2 * NSA Security-Enhanced Linux (SELinux) security module
4 * This file contains the SELinux hook function implementations.
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul@paul-moore.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
26 #include <linux/init.h>
28 #include <linux/kernel.h>
29 #include <linux/tracehook.h>
30 #include <linux/errno.h>
31 #include <linux/sched.h>
32 #include <linux/security.h>
33 #include <linux/xattr.h>
34 #include <linux/capability.h>
35 #include <linux/unistd.h>
37 #include <linux/mman.h>
38 #include <linux/slab.h>
39 #include <linux/pagemap.h>
40 #include <linux/proc_fs.h>
41 #include <linux/swap.h>
42 #include <linux/spinlock.h>
43 #include <linux/syscalls.h>
44 #include <linux/dcache.h>
45 #include <linux/file.h>
46 #include <linux/fdtable.h>
47 #include <linux/namei.h>
48 #include <linux/mount.h>
49 #include <linux/netfilter_ipv4.h>
50 #include <linux/netfilter_ipv6.h>
51 #include <linux/tty.h>
53 #include <net/ip.h> /* for local_port_range[] */
55 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
56 #include <net/net_namespace.h>
57 #include <net/netlabel.h>
58 #include <linux/uaccess.h>
59 #include <asm/ioctls.h>
60 #include <linux/atomic.h>
61 #include <linux/bitops.h>
62 #include <linux/interrupt.h>
63 #include <linux/netdevice.h> /* for network interface checks */
64 #include <net/netlink.h>
65 #include <linux/tcp.h>
66 #include <linux/udp.h>
67 #include <linux/dccp.h>
68 #include <linux/quota.h>
69 #include <linux/un.h> /* for Unix socket types */
70 #include <net/af_unix.h> /* for Unix socket types */
71 #include <linux/parser.h>
72 #include <linux/nfs_mount.h>
74 #include <linux/hugetlb.h>
75 #include <linux/personality.h>
76 #include <linux/audit.h>
77 #include <linux/string.h>
78 #include <linux/selinux.h>
79 #include <linux/mutex.h>
80 #include <linux/posix-timers.h>
81 #include <linux/syslog.h>
82 #include <linux/user_namespace.h>
83 #include <linux/export.h>
84 #include <linux/security.h>
85 #include <linux/msg.h>
86 #include <linux/shm.h>
98 #define SB_TYPE_FMT "%s%s%s"
99 #define SB_SUBTYPE(sb) (sb->s_subtype && sb->s_subtype[0])
100 #define SB_TYPE_ARGS(sb) sb->s_type->name, SB_SUBTYPE(sb) ? "." : "", SB_SUBTYPE(sb) ? sb->s_subtype : ""
102 extern struct security_operations *security_ops;
104 /* SECMARK reference count */
105 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
107 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
108 int selinux_enforcing;
110 static int __init enforcing_setup(char *str)
112 unsigned long enforcing;
113 if (!strict_strtoul(str, 0, &enforcing))
114 selinux_enforcing = enforcing ? 1 : 0;
117 __setup("enforcing=", enforcing_setup);
120 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
121 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
123 static int __init selinux_enabled_setup(char *str)
125 unsigned long enabled;
126 if (!strict_strtoul(str, 0, &enabled))
127 selinux_enabled = enabled ? 1 : 0;
130 __setup("selinux=", selinux_enabled_setup);
132 int selinux_enabled = 1;
135 static struct kmem_cache *sel_inode_cache;
138 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
141 * This function checks the SECMARK reference counter to see if any SECMARK
142 * targets are currently configured, if the reference counter is greater than
143 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
144 * enabled, false (0) if SECMARK is disabled. If the always_check_network
145 * policy capability is enabled, SECMARK is always considered enabled.
148 static int selinux_secmark_enabled(void)
150 return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
154 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
157 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
158 * (1) if any are enabled or false (0) if neither are enabled. If the
159 * always_check_network policy capability is enabled, peer labeling
160 * is always considered enabled.
