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07003621 int rc = 0;
Paul Moore98883bf2014-03-19 16:46:11 -04003622
3623 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3624 u32 sid = current_sid();
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003625 rc = avc_has_perm(&selinux_state,
3626 sid, sid, SECCLASS_MEMPROTECT,
Paul Moore98883bf2014-03-19 16:46:11 -04003627 MEMPROTECT__MMAP_ZERO, NULL);
3628 }
3629
3630 return rc;
Al Viroe5467852012-05-30 13:30:51 -04003631}
Linus Torvalds1da177e2005-04-16 15:20:36 -07003632
Al Viroe5467852012-05-30 13:30:51 -04003633static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3634 unsigned long prot, unsigned long flags)
3635{
Stephen Smalley3ba4bf52017-05-05 09:14:48 -04003636 struct common_audit_data ad;
3637 int rc;
3638
3639 if (file) {
3640 ad.type = LSM_AUDIT_DATA_FILE;
3641 ad.u.file = file;
3642 rc = inode_has_perm(current_cred(), file_inode(file),
3643 FILE__MAP, &ad);
3644 if (rc)
3645 return rc;
3646 }
3647
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003648 if (selinux_state.checkreqprot)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003649 prot = reqprot;
3650
3651 return file_map_prot_check(file, prot,
3652 (flags & MAP_TYPE) == MAP_SHARED);
3653}
3654
3655static int selinux_file_mprotect(struct vm_area_struct *vma,
3656 unsigned long reqprot,
3657 unsigned long prot)
3658{
David Howells88e67f32008-11-14 10:39:21 +11003659 const struct cred *cred = current_cred();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003660 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003661
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05003662 if (selinux_state.checkreqprot)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003663 prot = reqprot;
3664
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003665 if (default_noexec &&
3666 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
James Morrisd541bbe2009-01-29 12:19:51 +11003667 int rc = 0;
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003668 if (vma->vm_start >= vma->vm_mm->start_brk &&
3669 vma->vm_end <= vma->vm_mm->brk) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003670 rc = avc_has_perm(&selinux_state,
3671 sid, sid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003672 PROCESS__EXECHEAP, NULL);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003673 } else if (!vma->vm_file &&
Stephen Smalleyc2316db2016-04-08 13:55:03 -04003674 ((vma->vm_start <= vma->vm_mm->start_stack &&
3675 vma->vm_end >= vma->vm_mm->start_stack) ||
Andy Lutomirskid17af502016-09-30 10:58:58 -07003676 vma_is_stack_for_current(vma))) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003677 rc = avc_has_perm(&selinux_state,
3678 sid, sid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003679 PROCESS__EXECSTACK, NULL);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003680 } else if (vma->vm_file && vma->anon_vma) {
3681 /*
3682 * We are making executable a file mapping that has
3683 * had some COW done. Since pages might have been
3684 * written, check ability to execute the possibly
3685 * modified content. This typically should only
3686 * occur for text relocations.
3687 */
David Howellsd84f4f92008-11-14 10:39:23 +11003688 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
Stephen Smalleydb4c9642006-02-01 03:05:54 -08003689 }
Lorenzo Hernandez García-Hierro6b992192005-06-25 14:54:34 -07003690 if (rc)
3691 return rc;
3692 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003693
3694 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3695}
3696
3697static int selinux_file_lock(struct file *file, unsigned int cmd)
3698{
David Howells88e67f32008-11-14 10:39:21 +11003699 const struct cred *cred = current_cred();
3700
3701 return file_has_perm(cred, file, FILE__LOCK);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003702}
3703
3704static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3705 unsigned long arg)
3706{
David Howells88e67f32008-11-14 10:39:21 +11003707 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003708 int err = 0;
3709
3710 switch (cmd) {
Eric Paris828dfe12008-04-17 13:17:49 -04003711 case F_SETFL:
Eric Paris828dfe12008-04-17 13:17:49 -04003712 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
David Howells88e67f32008-11-14 10:39:21 +11003713 err = file_has_perm(cred, file, FILE__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003714 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003715 }
3716 /* fall through */
3717 case F_SETOWN:
3718 case F_SETSIG:
3719 case F_GETFL:
3720 case F_GETOWN:
3721 case F_GETSIG:
Cyrill Gorcunov1d151c32012-07-30 14:43:00 -07003722 case F_GETOWNER_UIDS:
Eric Paris828dfe12008-04-17 13:17:49 -04003723 /* Just check FD__USE permission */
David Howells88e67f32008-11-14 10:39:21 +11003724 err = file_has_perm(cred, file, 0);
Eric Paris828dfe12008-04-17 13:17:49 -04003725 break;
3726 case F_GETLK:
3727 case F_SETLK:
3728 case F_SETLKW:
Jeff Layton0d3f7a22014-04-22 08:23:58 -04003729 case F_OFD_GETLK:
3730 case F_OFD_SETLK:
3731 case F_OFD_SETLKW:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003732#if BITS_PER_LONG == 32
Eric Paris828dfe12008-04-17 13:17:49 -04003733 case F_GETLK64:
3734 case F_SETLK64:
3735 case F_SETLKW64:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003736#endif
David Howells88e67f32008-11-14 10:39:21 +11003737 err = file_has_perm(cred, file, FILE__LOCK);
Eric Paris828dfe12008-04-17 13:17:49 -04003738 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003739 }
3740
3741 return err;
3742}
3743
Jeff Laytone0b93ed2014-08-22 11:27:32 -04003744static void selinux_file_set_fowner(struct file *file)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003745{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003746 struct file_security_struct *fsec;
3747
Casey Schauflerbb6c6b02018-09-21 17:22:32 -07003748 fsec = selinux_file(file);
David Howells275bb412008-11-14 10:39:19 +11003749 fsec->fown_sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003750}
3751
3752static int selinux_file_send_sigiotask(struct task_struct *tsk,
3753 struct fown_struct *fown, int signum)
3754{
Eric Paris828dfe12008-04-17 13:17:49 -04003755 struct file *file;
Stephen Smalley65c90bc2009-05-04 15:43:18 -04003756 u32 sid = task_sid(tsk);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003757 u32 perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003758 struct file_security_struct *fsec;
3759
3760 /* struct fown_struct is never outside the context of a struct file */
Eric Paris828dfe12008-04-17 13:17:49 -04003761 file = container_of(fown, struct file, f_owner);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003762
Casey Schauflerbb6c6b02018-09-21 17:22:32 -07003763 fsec = selinux_file(file);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003764
3765 if (!signum)
3766 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3767 else
3768 perm = signal_to_av(signum);
3769
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003770 return avc_has_perm(&selinux_state,
3771 fsec->fown_sid, sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003772 SECCLASS_PROCESS, perm, NULL);
3773}
3774
3775static int selinux_file_receive(struct file *file)
3776{
David Howells88e67f32008-11-14 10:39:21 +11003777 const struct cred *cred = current_cred();
3778
3779 return file_has_perm(cred, file, file_to_av(file));
Linus Torvalds1da177e2005-04-16 15:20:36 -07003780}
3781
Al Viro94817692018-07-10 14:13:18 -04003782static int selinux_file_open(struct file *file)
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003783{
3784 struct file_security_struct *fsec;
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003785 struct inode_security_struct *isec;
David Howellsd84f4f92008-11-14 10:39:23 +11003786
Casey Schauflerbb6c6b02018-09-21 17:22:32 -07003787 fsec = selinux_file(file);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05003788 isec = inode_security(file_inode(file));
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003789 /*
3790 * Save inode label and policy sequence number
3791 * at open-time so that selinux_file_permission
3792 * can determine whether revalidation is necessary.
3793 * Task label is already saved in the file security
3794 * struct as its SID.
3795 */
3796 fsec->isid = isec->sid;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003797 fsec->pseqno = avc_policy_seqno(&selinux_state);
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003798 /*
3799 * Since the inode label or policy seqno may have changed
3800 * between the selinux_inode_permission check and the saving
3801 * of state above, recheck that access is still permitted.
3802 * Otherwise, access might never be revalidated against the
3803 * new inode label or new policy.
3804 * This check is not redundant - do not remove.
3805 */
Al Viro94817692018-07-10 14:13:18 -04003806 return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003807}
3808
Linus Torvalds1da177e2005-04-16 15:20:36 -07003809/* task security operations */
3810
Tetsuo Handaa79be232017-03-28 23:08:45 +09003811static int selinux_task_alloc(struct task_struct *task,
3812 unsigned long clone_flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003813{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003814 u32 sid = current_sid();
3815
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003816 return avc_has_perm(&selinux_state,
3817 sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003818}
3819
David Howellsf1752ee2008-11-14 10:39:17 +11003820/*
David Howellsd84f4f92008-11-14 10:39:23 +11003821 * prepare a new set of credentials for modification
3822 */
3823static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3824 gfp_t gfp)
3825{
Casey Schauflerbbd36622018-11-12 09:30:56 -08003826 const struct task_security_struct *old_tsec = selinux_cred(old);
3827 struct task_security_struct *tsec = selinux_cred(new);
David Howellsd84f4f92008-11-14 10:39:23 +11003828
Casey Schauflerbbd36622018-11-12 09:30:56 -08003829 *tsec = *old_tsec;
David Howellsd84f4f92008-11-14 10:39:23 +11003830 return 0;
3831}
3832
3833/*
David Howellsee18d642009-09-02 09:14:21 +01003834 * transfer the SELinux data to a blank set of creds
3835 */
3836static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3837{
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07003838 const struct task_security_struct *old_tsec = selinux_cred(old);
3839 struct task_security_struct *tsec = selinux_cred(new);
David Howellsee18d642009-09-02 09:14:21 +01003840
3841 *tsec = *old_tsec;
3842}
3843
Matthew Garrett3ec30112018-01-08 13:36:19 -08003844static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
3845{
3846 *secid = cred_sid(c);
3847}
3848
David Howellsee18d642009-09-02 09:14:21 +01003849/*
David Howells3a3b7ce2008-11-14 10:39:28 +11003850 * set the security data for a kernel service
3851 * - all the creation contexts are set to unlabelled
3852 */
3853static int selinux_kernel_act_as(struct cred *new, u32 secid)
3854{
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07003855 struct task_security_struct *tsec = selinux_cred(new);
David Howells3a3b7ce2008-11-14 10:39:28 +11003856 u32 sid = current_sid();
3857 int ret;
3858
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003859 ret = avc_has_perm(&selinux_state,
3860 sid, secid,
David Howells3a3b7ce2008-11-14 10:39:28 +11003861 SECCLASS_KERNEL_SERVICE,
3862 KERNEL_SERVICE__USE_AS_OVERRIDE,
3863 NULL);
3864 if (ret == 0) {
3865 tsec->sid = secid;
3866 tsec->create_sid = 0;
3867 tsec->keycreate_sid = 0;
3868 tsec->sockcreate_sid = 0;
3869 }
3870 return ret;
3871}
3872
3873/*
3874 * set the file creation context in a security record to the same as the
3875 * objective context of the specified inode
3876 */
3877static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3878{
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05003879 struct inode_security_struct *isec = inode_security(inode);
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07003880 struct task_security_struct *tsec = selinux_cred(new);
David Howells3a3b7ce2008-11-14 10:39:28 +11003881 u32 sid = current_sid();
3882 int ret;
3883
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003884 ret = avc_has_perm(&selinux_state,
3885 sid, isec->sid,
David Howells3a3b7ce2008-11-14 10:39:28 +11003886 SECCLASS_KERNEL_SERVICE,
3887 KERNEL_SERVICE__CREATE_FILES_AS,
3888 NULL);
3889
3890 if (ret == 0)
3891 tsec->create_sid = isec->sid;
David Howellsef574712010-02-26 01:56:16 +00003892 return ret;
David Howells3a3b7ce2008-11-14 10:39:28 +11003893}
3894
Eric Parisdd8dbf22009-11-03 16:35:32 +11003895static int selinux_kernel_module_request(char *kmod_name)
Eric Paris25354c42009-08-13 09:45:03 -04003896{
Eric Parisdd8dbf22009-11-03 16:35:32 +11003897 struct common_audit_data ad;
3898
Eric Paris50c205f2012-04-04 15:01:43 -04003899 ad.type = LSM_AUDIT_DATA_KMOD;
Eric Parisdd8dbf22009-11-03 16:35:32 +11003900 ad.u.kmod_name = kmod_name;
3901
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003902 return avc_has_perm(&selinux_state,
3903 current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
Eric Parisdd8dbf22009-11-03 16:35:32 +11003904 SYSTEM__MODULE_REQUEST, &ad);
Eric Paris25354c42009-08-13 09:45:03 -04003905}
3906
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003907static int selinux_kernel_module_from_file(struct file *file)
3908{
3909 struct common_audit_data ad;
3910 struct inode_security_struct *isec;
3911 struct file_security_struct *fsec;
3912 u32 sid = current_sid();
3913 int rc;
3914
3915 /* init_module */
3916 if (file == NULL)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003917 return avc_has_perm(&selinux_state,
3918 sid, sid, SECCLASS_SYSTEM,
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003919 SYSTEM__MODULE_LOAD, NULL);
3920
3921 /* finit_module */
Paul Moore20cdef82016-04-04 14:14:42 -04003922
Vivek Goyal43af5de2016-09-09 11:37:49 -04003923 ad.type = LSM_AUDIT_DATA_FILE;
3924 ad.u.file = file;
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003925
Casey Schauflerbb6c6b02018-09-21 17:22:32 -07003926 fsec = selinux_file(file);
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003927 if (sid != fsec->sid) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003928 rc = avc_has_perm(&selinux_state,
3929 sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003930 if (rc)
3931 return rc;
3932 }
3933
Paul Moore20cdef82016-04-04 14:14:42 -04003934 isec = inode_security(file_inode(file));
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003935 return avc_has_perm(&selinux_state,
3936 sid, isec->sid, SECCLASS_SYSTEM,
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003937 SYSTEM__MODULE_LOAD, &ad);
3938}
3939
3940static int selinux_kernel_read_file(struct file *file,
3941 enum kernel_read_file_id id)
3942{
3943 int rc = 0;
3944
3945 switch (id) {
3946 case READING_MODULE:
3947 rc = selinux_kernel_module_from_file(file);
3948 break;
3949 default:
3950 break;
3951 }
3952
3953 return rc;
3954}
3955
Mimi Zoharc77b8cd2018-07-13 14:06:02 -04003956static int selinux_kernel_load_data(enum kernel_load_data_id id)
3957{
3958 int rc = 0;
3959
3960 switch (id) {
3961 case LOADING_MODULE:
3962 rc = selinux_kernel_module_from_file(NULL);
3963 default:
3964 break;
3965 }
3966
3967 return rc;
3968}
3969
Linus Torvalds1da177e2005-04-16 15:20:36 -07003970static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3971{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003972 return avc_has_perm(&selinux_state,
3973 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003974 PROCESS__SETPGID, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003975}
3976
3977static int selinux_task_getpgid(struct task_struct *p)
3978{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003979 return avc_has_perm(&selinux_state,
3980 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003981 PROCESS__GETPGID, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003982}
3983
3984static int selinux_task_getsid(struct task_struct *p)
3985{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003986 return avc_has_perm(&selinux_state,
3987 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003988 PROCESS__GETSESSION, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003989}
3990
David Quigleyf9008e4c2006-06-30 01:55:46 -07003991static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3992{
David Howells275bb412008-11-14 10:39:19 +11003993 *secid = task_sid(p);
David Quigleyf9008e4c2006-06-30 01:55:46 -07003994}
3995
Linus Torvalds1da177e2005-04-16 15:20:36 -07003996static int selinux_task_setnice(struct task_struct *p, int nice)
3997{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05003998 return avc_has_perm(&selinux_state,
3999 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004000 PROCESS__SETSCHED, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004001}
4002
James Morris03e68062006-06-23 02:03:58 -07004003static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4004{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004005 return avc_has_perm(&selinux_state,
4006 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004007 PROCESS__SETSCHED, NULL);
James Morris03e68062006-06-23 02:03:58 -07004008}
4009
David Quigleya1836a42006-06-30 01:55:49 -07004010static int selinux_task_getioprio(struct task_struct *p)
4011{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004012 return avc_has_perm(&selinux_state,
4013 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004014 PROCESS__GETSCHED, NULL);
David Quigleya1836a42006-06-30 01:55:49 -07004015}
4016
Corentin LABBE42985552017-10-04 20:32:18 +02004017static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4018 unsigned int flags)
Stephen Smalley791ec492017-02-17 07:57:00 -05004019{
4020 u32 av = 0;
4021
Stephen Smalley84e68852017-02-28 09:35:08 -05004022 if (!flags)
4023 return 0;
Stephen Smalley791ec492017-02-17 07:57:00 -05004024 if (flags & LSM_PRLIMIT_WRITE)
4025 av |= PROCESS__SETRLIMIT;
4026 if (flags & LSM_PRLIMIT_READ)
4027 av |= PROCESS__GETRLIMIT;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004028 return avc_has_perm(&selinux_state,
4029 cred_sid(cred), cred_sid(tcred),
Stephen Smalley791ec492017-02-17 07:57:00 -05004030 SECCLASS_PROCESS, av, NULL);
4031}
4032
Jiri Slaby8fd00b42009-08-26 18:41:16 +02004033static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4034 struct rlimit *new_rlim)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004035{
Jiri Slaby8fd00b42009-08-26 18:41:16 +02004036 struct rlimit *old_rlim = p->signal->rlim + resource;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004037
4038 /* Control the ability to change the hard limit (whether
4039 lowering or raising it), so that the hard limit can
4040 later be used as a safe reset point for the soft limit
David Howellsd84f4f92008-11-14 10:39:23 +11004041 upon context transitions. See selinux_bprm_committing_creds. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07004042 if (old_rlim->rlim_max != new_rlim->rlim_max)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004043 return avc_has_perm(&selinux_state,
4044 current_sid(), task_sid(p),
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004045 SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004046
4047 return 0;
4048}
4049
KOSAKI Motohirob0ae1982010-10-15 04:21:18 +09004050static int selinux_task_setscheduler(struct task_struct *p)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004051{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004052 return avc_has_perm(&selinux_state,
4053 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004054 PROCESS__SETSCHED, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004055}
4056
4057static int selinux_task_getscheduler(struct task_struct *p)