163 static int selinux_peerlbl_enabled(void)
165 return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
169 * initialise the security for the init task
171 static void cred_init_security(void)
173 struct cred *cred = (struct cred *) current->real_cred;
174 struct task_security_struct *tsec;
176 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
178 panic("SELinux: Failed to initialize initial task.\n");
180 tsec->osid = tsec->sid = SECINITSID_KERNEL;
181 cred->security = tsec;
185 * get the security ID of a set of credentials
187 static inline u32 cred_sid(const struct cred *cred)
189 const struct task_security_struct *tsec;
191 tsec = cred->security;
196 * get the objective security ID of a task
198 static inline u32 task_sid(const struct task_struct *task)
203 sid = cred_sid(__task_cred(task));
209 * get the subjective security ID of the current task
211 static inline u32 current_sid(void)
213 const struct task_security_struct *tsec = current_security();
218 /* Allocate and free functions for each kind of security blob. */
220 static int inode_alloc_security(struct inode *inode)
222 struct inode_security_struct *isec;
223 u32 sid = current_sid();
225 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
229 mutex_init(&isec->lock);
230 INIT_LIST_HEAD(&isec->list);
232 isec->sid = SECINITSID_UNLABELED;
233 isec->sclass = SECCLASS_FILE;
234 isec->task_sid = sid;
235 inode->i_security = isec;
240 static void inode_free_security(struct inode *inode)
242 struct inode_security_struct *isec = inode->i_security;
243 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
245 spin_lock(&sbsec->isec_lock);
246 if (!list_empty(&isec->list))
247 list_del_init(&isec->list);
248 spin_unlock(&sbsec->isec_lock);
250 inode->i_security = NULL;
251 kmem_cache_free(sel_inode_cache, isec);
254 static int file_alloc_security(struct file *file)
256 struct file_security_struct *fsec;
257 u32 sid = current_sid();
259 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
264 fsec->fown_sid = sid;
265 file->f_security = fsec;
270 static void file_free_security(struct file *file)
272 struct file_security_struct *fsec = file->f_security;
273 file->f_security = NULL;
277 static int superblock_alloc_security(struct super_block *sb)
279 struct superblock_security_struct *sbsec;
281 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
285 mutex_init(&sbsec->lock);
286 INIT_LIST_HEAD(&sbsec->isec_head);
287 spin_lock_init(&sbsec->isec_lock);
289 sbsec->sid = SECINITSID_UNLABELED;
290 sbsec->def_sid = SECINITSID_FILE;
291 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
292 sb->s_security = sbsec;
297 static void superblock_free_security(struct super_block *sb)
299 struct superblock_security_struct *sbsec = sb->s_security;
300 sb->s_security = NULL;
304 /* The file system's label must be initialized prior to use. */
306 static const char *labeling_behaviors[7] = {
308 "uses transition SIDs",
310 "uses genfs_contexts",
311 "not configured for labeling",
312 "uses mountpoint labeling",
313 "uses native labeling",
316 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
318 static inline int inode_doinit(struct inode *inode)
320 return inode_doinit_with_dentry(inode, NULL);
329 Opt_labelsupport = 5,
333 #define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1)
335 static const match_table_t tokens = {
336 {Opt_context, CONTEXT_STR "%s"},
337 {Opt_fscontext, FSCONTEXT_STR "%s"},
338 {Opt_defcontext, DEFCONTEXT_STR "%s"},
339 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
340 {Opt_labelsupport, LABELSUPP_STR},
344 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
346 static int may_context_mount_sb_relabel(u32 sid,
347 struct superblock_security_struct *sbsec,
348 const struct cred *cred)
350 const struct task_security_struct *tsec = cred->security;
353 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
354 FILESYSTEM__RELABELFROM, NULL);
358 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
359 FILESYSTEM__RELABELTO, NULL);
363 static int may_context_mount_inode_relabel(u32 sid,
364 struct superblock_security_struct *sbsec,
365 const struct cred *cred)
367 const struct task_security_struct *tsec = cred->security;
369 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
370 FILESYSTEM__RELABELFROM, NULL);
374 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
375 FILESYSTEM__ASSOCIATE, NULL);
379 static int selinux_is_sblabel_mnt(struct super_block *sb)
381 struct superblock_security_struct *sbsec = sb->s_security;
383 if (sbsec->behavior == SECURITY_FS_USE_XATTR ||
384 sbsec->behavior == SECURITY_FS_USE_TRANS ||
385 sbsec->behavior == SECURITY_FS_USE_TASK)
388 /* Special handling for sysfs. Is genfs but also has setxattr handler*/
389 if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
393 * Special handling for rootfs. Is genfs but supports
394 * setting SELinux context on in-core inodes.
396 if (strncmp(sb->s_type->name, "rootfs", sizeof("rootfs")) == 0)
402 static int sb_finish_set_opts(struct super_block *sb)
404 struct superblock_security_struct *sbsec = sb->s_security;
405 struct dentry *root = sb->s_root;
406 struct inode *root_inode = root->d_inode;
409 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
410 /* Make sure that the xattr handler exists and that no
411 error other than -ENODATA is returned by getxattr on
412 the root directory. -ENODATA is ok, as this may be
413 the first boot of the SELinux kernel before we have
414 assigned xattr values to the filesystem. */
415 if (!root_inode->i_op->getxattr) {
416 printk(KERN_WARNING "SELinux: (dev %s, type "SB_TYPE_FMT") has no "
417 "xattr support\n", sb->s_id, SB_TYPE_ARGS(sb));
421 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
422 if (rc < 0 && rc != -ENODATA) {
423 if (rc == -EOPNOTSUPP)
424 printk(KERN_WARNING "SELinux: (dev %s, type "
425 SB_TYPE_FMT") has no security xattr handler\n",
426 sb->s_id, SB_TYPE_ARGS(sb));
428 printk(KERN_WARNING "SELinux: (dev %s, type "
429 SB_TYPE_FMT") getxattr errno %d\n", sb->s_id,
430 SB_TYPE_ARGS(sb), -rc);
435 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
436 printk(KERN_ERR "SELinux: initialized (dev %s, type "SB_TYPE_FMT"), unknown behavior\n",
437 sb->s_id, SB_TYPE_ARGS(sb));
439 printk(KERN_DEBUG "SELinux: initialized (dev %s, type "SB_TYPE_FMT"), %s\n",
440 sb->s_id, SB_TYPE_ARGS(sb),
441 labeling_behaviors[sbsec->behavior-1]);
443 sbsec->flags |= SE_SBINITIALIZED;
444 if (selinux_is_sblabel_mnt(sb))
445 sbsec->flags |= SBLABEL_MNT;
447 /* Initialize the root inode. */
448 rc = inode_doinit_with_dentry(root_inode, root);
450 /* Initialize any other inodes associated with the superblock, e.g.
451 inodes created prior to initial policy load or inodes created
452 during get_sb by a pseudo filesystem that directly
454 spin_lock(&sbsec->isec_lock);
456 if (!list_empty(&sbsec->isec_head)) {
457 struct inode_security_struct *isec =
458 list_entry(sbsec->isec_head.next,
459 struct inode_security_struct, list);
460 struct inode *inode = isec->inode;
461 spin_unlock(&sbsec->isec_lock);
462 inode = igrab(inode);
464 if (!IS_PRIVATE(inode))
468 spin_lock(&sbsec->isec_lock);
469 list_del_init(&isec->list);
472 spin_unlock(&sbsec->isec_lock);
478 * This function should allow an FS to ask what it's mount security
479 * options were so it can use those later for submounts, displaying
480 * mount options, or whatever.
482 static int selinux_get_mnt_opts(const struct super_block *sb,
483 struct security_mnt_opts *opts)
486 struct superblock_security_struct *sbsec = sb->s_security;
487 char *context = NULL;
491 security_init_mnt_opts(opts);
493 if (!(sbsec->flags & SE_SBINITIALIZED))
499 /* make sure we always check enough bits to cover the mask */
500 BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
502 tmp = sbsec->flags & SE_MNTMASK;
503 /* count the number of mount options for this sb */
504 for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
506 opts->num_mnt_opts++;
509 /* Check if the Label support flag is set */
510 if (sbsec->flags & SBLABEL_MNT)
511 opts->num_mnt_opts++;
513 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
514 if (!opts->mnt_opts) {
519 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
520 if (!opts->mnt_opts_flags) {
526 if (sbsec->flags & FSCONTEXT_MNT) {
527 rc = security_sid_to_context(sbsec->sid, &context, &len);
530 opts->mnt_opts[i] = context;
531 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
533 if (sbsec->flags & CONTEXT_MNT) {
534 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
537 opts->mnt_opts[i] = context;
538 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
540 if (sbsec->flags & DEFCONTEXT_MNT) {
541 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
544 opts->mnt_opts[i] = context;
545 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
547 if (sbsec->flags & ROOTCONTEXT_MNT) {
548 struct inode *root = sbsec->sb->s_root->d_inode;
549 struct inode_security_struct *isec = root->i_security;
551 rc = security_sid_to_context(isec->sid, &context, &len);
554 opts->mnt_opts[i] = context;
555 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
557 if (sbsec->flags & SBLABEL_MNT) {
558 opts->mnt_opts[i] = NULL;
559 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
562 BUG_ON(i != opts->num_mnt_opts);
567 security_free_mnt_opts(opts);
571 static int bad_option(struct superblock_security_struct *sbsec, char flag,
572 u32 old_sid, u32 new_sid)
574 char mnt_flags = sbsec->flags & SE_MNTMASK;
576 /* check if the old mount command had the same options */
577 if (sbsec->flags & SE_SBINITIALIZED)
578 if (!(sbsec->flags & flag) ||
579 (old_sid != new_sid))
582 /* check if we were passed the same options twice,
583 * aka someone passed context=a,context=b
585 if (!(sbsec->flags & SE_SBINITIALIZED))
586 if (mnt_flags & flag)
592 * Allow filesystems with binary mount data to explicitly set mount point
593 * labeling information.