4058{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004059 return avc_has_perm(&selinux_state,
4060 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004061 PROCESS__GETSCHED, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004062}
4063
David Quigley35601542006-06-23 02:04:01 -07004064static int selinux_task_movememory(struct task_struct *p)
4065{
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004066 return avc_has_perm(&selinux_state,
4067 current_sid(), task_sid(p), SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004068 PROCESS__SETSCHED, NULL);
David Quigley35601542006-06-23 02:04:01 -07004069}
4070
Eric W. Biedermanae7795b2018-09-25 11:27:20 +02004071static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
Stephen Smalley6b4f3d02017-09-08 12:40:01 -04004072 int sig, const struct cred *cred)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004073{
Stephen Smalley6b4f3d02017-09-08 12:40:01 -04004074 u32 secid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004075 u32 perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004076
Linus Torvalds1da177e2005-04-16 15:20:36 -07004077 if (!sig)
4078 perm = PROCESS__SIGNULL; /* null signal; existence test */
4079 else
4080 perm = signal_to_av(sig);
Stephen Smalley6b4f3d02017-09-08 12:40:01 -04004081 if (!cred)
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004082 secid = current_sid();
Stephen Smalley6b4f3d02017-09-08 12:40:01 -04004083 else
4084 secid = cred_sid(cred);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004085 return avc_has_perm(&selinux_state,
4086 secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004087}
4088
Linus Torvalds1da177e2005-04-16 15:20:36 -07004089static void selinux_task_to_inode(struct task_struct *p,
4090 struct inode *inode)
4091{
Casey Schaufler80788c22018-09-21 17:19:11 -07004092 struct inode_security_struct *isec = selinux_inode(inode);
David Howells275bb412008-11-14 10:39:19 +11004093 u32 sid = task_sid(p);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004094
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004095 spin_lock(&isec->lock);
Andreas Gruenbacherdb978da2016-11-10 22:18:28 +01004096 isec->sclass = inode_mode_to_security_class(inode->i_mode);
David Howells275bb412008-11-14 10:39:19 +11004097 isec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05004098 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004099 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004100}
4101
Linus Torvalds1da177e2005-04-16 15:20:36 -07004102/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004103static int selinux_parse_skb_ipv4(struct sk_buff *skb,
Thomas Liu2bf49692009-07-14 12:14:09 -04004104 struct common_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004105{
4106 int offset, ihlen, ret = -EINVAL;
4107 struct iphdr _iph, *ih;
4108
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03004109 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004110 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4111 if (ih == NULL)
4112 goto out;
4113
4114 ihlen = ih->ihl * 4;
4115 if (ihlen < sizeof(_iph))
4116 goto out;
4117
Eric Paris48c62af2012-04-02 13:15:44 -04004118 ad->u.net->v4info.saddr = ih->saddr;
4119 ad->u.net->v4info.daddr = ih->daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004120 ret = 0;
4121
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004122 if (proto)
4123 *proto = ih->protocol;
4124
Linus Torvalds1da177e2005-04-16 15:20:36 -07004125 switch (ih->protocol) {
Eric Paris828dfe12008-04-17 13:17:49 -04004126 case IPPROTO_TCP: {
4127 struct tcphdr _tcph, *th;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004128
Eric Paris828dfe12008-04-17 13:17:49 -04004129 if (ntohs(ih->frag_off) & IP_OFFSET)
4130 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004131
4132 offset += ihlen;
4133 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4134 if (th == NULL)
4135 break;
4136
Eric Paris48c62af2012-04-02 13:15:44 -04004137 ad->u.net->sport = th->source;
4138 ad->u.net->dport = th->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004139 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004140 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004141
Eric Paris828dfe12008-04-17 13:17:49 -04004142 case IPPROTO_UDP: {
4143 struct udphdr _udph, *uh;
4144
4145 if (ntohs(ih->frag_off) & IP_OFFSET)
4146 break;
4147
4148 offset += ihlen;
4149 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4150 if (uh == NULL)
4151 break;
4152
Eric Paris48c62af2012-04-02 13:15:44 -04004153 ad->u.net->sport = uh->source;
4154 ad->u.net->dport = uh->dest;
Eric Paris828dfe12008-04-17 13:17:49 -04004155 break;
4156 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004157
James Morris2ee92d42006-11-13 16:09:01 -08004158 case IPPROTO_DCCP: {
4159 struct dccp_hdr _dccph, *dh;
4160
4161 if (ntohs(ih->frag_off) & IP_OFFSET)
4162 break;
4163
4164 offset += ihlen;
4165 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4166 if (dh == NULL)
4167 break;
4168
Eric Paris48c62af2012-04-02 13:15:44 -04004169 ad->u.net->sport = dh->dccph_sport;
4170 ad->u.net->dport = dh->dccph_dport;
James Morris2ee92d42006-11-13 16:09:01 -08004171 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004172 }
James Morris2ee92d42006-11-13 16:09:01 -08004173
Richard Hainesd4529302018-02-13 20:57:18 +00004174#if IS_ENABLED(CONFIG_IP_SCTP)
4175 case IPPROTO_SCTP: {
4176 struct sctphdr _sctph, *sh;
4177
4178 if (ntohs(ih->frag_off) & IP_OFFSET)
4179 break;
4180
4181 offset += ihlen;
4182 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4183 if (sh == NULL)
4184 break;
4185
4186 ad->u.net->sport = sh->source;
4187 ad->u.net->dport = sh->dest;
4188 break;
4189 }
4190#endif
Eric Paris828dfe12008-04-17 13:17:49 -04004191 default:
4192 break;
4193 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004194out:
4195 return ret;
4196}
4197
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04004198#if IS_ENABLED(CONFIG_IPV6)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004199
4200/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004201static int selinux_parse_skb_ipv6(struct sk_buff *skb,
Thomas Liu2bf49692009-07-14 12:14:09 -04004202 struct common_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004203{
4204 u8 nexthdr;
4205 int ret = -EINVAL, offset;
4206 struct ipv6hdr _ipv6h, *ip6;
Jesse Gross75f28112011-11-30 17:05:51 -08004207 __be16 frag_off;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004208
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03004209 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004210 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4211 if (ip6 == NULL)
4212 goto out;
4213
Eric Paris48c62af2012-04-02 13:15:44 -04004214 ad->u.net->v6info.saddr = ip6->saddr;
4215 ad->u.net->v6info.daddr = ip6->daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004216 ret = 0;
4217
4218 nexthdr = ip6->nexthdr;
4219 offset += sizeof(_ipv6h);
Jesse Gross75f28112011-11-30 17:05:51 -08004220 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004221 if (offset < 0)
4222 goto out;
4223
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004224 if (proto)
4225 *proto = nexthdr;
4226
Linus Torvalds1da177e2005-04-16 15:20:36 -07004227 switch (nexthdr) {
4228 case IPPROTO_TCP: {
Eric Paris828dfe12008-04-17 13:17:49 -04004229 struct tcphdr _tcph, *th;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004230
4231 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4232 if (th == NULL)
4233 break;
4234
Eric Paris48c62af2012-04-02 13:15:44 -04004235 ad->u.net->sport = th->source;
4236 ad->u.net->dport = th->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004237 break;
4238 }
4239
4240 case IPPROTO_UDP: {
4241 struct udphdr _udph, *uh;
4242
4243 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4244 if (uh == NULL)
4245 break;
4246
Eric Paris48c62af2012-04-02 13:15:44 -04004247 ad->u.net->sport = uh->source;
4248 ad->u.net->dport = uh->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004249 break;
4250 }
4251
James Morris2ee92d42006-11-13 16:09:01 -08004252 case IPPROTO_DCCP: {
4253 struct dccp_hdr _dccph, *dh;
4254
4255 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4256 if (dh == NULL)
4257 break;
4258
Eric Paris48c62af2012-04-02 13:15:44 -04004259 ad->u.net->sport = dh->dccph_sport;
4260 ad->u.net->dport = dh->dccph_dport;
James Morris2ee92d42006-11-13 16:09:01 -08004261 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004262 }
James Morris2ee92d42006-11-13 16:09:01 -08004263
Richard Hainesd4529302018-02-13 20:57:18 +00004264#if IS_ENABLED(CONFIG_IP_SCTP)
4265 case IPPROTO_SCTP: {
4266 struct sctphdr _sctph, *sh;
4267
4268 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4269 if (sh == NULL)
4270 break;
4271
4272 ad->u.net->sport = sh->source;
4273 ad->u.net->dport = sh->dest;
4274 break;
4275 }
4276#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07004277 /* includes fragments */
4278 default:
4279 break;
4280 }
4281out:
4282 return ret;
4283}
4284
4285#endif /* IPV6 */
4286
Thomas Liu2bf49692009-07-14 12:14:09 -04004287static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
David Howellscf9481e2008-07-27 21:31:07 +10004288 char **_addrp, int src, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004289{
David Howellscf9481e2008-07-27 21:31:07 +10004290 char *addrp;
4291 int ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004292
Eric Paris48c62af2012-04-02 13:15:44 -04004293 switch (ad->u.net->family) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07004294 case PF_INET:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004295 ret = selinux_parse_skb_ipv4(skb, ad, proto);
David Howellscf9481e2008-07-27 21:31:07 +10004296 if (ret)
4297 goto parse_error;
Eric Paris48c62af2012-04-02 13:15:44 -04004298 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4299 &ad->u.net->v4info.daddr);
David Howellscf9481e2008-07-27 21:31:07 +10004300 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004301
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04004302#if IS_ENABLED(CONFIG_IPV6)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004303 case PF_INET6:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004304 ret = selinux_parse_skb_ipv6(skb, ad, proto);
David Howellscf9481e2008-07-27 21:31:07 +10004305 if (ret)
4306 goto parse_error;
Eric Paris48c62af2012-04-02 13:15:44 -04004307 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4308 &ad->u.net->v6info.daddr);
David Howellscf9481e2008-07-27 21:31:07 +10004309 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004310#endif /* IPV6 */
4311 default:
David Howellscf9481e2008-07-27 21:31:07 +10004312 addrp = NULL;
4313 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004314 }
4315
David Howellscf9481e2008-07-27 21:31:07 +10004316parse_error:
peter enderborgc103a912018-06-12 10:09:03 +02004317 pr_warn(
David Howellscf9481e2008-07-27 21:31:07 +10004318 "SELinux: failure in selinux_parse_skb(),"
4319 " unable to parse packet\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07004320 return ret;
David Howellscf9481e2008-07-27 21:31:07 +10004321
4322okay:
4323 if (_addrp)
4324 *_addrp = addrp;
4325 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004326}
4327
Paul Moore4f6a9932007-03-01 14:35:22 -05004328/**
Paul Moore220deb92008-01-29 08:38:23 -05004329 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
Paul Moore4f6a9932007-03-01 14:35:22 -05004330 * @skb: the packet
Paul Moore75e22912008-01-29 08:38:04 -05004331 * @family: protocol family
Paul Moore220deb92008-01-29 08:38:23 -05004332 * @sid: the packet's peer label SID
Paul Moore4f6a9932007-03-01 14:35:22 -05004333 *
4334 * Description:
Paul Moore220deb92008-01-29 08:38:23 -05004335 * Check the various different forms of network peer labeling and determine
4336 * the peer label/SID for the packet; most of the magic actually occurs in
4337 * the security server function security_net_peersid_cmp(). The function
4338 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4339 * or -EACCES if @sid is invalid due to inconsistencies with the different
4340 * peer labels.
Paul Moore4f6a9932007-03-01 14:35:22 -05004341 *
4342 */
Paul Moore220deb92008-01-29 08:38:23 -05004343static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
Paul Moore4f6a9932007-03-01 14:35:22 -05004344{
Paul Moore71f1cb02008-01-29 08:51:16 -05004345 int err;
Paul Moore4f6a9932007-03-01 14:35:22 -05004346 u32 xfrm_sid;
4347 u32 nlbl_sid;
Paul Moore220deb92008-01-29 08:38:23 -05004348 u32 nlbl_type;
Paul Moore4f6a9932007-03-01 14:35:22 -05004349
Paul Moore817eff72013-12-10 14:57:54 -05004350 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
Paul Moorebed4d7e2013-07-23 17:38:40 -04004351 if (unlikely(err))
4352 return -EACCES;
4353 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4354 if (unlikely(err))
4355 return -EACCES;
Paul Moore220deb92008-01-29 08:38:23 -05004356
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004357 err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4358 nlbl_type, xfrm_sid, sid);
Paul Moore71f1cb02008-01-29 08:51:16 -05004359 if (unlikely(err)) {
peter enderborgc103a912018-06-12 10:09:03 +02004360 pr_warn(
Paul Moore71f1cb02008-01-29 08:51:16 -05004361 "SELinux: failure in selinux_skb_peerlbl_sid(),"
4362 " unable to determine packet's peer label\n");
Paul Moore220deb92008-01-29 08:38:23 -05004363 return -EACCES;
Paul Moore71f1cb02008-01-29 08:51:16 -05004364 }
Paul Moore220deb92008-01-29 08:38:23 -05004365
4366 return 0;
Paul Moore4f6a9932007-03-01 14:35:22 -05004367}
4368
Paul Moore446b8022013-12-04 16:10:51 -05004369/**
4370 * selinux_conn_sid - Determine the child socket label for a connection
4371 * @sk_sid: the parent socket's SID
4372 * @skb_sid: the packet's SID
4373 * @conn_sid: the resulting connection SID
4374 *
4375 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4376 * combined with the MLS information from @skb_sid in order to create
4377 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
4378 * of @sk_sid. Returns zero on success, negative values on failure.
4379 *
4380 */
4381static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4382{
4383 int err = 0;
4384
4385 if (skb_sid != SECSID_NULL)
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004386 err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4387 conn_sid);
Paul Moore446b8022013-12-04 16:10:51 -05004388 else
4389 *conn_sid = sk_sid;
4390
4391 return err;
4392}
4393
Linus Torvalds1da177e2005-04-16 15:20:36 -07004394/* socket security operations */
Paul Moored4f2d972010-04-22 14:46:18 -04004395
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004396static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4397 u16 secclass, u32 *socksid)
Paul Moored4f2d972010-04-22 14:46:18 -04004398{
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004399 if (tsec->sockcreate_sid > SECSID_NULL) {
4400 *socksid = tsec->sockcreate_sid;
4401 return 0;
4402 }
4403
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004404 return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4405 secclass, NULL, socksid);
Paul Moored4f2d972010-04-22 14:46:18 -04004406}
4407
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004408static int sock_has_perm(struct sock *sk, u32 perms)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004409{
Paul Moore253bfae2010-04-22 14:46:19 -04004410 struct sk_security_struct *sksec = sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004411 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004412 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004413
Paul Moore253bfae2010-04-22 14:46:19 -04004414 if (sksec->sid == SECINITSID_KERNEL)
4415 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004416
Eric Paris50c205f2012-04-04 15:01:43 -04004417 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004418 ad.u.net = &net;
4419 ad.u.net->sk = sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004420
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004421 return avc_has_perm(&selinux_state,
4422 current_sid(), sksec->sid, sksec->sclass, perms,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004423 &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004424}
4425
4426static int selinux_socket_create(int family, int type,
4427 int protocol, int kern)
4428{
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07004429 const struct task_security_struct *tsec = selinux_cred(current_cred());
Paul Moored4f2d972010-04-22 14:46:18 -04004430 u32 newsid;
David Howells275bb412008-11-14 10:39:19 +11004431 u16 secclass;
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004432 int rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004433
4434 if (kern)
Paul Moored4f2d972010-04-22 14:46:18 -04004435 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004436
David Howells275bb412008-11-14 10:39:19 +11004437 secclass = socket_type_to_security_class(family, type, protocol);
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004438 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4439 if (rc)
4440 return rc;
4441
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004442 return avc_has_perm(&selinux_state,
4443 tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004444}
4445
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07004446static int selinux_socket_post_create(struct socket *sock, int family,
4447 int type, int protocol, int kern)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004448{
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07004449 const struct task_security_struct *tsec = selinux_cred(current_cred());
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05004450 struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004451 struct sk_security_struct *sksec;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004452 u16 sclass = socket_type_to_security_class(family, type, protocol);
4453 u32 sid = SECINITSID_KERNEL;
David Howells275bb412008-11-14 10:39:19 +11004454 int err = 0;
4455
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004456 if (!kern) {
4457 err = socket_sockcreate_sid(tsec, sclass, &sid);
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004458 if (err)
4459 return err;
4460 }
David Howells275bb412008-11-14 10:39:19 +11004461
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004462 isec->sclass = sclass;
4463 isec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05004464 isec->initialized = LABEL_INITIALIZED;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004465
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004466 if (sock->sk) {
4467 sksec = sock->sk->sk_security;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004468 sksec->sclass = sclass;
4469 sksec->sid = sid;
Richard Hainesd4529302018-02-13 20:57:18 +00004470 /* Allows detection of the first association on this socket */
4471 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4472 sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4473
Paul Moore389fb8002009-03-27 17:10:34 -04004474 err = selinux_netlbl_socket_post_create(sock->sk, family);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004475 }
4476
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07004477 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004478}
4479
David Herrmann0b811db2018-05-04 16:28:21 +02004480static int selinux_socket_socketpair(struct socket *socka,
4481 struct socket *sockb)
4482{
4483 struct sk_security_struct *sksec_a = socka->sk->sk_security;
4484 struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4485
4486 sksec_a->peer_sid = sksec_b->sid;
4487 sksec_b->peer_sid = sksec_a->sid;
4488
4489 return 0;
4490}
4491
Linus Torvalds1da177e2005-04-16 15:20:36 -07004492/* Range of port numbers used to automatically bind.