595 static int selinux_set_mnt_opts(struct super_block *sb,
596 struct security_mnt_opts *opts,
597 unsigned long kern_flags,
598 unsigned long *set_kern_flags)
600 const struct cred *cred = current_cred();
602 struct superblock_security_struct *sbsec = sb->s_security;
603 struct inode *inode = sbsec->sb->s_root->d_inode;
604 struct inode_security_struct *root_isec = inode->i_security;
605 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
606 u32 defcontext_sid = 0;
607 char **mount_options = opts->mnt_opts;
608 int *flags = opts->mnt_opts_flags;
609 int num_opts = opts->num_mnt_opts;
611 mutex_lock(&sbsec->lock);
613 if (!ss_initialized) {
615 /* Defer initialization until selinux_complete_init,
616 after the initial policy is loaded and the security
617 server is ready to handle calls. */
621 printk(KERN_WARNING "SELinux: Unable to set superblock options "
622 "before the security server is initialized\n");
625 if (kern_flags && !set_kern_flags) {
626 /* Specifying internal flags without providing a place to
627 * place the results is not allowed */
633 * Binary mount data FS will come through this function twice. Once
634 * from an explicit call and once from the generic calls from the vfs.
635 * Since the generic VFS calls will not contain any security mount data
636 * we need to skip the double mount verification.
638 * This does open a hole in which we will not notice if the first
639 * mount using this sb set explict options and a second mount using
640 * this sb does not set any security options. (The first options
641 * will be used for both mounts)
643 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
648 * parse the mount options, check if they are valid sids.
649 * also check if someone is trying to mount the same sb more
650 * than once with different security options.
652 for (i = 0; i < num_opts; i++) {
655 if (flags[i] == SBLABEL_MNT)
657 rc = security_context_to_sid(mount_options[i],
658 strlen(mount_options[i]), &sid);
660 printk(KERN_WARNING "SELinux: security_context_to_sid"
661 "(%s) failed for (dev %s, type "SB_TYPE_FMT") errno=%d\n",
662 mount_options[i], sb->s_id, SB_TYPE_ARGS(sb), rc);
669 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
671 goto out_double_mount;
673 sbsec->flags |= FSCONTEXT_MNT;
678 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
680 goto out_double_mount;
682 sbsec->flags |= CONTEXT_MNT;
684 case ROOTCONTEXT_MNT:
685 rootcontext_sid = sid;
687 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
689 goto out_double_mount;
691 sbsec->flags |= ROOTCONTEXT_MNT;
695 defcontext_sid = sid;
697 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
699 goto out_double_mount;
701 sbsec->flags |= DEFCONTEXT_MNT;
710 if (sbsec->flags & SE_SBINITIALIZED) {
711 /* previously mounted with options, but not on this attempt? */
712 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
713 goto out_double_mount;
718 if (strcmp(sb->s_type->name, "proc") == 0)
719 sbsec->flags |= SE_SBPROC;
721 if (!sbsec->behavior) {
723 * Determine the labeling behavior to use for this
726 rc = security_fs_use(sb);
729 "%s: security_fs_use(%s) returned %d\n",
730 __func__, sb->s_type->name, rc);
734 /* sets the context of the superblock for the fs being mounted. */
736 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
740 sbsec->sid = fscontext_sid;
744 * Switch to using mount point labeling behavior.
745 * sets the label used on all file below the mountpoint, and will set
746 * the superblock context if not already set.
748 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
749 sbsec->behavior = SECURITY_FS_USE_NATIVE;
750 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
754 if (!fscontext_sid) {
755 rc = may_context_mount_sb_relabel(context_sid, sbsec,
759 sbsec->sid = context_sid;
761 rc = may_context_mount_inode_relabel(context_sid, sbsec,
766 if (!rootcontext_sid)
767 rootcontext_sid = context_sid;
769 sbsec->mntpoint_sid = context_sid;
770 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
773 if (rootcontext_sid) {
774 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
779 root_isec->sid = rootcontext_sid;
780 root_isec->initialized = 1;
783 if (defcontext_sid) {
784 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
785 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
787 printk(KERN_WARNING "SELinux: defcontext option is "
788 "invalid for this filesystem type\n");
792 if (defcontext_sid != sbsec->def_sid) {
793 rc = may_context_mount_inode_relabel(defcontext_sid,
799 sbsec->def_sid = defcontext_sid;
802 rc = sb_finish_set_opts(sb);
804 mutex_unlock(&sbsec->lock);
808 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
809 "security settings for (dev %s, type "SB_TYPE_FMT")\n", sb->s_id,
814 static int selinux_cmp_sb_context(const struct super_block *oldsb,
815 const struct super_block *newsb)
817 struct superblock_security_struct *old = oldsb->s_security;
818 struct superblock_security_struct *new = newsb->s_security;
819 char oldflags = old->flags & SE_MNTMASK;
820 char newflags = new->flags & SE_MNTMASK;
822 if (oldflags != newflags)
824 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
826 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
828 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
830 if (oldflags & ROOTCONTEXT_MNT) {
831 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
832 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
833 if (oldroot->sid != newroot->sid)
838 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, "
839 "different security settings for (dev %s, "
840 "type %s)\n", newsb->s_id, newsb->s_type->name);
844 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
845 struct super_block *newsb)
847 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
848 struct superblock_security_struct *newsbsec = newsb->s_security;
850 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
851 int set_context = (oldsbsec->flags & CONTEXT_MNT);
852 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
855 * if the parent was able to be mounted it clearly had no special lsm
856 * mount options. thus we can safely deal with this superblock later
861 /* how can we clone if the old one wasn't set up?? */
862 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
864 /* if fs is reusing a sb, make sure that the contexts match */
865 if (newsbsec->flags & SE_SBINITIALIZED)
866 return selinux_cmp_sb_context(oldsb, newsb);
868 mutex_lock(&newsbsec->lock);
870 newsbsec->flags = oldsbsec->flags;
872 newsbsec->sid = oldsbsec->sid;
873 newsbsec->def_sid = oldsbsec->def_sid;
874 newsbsec->behavior = oldsbsec->behavior;
877 u32 sid = oldsbsec->mntpoint_sid;
881 if (!set_rootcontext) {
882 struct inode *newinode = newsb->s_root->d_inode;
883 struct inode_security_struct *newisec = newinode->i_security;
886 newsbsec->mntpoint_sid = sid;
888 if (set_rootcontext) {
889 const struct inode *oldinode = oldsb->s_root->d_inode;
890 const struct inode_security_struct *oldisec = oldinode->i_security;
891 struct inode *newinode = newsb->s_root->d_inode;
892 struct inode_security_struct *newisec = newinode->i_security;
894 newisec->sid = oldisec->sid;
897 sb_finish_set_opts(newsb);
898 mutex_unlock(&newsbsec->lock);
902 static int selinux_parse_opts_str(char *options,
903 struct security_mnt_opts *opts)
906 char *context = NULL, *defcontext = NULL;
907 char *fscontext = NULL, *rootcontext = NULL;
908 int rc, num_mnt_opts = 0;
910 opts->num_mnt_opts = 0;
912 /* Standard string-based options. */
913 while ((p = strsep(&options, "|")) != NULL) {
915 substring_t args[MAX_OPT_ARGS];
920 token = match_token(p, tokens, args);
924 if (context || defcontext) {
926 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
929 context = match_strdup(&args[0]);
939 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