4493 Need to determine whether we should perform a name_bind
4494 permission check between the socket and the port number. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07004495
4496static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4497{
Paul Moore253bfae2010-04-22 14:46:19 -04004498 struct sock *sk = sock->sk;
Alexey Kodanev0f8db8c2018-05-11 20:15:11 +03004499 struct sk_security_struct *sksec = sk->sk_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004500 u16 family;
4501 int err;
4502
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004503 err = sock_has_perm(sk, SOCKET__BIND);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004504 if (err)
4505 goto out;
4506
Richard Hainesd4529302018-02-13 20:57:18 +00004507 /* If PF_INET or PF_INET6, check name_bind permission for the port. */
Paul Moore253bfae2010-04-22 14:46:19 -04004508 family = sk->sk_family;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004509 if (family == PF_INET || family == PF_INET6) {
4510 char *addrp;
Thomas Liu2bf49692009-07-14 12:14:09 -04004511 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004512 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004513 struct sockaddr_in *addr4 = NULL;
4514 struct sockaddr_in6 *addr6 = NULL;
Tetsuo Handac750e692019-04-12 19:59:34 +09004515 u16 family_sa;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004516 unsigned short snum;
James Morrise399f982008-06-12 01:39:58 +10004517 u32 sid, node_perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004518
Richard Hainesd4529302018-02-13 20:57:18 +00004519 /*
4520 * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4521 * that validates multiple binding addresses. Because of this
4522 * need to check address->sa_family as it is possible to have
4523 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4524 */
Tetsuo Handac750e692019-04-12 19:59:34 +09004525 if (addrlen < offsetofend(struct sockaddr, sa_family))
4526 return -EINVAL;
4527 family_sa = address->sa_family;
Alexey Kodanev0f8db8c2018-05-11 20:15:11 +03004528 switch (family_sa) {
4529 case AF_UNSPEC:
Richard Haines68741a8a2018-03-02 19:54:34 +00004530 case AF_INET:
4531 if (addrlen < sizeof(struct sockaddr_in))
4532 return -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004533 addr4 = (struct sockaddr_in *)address;
Alexey Kodanev0f8db8c2018-05-11 20:15:11 +03004534 if (family_sa == AF_UNSPEC) {
4535 /* see __inet_bind(), we only want to allow
4536 * AF_UNSPEC if the address is INADDR_ANY
4537 */
4538 if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4539 goto err_af;
4540 family_sa = AF_INET;
4541 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004542 snum = ntohs(addr4->sin_port);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004543 addrp = (char *)&addr4->sin_addr.s_addr;
Richard Haines68741a8a2018-03-02 19:54:34 +00004544 break;
4545 case AF_INET6:
4546 if (addrlen < SIN6_LEN_RFC2133)
4547 return -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004548 addr6 = (struct sockaddr_in6 *)address;
4549 snum = ntohs(addr6->sin6_port);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004550 addrp = (char *)&addr6->sin6_addr.s6_addr;
Richard Haines68741a8a2018-03-02 19:54:34 +00004551 break;
4552 default:
Alexey Kodanev0f8db8c2018-05-11 20:15:11 +03004553 goto err_af;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004554 }
4555
Alexey Kodanev88b7d372018-05-11 20:15:12 +03004556 ad.type = LSM_AUDIT_DATA_NET;
4557 ad.u.net = &net;
4558 ad.u.net->sport = htons(snum);
4559 ad.u.net->family = family_sa;
4560
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004561 if (snum) {
4562 int low, high;
4563
Eric W. Biederman0bbf87d2013-09-28 14:10:59 -07004564 inet_get_local_port_range(sock_net(sk), &low, &high);
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004565
Krister Johansen4548b682017-01-20 17:49:11 -08004566 if (snum < max(inet_prot_sock(sock_net(sk)), low) ||
4567 snum > high) {
Paul Moore3e1121722008-04-10 10:48:14 -04004568 err = sel_netport_sid(sk->sk_protocol,
4569 snum, &sid);
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004570 if (err)
4571 goto out;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004572 err = avc_has_perm(&selinux_state,
4573 sksec->sid, sid,
Paul Moore253bfae2010-04-22 14:46:19 -04004574 sksec->sclass,
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004575 SOCKET__NAME_BIND, &ad);
4576 if (err)
4577 goto out;
4578 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004579 }
Eric Paris828dfe12008-04-17 13:17:49 -04004580
Paul Moore253bfae2010-04-22 14:46:19 -04004581 switch (sksec->sclass) {
James Morris13402582005-09-30 14:24:34 -04004582 case SECCLASS_TCP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004583 node_perm = TCP_SOCKET__NODE_BIND;
4584 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004585
James Morris13402582005-09-30 14:24:34 -04004586 case SECCLASS_UDP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004587 node_perm = UDP_SOCKET__NODE_BIND;
4588 break;
James Morris2ee92d42006-11-13 16:09:01 -08004589
4590 case SECCLASS_DCCP_SOCKET:
4591 node_perm = DCCP_SOCKET__NODE_BIND;
4592 break;
4593
Richard Hainesd4529302018-02-13 20:57:18 +00004594 case SECCLASS_SCTP_SOCKET:
4595 node_perm = SCTP_SOCKET__NODE_BIND;
4596 break;
4597
Linus Torvalds1da177e2005-04-16 15:20:36 -07004598 default:
4599 node_perm = RAWIP_SOCKET__NODE_BIND;
4600 break;
4601 }
Eric Paris828dfe12008-04-17 13:17:49 -04004602
Alexey Kodanev88b7d372018-05-11 20:15:12 +03004603 err = sel_netnode_sid(addrp, family_sa, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004604 if (err)
4605 goto out;
Eric Paris828dfe12008-04-17 13:17:49 -04004606
Alexey Kodanev0f8db8c2018-05-11 20:15:11 +03004607 if (family_sa == AF_INET)
Eric Paris48c62af2012-04-02 13:15:44 -04004608 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004609 else
Eric Paris48c62af2012-04-02 13:15:44 -04004610 ad.u.net->v6info.saddr = addr6->sin6_addr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004611
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004612 err = avc_has_perm(&selinux_state,
4613 sksec->sid, sid,
Paul Moore253bfae2010-04-22 14:46:19 -04004614 sksec->sclass, node_perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004615 if (err)
4616 goto out;
4617 }
4618out:
4619 return err;
Alexey Kodanev0f8db8c2018-05-11 20:15:11 +03004620err_af:
4621 /* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4622 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4623 return -EINVAL;
4624 return -EAFNOSUPPORT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004625}
4626
Richard Hainesd4529302018-02-13 20:57:18 +00004627/* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
Kees Cookd61330c2019-02-17 14:08:36 -08004628 * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst
Richard Hainesd4529302018-02-13 20:57:18 +00004629 */
4630static int selinux_socket_connect_helper(struct socket *sock,
4631 struct sockaddr *address, int addrlen)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004632{
Paul Moore014ab192008-10-10 10:16:33 -04004633 struct sock *sk = sock->sk;
Paul Moore253bfae2010-04-22 14:46:19 -04004634 struct sk_security_struct *sksec = sk->sk_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004635 int err;
4636
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004637 err = sock_has_perm(sk, SOCKET__CONNECT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004638 if (err)
4639 return err;
4640
4641 /*
Richard Hainesd4529302018-02-13 20:57:18 +00004642 * If a TCP, DCCP or SCTP socket, check name_connect permission
4643 * for the port.
Linus Torvalds1da177e2005-04-16 15:20:36 -07004644 */
Paul Moore253bfae2010-04-22 14:46:19 -04004645 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
Richard Hainesd4529302018-02-13 20:57:18 +00004646 sksec->sclass == SECCLASS_DCCP_SOCKET ||
4647 sksec->sclass == SECCLASS_SCTP_SOCKET) {
Thomas Liu2bf49692009-07-14 12:14:09 -04004648 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004649 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004650 struct sockaddr_in *addr4 = NULL;
4651 struct sockaddr_in6 *addr6 = NULL;
4652 unsigned short snum;
James Morris2ee92d42006-11-13 16:09:01 -08004653 u32 sid, perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004654
Richard Hainesd4529302018-02-13 20:57:18 +00004655 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4656 * that validates multiple connect addresses. Because of this
4657 * need to check address->sa_family as it is possible to have
4658 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4659 */
Tetsuo Handac750e692019-04-12 19:59:34 +09004660 if (addrlen < offsetofend(struct sockaddr, sa_family))
4661 return -EINVAL;
Richard Haines68741a8a2018-03-02 19:54:34 +00004662 switch (address->sa_family) {
4663 case AF_INET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004664 addr4 = (struct sockaddr_in *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07004665 if (addrlen < sizeof(struct sockaddr_in))
Linus Torvalds1da177e2005-04-16 15:20:36 -07004666 return -EINVAL;
4667 snum = ntohs(addr4->sin_port);
Richard Haines68741a8a2018-03-02 19:54:34 +00004668 break;
4669 case AF_INET6:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004670 addr6 = (struct sockaddr_in6 *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07004671 if (addrlen < SIN6_LEN_RFC2133)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004672 return -EINVAL;
4673 snum = ntohs(addr6->sin6_port);
Richard Haines68741a8a2018-03-02 19:54:34 +00004674 break;
4675 default:
4676 /* Note that SCTP services expect -EINVAL, whereas
4677 * others expect -EAFNOSUPPORT.
4678 */
4679 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4680 return -EINVAL;
4681 else
4682 return -EAFNOSUPPORT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004683 }
4684
Paul Moore3e1121722008-04-10 10:48:14 -04004685 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004686 if (err)
Richard Hainesd4529302018-02-13 20:57:18 +00004687 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004688
Richard Hainesd4529302018-02-13 20:57:18 +00004689 switch (sksec->sclass) {
4690 case SECCLASS_TCP_SOCKET:
4691 perm = TCP_SOCKET__NAME_CONNECT;
4692 break;
4693 case SECCLASS_DCCP_SOCKET:
4694 perm = DCCP_SOCKET__NAME_CONNECT;
4695 break;
4696 case SECCLASS_SCTP_SOCKET:
4697 perm = SCTP_SOCKET__NAME_CONNECT;
4698 break;
4699 }
James Morris2ee92d42006-11-13 16:09:01 -08004700
Eric Paris50c205f2012-04-04 15:01:43 -04004701 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004702 ad.u.net = &net;
4703 ad.u.net->dport = htons(snum);
Alexey Kodanev88b7d372018-05-11 20:15:12 +03004704 ad.u.net->family = address->sa_family;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004705 err = avc_has_perm(&selinux_state,
4706 sksec->sid, sid, sksec->sclass, perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004707 if (err)
Richard Hainesd4529302018-02-13 20:57:18 +00004708 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004709 }
4710
Richard Hainesd4529302018-02-13 20:57:18 +00004711 return 0;
4712}
Paul Moore014ab192008-10-10 10:16:33 -04004713
Richard Hainesd4529302018-02-13 20:57:18 +00004714/* Supports connect(2), see comments in selinux_socket_connect_helper() */
4715static int selinux_socket_connect(struct socket *sock,
4716 struct sockaddr *address, int addrlen)
4717{
4718 int err;
4719 struct sock *sk = sock->sk;
4720
4721 err = selinux_socket_connect_helper(sock, address, addrlen);
4722 if (err)
4723 return err;
4724
4725 return selinux_netlbl_socket_connect(sk, address);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004726}
4727
4728static int selinux_socket_listen(struct socket *sock, int backlog)
4729{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004730 return sock_has_perm(sock->sk, SOCKET__LISTEN);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004731}
4732
4733static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4734{
4735 int err;
4736 struct inode_security_struct *isec;
4737 struct inode_security_struct *newisec;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004738 u16 sclass;
4739 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004740
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004741 err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004742 if (err)
4743 return err;
4744
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05004745 isec = inode_security_novalidate(SOCK_INODE(sock));
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004746 spin_lock(&isec->lock);
4747 sclass = isec->sclass;
4748 sid = isec->sid;
4749 spin_unlock(&isec->lock);
4750
4751 newisec = inode_security_novalidate(SOCK_INODE(newsock));
4752 newisec->sclass = sclass;
4753 newisec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05004754 newisec->initialized = LABEL_INITIALIZED;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004755
4756 return 0;
4757}
4758
4759static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
Eric Paris828dfe12008-04-17 13:17:49 -04004760 int size)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004761{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004762 return sock_has_perm(sock->sk, SOCKET__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004763}
4764
4765static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4766 int size, int flags)
4767{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004768 return sock_has_perm(sock->sk, SOCKET__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004769}
4770
4771static int selinux_socket_getsockname(struct socket *sock)
4772{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004773 return sock_has_perm(sock->sk, SOCKET__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004774}
4775
4776static int selinux_socket_getpeername(struct socket *sock)
4777{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004778 return sock_has_perm(sock->sk, SOCKET__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004779}
4780
Eric Paris828dfe12008-04-17 13:17:49 -04004781static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004782{
Paul Mooref8687af2006-10-30 15:22:15 -08004783 int err;
4784
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004785 err = sock_has_perm(sock->sk, SOCKET__SETOPT);
Paul Mooref8687af2006-10-30 15:22:15 -08004786 if (err)
4787 return err;
4788
4789 return selinux_netlbl_socket_setsockopt(sock, level, optname);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004790}
4791
4792static int selinux_socket_getsockopt(struct socket *sock, int level,
4793 int optname)
4794{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004795 return sock_has_perm(sock->sk, SOCKET__GETOPT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004796}
4797
4798static int selinux_socket_shutdown(struct socket *sock, int how)
4799{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004800 return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004801}
4802
David S. Miller3610cda2011-01-05 15:38:53 -08004803static int selinux_socket_unix_stream_connect(struct sock *sock,
4804 struct sock *other,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004805 struct sock *newsk)
4806{
David S. Miller3610cda2011-01-05 15:38:53 -08004807 struct sk_security_struct *sksec_sock = sock->sk_security;
4808 struct sk_security_struct *sksec_other = other->sk_security;
Paul Moore4d1e2452010-04-22 14:46:18 -04004809 struct sk_security_struct *sksec_new = newsk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004810 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004811 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004812 int err;
4813
Eric Paris50c205f2012-04-04 15:01:43 -04004814 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004815 ad.u.net = &net;
4816 ad.u.net->sk = other;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004817
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004818 err = avc_has_perm(&selinux_state,
4819 sksec_sock->sid, sksec_other->sid,
Paul Moore4d1e2452010-04-22 14:46:18 -04004820 sksec_other->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004821 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4822 if (err)
4823 return err;
4824
Linus Torvalds1da177e2005-04-16 15:20:36 -07004825 /* server child socket */
Paul Moore4d1e2452010-04-22 14:46:18 -04004826 sksec_new->peer_sid = sksec_sock->sid;
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004827 err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
4828 sksec_sock->sid, &sksec_new->sid);
Paul Moore4d1e2452010-04-22 14:46:18 -04004829 if (err)
4830 return err;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004831
Paul Moore4d1e2452010-04-22 14:46:18 -04004832 /* connecting socket */
4833 sksec_sock->peer_sid = sksec_new->sid;
4834
4835 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004836}
4837
4838static int selinux_socket_unix_may_send(struct socket *sock,
4839 struct socket *other)
4840{
Paul Moore253bfae2010-04-22 14:46:19 -04004841 struct sk_security_struct *ssec = sock->sk->sk_security;
4842 struct sk_security_struct *osec = other->sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004843 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004844 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004845
Eric Paris50c205f2012-04-04 15:01:43 -04004846 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004847 ad.u.net = &net;
4848 ad.u.net->sk = other->sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004849
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004850 return avc_has_perm(&selinux_state,
4851 ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
Paul Moore253bfae2010-04-22 14:46:19 -04004852 &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004853}
4854
Paul Moorecbe0d6e2014-09-10 17:09:57 -04004855static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4856 char *addrp, u16 family, u32 peer_sid,
Thomas Liu2bf49692009-07-14 12:14:09 -04004857 struct common_audit_data *ad)
Paul Mooreeffad8d2008-01-29 08:49:27 -05004858{
4859 int err;
4860 u32 if_sid;
4861 u32 node_sid;
4862
Paul Moorecbe0d6e2014-09-10 17:09:57 -04004863 err = sel_netif_sid(ns, ifindex, &if_sid);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004864 if (err)
4865 return err;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004866 err = avc_has_perm(&selinux_state,
4867 peer_sid, if_sid,
Paul Mooreeffad8d2008-01-29 08:49:27 -05004868 SECCLASS_NETIF, NETIF__INGRESS, ad);
4869 if (err)
4870 return err;
4871
4872 err = sel_netnode_sid(addrp, family, &node_sid);
4873 if (err)
4874 return err;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004875 return avc_has_perm(&selinux_state,
4876 peer_sid, node_sid,
Paul Mooreeffad8d2008-01-29 08:49:27 -05004877 SECCLASS_NODE, NODE__RECVFROM, ad);
4878}
4879
Paul Moore220deb92008-01-29 08:38:23 -05004880static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
Paul Moored8395c82008-10-10 10:16:30 -04004881 u16 family)
Paul Moore220deb92008-01-29 08:38:23 -05004882{
Paul Moore277d3422008-12-31 12:54:11 -05004883 int err = 0;
Paul Moore220deb92008-01-29 08:38:23 -05004884 struct sk_security_struct *sksec = sk->sk_security;