942 fscontext = match_strdup(&args[0]);
949 case Opt_rootcontext:
952 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
955 rootcontext = match_strdup(&args[0]);
963 if (context || defcontext) {
965 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
968 defcontext = match_strdup(&args[0]);
974 case Opt_labelsupport:
978 printk(KERN_WARNING "SELinux: unknown mount option\n");
985 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
989 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
990 if (!opts->mnt_opts_flags) {
991 kfree(opts->mnt_opts);
996 opts->mnt_opts[num_mnt_opts] = fscontext;
997 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1000 opts->mnt_opts[num_mnt_opts] = context;
1001 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1004 opts->mnt_opts[num_mnt_opts] = rootcontext;
1005 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1008 opts->mnt_opts[num_mnt_opts] = defcontext;
1009 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1012 opts->num_mnt_opts = num_mnt_opts;
1023 * string mount options parsing and call set the sbsec
1025 static int superblock_doinit(struct super_block *sb, void *data)
1028 char *options = data;
1029 struct security_mnt_opts opts;
1031 security_init_mnt_opts(&opts);
1036 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1038 rc = selinux_parse_opts_str(options, &opts);
1043 rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1046 security_free_mnt_opts(&opts);
1050 static void selinux_write_opts(struct seq_file *m,
1051 struct security_mnt_opts *opts)
1056 for (i = 0; i < opts->num_mnt_opts; i++) {
1059 if (opts->mnt_opts[i])
1060 has_comma = strchr(opts->mnt_opts[i], ',');
1064 switch (opts->mnt_opts_flags[i]) {
1066 prefix = CONTEXT_STR;
1069 prefix = FSCONTEXT_STR;
1071 case ROOTCONTEXT_MNT:
1072 prefix = ROOTCONTEXT_STR;
1074 case DEFCONTEXT_MNT:
1075 prefix = DEFCONTEXT_STR;
1079 seq_puts(m, LABELSUPP_STR);
1085 /* we need a comma before each option */
1087 seq_puts(m, prefix);
1090 seq_puts(m, opts->mnt_opts[i]);
1096 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1098 struct security_mnt_opts opts;
1101 rc = selinux_get_mnt_opts(sb, &opts);
1103 /* before policy load we may get EINVAL, don't show anything */
1109 selinux_write_opts(m, &opts);
1111 security_free_mnt_opts(&opts);
1116 static inline u16 inode_mode_to_security_class(umode_t mode)
1118 switch (mode & S_IFMT) {
1120 return SECCLASS_SOCK_FILE;
1122 return SECCLASS_LNK_FILE;
1124 return SECCLASS_FILE;
1126 return SECCLASS_BLK_FILE;
1128 return SECCLASS_DIR;
1130 return SECCLASS_CHR_FILE;
1132 return SECCLASS_FIFO_FILE;
1136 return SECCLASS_FILE;
1139 static inline int default_protocol_stream(int protocol)
1141 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1144 static inline int default_protocol_dgram(int protocol)
1146 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1149 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1155 case SOCK_SEQPACKET:
1156 return SECCLASS_UNIX_STREAM_SOCKET;
1158 return SECCLASS_UNIX_DGRAM_SOCKET;
1165 if (default_protocol_stream(protocol))
1166 return SECCLASS_TCP_SOCKET;
1168 return SECCLASS_RAWIP_SOCKET;
1170 if (default_protocol_dgram(protocol))
1171 return SECCLASS_UDP_SOCKET;
1173 return SECCLASS_RAWIP_SOCKET;
1175 return SECCLASS_DCCP_SOCKET;
1177 return SECCLASS_RAWIP_SOCKET;
1183 return SECCLASS_NETLINK_ROUTE_SOCKET;
1184 case NETLINK_FIREWALL:
1185 return SECCLASS_NETLINK_FIREWALL_SOCKET;
1186 case NETLINK_SOCK_DIAG:
1187 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1189 return SECCLASS_NETLINK_NFLOG_SOCKET;
1191 return SECCLASS_NETLINK_XFRM_SOCKET;
1192 case NETLINK_SELINUX:
1193 return SECCLASS_NETLINK_SELINUX_SOCKET;
1195 return SECCLASS_NETLINK_AUDIT_SOCKET;
1196 case NETLINK_IP6_FW:
1197 return SECCLASS_NETLINK_IP6FW_SOCKET;
1198 case NETLINK_DNRTMSG:
1199 return SECCLASS_NETLINK_DNRT_SOCKET;
1200 case NETLINK_KOBJECT_UEVENT:
1201 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1203 return SECCLASS_NETLINK_SOCKET;
1206 return SECCLASS_PACKET_SOCKET;
1208 return SECCLASS_KEY_SOCKET;
1210 return SECCLASS_APPLETALK_SOCKET;
1213 return SECCLASS_SOCKET;
1216 #ifdef CONFIG_PROC_FS
1217 static int selinux_proc_get_sid(struct dentry *dentry,
1222 char *buffer, *path;
1224 buffer = (char *)__get_free_page(GFP_KERNEL);
1228 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1232 /* each process gets a /proc/PID/ entry. Strip off the
1233 * PID part to get a valid selinux labeling.
1234 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1235 while (path[1] >= '0' && path[1] <= '9') {
1239 rc = security_genfs_sid("proc", path, tclass, sid);
1241 free_page((unsigned long)buffer);
1245 static int selinux_proc_get_sid(struct dentry *dentry,
1253 /* The inode's security attributes must be initialized before first use. */
1254 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1256 struct superblock_security_struct *sbsec = NULL;
1257 struct inode_security_struct *isec = inode->i_security;
1259 struct dentry *dentry;
1260 #define INITCONTEXTLEN 255
1261 char *context = NULL;
1265 if (isec->initialized)
1268 mutex_lock(&isec->lock);
1269 if (isec->initialized)
1272 sbsec = inode->i_sb->s_security;
1273 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1274 /* Defer initialization until selinux_complete_init,
1275 after the initial policy is loaded and the security
1276 server is ready to handle calls. */
1277 spin_lock(&sbsec->isec_lock);
1278 if (list_empty(&isec->list))
1279 list_add(&isec->list, &sbsec->isec_head);
1280 spin_unlock(&sbsec->isec_lock);
1284 switch (sbsec->behavior) {
1285 case SECURITY_FS_USE_NATIVE:
1287 case SECURITY_FS_USE_XATTR:
1288 if (!inode->i_op->getxattr) {
1289 isec->sid = sbsec->def_sid;
1293 /* Need a dentry, since the xattr API requires one.
1294 Life would be simpler if we could just pass the inode. */
1296 /* Called from d_instantiate or d_splice_alias. */
1297 dentry = dget(opt_dentry);
1299 /* Called from selinux_complete_init, try to find a dentry. */
1300 dentry = d_find_alias(inode);
1304 * this is can be hit on boot when a file is accessed
1305 * before the policy is loaded. When we load policy we
1306 * may find inodes that have no dentry on the
1307 * sbsec->isec_head list. No reason to complain as these
1308 * will get fixed up the next time we go through
1309 * inode_doinit with a dentry, before these inodes could
1310 * be used again by userspace.
1315 len = INITCONTEXTLEN;
1316 context = kmalloc(len+1, GFP_NOFS);
1322 context[len] = '\0';
1323 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1325 if (rc == -ERANGE) {
1328 /* Need a larger buffer. Query for the right size. */
1329 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1336 context = kmalloc(len+1, GFP_NOFS);
1342 context[len] = '\0';
1343 rc = inode->i_op->getxattr(dentry,
1349 if (rc != -ENODATA) {
1350 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1351 "%d for dev=%s ino=%ld\n", __func__,
1352 -rc, inode->i_sb->s_id, inode->i_ino);
1356 /* Map ENODATA to the default file SID */
1357 sid = sbsec->def_sid;
1360 rc = security_context_to_sid_default(context, rc, &sid,
1364 char *dev = inode->i_sb->s_id;
1365 unsigned long ino = inode->i_ino;
1367 if (rc == -EINVAL) {
1368 if (printk_ratelimit())
1369 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1370 "context=%s. This indicates you may need to relabel the inode or the "
1371 "filesystem in question.\n", ino, dev, context);
1373 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1374 "returned %d for dev=%s ino=%ld\n",
1375 __func__, context, -rc, dev, ino);
1378 /* Leave with the unlabeled SID */
1386 case SECURITY_FS_USE_TASK:
1387 isec->sid = isec->task_sid;
1389 case SECURITY_FS_USE_TRANS:
1390 /* Default to the fs SID. */
1391 isec->sid = sbsec->sid;
1393 /* Try to obtain a transition SID. */
1394 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1395 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1396 isec->sclass, NULL, &sid);
1401 case SECURITY_FS_USE_MNTPOINT:
1402 isec->sid = sbsec->mntpoint_sid;
1405 /* Default to the fs superblock SID. */
1406 isec->sid = sbsec->sid;
1408 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1410 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1411 rc = selinux_proc_get_sid(opt_dentry,
1422 isec->initialized = 1;
1425 mutex_unlock(&isec->lock);
1427 if (isec->sclass == SECCLASS_FILE)
1428 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1432 /* Convert a Linux signal to an access vector. */
1433 static inline u32 signal_to_av(int sig)
1439 /* Commonly granted from child to parent. */
1440 perm = PROCESS__SIGCHLD;
1443 /* Cannot be caught or ignored */
1444 perm = PROCESS__SIGKILL;
1447 /* Cannot be caught or ignored */
1448 perm = PROCESS__SIGSTOP;
1451 /* All other signals. */
1452 perm = PROCESS__SIGNAL;
1460 * Check permission between a pair of credentials
1461 * fork check, ptrace check, etc.