Paul Moore220deb92008-01-29 08:38:23 -05004885 u32 sk_sid = sksec->sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04004886 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004887 struct lsm_network_audit net = {0,};
Paul Moored8395c82008-10-10 10:16:30 -04004888 char *addrp;
4889
Eric Paris50c205f2012-04-04 15:01:43 -04004890 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004891 ad.u.net = &net;
4892 ad.u.net->netif = skb->skb_iif;
4893 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04004894 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4895 if (err)
4896 return err;
Paul Moore220deb92008-01-29 08:38:23 -05004897
Paul Moore58bfbb52009-03-27 17:10:41 -04004898 if (selinux_secmark_enabled()) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004899 err = avc_has_perm(&selinux_state,
4900 sk_sid, skb->secmark, SECCLASS_PACKET,
Paul Moored8395c82008-10-10 10:16:30 -04004901 PACKET__RECV, &ad);
Paul Moore58bfbb52009-03-27 17:10:41 -04004902 if (err)
4903 return err;
4904 }
Paul Moore220deb92008-01-29 08:38:23 -05004905
Steffen Klassertb9679a72011-02-23 12:55:21 +01004906 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4907 if (err)
4908 return err;
4909 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004910
James Morris4e5ab4c2006-06-09 00:33:33 -07004911 return err;
4912}
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004913
James Morris4e5ab4c2006-06-09 00:33:33 -07004914static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4915{
Paul Moore220deb92008-01-29 08:38:23 -05004916 int err;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004917 struct sk_security_struct *sksec = sk->sk_security;
Paul Moore220deb92008-01-29 08:38:23 -05004918 u16 family = sk->sk_family;
4919 u32 sk_sid = sksec->sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04004920 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004921 struct lsm_network_audit net = {0,};
Paul Moore220deb92008-01-29 08:38:23 -05004922 char *addrp;
Paul Moored8395c82008-10-10 10:16:30 -04004923 u8 secmark_active;
4924 u8 peerlbl_active;
James Morris4e5ab4c2006-06-09 00:33:33 -07004925
James Morris4e5ab4c2006-06-09 00:33:33 -07004926 if (family != PF_INET && family != PF_INET6)
Paul Moore220deb92008-01-29 08:38:23 -05004927 return 0;
James Morris4e5ab4c2006-06-09 00:33:33 -07004928
4929 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
Al Viro87fcd702006-12-04 22:00:55 +00004930 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
James Morris4e5ab4c2006-06-09 00:33:33 -07004931 family = PF_INET;
4932
Paul Moored8395c82008-10-10 10:16:30 -04004933 /* If any sort of compatibility mode is enabled then handoff processing
4934 * to the selinux_sock_rcv_skb_compat() function to deal with the
4935 * special handling. We do this in an attempt to keep this function
4936 * as fast and as clean as possible. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05004937 if (!selinux_policycap_netpeer())
Paul Moored8395c82008-10-10 10:16:30 -04004938 return selinux_sock_rcv_skb_compat(sk, skb, family);
4939
4940 secmark_active = selinux_secmark_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04004941 peerlbl_active = selinux_peerlbl_enabled();
Paul Moored8395c82008-10-10 10:16:30 -04004942 if (!secmark_active && !peerlbl_active)
4943 return 0;
4944
Eric Paris50c205f2012-04-04 15:01:43 -04004945 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004946 ad.u.net = &net;
4947 ad.u.net->netif = skb->skb_iif;
4948 ad.u.net->family = family;
Paul Moore224dfbd2008-01-29 08:38:13 -05004949 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
James Morris4e5ab4c2006-06-09 00:33:33 -07004950 if (err)
Paul Moore220deb92008-01-29 08:38:23 -05004951 return err;
James Morris4e5ab4c2006-06-09 00:33:33 -07004952
Paul Moored8395c82008-10-10 10:16:30 -04004953 if (peerlbl_active) {
Paul Moored621d352008-01-29 08:43:36 -05004954 u32 peer_sid;
4955
4956 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4957 if (err)
4958 return err;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04004959 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4960 addrp, family, peer_sid, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04004961 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04004962 selinux_netlbl_err(skb, family, err, 0);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004963 return err;
Paul Mooredfaebe92008-10-10 10:16:31 -04004964 }
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004965 err = avc_has_perm(&selinux_state,
4966 sk_sid, peer_sid, SECCLASS_PEER,
Paul Moored621d352008-01-29 08:43:36 -05004967 PEER__RECV, &ad);
Chad Hanson46d01d62013-12-23 17:45:01 -05004968 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04004969 selinux_netlbl_err(skb, family, err, 0);
Chad Hanson46d01d62013-12-23 17:45:01 -05004970 return err;
4971 }
Paul Moored621d352008-01-29 08:43:36 -05004972 }
4973
Paul Moored8395c82008-10-10 10:16:30 -04004974 if (secmark_active) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05004975 err = avc_has_perm(&selinux_state,
4976 sk_sid, skb->secmark, SECCLASS_PACKET,
Paul Mooreeffad8d2008-01-29 08:49:27 -05004977 PACKET__RECV, &ad);
4978 if (err)
4979 return err;
4980 }
4981
Paul Moored621d352008-01-29 08:43:36 -05004982 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004983}
4984
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004985static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4986 int __user *optlen, unsigned len)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004987{
4988 int err = 0;
4989 char *scontext;
4990 u32 scontext_len;
Paul Moore253bfae2010-04-22 14:46:19 -04004991 struct sk_security_struct *sksec = sock->sk->sk_security;
Paul Moore3de4bab2006-11-17 17:38:54 -05004992 u32 peer_sid = SECSID_NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004993
Paul Moore253bfae2010-04-22 14:46:19 -04004994 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
Richard Hainesd4529302018-02-13 20:57:18 +00004995 sksec->sclass == SECCLASS_TCP_SOCKET ||
4996 sksec->sclass == SECCLASS_SCTP_SOCKET)
Eric Parisdd3e7832010-04-07 15:08:46 -04004997 peer_sid = sksec->peer_sid;
Paul Moore253bfae2010-04-22 14:46:19 -04004998 if (peer_sid == SECSID_NULL)
4999 return -ENOPROTOOPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005000
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005001 err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
5002 &scontext_len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005003 if (err)
Paul Moore253bfae2010-04-22 14:46:19 -04005004 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005005
5006 if (scontext_len > len) {
5007 err = -ERANGE;
5008 goto out_len;
5009 }
5010
5011 if (copy_to_user(optval, scontext, scontext_len))
5012 err = -EFAULT;
5013
5014out_len:
5015 if (put_user(scontext_len, optlen))
5016 err = -EFAULT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005017 kfree(scontext);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005018 return err;
5019}
5020
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005021static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
Catherine Zhang2c7946a2006-03-20 22:41:23 -08005022{
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005023 u32 peer_secid = SECSID_NULL;
Paul Moore75e22912008-01-29 08:38:04 -05005024 u16 family;
Paul Moore899134f2016-03-28 15:19:10 -04005025 struct inode_security_struct *isec;
Catherine Zhang877ce7c2006-06-29 12:27:47 -07005026
Paul Mooreaa862902008-10-10 10:16:29 -04005027 if (skb && skb->protocol == htons(ETH_P_IP))
5028 family = PF_INET;
5029 else if (skb && skb->protocol == htons(ETH_P_IPV6))
5030 family = PF_INET6;
5031 else if (sock)
Paul Moore75e22912008-01-29 08:38:04 -05005032 family = sock->sk->sk_family;
Paul Moore75e22912008-01-29 08:38:04 -05005033 else
5034 goto out;
5035
Paul Moore899134f2016-03-28 15:19:10 -04005036 if (sock && family == PF_UNIX) {
5037 isec = inode_security_novalidate(SOCK_INODE(sock));
5038 peer_secid = isec->sid;
5039 } else if (skb)
Paul Moore220deb92008-01-29 08:38:23 -05005040 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
Catherine Zhang2c7946a2006-03-20 22:41:23 -08005041
Paul Moore75e22912008-01-29 08:38:04 -05005042out:
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005043 *secid = peer_secid;
Paul Moore75e22912008-01-29 08:38:04 -05005044 if (peer_secid == SECSID_NULL)
5045 return -EINVAL;
5046 return 0;
Catherine Zhang2c7946a2006-03-20 22:41:23 -08005047}
5048
Al Viro7d877f32005-10-21 03:20:43 -04005049static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005050{
Paul Moore84914b72010-04-22 14:46:18 -04005051 struct sk_security_struct *sksec;
5052
5053 sksec = kzalloc(sizeof(*sksec), priority);
5054 if (!sksec)
5055 return -ENOMEM;
5056
5057 sksec->peer_sid = SECINITSID_UNLABELED;
5058 sksec->sid = SECINITSID_UNLABELED;
Stephen Smalley5dee25d2015-07-10 17:19:57 -04005059 sksec->sclass = SECCLASS_SOCKET;
Paul Moore84914b72010-04-22 14:46:18 -04005060 selinux_netlbl_sk_security_reset(sksec);
5061 sk->sk_security = sksec;
5062
5063 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005064}
5065
5066static void selinux_sk_free_security(struct sock *sk)
5067{
Paul Moore84914b72010-04-22 14:46:18 -04005068 struct sk_security_struct *sksec = sk->sk_security;
5069
5070 sk->sk_security = NULL;
5071 selinux_netlbl_sk_security_free(sksec);
5072 kfree(sksec);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005073}
5074
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005075static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5076{
Eric Parisdd3e7832010-04-07 15:08:46 -04005077 struct sk_security_struct *sksec = sk->sk_security;
5078 struct sk_security_struct *newsksec = newsk->sk_security;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005079
Eric Parisdd3e7832010-04-07 15:08:46 -04005080 newsksec->sid = sksec->sid;
5081 newsksec->peer_sid = sksec->peer_sid;
5082 newsksec->sclass = sksec->sclass;
Paul Moore99f59ed2006-08-29 17:53:48 -07005083
Eric Parisdd3e7832010-04-07 15:08:46 -04005084 selinux_netlbl_sk_security_reset(newsksec);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005085}
5086
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07005087static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005088{
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005089 if (!sk)
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07005090 *secid = SECINITSID_ANY_SOCKET;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005091 else {
5092 struct sk_security_struct *sksec = sk->sk_security;
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005093
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07005094 *secid = sksec->sid;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07005095 }
Trent Jaegerd28d1e02005-12-13 23:12:40 -08005096}
5097
Eric Paris828dfe12008-04-17 13:17:49 -04005098static void selinux_sock_graft(struct sock *sk, struct socket *parent)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005099{
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05005100 struct inode_security_struct *isec =
5101 inode_security_novalidate(SOCK_INODE(parent));
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005102 struct sk_security_struct *sksec = sk->sk_security;
5103
Paul Moore2873ead2014-07-28 10:42:48 -04005104 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5105 sk->sk_family == PF_UNIX)
David Woodhouse2148ccc2006-09-29 15:50:25 -07005106 isec->sid = sksec->sid;
Paul Moore220deb92008-01-29 08:38:23 -05005107 sksec->sclass = isec->sclass;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005108}
5109
Richard Hainesd4529302018-02-13 20:57:18 +00005110/* Called whenever SCTP receives an INIT chunk. This happens when an incoming
5111 * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
5112 * already present).
5113 */
5114static int selinux_sctp_assoc_request(struct sctp_endpoint *ep,
5115 struct sk_buff *skb)
5116{
5117 struct sk_security_struct *sksec = ep->base.sk->sk_security;
5118 struct common_audit_data ad;
5119 struct lsm_network_audit net = {0,};
5120 u8 peerlbl_active;
5121 u32 peer_sid = SECINITSID_UNLABELED;
5122 u32 conn_sid;
5123 int err = 0;
5124
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005125 if (!selinux_policycap_extsockclass())
Richard Hainesd4529302018-02-13 20:57:18 +00005126 return 0;
5127
5128 peerlbl_active = selinux_peerlbl_enabled();
5129
5130 if (peerlbl_active) {
5131 /* This will return peer_sid = SECSID_NULL if there are
5132 * no peer labels, see security_net_peersid_resolve().
5133 */
5134 err = selinux_skb_peerlbl_sid(skb, ep->base.sk->sk_family,
5135 &peer_sid);
5136 if (err)
5137 return err;
5138
5139 if (peer_sid == SECSID_NULL)
5140 peer_sid = SECINITSID_UNLABELED;
5141 }
5142
5143 if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5144 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5145
5146 /* Here as first association on socket. As the peer SID
5147 * was allowed by peer recv (and the netif/node checks),
5148 * then it is approved by policy and used as the primary
5149 * peer SID for getpeercon(3).
5150 */
5151 sksec->peer_sid = peer_sid;
5152 } else if (sksec->peer_sid != peer_sid) {
5153 /* Other association peer SIDs are checked to enforce
5154 * consistency among the peer SIDs.
5155 */
5156 ad.type = LSM_AUDIT_DATA_NET;
5157 ad.u.net = &net;
5158 ad.u.net->sk = ep->base.sk;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005159 err = avc_has_perm(&selinux_state,
5160 sksec->peer_sid, peer_sid, sksec->sclass,
Richard Hainesd4529302018-02-13 20:57:18 +00005161 SCTP_SOCKET__ASSOCIATION, &ad);
5162 if (err)
5163 return err;
5164 }
5165
5166 /* Compute the MLS component for the connection and store
5167 * the information in ep. This will be used by SCTP TCP type
5168 * sockets and peeled off connections as they cause a new
5169 * socket to be generated. selinux_sctp_sk_clone() will then
5170 * plug this into the new socket.
5171 */
5172 err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
5173 if (err)
5174 return err;
5175
5176 ep->secid = conn_sid;
5177 ep->peer_secid = peer_sid;
5178
5179 /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5180 return selinux_netlbl_sctp_assoc_request(ep, skb);
5181}
5182
5183/* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5184 * based on their @optname.
5185 */
5186static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5187 struct sockaddr *address,
5188 int addrlen)
5189{
5190 int len, err = 0, walk_size = 0;
5191 void *addr_buf;
5192 struct sockaddr *addr;
5193 struct socket *sock;
5194
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005195 if (!selinux_policycap_extsockclass())
Richard Hainesd4529302018-02-13 20:57:18 +00005196 return 0;
5197
5198 /* Process one or more addresses that may be IPv4 or IPv6 */
5199 sock = sk->sk_socket;
5200 addr_buf = address;
5201
5202 while (walk_size < addrlen) {
Ondrej Mosnacekc1383252018-11-13 16:16:08 +01005203 if (walk_size + sizeof(sa_family_t) > addrlen)
5204 return -EINVAL;
5205
Richard Hainesd4529302018-02-13 20:57:18 +00005206 addr = addr_buf;
5207 switch (addr->sa_family) {
Alexey Kodanev4152dc92018-05-11 20:15:13 +03005208 case AF_UNSPEC:
Richard Hainesd4529302018-02-13 20:57:18 +00005209 case AF_INET:
5210 len = sizeof(struct sockaddr_in);
5211 break;
5212 case AF_INET6:
5213 len = sizeof(struct sockaddr_in6);
5214 break;
5215 default:
Alexey Kodanev4152dc92018-05-11 20:15:13 +03005216 return -EINVAL;
Richard Hainesd4529302018-02-13 20:57:18 +00005217 }
5218
Xin Long292c9972019-03-09 00:07:34 +08005219 if (walk_size + len > addrlen)
5220 return -EINVAL;
5221
Richard Hainesd4529302018-02-13 20:57:18 +00005222 err = -EINVAL;
5223 switch (optname) {
5224 /* Bind checks */
5225 case SCTP_PRIMARY_ADDR:
5226 case SCTP_SET_PEER_PRIMARY_ADDR:
5227 case SCTP_SOCKOPT_BINDX_ADD:
5228 err = selinux_socket_bind(sock, addr, len);
5229 break;
5230 /* Connect checks */
5231 case SCTP_SOCKOPT_CONNECTX:
5232 case SCTP_PARAM_SET_PRIMARY:
5233 case SCTP_PARAM_ADD_IP:
5234 case SCTP_SENDMSG_CONNECT:
5235 err = selinux_socket_connect_helper(sock, addr, len);
5236 if (err)
5237 return err;
5238
5239 /* As selinux_sctp_bind_connect() is called by the
5240 * SCTP protocol layer, the socket is already locked,
5241 * therefore selinux_netlbl_socket_connect_locked() is
5242 * is called here. The situations handled are:
5243 * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5244 * whenever a new IP address is added or when a new
5245 * primary address is selected.
5246 * Note that an SCTP connect(2) call happens before
5247 * the SCTP protocol layer and is handled via
5248 * selinux_socket_connect().
5249 */
5250 err = selinux_netlbl_socket_connect_locked(sk, addr);
5251 break;
5252 }
5253
5254 if (err)
5255 return err;
5256
5257 addr_buf += len;
5258 walk_size += len;
5259 }
5260
5261 return 0;
5262}
5263
5264/* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5265static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
5266 struct sock *newsk)
5267{
5268 struct sk_security_struct *sksec = sk->sk_security;
5269 struct sk_security_struct *newsksec = newsk->sk_security;
5270
5271 /* If policy does not support SECCLASS_SCTP_SOCKET then call
5272 * the non-sctp clone version.
5273 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005274 if (!selinux_policycap_extsockclass())
Richard Hainesd4529302018-02-13 20:57:18 +00005275 return selinux_sk_clone_security(sk, newsk);
5276
5277 newsksec->sid = ep->secid;
5278 newsksec->peer_sid = ep->peer_secid;
5279 newsksec->sclass = sksec->sclass;
5280 selinux_netlbl_sctp_sk_clone(sk, newsk);
5281}
5282
Adrian Bunk9a673e52006-08-15 00:03:53 -07005283static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
5284 struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005285{
5286 struct sk_security_struct *sksec = sk->sk_security;
5287 int err;
Paul Moore0b1f24e2013-12-03 11:39:13 -05005288 u16 family = req->rsk_ops->family;
Paul Moore446b8022013-12-04 16:10:51 -05005289 u32 connsid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005290 u32 peersid;
5291
Paul Mooreaa862902008-10-10 10:16:29 -04005292 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
Paul Moore220deb92008-01-29 08:38:23 -05005293 if (err)
5294 return err;
Paul Moore446b8022013-12-04 16:10:51 -05005295 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5296 if (err)
5297 return err;
5298 req->secid = connsid;
5299 req->peer_secid = peersid;
Venkat Yekkiralaa51c64f2006-07-27 22:01:34 -07005300
Paul Moore389fb8002009-03-27 17:10:34 -04005301 return selinux_netlbl_inet_conn_request(req, family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005302}
5303
Adrian Bunk9a673e52006-08-15 00:03:53 -07005304static void selinux_inet_csk_clone(struct sock *newsk,
5305 const struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005306{
5307 struct sk_security_struct *newsksec = newsk->sk_security;
5308
5309 newsksec->sid = req->secid;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005310 newsksec->peer_sid = req->peer_secid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005311 /* NOTE: Ideally, we should also get the isec->sid for the
5312 new socket in sync, but we don't have the isec available yet.
5313 So we will wait until sock_graft to do it, by which
5314 time it will have been created and available. */
Paul Moore99f59ed2006-08-29 17:53:48 -07005315
Paul Moore9f2ad662006-11-17 17:38:53 -05005316 /* We don't need to take any sort of lock here as we are the only
5317 * thread with access to newsksec */
Paul Moore389fb8002009-03-27 17:10:34 -04005318 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005319}
5320
Paul Moore014ab192008-10-10 10:16:33 -04005321static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005322{
Paul Mooreaa862902008-10-10 10:16:29 -04005323 u16 family = sk->sk_family;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005324 struct sk_security_struct *sksec = sk->sk_security;
5325
Paul Mooreaa862902008-10-10 10:16:29 -04005326 /* handle mapped IPv4 packets arriving via IPv6 sockets */
5327 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5328 family = PF_INET;
5329
5330 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
Venkat Yekkirala6b877692006-11-08 17:04:09 -06005331}
5332
Eric Paris2606fd12010-10-13 16:24:41 -04005333static int selinux_secmark_relabel_packet(u32 sid)
5334{
5335 const struct task_security_struct *__tsec;
5336 u32 tsid;
5337
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07005338 __tsec = selinux_cred(current_cred());
Eric Paris2606fd12010-10-13 16:24:41 -04005339 tsid = __tsec->sid;
5340
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005341 return avc_has_perm(&selinux_state,
5342 tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5343 NULL);
Eric Paris2606fd12010-10-13 16:24:41 -04005344}
5345
5346static void selinux_secmark_refcount_inc(void)
5347{
5348 atomic_inc(&selinux_secmark_refcount);
5349}
5350
5351static void selinux_secmark_refcount_dec(void)
5352{
5353 atomic_dec(&selinux_secmark_refcount);
5354}
5355
Adrian Bunk9a673e52006-08-15 00:03:53 -07005356static void selinux_req_classify_flow(const struct request_sock *req,
5357 struct flowi *fl)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005358{
David S. Miller1d28f422011-03-12 00:29:39 -05005359 fl->flowi_secid = req->secid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005360}
5361
Paul Moore5dbbaf22013-01-14 07:12:19 +00005362static int selinux_tun_dev_alloc_security(void **security)
5363{
5364 struct tun_security_struct *tunsec;
5365
5366 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5367 if (!tunsec)
5368 return -ENOMEM;
5369 tunsec->sid = current_sid();
5370
5371 *security = tunsec;
5372 return 0;
5373}
5374
5375static void selinux_tun_dev_free_security(void *security)
5376{
5377 kfree(security);
5378}
5379
Paul Mooreed6d76e2009-08-28 18:12:49 -04005380static int selinux_tun_dev_create(void)
5381{
5382 u32 sid = current_sid();
5383
5384 /* we aren't taking into account the "sockcreate" SID since the socket
5385 * that is being created here is not a socket in the traditional sense,
5386 * instead it is a private sock, accessible only to the kernel, and
5387 * representing a wide range of network traffic spanning multiple
5388 * connections unlike traditional sockets - check the TUN driver to
5389 * get a better understanding of why this socket is special */
5390
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005391 return avc_has_perm(&selinux_state,
5392 sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
Paul Mooreed6d76e2009-08-28 18:12:49 -04005393 NULL);
5394}
5395
Paul Moore5dbbaf22013-01-14 07:12:19 +00005396static int selinux_tun_dev_attach_queue(void *security)
Paul Mooreed6d76e2009-08-28 18:12:49 -04005397{
Paul Moore5dbbaf22013-01-14 07:12:19 +00005398 struct tun_security_struct *tunsec = security;
5399
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005400 return avc_has_perm(&selinux_state,
5401 current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
Paul Moore5dbbaf22013-01-14 07:12:19 +00005402 TUN_SOCKET__ATTACH_QUEUE, NULL);
5403}
5404
5405static int selinux_tun_dev_attach(struct sock *sk, void *security)
5406{
5407 struct tun_security_struct *tunsec = security;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005408 struct sk_security_struct *sksec = sk->sk_security;
5409
5410 /* we don't currently perform any NetLabel based labeling here and it
5411 * isn't clear that we would want to do so anyway; while we could apply
5412 * labeling without the support of the TUN user the resulting labeled
5413 * traffic from the other end of the connection would almost certainly
5414 * cause confusion to the TUN user that had no idea network labeling
5415 * protocols were being used */
5416
Paul Moore5dbbaf22013-01-14 07:12:19 +00005417 sksec->sid = tunsec->sid;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005418 sksec->sclass = SECCLASS_TUN_SOCKET;
Paul Moore5dbbaf22013-01-14 07:12:19 +00005419
5420 return 0;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005421}
5422
Paul Moore5dbbaf22013-01-14 07:12:19 +00005423static int selinux_tun_dev_open(void *security)
Paul Mooreed6d76e2009-08-28 18:12:49 -04005424{
Paul Moore5dbbaf22013-01-14 07:12:19 +00005425 struct tun_security_struct *tunsec = security;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005426 u32 sid = current_sid();
5427 int err;
5428
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005429 err = avc_has_perm(&selinux_state,
5430 sid, tunsec->sid, SECCLASS_TUN_SOCKET,
Paul Mooreed6d76e2009-08-28 18:12:49 -04005431 TUN_SOCKET__RELABELFROM, NULL);
5432 if (err)
5433 return err;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005434 err = avc_has_perm(&selinux_state,
5435 sid, sid, SECCLASS_TUN_SOCKET,
Paul Mooreed6d76e2009-08-28 18:12:49 -04005436 TUN_SOCKET__RELABELTO, NULL);
5437 if (err)
5438 return err;
Paul Moore5dbbaf22013-01-14 07:12:19 +00005439 tunsec->sid = sid;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005440
5441 return 0;
5442}
5443
Linus Torvalds1da177e2005-04-16 15:20:36 -07005444static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5445{
5446 int err = 0;
5447 u32 perm;
5448 struct nlmsghdr *nlh;
Paul Moore253bfae2010-04-22 14:46:19 -04005449 struct sk_security_struct *sksec = sk->sk_security;
Eric Paris828dfe12008-04-17 13:17:49 -04005450
Hong zhi guo77954982013-03-27 06:49:35 +00005451 if (skb->len < NLMSG_HDRLEN) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005452 err = -EINVAL;
5453 goto out;
5454 }
Arnaldo Carvalho de Melob529ccf2007-04-25 19:08:35 -07005455 nlh = nlmsg_hdr(skb);
Eric Paris828dfe12008-04-17 13:17:49 -04005456
Paul Moore253bfae2010-04-22 14:46:19 -04005457 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005458 if (err) {
5459 if (err == -EINVAL) {
Vladis Dronov76319942015-12-24 11:09:41 -05005460 pr_warn_ratelimited("SELinux: unrecognized netlink"
5461 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5462 " pig=%d comm=%s\n",
Marek Milkoviccded3ff2015-06-04 16:22:16 -04005463 sk->sk_protocol, nlh->nlmsg_type,
Vladis Dronov76319942015-12-24 11:09:41 -05005464 secclass_map[sksec->sclass - 1].name,
5465 task_pid_nr(current), current->comm);
Paul Mooree5a5ca92018-03-01 17:38:30 -05005466 if (!enforcing_enabled(&selinux_state) ||
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005467 security_get_allow_unknown(&selinux_state))
Linus Torvalds1da177e2005-04-16 15:20:36 -07005468 err = 0;
5469 }
5470
5471 /* Ignore */
5472 if (err == -ENOENT)
5473 err = 0;
5474 goto out;
5475 }
5476
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005477 err = sock_has_perm(sk, perm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005478out:
5479 return err;
5480}
5481
5482#ifdef CONFIG_NETFILTER
5483
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005484static unsigned int selinux_ip_forward(struct sk_buff *skb,
5485 const struct net_device *indev,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005486 u16 family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005487{
Paul Mooredfaebe92008-10-10 10:16:31 -04005488 int err;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005489 char *addrp;
5490 u32 peer_sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04005491 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005492 struct lsm_network_audit net = {0,};
Paul Mooreeffad8d2008-01-29 08:49:27 -05005493 u8 secmark_active;
Paul Moore948bf852008-10-10 10:16:32 -04005494 u8 netlbl_active;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005495 u8 peerlbl_active;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005496
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005497 if (!selinux_policycap_netpeer())
Paul Mooreeffad8d2008-01-29 08:49:27 -05005498 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005499
Paul Mooreeffad8d2008-01-29 08:49:27 -05005500 secmark_active = selinux_secmark_enabled();
Paul Moore948bf852008-10-10 10:16:32 -04005501 netlbl_active = netlbl_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04005502 peerlbl_active = selinux_peerlbl_enabled();
Paul Mooreeffad8d2008-01-29 08:49:27 -05005503 if (!secmark_active && !peerlbl_active)
5504 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005505
Paul Moored8395c82008-10-10 10:16:30 -04005506 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5507 return NF_DROP;
5508
Eric Paris50c205f2012-04-04 15:01:43 -04005509 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005510 ad.u.net = &net;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005511 ad.u.net->netif = indev->ifindex;
Eric Paris48c62af2012-04-02 13:15:44 -04005512 ad.u.net->family = family;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005513 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5514 return NF_DROP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005515
Paul Mooredfaebe92008-10-10 10:16:31 -04005516 if (peerlbl_active) {
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005517 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5518 addrp, family, peer_sid, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04005519 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04005520 selinux_netlbl_err(skb, family, err, 1);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005521 return NF_DROP;
Paul Mooredfaebe92008-10-10 10:16:31 -04005522 }
5523 }
Paul Mooreeffad8d2008-01-29 08:49:27 -05005524
5525 if (secmark_active)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005526 if (avc_has_perm(&selinux_state,
5527 peer_sid, skb->secmark,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005528 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5529 return NF_DROP;
5530
Paul Moore948bf852008-10-10 10:16:32 -04005531 if (netlbl_active)
5532 /* we do this in the FORWARD path and not the POST_ROUTING
5533 * path because we want to make sure we apply the necessary
5534 * labeling before IPsec is applied so we can leverage AH
5535 * protection */
5536 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5537 return NF_DROP;
5538
Paul Mooreeffad8d2008-01-29 08:49:27 -05005539 return NF_ACCEPT;
5540}
5541
Eric W. Biederman06198b32015-09-18 14:33:06 -05005542static unsigned int selinux_ipv4_forward(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005543 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005544 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005545{
David S. Miller238e54c2015-04-03 20:32:56 -04005546 return selinux_ip_forward(skb, state->in, PF_INET);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005547}
5548
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005549#if IS_ENABLED(CONFIG_IPV6)
Eric W. Biederman06198b32015-09-18 14:33:06 -05005550static unsigned int selinux_ipv6_forward(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005551 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005552 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005553{
David S. Miller238e54c2015-04-03 20:32:56 -04005554 return selinux_ip_forward(skb, state->in, PF_INET6);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005555}
5556#endif /* IPV6 */
5557
Paul Moore948bf852008-10-10 10:16:32 -04005558static unsigned int selinux_ip_output(struct sk_buff *skb,
5559 u16 family)
5560{
Paul Moore47180062013-12-04 16:10:45 -05005561 struct sock *sk;
Paul Moore948bf852008-10-10 10:16:32 -04005562 u32 sid;
5563
5564 if (!netlbl_enabled())
5565 return NF_ACCEPT;
5566
5567 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5568 * because we want to make sure we apply the necessary labeling
5569 * before IPsec is applied so we can leverage AH protection */
Paul Moore47180062013-12-04 16:10:45 -05005570 sk = skb->sk;
5571 if (sk) {
5572 struct sk_security_struct *sksec;
5573
Eric Dumazete446f9d2015-10-08 05:01:55 -07005574 if (sk_listener(sk))
Paul Moore47180062013-12-04 16:10:45 -05005575 /* if the socket is the listening state then this
5576 * packet is a SYN-ACK packet which means it needs to
5577 * be labeled based on the connection/request_sock and
5578 * not the parent socket. unfortunately, we can't
5579 * lookup the request_sock yet as it isn't queued on
5580 * the parent socket until after the SYN-ACK is sent.
5581 * the "solution" is to simply pass the packet as-is
5582 * as any IP option based labeling should be copied
5583 * from the initial connection request (in the IP
5584 * layer). it is far from ideal, but until we get a
5585 * security label in the packet itself this is the
5586 * best we can do. */
5587 return NF_ACCEPT;
5588
5589 /* standard practice, label using the parent socket */
5590 sksec = sk->sk_security;
Paul Moore948bf852008-10-10 10:16:32 -04005591 sid = sksec->sid;
5592 } else
5593 sid = SECINITSID_KERNEL;
5594 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5595 return NF_DROP;
5596
5597 return NF_ACCEPT;
5598}
5599
Eric W. Biederman06198b32015-09-18 14:33:06 -05005600static unsigned int selinux_ipv4_output(void *priv,
Paul Moore948bf852008-10-10 10:16:32 -04005601 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005602 const struct nf_hook_state *state)
Paul Moore948bf852008-10-10 10:16:32 -04005603{
5604 return selinux_ip_output(skb, PF_INET);
5605}
5606
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005607#if IS_ENABLED(CONFIG_IPV6)
Huw Davies2917f572016-06-27 15:06:15 -04005608static unsigned int selinux_ipv6_output(void *priv,
5609 struct sk_buff *skb,
5610 const struct nf_hook_state *state)
5611{
5612 return selinux_ip_output(skb, PF_INET6);
5613}
5614#endif /* IPV6 */
5615
Paul Mooreeffad8d2008-01-29 08:49:27 -05005616static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5617 int ifindex,
Paul Moored8395c82008-10-10 10:16:30 -04005618 u16 family)
James Morris4e5ab4c2006-06-09 00:33:33 -07005619{
Eric Dumazet54abc682015-11-08 10:54:07 -08005620 struct sock *sk = skb_to_full_sk(skb);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005621 struct sk_security_struct *sksec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005622 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005623 struct lsm_network_audit net = {0,};
Paul Moored8395c82008-10-10 10:16:30 -04005624 char *addrp;
5625 u8 proto;
James Morris4e5ab4c2006-06-09 00:33:33 -07005626
Paul Mooreeffad8d2008-01-29 08:49:27 -05005627 if (sk == NULL)
5628 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005629 sksec = sk->sk_security;
James Morris4e5ab4c2006-06-09 00:33:33 -07005630
Eric Paris50c205f2012-04-04 15:01:43 -04005631 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005632 ad.u.net = &net;
5633 ad.u.net->netif = ifindex;
5634 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04005635 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5636 return NF_DROP;
5637
Paul Moore58bfbb52009-03-27 17:10:41 -04005638 if (selinux_secmark_enabled())
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005639 if (avc_has_perm(&selinux_state,
5640 sksec->sid, skb->secmark,
Paul Moored8395c82008-10-10 10:16:30 -04005641 SECCLASS_PACKET, PACKET__SEND, &ad))
Eric Paris2fe66ec2010-11-23 06:28:08 +00005642 return NF_DROP_ERR(-ECONNREFUSED);
James Morris4e5ab4c2006-06-09 00:33:33 -07005643
Steffen Klassertb9679a72011-02-23 12:55:21 +01005644 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5645 return NF_DROP_ERR(-ECONNREFUSED);
James Morris4e5ab4c2006-06-09 00:33:33 -07005646
Paul Mooreeffad8d2008-01-29 08:49:27 -05005647 return NF_ACCEPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005648}
5649
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005650static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5651 const struct net_device *outdev,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005652 u16 family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005653{
Paul Mooreeffad8d2008-01-29 08:49:27 -05005654 u32 secmark_perm;
5655 u32 peer_sid;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005656 int ifindex = outdev->ifindex;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005657 struct sock *sk;
Thomas Liu2bf49692009-07-14 12:14:09 -04005658 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005659 struct lsm_network_audit net = {0,};
Paul Mooreeffad8d2008-01-29 08:49:27 -05005660 char *addrp;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005661 u8 secmark_active;
5662 u8 peerlbl_active;
5663
Paul Mooreeffad8d2008-01-29 08:49:27 -05005664 /* If any sort of compatibility mode is enabled then handoff processing
5665 * to the selinux_ip_postroute_compat() function to deal with the
5666 * special handling. We do this in an attempt to keep this function
5667 * as fast and as clean as possible. */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005668 if (!selinux_policycap_netpeer())
Paul Moored8395c82008-10-10 10:16:30 -04005669 return selinux_ip_postroute_compat(skb, ifindex, family);
Paul Moorec0828e52013-12-10 14:58:01 -05005670
Paul Mooreeffad8d2008-01-29 08:49:27 -05005671 secmark_active = selinux_secmark_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04005672 peerlbl_active = selinux_peerlbl_enabled();
Paul Mooreeffad8d2008-01-29 08:49:27 -05005673 if (!secmark_active && !peerlbl_active)
5674 return NF_ACCEPT;
5675
Eric Dumazet54abc682015-11-08 10:54:07 -08005676 sk = skb_to_full_sk(skb);
Paul Moorec0828e52013-12-10 14:58:01 -05005677
Paul Mooreeffad8d2008-01-29 08:49:27 -05005678#ifdef CONFIG_XFRM
5679 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5680 * packet transformation so allow the packet to pass without any checks
5681 * since we'll have another chance to perform access control checks
5682 * when the packet is on it's final way out.
5683 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
Paul Moorec0828e52013-12-10 14:58:01 -05005684 * is NULL, in this case go ahead and apply access control.
5685 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5686 * TCP listening state we cannot wait until the XFRM processing
5687 * is done as we will miss out on the SA label if we do;
5688 * unfortunately, this means more work, but it is only once per
5689 * connection. */
5690 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
Eric Dumazete446f9d2015-10-08 05:01:55 -07005691 !(sk && sk_listener(sk)))
Paul Mooreeffad8d2008-01-29 08:49:27 -05005692 return NF_ACCEPT;
5693#endif
Paul Mooreeffad8d2008-01-29 08:49:27 -05005694
Paul Moored8395c82008-10-10 10:16:30 -04005695 if (sk == NULL) {
Paul Moore446b8022013-12-04 16:10:51 -05005696 /* Without an associated socket the packet is either coming
5697 * from the kernel or it is being forwarded; check the packet
5698 * to determine which and if the packet is being forwarded
5699 * query the packet directly to determine the security label. */
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005700 if (skb->skb_iif) {
5701 secmark_perm = PACKET__FORWARD_OUT;
Paul Moored8395c82008-10-10 10:16:30 -04005702 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005703 return NF_DROP;
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005704 } else {
5705 secmark_perm = PACKET__SEND;
Paul Moored8395c82008-10-10 10:16:30 -04005706 peer_sid = SECINITSID_KERNEL;
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005707 }
Eric Dumazete446f9d2015-10-08 05:01:55 -07005708 } else if (sk_listener(sk)) {
Paul Moore446b8022013-12-04 16:10:51 -05005709 /* Locally generated packet but the associated socket is in the
5710 * listening state which means this is a SYN-ACK packet. In
5711 * this particular case the correct security label is assigned
5712 * to the connection/request_sock but unfortunately we can't
5713 * query the request_sock as it isn't queued on the parent
5714 * socket until after the SYN-ACK packet is sent; the only
5715 * viable choice is to regenerate the label like we do in
5716 * selinux_inet_conn_request(). See also selinux_ip_output()
5717 * for similar problems. */
5718 u32 skb_sid;
Eric Dumazete446f9d2015-10-08 05:01:55 -07005719 struct sk_security_struct *sksec;
5720
Eric Dumazete446f9d2015-10-08 05:01:55 -07005721 sksec = sk->sk_security;
Paul Moore446b8022013-12-04 16:10:51 -05005722 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5723 return NF_DROP;
Paul Moorec0828e52013-12-10 14:58:01 -05005724 /* At this point, if the returned skb peerlbl is SECSID_NULL
5725 * and the packet has been through at least one XFRM
5726 * transformation then we must be dealing with the "final"
5727 * form of labeled IPsec packet; since we've already applied
5728 * all of our access controls on this packet we can safely
5729 * pass the packet. */
5730 if (skb_sid == SECSID_NULL) {
5731 switch (family) {
5732 case PF_INET:
5733 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5734 return NF_ACCEPT;
5735 break;
5736 case PF_INET6:
5737 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5738 return NF_ACCEPT;
Paul Moorea7a91a12014-09-03 10:51:59 -04005739 break;
Paul Moorec0828e52013-12-10 14:58:01 -05005740 default:
5741 return NF_DROP_ERR(-ECONNREFUSED);
5742 }
5743 }
Paul Moore446b8022013-12-04 16:10:51 -05005744 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5745 return NF_DROP;
5746 secmark_perm = PACKET__SEND;
Paul Moored8395c82008-10-10 10:16:30 -04005747 } else {
Paul Moore446b8022013-12-04 16:10:51 -05005748 /* Locally generated packet, fetch the security label from the
5749 * associated socket. */
Paul Mooreeffad8d2008-01-29 08:49:27 -05005750 struct sk_security_struct *sksec = sk->sk_security;
5751 peer_sid = sksec->sid;
5752 secmark_perm = PACKET__SEND;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005753 }
5754
Eric Paris50c205f2012-04-04 15:01:43 -04005755 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005756 ad.u.net = &net;
5757 ad.u.net->netif = ifindex;
5758 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04005759 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
Eric Paris04f6d702010-11-23 06:28:02 +00005760 return NF_DROP;
Paul Moored8395c82008-10-10 10:16:30 -04005761
Paul Mooreeffad8d2008-01-29 08:49:27 -05005762 if (secmark_active)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005763 if (avc_has_perm(&selinux_state,
5764 peer_sid, skb->secmark,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005765 SECCLASS_PACKET, secmark_perm, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005766 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005767
5768 if (peerlbl_active) {
5769 u32 if_sid;
5770 u32 node_sid;
5771
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005772 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005773 return NF_DROP;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005774 if (avc_has_perm(&selinux_state,
5775 peer_sid, if_sid,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005776 SECCLASS_NETIF, NETIF__EGRESS, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005777 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005778
5779 if (sel_netnode_sid(addrp, family, &node_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005780 return NF_DROP;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005781 if (avc_has_perm(&selinux_state,
5782 peer_sid, node_sid,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005783 SECCLASS_NODE, NODE__SENDTO, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005784 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005785 }
5786
5787 return NF_ACCEPT;
5788}
5789
Eric W. Biederman06198b32015-09-18 14:33:06 -05005790static unsigned int selinux_ipv4_postroute(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005791 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005792 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005793{
David S. Miller238e54c2015-04-03 20:32:56 -04005794 return selinux_ip_postroute(skb, state->out, PF_INET);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005795}
5796
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005797#if IS_ENABLED(CONFIG_IPV6)
Eric W. Biederman06198b32015-09-18 14:33:06 -05005798static unsigned int selinux_ipv6_postroute(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005799 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005800 const struct nf_hook_state *state)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005801{
David S. Miller238e54c2015-04-03 20:32:56 -04005802 return selinux_ip_postroute(skb, state->out, PF_INET6);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005803}
Linus Torvalds1da177e2005-04-16 15:20:36 -07005804#endif /* IPV6 */
5805
5806#endif /* CONFIG_NETFILTER */
5807
Linus Torvalds1da177e2005-04-16 15:20:36 -07005808static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5809{
Stephen Smalley941fc5b2009-10-01 14:48:23 -04005810 return selinux_nlmsg_perm(sk, skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005811}
5812
Casey Schauflerecd5f822018-11-20 11:55:02 -08005813static void ipc_init_security(struct ipc_security_struct *isec, u16 sclass)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005814{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005815 isec->sclass = sclass;
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005816 isec->sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005817}
5818
5819static int msg_msg_alloc_security(struct msg_msg *msg)
5820{
5821 struct msg_security_struct *msec;
5822
Casey Schauflerecd5f822018-11-20 11:55:02 -08005823 msec = selinux_msg_msg(msg);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005824 msec->sid = SECINITSID_UNLABELED;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005825
5826 return 0;
5827}
5828
Linus Torvalds1da177e2005-04-16 15:20:36 -07005829static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
Stephen Smalley6af963f2005-05-01 08:58:39 -07005830 u32 perms)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005831{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005832 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005833 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005834 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005835
Casey Schaufler7c653822018-09-21 17:19:45 -07005836 isec = selinux_ipc(ipc_perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005837
Eric Paris50c205f2012-04-04 15:01:43 -04005838 ad.type = LSM_AUDIT_DATA_IPC;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005839 ad.u.ipc_id = ipc_perms->key;
5840
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005841 return avc_has_perm(&selinux_state,
5842 sid, isec->sid, isec->sclass, perms, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005843}
5844
5845static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5846{
5847 return msg_msg_alloc_security(msg);
5848}
5849
Linus Torvalds1da177e2005-04-16 15:20:36 -07005850/* message queue security operations */
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005851static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005852{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005853 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005854 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005855 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005856 int rc;
5857
Casey Schauflerecd5f822018-11-20 11:55:02 -08005858 isec = selinux_ipc(msq);
5859 ipc_init_security(isec, SECCLASS_MSGQ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005860
Eric Paris50c205f2012-04-04 15:01:43 -04005861 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005862 ad.u.ipc_id = msq->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005863
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005864 rc = avc_has_perm(&selinux_state,
5865 sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005866 MSGQ__CREATE, &ad);
Casey Schauflerecd5f822018-11-20 11:55:02 -08005867 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005868}
5869
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005870static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005871{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005872 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005873 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005874 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005875
Casey Schaufler7c653822018-09-21 17:19:45 -07005876 isec = selinux_ipc(msq);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005877
Eric Paris50c205f2012-04-04 15:01:43 -04005878 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005879 ad.u.ipc_id = msq->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005880
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005881 return avc_has_perm(&selinux_state,
5882 sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005883 MSGQ__ASSOCIATE, &ad);
5884}
5885
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005886static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005887{
5888 int err;
5889 int perms;
5890
Eric Paris828dfe12008-04-17 13:17:49 -04005891 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005892 case IPC_INFO:
5893 case MSG_INFO:
5894 /* No specific object, just general system-wide information. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005895 return avc_has_perm(&selinux_state,
5896 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005897 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005898 case IPC_STAT:
5899 case MSG_STAT:
Davidlohr Bueso23c8cec2018-04-10 16:35:30 -07005900 case MSG_STAT_ANY:
Linus Torvalds1da177e2005-04-16 15:20:36 -07005901 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5902 break;
5903 case IPC_SET:
5904 perms = MSGQ__SETATTR;
5905 break;
5906 case IPC_RMID:
5907 perms = MSGQ__DESTROY;
5908 break;
5909 default:
5910 return 0;
5911 }
5912
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005913 err = ipc_has_perm(msq, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005914 return err;
5915}
5916
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005917static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005918{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005919 struct ipc_security_struct *isec;
5920 struct msg_security_struct *msec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005921 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005922 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005923 int rc;
5924
Casey Schaufler7c653822018-09-21 17:19:45 -07005925 isec = selinux_ipc(msq);
5926 msec = selinux_msg_msg(msg);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005927
5928 /*
5929 * First time through, need to assign label to the message
5930 */
5931 if (msec->sid == SECINITSID_UNLABELED) {
5932 /*
5933 * Compute new sid based on current process and
5934 * message queue this message will be stored in
5935 */
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05005936 rc = security_transition_sid(&selinux_state, sid, isec->sid,
5937 SECCLASS_MSG, NULL, &msec->sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005938 if (rc)
5939 return rc;
5940 }
5941
Eric Paris50c205f2012-04-04 15:01:43 -04005942 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005943 ad.u.ipc_id = msq->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005944
5945 /* Can this process write to the queue? */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005946 rc = avc_has_perm(&selinux_state,
5947 sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005948 MSGQ__WRITE, &ad);
5949 if (!rc)
5950 /* Can this process send the message */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005951 rc = avc_has_perm(&selinux_state,
5952 sid, msec->sid, SECCLASS_MSG,
David Howells275bb412008-11-14 10:39:19 +11005953 MSG__SEND, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005954 if (!rc)
5955 /* Can the message be put in the queue? */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005956 rc = avc_has_perm(&selinux_state,
5957 msec->sid, isec->sid, SECCLASS_MSGQ,
David Howells275bb412008-11-14 10:39:19 +11005958 MSGQ__ENQUEUE, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005959
5960 return rc;
5961}
5962
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005963static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005964 struct task_struct *target,
5965 long type, int mode)
5966{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005967 struct ipc_security_struct *isec;
5968 struct msg_security_struct *msec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005969 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005970 u32 sid = task_sid(target);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005971 int rc;
5972
Casey Schaufler7c653822018-09-21 17:19:45 -07005973 isec = selinux_ipc(msq);
5974 msec = selinux_msg_msg(msg);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005975
Eric Paris50c205f2012-04-04 15:01:43 -04005976 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermand8c6e852018-03-22 21:22:26 -05005977 ad.u.ipc_id = msq->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005978
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005979 rc = avc_has_perm(&selinux_state,
5980 sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005981 SECCLASS_MSGQ, MSGQ__READ, &ad);
5982 if (!rc)
Stephen Smalley6b6bc622018-03-05 11:47:56 -05005983 rc = avc_has_perm(&selinux_state,
5984 sid, msec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005985 SECCLASS_MSG, MSG__RECEIVE, &ad);
5986 return rc;
5987}
5988
5989/* Shared Memory security operations */
Eric W. Biederman7191adf2018-03-22 21:08:27 -05005990static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005991{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005992 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005993 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005994 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005995 int rc;
5996
Casey Schauflerecd5f822018-11-20 11:55:02 -08005997 isec = selinux_ipc(shp);
5998 ipc_init_security(isec, SECCLASS_SHM);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005999
Eric Paris50c205f2012-04-04 15:01:43 -04006000 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006001 ad.u.ipc_id = shp->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006002
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006003 rc = avc_has_perm(&selinux_state,
6004 sid, isec->sid, SECCLASS_SHM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006005 SHM__CREATE, &ad);
Casey Schauflerecd5f822018-11-20 11:55:02 -08006006 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006007}
6008
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006009static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006010{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006011 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006012 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006013 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006014
Casey Schaufler7c653822018-09-21 17:19:45 -07006015 isec = selinux_ipc(shp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006016
Eric Paris50c205f2012-04-04 15:01:43 -04006017 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006018 ad.u.ipc_id = shp->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006019
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006020 return avc_has_perm(&selinux_state,
6021 sid, isec->sid, SECCLASS_SHM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006022 SHM__ASSOCIATE, &ad);
6023}
6024
6025/* Note, at this point, shp is locked down */
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006026static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006027{
6028 int perms;
6029 int err;
6030
Eric Paris828dfe12008-04-17 13:17:49 -04006031 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006032 case IPC_INFO:
6033 case SHM_INFO:
6034 /* No specific object, just general system-wide information. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006035 return avc_has_perm(&selinux_state,
6036 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006037 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006038 case IPC_STAT:
6039 case SHM_STAT:
Davidlohr Buesoc21a6972018-04-10 16:35:23 -07006040 case SHM_STAT_ANY:
Linus Torvalds1da177e2005-04-16 15:20:36 -07006041 perms = SHM__GETATTR | SHM__ASSOCIATE;
6042 break;
6043 case IPC_SET:
6044 perms = SHM__SETATTR;
6045 break;
6046 case SHM_LOCK:
6047 case SHM_UNLOCK:
6048 perms = SHM__LOCK;
6049 break;
6050 case IPC_RMID:
6051 perms = SHM__DESTROY;
6052 break;
6053 default:
6054 return 0;
6055 }
6056
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006057 err = ipc_has_perm(shp, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006058 return err;
6059}
6060
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006061static int selinux_shm_shmat(struct kern_ipc_perm *shp,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006062 char __user *shmaddr, int shmflg)
6063{
6064 u32 perms;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006065
6066 if (shmflg & SHM_RDONLY)
6067 perms = SHM__READ;
6068 else
6069 perms = SHM__READ | SHM__WRITE;
6070
Eric W. Biederman7191adf2018-03-22 21:08:27 -05006071 return ipc_has_perm(shp, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006072}
6073
6074/* Semaphore security operations */
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006075static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006076{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006077 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006078 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006079 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006080 int rc;
6081
Casey Schauflerecd5f822018-11-20 11:55:02 -08006082 isec = selinux_ipc(sma);
6083 ipc_init_security(isec, SECCLASS_SEM);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006084
Eric Paris50c205f2012-04-04 15:01:43 -04006085 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006086 ad.u.ipc_id = sma->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006087
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006088 rc = avc_has_perm(&selinux_state,
6089 sid, isec->sid, SECCLASS_SEM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006090 SEM__CREATE, &ad);
Casey Schauflerecd5f822018-11-20 11:55:02 -08006091 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006092}
6093
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006094static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006095{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006096 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04006097 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11006098 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006099
Casey Schaufler7c653822018-09-21 17:19:45 -07006100 isec = selinux_ipc(sma);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006101
Eric Paris50c205f2012-04-04 15:01:43 -04006102 ad.type = LSM_AUDIT_DATA_IPC;
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006103 ad.u.ipc_id = sma->key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006104
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006105 return avc_has_perm(&selinux_state,
6106 sid, isec->sid, SECCLASS_SEM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006107 SEM__ASSOCIATE, &ad);
6108}
6109
6110/* Note, at this point, sma is locked down */
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006111static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006112{
6113 int err;
6114 u32 perms;
6115
Eric Paris828dfe12008-04-17 13:17:49 -04006116 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006117 case IPC_INFO:
6118 case SEM_INFO:
6119 /* No specific object, just general system-wide information. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006120 return avc_has_perm(&selinux_state,
6121 current_sid(), SECINITSID_KERNEL,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006122 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006123 case GETPID:
6124 case GETNCNT:
6125 case GETZCNT:
6126 perms = SEM__GETATTR;
6127 break;
6128 case GETVAL:
6129 case GETALL:
6130 perms = SEM__READ;
6131 break;
6132 case SETVAL:
6133 case SETALL:
6134 perms = SEM__WRITE;
6135 break;
6136 case IPC_RMID:
6137 perms = SEM__DESTROY;
6138 break;
6139 case IPC_SET:
6140 perms = SEM__SETATTR;
6141 break;
6142 case IPC_STAT:
6143 case SEM_STAT:
Davidlohr Buesoa280d6d2018-04-10 16:35:26 -07006144 case SEM_STAT_ANY:
Linus Torvalds1da177e2005-04-16 15:20:36 -07006145 perms = SEM__GETATTR | SEM__ASSOCIATE;
6146 break;
6147 default:
6148 return 0;
6149 }
6150
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006151 err = ipc_has_perm(sma, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006152 return err;
6153}
6154
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006155static int selinux_sem_semop(struct kern_ipc_perm *sma,
Linus Torvalds1da177e2005-04-16 15:20:36 -07006156 struct sembuf *sops, unsigned nsops, int alter)
6157{
6158 u32 perms;
6159
6160 if (alter)
6161 perms = SEM__READ | SEM__WRITE;
6162 else
6163 perms = SEM__READ;
6164
Eric W. Biedermanaefad952018-03-22 20:52:43 -05006165 return ipc_has_perm(sma, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006166}
6167
6168static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6169{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006170 u32 av = 0;
6171
Linus Torvalds1da177e2005-04-16 15:20:36 -07006172 av = 0;
6173 if (flag & S_IRUGO)
6174 av |= IPC__UNIX_READ;
6175 if (flag & S_IWUGO)
6176 av |= IPC__UNIX_WRITE;
6177
6178 if (av == 0)
6179 return 0;
6180
Stephen Smalley6af963f2005-05-01 08:58:39 -07006181 return ipc_has_perm(ipcp, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006182}
6183
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02006184static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6185{
Casey Schaufler7c653822018-09-21 17:19:45 -07006186 struct ipc_security_struct *isec = selinux_ipc(ipcp);
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02006187 *secid = isec->sid;
6188}
6189
Eric Paris828dfe12008-04-17 13:17:49 -04006190static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006191{
6192 if (inode)
6193 inode_doinit_with_dentry(inode, dentry);
6194}
6195
6196static int selinux_getprocattr(struct task_struct *p,
Al Viro04ff9702007-03-12 16:17:58 +00006197 char *name, char **value)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006198{
David Howells275bb412008-11-14 10:39:19 +11006199 const struct task_security_struct *__tsec;
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00006200 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006201 int error;
Al Viro04ff9702007-03-12 16:17:58 +00006202 unsigned len;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006203
David Howells275bb412008-11-14 10:39:19 +11006204 rcu_read_lock();
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07006205 __tsec = selinux_cred(__task_cred(p));
Linus Torvalds1da177e2005-04-16 15:20:36 -07006206
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006207 if (current != p) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006208 error = avc_has_perm(&selinux_state,
6209 current_sid(), __tsec->sid,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006210 SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6211 if (error)
6212 goto bad;
6213 }
6214
Linus Torvalds1da177e2005-04-16 15:20:36 -07006215 if (!strcmp(name, "current"))
David Howells275bb412008-11-14 10:39:19 +11006216 sid = __tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006217 else if (!strcmp(name, "prev"))
David Howells275bb412008-11-14 10:39:19 +11006218 sid = __tsec->osid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006219 else if (!strcmp(name, "exec"))
David Howells275bb412008-11-14 10:39:19 +11006220 sid = __tsec->exec_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006221 else if (!strcmp(name, "fscreate"))
David Howells275bb412008-11-14 10:39:19 +11006222 sid = __tsec->create_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07006223 else if (!strcmp(name, "keycreate"))
David Howells275bb412008-11-14 10:39:19 +11006224 sid = __tsec->keycreate_sid;
Eric Paris42c3e032006-06-26 00:26:03 -07006225 else if (!strcmp(name, "sockcreate"))
David Howells275bb412008-11-14 10:39:19 +11006226 sid = __tsec->sockcreate_sid;
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006227 else {
6228 error = -EINVAL;
6229 goto bad;
6230 }
David Howells275bb412008-11-14 10:39:19 +11006231 rcu_read_unlock();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006232
6233 if (!sid)
6234 return 0;
6235
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006236 error = security_sid_to_context(&selinux_state, sid, value, &len);
Al Viro04ff9702007-03-12 16:17:58 +00006237 if (error)
6238 return error;
6239 return len;
David Howells275bb412008-11-14 10:39:19 +11006240
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006241bad:
David Howells275bb412008-11-14 10:39:19 +11006242 rcu_read_unlock();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006243 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006244}
6245
Stephen Smalleyb21507e2017-01-09 10:07:31 -05006246static int selinux_setprocattr(const char *name, void *value, size_t size)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006247{
6248 struct task_security_struct *tsec;
David Howellsd84f4f92008-11-14 10:39:23 +11006249 struct cred *new;
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006250 u32 mysid = current_sid(), sid = 0, ptsid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006251 int error;
6252 char *str = value;
6253
Linus Torvalds1da177e2005-04-16 15:20:36 -07006254 /*
6255 * Basic control over ability to set these attributes at all.
Linus Torvalds1da177e2005-04-16 15:20:36 -07006256 */
6257 if (!strcmp(name, "exec"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006258 error = avc_has_perm(&selinux_state,
6259 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006260 PROCESS__SETEXEC, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006261 else if (!strcmp(name, "fscreate"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006262 error = avc_has_perm(&selinux_state,
6263 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006264 PROCESS__SETFSCREATE, NULL);
Michael LeMay4eb582c2006-06-26 00:24:57 -07006265 else if (!strcmp(name, "keycreate"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006266 error = avc_has_perm(&selinux_state,
6267 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006268 PROCESS__SETKEYCREATE, NULL);
Eric Paris42c3e032006-06-26 00:26:03 -07006269 else if (!strcmp(name, "sockcreate"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006270 error = avc_has_perm(&selinux_state,
6271 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006272 PROCESS__SETSOCKCREATE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006273 else if (!strcmp(name, "current"))
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006274 error = avc_has_perm(&selinux_state,
6275 mysid, mysid, SECCLASS_PROCESS,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006276 PROCESS__SETCURRENT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006277 else
6278 error = -EINVAL;
6279 if (error)
6280 return error;
6281
6282 /* Obtain a SID for the context, if one was specified. */
Stephen Smalleya050a572017-01-31 11:54:04 -05006283 if (size && str[0] && str[0] != '\n') {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006284 if (str[size-1] == '\n') {
6285 str[size-1] = 0;
6286 size--;
6287 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006288 error = security_context_to_sid(&selinux_state, value, size,
6289 &sid, GFP_KERNEL);
Stephen Smalley12b29f32008-05-07 13:03:20 -04006290 if (error == -EINVAL && !strcmp(name, "fscreate")) {
Stephen Smalleydb590002017-04-20 11:31:30 -04006291 if (!has_cap_mac_admin(true)) {
Eric Parisd6ea83e2012-04-04 13:45:49 -04006292 struct audit_buffer *ab;
6293 size_t audit_size;
6294
6295 /* We strip a nul only if it is at the end, otherwise the
6296 * context contains a nul and we should audit that */
6297 if (str[size - 1] == '\0')
6298 audit_size = size - 1;
6299 else
6300 audit_size = size;
Richard Guy Briggscdfb6b32018-05-12 21:58:20 -04006301 ab = audit_log_start(audit_context(),
6302 GFP_ATOMIC,
6303 AUDIT_SELINUX_ERR);
Eric Parisd6ea83e2012-04-04 13:45:49 -04006304 audit_log_format(ab, "op=fscreate invalid_context=");
6305 audit_log_n_untrustedstring(ab, value, audit_size);
6306 audit_log_end(ab);
6307
Stephen Smalley12b29f32008-05-07 13:03:20 -04006308 return error;
Eric Parisd6ea83e2012-04-04 13:45:49 -04006309 }
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006310 error = security_context_to_sid_force(
6311 &selinux_state,
6312 value, size, &sid);
Stephen Smalley12b29f32008-05-07 13:03:20 -04006313 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07006314 if (error)
6315 return error;
6316 }
6317
David Howellsd84f4f92008-11-14 10:39:23 +11006318 new = prepare_creds();
6319 if (!new)
6320 return -ENOMEM;
6321
Linus Torvalds1da177e2005-04-16 15:20:36 -07006322 /* Permission checking based on the specified context is
6323 performed during the actual operation (execve,
6324 open/mkdir/...), when we know the full context of the
David Howellsd84f4f92008-11-14 10:39:23 +11006325 operation. See selinux_bprm_set_creds for the execve
Linus Torvalds1da177e2005-04-16 15:20:36 -07006326 checks and may_create for the file creation checks. The
6327 operation will then fail if the context is not permitted. */
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07006328 tsec = selinux_cred(new);
David Howellsd84f4f92008-11-14 10:39:23 +11006329 if (!strcmp(name, "exec")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006330 tsec->exec_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006331 } else if (!strcmp(name, "fscreate")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07006332 tsec->create_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006333 } else if (!strcmp(name, "keycreate")) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006334 error = avc_has_perm(&selinux_state,
6335 mysid, sid, SECCLASS_KEY, KEY__CREATE,
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006336 NULL);
Michael LeMay4eb582c2006-06-26 00:24:57 -07006337 if (error)
David Howellsd84f4f92008-11-14 10:39:23 +11006338 goto abort_change;
Michael LeMay4eb582c2006-06-26 00:24:57 -07006339 tsec->keycreate_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006340 } else if (!strcmp(name, "sockcreate")) {
Eric Paris42c3e032006-06-26 00:26:03 -07006341 tsec->sockcreate_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11006342 } else if (!strcmp(name, "current")) {
6343 error = -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006344 if (sid == 0)
David Howellsd84f4f92008-11-14 10:39:23 +11006345 goto abort_change;
KaiGai Koheid9250de2008-08-28 16:35:57 +09006346
David Howellsd84f4f92008-11-14 10:39:23 +11006347 /* Only allow single threaded processes to change context */
6348 error = -EPERM;
Oleg Nesterov5bb459b2009-07-10 03:48:23 +02006349 if (!current_is_single_threaded()) {
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006350 error = security_bounded_transition(&selinux_state,
6351 tsec->sid, sid);
David Howellsd84f4f92008-11-14 10:39:23 +11006352 if (error)
6353 goto abort_change;
Eric Paris828dfe12008-04-17 13:17:49 -04006354 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07006355
6356 /* Check permissions for the transition. */
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006357 error = avc_has_perm(&selinux_state,
6358 tsec->sid, sid, SECCLASS_PROCESS,
Eric Paris828dfe12008-04-17 13:17:49 -04006359 PROCESS__DYNTRANSITION, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006360 if (error)
David Howellsd84f4f92008-11-14 10:39:23 +11006361 goto abort_change;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006362
6363 /* Check for ptracing, and update the task SID if ok.
6364 Otherwise, leave SID unchanged and fail. */
Stephen Smalleybe0554c2017-01-09 10:07:31 -05006365 ptsid = ptrace_parent_sid();
Paul Moore0c6181c2016-03-30 21:41:21 -04006366 if (ptsid != 0) {
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006367 error = avc_has_perm(&selinux_state,
6368 ptsid, sid, SECCLASS_PROCESS,
David Howellsd84f4f92008-11-14 10:39:23 +11006369 PROCESS__PTRACE, NULL);
6370 if (error)
6371 goto abort_change;
6372 }
6373
6374 tsec->sid = sid;
6375 } else {
6376 error = -EINVAL;
6377 goto abort_change;
6378 }
6379
6380 commit_creds(new);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006381 return size;
David Howellsd84f4f92008-11-14 10:39:23 +11006382
6383abort_change:
6384 abort_creds(new);
6385 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006386}
6387
David Quigley746df9b2013-05-22 12:50:35 -04006388static int selinux_ismaclabel(const char *name)
6389{
6390 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6391}
6392
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006393static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6394{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006395 return security_sid_to_context(&selinux_state, secid,
6396 secdata, seclen);
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006397}
6398
David Howells7bf570d2008-04-29 20:52:51 +01006399static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
David Howells63cb3442008-01-15 23:47:35 +00006400{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006401 return security_context_to_sid(&selinux_state, secdata, seclen,
6402 secid, GFP_KERNEL);
David Howells63cb3442008-01-15 23:47:35 +00006403}
6404
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006405static void selinux_release_secctx(char *secdata, u32 seclen)
6406{
Paul Moore088999e2007-08-01 11:12:58 -04006407 kfree(secdata);
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006408}
6409
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006410static void selinux_inode_invalidate_secctx(struct inode *inode)
6411{
Casey Schaufler80788c22018-09-21 17:19:11 -07006412 struct inode_security_struct *isec = selinux_inode(inode);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006413
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01006414 spin_lock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006415 isec->initialized = LABEL_INVALID;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01006416 spin_unlock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006417}
6418
David P. Quigley1ee65e32009-09-03 14:25:57 -04006419/*
6420 * called with inode->i_mutex locked
6421 */
6422static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6423{
Ondrej Mosnacek53e0c2a2018-12-21 21:18:53 +01006424 int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
6425 ctx, ctxlen, 0);
6426 /* Do not return error when suppressing label (SBLABEL_MNT not set). */
6427 return rc == -EOPNOTSUPP ? 0 : rc;
David P. Quigley1ee65e32009-09-03 14:25:57 -04006428}
6429
6430/*
6431 * called with inode->i_mutex locked
6432 */
6433static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6434{
6435 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6436}
6437
6438static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6439{
6440 int len = 0;
6441 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6442 ctx, true);
6443 if (len < 0)
6444 return len;
6445 *ctxlen = len;
6446 return 0;
6447}
Michael LeMayd7200242006-06-22 14:47:17 -07006448#ifdef CONFIG_KEYS
6449
David Howellsd84f4f92008-11-14 10:39:23 +11006450static int selinux_key_alloc(struct key *k, const struct cred *cred,
David Howells7e047ef2006-06-26 00:24:50 -07006451 unsigned long flags)
Michael LeMayd7200242006-06-22 14:47:17 -07006452{
David Howellsd84f4f92008-11-14 10:39:23 +11006453 const struct task_security_struct *tsec;
Michael LeMayd7200242006-06-22 14:47:17 -07006454 struct key_security_struct *ksec;
6455
6456 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6457 if (!ksec)
6458 return -ENOMEM;
6459
Casey Schaufler0c6cfa62018-09-21 17:17:16 -07006460 tsec = selinux_cred(cred);
David Howellsd84f4f92008-11-14 10:39:23 +11006461 if (tsec->keycreate_sid)
6462 ksec->sid = tsec->keycreate_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07006463 else
David Howellsd84f4f92008-11-14 10:39:23 +11006464 ksec->sid = tsec->sid;
Michael LeMayd7200242006-06-22 14:47:17 -07006465
David Howells275bb412008-11-14 10:39:19 +11006466 k->security = ksec;
Michael LeMayd7200242006-06-22 14:47:17 -07006467 return 0;
6468}
6469
6470static void selinux_key_free(struct key *k)
6471{
6472 struct key_security_struct *ksec = k->security;
6473
6474 k->security = NULL;
6475 kfree(ksec);
6476}
6477
6478static int selinux_key_permission(key_ref_t key_ref,
David Howellsd84f4f92008-11-14 10:39:23 +11006479 const struct cred *cred,
David Howellsf5895942014-03-14 17:44:49 +00006480 unsigned perm)
Michael LeMayd7200242006-06-22 14:47:17 -07006481{
6482 struct key *key;
Michael LeMayd7200242006-06-22 14:47:17 -07006483 struct key_security_struct *ksec;
David Howells275bb412008-11-14 10:39:19 +11006484 u32 sid;
Michael LeMayd7200242006-06-22 14:47:17 -07006485
6486 /* if no specific permissions are requested, we skip the
6487 permission check. No serious, additional covert channels
6488 appear to be created. */
6489 if (perm == 0)
6490 return 0;
6491
David Howellsd84f4f92008-11-14 10:39:23 +11006492 sid = cred_sid(cred);
David Howells275bb412008-11-14 10:39:19 +11006493
6494 key = key_ref_to_ptr(key_ref);
6495 ksec = key->security;
6496
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006497 return avc_has_perm(&selinux_state,
6498 sid, ksec->sid, SECCLASS_KEY, perm, NULL);
Michael LeMayd7200242006-06-22 14:47:17 -07006499}
6500
David Howells70a5bb72008-04-29 01:01:26 -07006501static int selinux_key_getsecurity(struct key *key, char **_buffer)
6502{
6503 struct key_security_struct *ksec = key->security;
6504 char *context = NULL;
6505 unsigned len;
6506 int rc;
6507
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006508 rc = security_sid_to_context(&selinux_state, ksec->sid,
6509 &context, &len);
David Howells70a5bb72008-04-29 01:01:26 -07006510 if (!rc)
6511 rc = len;
6512 *_buffer = context;
6513 return rc;
6514}
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03006515#endif
David Howells70a5bb72008-04-29 01:01:26 -07006516
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03006517#ifdef CONFIG_SECURITY_INFINIBAND
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03006518static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6519{
6520 struct common_audit_data ad;
6521 int err;
6522 u32 sid = 0;
6523 struct ib_security_struct *sec = ib_sec;
6524 struct lsm_ibpkey_audit ibpkey;
6525
Daniel Jurgens409dcf32017-05-19 15:48:59 +03006526 err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03006527 if (err)
6528 return err;
6529
6530 ad.type = LSM_AUDIT_DATA_IBPKEY;
6531 ibpkey.subnet_prefix = subnet_prefix;
6532 ibpkey.pkey = pkey_val;
6533 ad.u.ibpkey = &ibpkey;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006534 return avc_has_perm(&selinux_state,
6535 sec->sid, sid,
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03006536 SECCLASS_INFINIBAND_PKEY,
6537 INFINIBAND_PKEY__ACCESS, &ad);
6538}
6539
Daniel Jurgensab861df2017-05-19 15:48:58 +03006540static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6541 u8 port_num)
6542{
6543 struct common_audit_data ad;
6544 int err;
6545 u32 sid = 0;
6546 struct ib_security_struct *sec = ib_sec;
6547 struct lsm_ibendport_audit ibendport;
6548
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006549 err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6550 &sid);
Daniel Jurgensab861df2017-05-19 15:48:58 +03006551
6552 if (err)
6553 return err;
6554
6555 ad.type = LSM_AUDIT_DATA_IBENDPORT;
6556 strncpy(ibendport.dev_name, dev_name, sizeof(ibendport.dev_name));
6557 ibendport.port = port_num;
6558 ad.u.ibendport = &ibendport;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006559 return avc_has_perm(&selinux_state,
6560 sec->sid, sid,
Daniel Jurgensab861df2017-05-19 15:48:58 +03006561 SECCLASS_INFINIBAND_ENDPORT,
6562 INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6563}
6564
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03006565static int selinux_ib_alloc_security(void **ib_sec)
6566{
6567 struct ib_security_struct *sec;
6568
6569 sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6570 if (!sec)
6571 return -ENOMEM;
6572 sec->sid = current_sid();
6573
6574 *ib_sec = sec;
6575 return 0;
6576}
6577
6578static void selinux_ib_free_security(void *ib_sec)
6579{
6580 kfree(ib_sec);
6581}
Michael LeMayd7200242006-06-22 14:47:17 -07006582#endif
6583
Chenbo Fengec27c352017-10-18 13:00:25 -07006584#ifdef CONFIG_BPF_SYSCALL
6585static int selinux_bpf(int cmd, union bpf_attr *attr,
6586 unsigned int size)
6587{
6588 u32 sid = current_sid();
6589 int ret;
6590
6591 switch (cmd) {
6592 case BPF_MAP_CREATE:
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006593 ret = avc_has_perm(&selinux_state,
6594 sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
Chenbo Fengec27c352017-10-18 13:00:25 -07006595 NULL);
6596 break;
6597 case BPF_PROG_LOAD:
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006598 ret = avc_has_perm(&selinux_state,
6599 sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
Chenbo Fengec27c352017-10-18 13:00:25 -07006600 NULL);
6601 break;
6602 default:
6603 ret = 0;
6604 break;
6605 }
6606
6607 return ret;
6608}
6609
6610static u32 bpf_map_fmode_to_av(fmode_t fmode)
6611{
6612 u32 av = 0;
6613
6614 if (fmode & FMODE_READ)
6615 av |= BPF__MAP_READ;
6616 if (fmode & FMODE_WRITE)
6617 av |= BPF__MAP_WRITE;
6618 return av;
6619}
6620
Chenbo Fengf66e4482017-10-18 13:00:26 -07006621/* This function will check the file pass through unix socket or binder to see
6622 * if it is a bpf related object. And apply correspinding checks on the bpf
6623 * object based on the type. The bpf maps and programs, not like other files and
6624 * socket, are using a shared anonymous inode inside the kernel as their inode.
6625 * So checking that inode cannot identify if the process have privilege to
6626 * access the bpf object and that's why we have to add this additional check in
6627 * selinux_file_receive and selinux_binder_transfer_files.
6628 */
6629static int bpf_fd_pass(struct file *file, u32 sid)
6630{
6631 struct bpf_security_struct *bpfsec;
6632 struct bpf_prog *prog;
6633 struct bpf_map *map;
6634 int ret;
6635
6636 if (file->f_op == &bpf_map_fops) {
6637 map = file->private_data;
6638 bpfsec = map->security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006639 ret = avc_has_perm(&selinux_state,
6640 sid, bpfsec->sid, SECCLASS_BPF,
Chenbo Fengf66e4482017-10-18 13:00:26 -07006641 bpf_map_fmode_to_av(file->f_mode), NULL);
6642 if (ret)
6643 return ret;
6644 } else if (file->f_op == &bpf_prog_fops) {
6645 prog = file->private_data;
6646 bpfsec = prog->aux->security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006647 ret = avc_has_perm(&selinux_state,
6648 sid, bpfsec->sid, SECCLASS_BPF,
Chenbo Fengf66e4482017-10-18 13:00:26 -07006649 BPF__PROG_RUN, NULL);
6650 if (ret)
6651 return ret;
6652 }
6653 return 0;
6654}
6655
Chenbo Fengec27c352017-10-18 13:00:25 -07006656static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6657{
6658 u32 sid = current_sid();
6659 struct bpf_security_struct *bpfsec;
6660
6661 bpfsec = map->security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006662 return avc_has_perm(&selinux_state,
6663 sid, bpfsec->sid, SECCLASS_BPF,
Chenbo Fengec27c352017-10-18 13:00:25 -07006664 bpf_map_fmode_to_av(fmode), NULL);
6665}
6666
6667static int selinux_bpf_prog(struct bpf_prog *prog)
6668{
6669 u32 sid = current_sid();
6670 struct bpf_security_struct *bpfsec;
6671
6672 bpfsec = prog->aux->security;
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006673 return avc_has_perm(&selinux_state,
6674 sid, bpfsec->sid, SECCLASS_BPF,
Chenbo Fengec27c352017-10-18 13:00:25 -07006675 BPF__PROG_RUN, NULL);
6676}
6677
6678static int selinux_bpf_map_alloc(struct bpf_map *map)
6679{
6680 struct bpf_security_struct *bpfsec;
6681
6682 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6683 if (!bpfsec)
6684 return -ENOMEM;
6685
6686 bpfsec->sid = current_sid();
6687 map->security = bpfsec;
6688
6689 return 0;
6690}
6691
6692static void selinux_bpf_map_free(struct bpf_map *map)
6693{
6694 struct bpf_security_struct *bpfsec = map->security;
6695
6696 map->security = NULL;
6697 kfree(bpfsec);
6698}
6699
6700static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6701{
6702 struct bpf_security_struct *bpfsec;
6703
6704 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6705 if (!bpfsec)
6706 return -ENOMEM;
6707
6708 bpfsec->sid = current_sid();
6709 aux->security = bpfsec;
6710
6711 return 0;
6712}
6713
6714static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
6715{
6716 struct bpf_security_struct *bpfsec = aux->security;
6717
6718 aux->security = NULL;
6719 kfree(bpfsec);
6720}
6721#endif
6722
Casey Schauflerbbd36622018-11-12 09:30:56 -08006723struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = {
6724 .lbs_cred = sizeof(struct task_security_struct),
Casey Schaufler33bf60c2018-11-12 12:02:49 -08006725 .lbs_file = sizeof(struct file_security_struct),
Casey Schauflerafb1cbe32018-09-21 17:19:29 -07006726 .lbs_inode = sizeof(struct inode_security_struct),
Casey Schauflerecd5f822018-11-20 11:55:02 -08006727 .lbs_ipc = sizeof(struct ipc_security_struct),
6728 .lbs_msg_msg = sizeof(struct msg_security_struct),
Casey Schauflerbbd36622018-11-12 09:30:56 -08006729};
6730
James Morrisca97d932017-02-15 00:18:51 +11006731static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
Casey Schauflere20b0432015-05-02 15:11:36 -07006732 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6733 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6734 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6735 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02006736
Casey Schauflere20b0432015-05-02 15:11:36 -07006737 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6738 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6739 LSM_HOOK_INIT(capget, selinux_capget),
6740 LSM_HOOK_INIT(capset, selinux_capset),
6741 LSM_HOOK_INIT(capable, selinux_capable),
6742 LSM_HOOK_INIT(quotactl, selinux_quotactl),
6743 LSM_HOOK_INIT(quota_on, selinux_quota_on),
6744 LSM_HOOK_INIT(syslog, selinux_syslog),
6745 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
Stephen Smalley79af7302015-01-21 10:54:10 -05006746
Casey Schauflere20b0432015-05-02 15:11:36 -07006747 LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006748
Casey Schauflere20b0432015-05-02 15:11:36 -07006749 LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6750 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6751 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006752
Al Viro0b520752018-12-23 16:02:47 -05006753 LSM_HOOK_INIT(fs_context_dup, selinux_fs_context_dup),
David Howells442155c2018-11-01 23:07:24 +00006754 LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param),
6755
Casey Schauflere20b0432015-05-02 15:11:36 -07006756 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6757 LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
Al Viro5b400232018-12-12 20:13:29 -05006758 LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts),
Al Viro204cc0c2018-12-13 13:41:47 -05006759 LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts),
Casey Schauflere20b0432015-05-02 15:11:36 -07006760 LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6761 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6762 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6763 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6764 LSM_HOOK_INIT(sb_mount, selinux_mount),
6765 LSM_HOOK_INIT(sb_umount, selinux_umount),
6766 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6767 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
Al Viro757cbe52018-12-14 23:42:21 -05006768 LSM_HOOK_INIT(sb_add_mnt_opt, selinux_add_mnt_opt),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006769
Casey Schauflere20b0432015-05-02 15:11:36 -07006770 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
Vivek Goyala518b0a2016-07-13 10:44:53 -04006771 LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
Eric Parise0007522008-03-05 10:31:54 -05006772
Casey Schauflere20b0432015-05-02 15:11:36 -07006773 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6774 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6775 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6776 LSM_HOOK_INIT(inode_create, selinux_inode_create),
6777 LSM_HOOK_INIT(inode_link, selinux_inode_link),
6778 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6779 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6780 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6781 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6782 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6783 LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6784 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6785 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6786 LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6787 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6788 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6789 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6790 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6791 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6792 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6793 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6794 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6795 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6796 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6797 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
Vivek Goyal56909eb2016-07-13 10:44:48 -04006798 LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
Vivek Goyal19472b62016-07-13 10:44:50 -04006799 LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006800
Ondrej Mosnacekec882da2019-02-22 15:57:17 +01006801 LSM_HOOK_INIT(kernfs_init_security, selinux_kernfs_init_security),
6802
Casey Schauflere20b0432015-05-02 15:11:36 -07006803 LSM_HOOK_INIT(file_permission, selinux_file_permission),
6804 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
Casey Schauflere20b0432015-05-02 15:11:36 -07006805 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6806 LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6807 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6808 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6809 LSM_HOOK_INIT(file_lock, selinux_file_lock),
6810 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6811 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6812 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6813 LSM_HOOK_INIT(file_receive, selinux_file_receive),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006814
Casey Schauflere20b0432015-05-02 15:11:36 -07006815 LSM_HOOK_INIT(file_open, selinux_file_open),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006816
Tetsuo Handaa79be232017-03-28 23:08:45 +09006817 LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
Casey Schauflere20b0432015-05-02 15:11:36 -07006818 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6819 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
Matthew Garrett3ec30112018-01-08 13:36:19 -08006820 LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
Casey Schauflere20b0432015-05-02 15:11:36 -07006821 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6822 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6823 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
Mimi Zoharc77b8cd2018-07-13 14:06:02 -04006824 LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07006825 LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
Casey Schauflere20b0432015-05-02 15:11:36 -07006826 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6827 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6828 LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6829 LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6830 LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6831 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6832 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
Stephen Smalley791ec492017-02-17 07:57:00 -05006833 LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
Casey Schauflere20b0432015-05-02 15:11:36 -07006834 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6835 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6836 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6837 LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6838 LSM_HOOK_INIT(task_kill, selinux_task_kill),
Casey Schauflere20b0432015-05-02 15:11:36 -07006839 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09006840
Casey Schauflere20b0432015-05-02 15:11:36 -07006841 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6842 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006843
Casey Schauflere20b0432015-05-02 15:11:36 -07006844 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006845
Casey Schauflere20b0432015-05-02 15:11:36 -07006846 LSM_HOOK_INIT(msg_queue_alloc_security,
6847 selinux_msg_queue_alloc_security),
Casey Schauflere20b0432015-05-02 15:11:36 -07006848 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6849 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6850 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6851 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006852
Casey Schauflere20b0432015-05-02 15:11:36 -07006853 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
Casey Schauflere20b0432015-05-02 15:11:36 -07006854 LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6855 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6856 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006857
Casey Schauflere20b0432015-05-02 15:11:36 -07006858 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
Casey Schauflere20b0432015-05-02 15:11:36 -07006859 LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6860 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6861 LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006862
Casey Schauflere20b0432015-05-02 15:11:36 -07006863 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006864
Casey Schauflere20b0432015-05-02 15:11:36 -07006865 LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6866 LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006867
Casey Schauflere20b0432015-05-02 15:11:36 -07006868 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6869 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6870 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6871 LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006872 LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
Casey Schauflere20b0432015-05-02 15:11:36 -07006873 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6874 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6875 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006876
Casey Schauflere20b0432015-05-02 15:11:36 -07006877 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6878 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006879
Casey Schauflere20b0432015-05-02 15:11:36 -07006880 LSM_HOOK_INIT(socket_create, selinux_socket_create),
6881 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
David Herrmann0b811db2018-05-04 16:28:21 +02006882 LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
Casey Schauflere20b0432015-05-02 15:11:36 -07006883 LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6884 LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6885 LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6886 LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6887 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6888 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6889 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6890 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6891 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6892 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6893 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6894 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6895 LSM_HOOK_INIT(socket_getpeersec_stream,
6896 selinux_socket_getpeersec_stream),
6897 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6898 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6899 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6900 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6901 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6902 LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
Richard Hainesd4529302018-02-13 20:57:18 +00006903 LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
6904 LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
6905 LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
Casey Schauflere20b0432015-05-02 15:11:36 -07006906 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6907 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6908 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6909 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6910 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6911 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6912 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6913 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6914 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6915 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6916 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6917 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6918 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03006919#ifdef CONFIG_SECURITY_INFINIBAND
Daniel Jurgenscfc4d882017-05-19 15:48:57 +03006920 LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
Daniel Jurgensab861df2017-05-19 15:48:58 +03006921 LSM_HOOK_INIT(ib_endport_manage_subnet,
6922 selinux_ib_endport_manage_subnet),
Daniel Jurgens3a976fa2017-05-19 15:48:56 +03006923 LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
6924 LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
6925#endif
Trent Jaegerd28d1e02005-12-13 23:12:40 -08006926#ifdef CONFIG_SECURITY_NETWORK_XFRM
Casey Schauflere20b0432015-05-02 15:11:36 -07006927 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6928 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6929 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6930 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6931 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6932 LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6933 selinux_xfrm_state_alloc_acquire),
6934 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6935 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6936 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6937 LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6938 selinux_xfrm_state_pol_flow_match),
6939 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006940#endif
Michael LeMayd7200242006-06-22 14:47:17 -07006941
6942#ifdef CONFIG_KEYS
Casey Schauflere20b0432015-05-02 15:11:36 -07006943 LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6944 LSM_HOOK_INIT(key_free, selinux_key_free),
6945 LSM_HOOK_INIT(key_permission, selinux_key_permission),
6946 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
Michael LeMayd7200242006-06-22 14:47:17 -07006947#endif
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +02006948
6949#ifdef CONFIG_AUDIT
Casey Schauflere20b0432015-05-02 15:11:36 -07006950 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6951 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6952 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6953 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +02006954#endif
Chenbo Fengec27c352017-10-18 13:00:25 -07006955
6956#ifdef CONFIG_BPF_SYSCALL
6957 LSM_HOOK_INIT(bpf, selinux_bpf),
6958 LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
6959 LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
6960 LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
6961 LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
6962 LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
6963 LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
6964#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07006965};
6966
6967static __init int selinux_init(void)
6968{
peter enderborgc103a912018-06-12 10:09:03 +02006969 pr_info("SELinux: Initializing.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07006970
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006971 memset(&selinux_state, 0, sizeof(selinux_state));
Paul Mooree5a5ca92018-03-01 17:38:30 -05006972 enforcing_set(&selinux_state, selinux_enforcing_boot);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006973 selinux_state.checkreqprot = selinux_checkreqprot_boot;
6974 selinux_ss_init(&selinux_state.ss);
Stephen Smalley6b6bc622018-03-05 11:47:56 -05006975 selinux_avc_init(&selinux_state.avc);
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006976
Linus Torvalds1da177e2005-04-16 15:20:36 -07006977 /* Set the security state for the initial task. */
David Howellsd84f4f92008-11-14 10:39:23 +11006978 cred_init_security();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006979
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04006980 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6981
Linus Torvalds1da177e2005-04-16 15:20:36 -07006982 avc_init();
6983
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006984 avtab_cache_init();
6985
6986 ebitmap_cache_init();
6987
6988 hashtab_cache_init();
6989
Casey Schauflerd69dece52017-01-18 17:09:05 -08006990 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
Linus Torvalds1da177e2005-04-16 15:20:36 -07006991
Paul Moore615e51f2014-06-26 14:33:56 -04006992 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6993 panic("SELinux: Unable to register AVC netcache callback\n");
6994
Daniel Jurgens8f408ab2017-05-19 15:48:53 +03006995 if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
6996 panic("SELinux: Unable to register AVC LSM notifier callback\n");
6997
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05006998 if (selinux_enforcing_boot)
peter enderborgc103a912018-06-12 10:09:03 +02006999 pr_debug("SELinux: Starting in enforcing mode\n");
Eric Paris828dfe12008-04-17 13:17:49 -04007000 else
peter enderborgc103a912018-06-12 10:09:03 +02007001 pr_debug("SELinux: Starting in permissive mode\n");
Michael LeMayd7200242006-06-22 14:47:17 -07007002
David Howells442155c2018-11-01 23:07:24 +00007003 fs_validate_description(&selinux_fs_parameters);
7004
Linus Torvalds1da177e2005-04-16 15:20:36 -07007005 return 0;
7006}
7007
Al Viroe8c26252010-03-23 06:36:54 -04007008static void delayed_superblock_init(struct super_block *sb, void *unused)
7009{
Al Viro204cc0c2018-12-13 13:41:47 -05007010 selinux_set_mnt_opts(sb, NULL, 0, NULL);
Al Viroe8c26252010-03-23 06:36:54 -04007011}
7012
Linus Torvalds1da177e2005-04-16 15:20:36 -07007013void selinux_complete_init(void)
7014{
peter enderborgc103a912018-06-12 10:09:03 +02007015 pr_debug("SELinux: Completing initialization.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07007016
7017 /* Set up any superblocks initialized prior to the policy load. */
peter enderborgc103a912018-06-12 10:09:03 +02007018 pr_debug("SELinux: Setting up existing superblocks.\n");
Al Viroe8c26252010-03-23 06:36:54 -04007019 iterate_supers(delayed_superblock_init, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07007020}
7021
7022/* SELinux requires early initialization in order to label
7023 all processes and objects when they are created. */
Kees Cook3d6e5f62018-10-10 17:18:23 -07007024DEFINE_LSM(selinux) = {
Kees Cook07aed2f2018-10-10 17:18:24 -07007025 .name = "selinux",
Kees Cook14bd99c2018-09-19 19:57:06 -07007026 .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
Kees Cookc5459b82018-09-13 22:28:48 -07007027 .enabled = &selinux_enabled,
Casey Schauflerbbd36622018-11-12 09:30:56 -08007028 .blobs = &selinux_blob_sizes,
Kees Cook3d6e5f62018-10-10 17:18:23 -07007029 .init = selinux_init,
7030};
Linus Torvalds1da177e2005-04-16 15:20:36 -07007031
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08007032#if defined(CONFIG_NETFILTER)
Linus Torvalds1da177e2005-04-16 15:20:36 -07007033
Florian Westphal591bb272017-07-26 11:40:52 +02007034static const struct nf_hook_ops selinux_nf_ops[] = {
Paul Mooreeffad8d2008-01-29 08:49:27 -05007035 {
7036 .hook = selinux_ipv4_postroute,
Alban Crequy2597a832012-05-14 03:56:39 +00007037 .pf = NFPROTO_IPV4,
Paul Mooreeffad8d2008-01-29 08:49:27 -05007038 .hooknum = NF_INET_POST_ROUTING,
7039 .priority = NF_IP_PRI_SELINUX_LAST,
7040 },
7041 {
7042 .hook = selinux_ipv4_forward,
Alban Crequy2597a832012-05-14 03:56:39 +00007043 .pf = NFPROTO_IPV4,
Paul Mooreeffad8d2008-01-29 08:49:27 -05007044 .hooknum = NF_INET_FORWARD,
7045 .priority = NF_IP_PRI_SELINUX_FIRST,
Paul Moore948bf852008-10-10 10:16:32 -04007046 },
7047 {
7048 .hook = selinux_ipv4_output,
Alban Crequy2597a832012-05-14 03:56:39 +00007049 .pf = NFPROTO_IPV4,
Paul Moore948bf852008-10-10 10:16:32 -04007050 .hooknum = NF_INET_LOCAL_OUT,
7051 .priority = NF_IP_PRI_SELINUX_FIRST,
Jiri Pirko25db6be2014-09-03 17:42:13 +02007052 },
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04007053#if IS_ENABLED(CONFIG_IPV6)
Paul Mooreeffad8d2008-01-29 08:49:27 -05007054 {
7055 .hook = selinux_ipv6_postroute,
Alban Crequy2597a832012-05-14 03:56:39 +00007056 .pf = NFPROTO_IPV6,
Paul Mooreeffad8d2008-01-29 08:49:27 -05007057 .hooknum = NF_INET_POST_ROUTING,
7058 .priority = NF_IP6_PRI_SELINUX_LAST,
7059 },
7060 {
7061 .hook = selinux_ipv6_forward,
Alban Crequy2597a832012-05-14 03:56:39 +00007062 .pf = NFPROTO_IPV6,
Paul Mooreeffad8d2008-01-29 08:49:27 -05007063 .hooknum = NF_INET_FORWARD,
7064 .priority = NF_IP6_PRI_SELINUX_FIRST,
Jiri Pirko25db6be2014-09-03 17:42:13 +02007065 },
Huw Davies2917f572016-06-27 15:06:15 -04007066 {
7067 .hook = selinux_ipv6_output,
7068 .pf = NFPROTO_IPV6,
7069 .hooknum = NF_INET_LOCAL_OUT,
7070 .priority = NF_IP6_PRI_SELINUX_FIRST,
7071 },
Linus Torvalds1da177e2005-04-16 15:20:36 -07007072#endif /* IPV6 */
Jiri Pirko25db6be2014-09-03 17:42:13 +02007073};
Linus Torvalds1da177e2005-04-16 15:20:36 -07007074
Florian Westphal8e71bf72017-04-21 11:49:09 +02007075static int __net_init selinux_nf_register(struct net *net)
7076{
7077 return nf_register_net_hooks(net, selinux_nf_ops,
7078 ARRAY_SIZE(selinux_nf_ops));
7079}
7080
7081static void __net_exit selinux_nf_unregister(struct net *net)
7082{
7083 nf_unregister_net_hooks(net, selinux_nf_ops,
7084 ARRAY_SIZE(selinux_nf_ops));
7085}
7086
7087static struct pernet_operations selinux_net_ops = {
7088 .init = selinux_nf_register,
7089 .exit = selinux_nf_unregister,
7090};
7091
Linus Torvalds1da177e2005-04-16 15:20:36 -07007092static int __init selinux_nf_ip_init(void)
7093{
Jiri Pirko25db6be2014-09-03 17:42:13 +02007094 int err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07007095
7096 if (!selinux_enabled)
Jiri Pirko25db6be2014-09-03 17:42:13 +02007097 return 0;
Eric Parisfadcdb42007-02-22 18:11:31 -05007098
peter enderborgc103a912018-06-12 10:09:03 +02007099 pr_debug("SELinux: Registering netfilter hooks\n");
Eric Parisfadcdb42007-02-22 18:11:31 -05007100
Florian Westphal8e71bf72017-04-21 11:49:09 +02007101 err = register_pernet_subsys(&selinux_net_ops);
Alexey Dobriyan6c5a9d22008-07-26 17:48:15 -07007102 if (err)
Florian Westphal8e71bf72017-04-21 11:49:09 +02007103 panic("SELinux: register_pernet_subsys: error %d\n", err);
Linus Torvalds1da177e2005-04-16 15:20:36 -07007104
Jiri Pirko25db6be2014-09-03 17:42:13 +02007105 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07007106}
Linus Torvalds1da177e2005-04-16 15:20:36 -07007107__initcall(selinux_nf_ip_init);
7108
7109#ifdef CONFIG_SECURITY_SELINUX_DISABLE
7110static void selinux_nf_ip_exit(void)
7111{
peter enderborgc103a912018-06-12 10:09:03 +02007112 pr_debug("SELinux: Unregistering netfilter hooks\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07007113
Florian Westphal8e71bf72017-04-21 11:49:09 +02007114 unregister_pernet_subsys(&selinux_net_ops);
Linus Torvalds1da177e2005-04-16 15:20:36 -07007115}
7116#endif
7117
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08007118#else /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07007119
7120#ifdef CONFIG_SECURITY_SELINUX_DISABLE
7121#define selinux_nf_ip_exit()
7122#endif
7123
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08007124#endif /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07007125
7126#ifdef CONFIG_SECURITY_SELINUX_DISABLE
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007127int selinux_disable(struct selinux_state *state)
Linus Torvalds1da177e2005-04-16 15:20:36 -07007128{
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007129 if (state->initialized) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07007130 /* Not permitted after initial policy load. */
7131 return -EINVAL;
7132 }
7133
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007134 if (state->disabled) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07007135 /* Only do this once. */
7136 return -EINVAL;
7137 }
7138
Stephen Smalleyaa8e7122018-03-01 18:48:02 -05007139 state->disabled = 1;
7140
peter enderborgc103a912018-06-12 10:09:03 +02007141 pr_info("SELinux: Disabled at runtime.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07007142
Stephen Smalley30d55282006-05-03 10:52:36 -04007143 selinux_enabled = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07007144
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07007145 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
Linus Torvalds1da177e2005-04-16 15:20:36 -07007146
Eric Parisaf8ff042009-09-20 21:23:01 -04007147 /* Try to destroy the avc node cache */
7148 avc_disable();
7149
Linus Torvalds1da177e2005-04-16 15:20:36 -07007150 /* Unregister netfilter hooks. */
7151 selinux_nf_ip_exit();
7152
7153 /* Unregister selinuxfs. */
7154 exit_sel_fs();
7155
7156 return 0;
7157}
7158#endif