1463 static int cred_has_perm(const struct cred *actor,
1464 const struct cred *target,
1467 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1469 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1473 * Check permission between a pair of tasks, e.g. signal checks,
1474 * fork check, ptrace check, etc.
1475 * tsk1 is the actor and tsk2 is the target
1476 * - this uses the default subjective creds of tsk1
1478 static int task_has_perm(const struct task_struct *tsk1,
1479 const struct task_struct *tsk2,
1482 const struct task_security_struct *__tsec1, *__tsec2;
1486 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1487 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1489 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1493 * Check permission between current and another task, e.g. signal checks,
1494 * fork check, ptrace check, etc.
1495 * current is the actor and tsk2 is the target
1496 * - this uses current's subjective creds
1498 static int current_has_perm(const struct task_struct *tsk,
1503 sid = current_sid();
1504 tsid = task_sid(tsk);
1505 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1508 #if CAP_LAST_CAP > 63
1509 #error Fix SELinux to handle capabilities > 63.
1512 /* Check whether a task is allowed to use a capability. */
1513 static int cred_has_capability(const struct cred *cred,
1516 struct common_audit_data ad;
1517 struct av_decision avd;
1519 u32 sid = cred_sid(cred);
1520 u32 av = CAP_TO_MASK(cap);
1523 ad.type = LSM_AUDIT_DATA_CAP;
1526 switch (CAP_TO_INDEX(cap)) {
1528 sclass = SECCLASS_CAPABILITY;
1531 sclass = SECCLASS_CAPABILITY2;
1535 "SELinux: out of range capability %d\n", cap);
1540 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1541 if (audit == SECURITY_CAP_AUDIT) {
1542 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1549 /* Check whether a task is allowed to use a system operation. */
1550 static int task_has_system(struct task_struct *tsk,
1553 u32 sid = task_sid(tsk);
1555 return avc_has_perm(sid, SECINITSID_KERNEL,
1556 SECCLASS_SYSTEM, perms, NULL);
1559 /* Check whether a task has a particular permission to an inode.
1560 The 'adp' parameter is optional and allows other audit
1561 data to be passed (e.g. the dentry). */
1562 static int inode_has_perm(const struct cred *cred,
1563 struct inode *inode,
1565 struct common_audit_data *adp,
1568 struct inode_security_struct *isec;
1571 validate_creds(cred);
1573 if (unlikely(IS_PRIVATE(inode)))
1576 sid = cred_sid(cred);
1577 isec = inode->i_security;
1579 return avc_has_perm_flags(sid, isec->sid, isec->sclass, perms, adp, flags);
1582 /* Same as inode_has_perm, but pass explicit audit data containing
1583 the dentry to help the auditing code to more easily generate the
1584 pathname if needed. */
1585 static inline int dentry_has_perm(const struct cred *cred,
1586 struct dentry *dentry,
1589 struct inode *inode = dentry->d_inode;
1590 struct common_audit_data ad;
1592 ad.type = LSM_AUDIT_DATA_DENTRY;
1593 ad.u.dentry = dentry;
1594 return inode_has_perm(cred, inode, av, &ad, 0);
1597 /* Same as inode_has_perm, but pass explicit audit data containing
1598 the path to help the auditing code to more easily generate the
1599 pathname if needed. */
1600 static inline int path_has_perm(const struct cred *cred,
1604 struct inode *inode = path->dentry->d_inode;
1605 struct common_audit_data ad;
1607 ad.type = LSM_AUDIT_DATA_PATH;
1609 return inode_has_perm(cred, inode, av, &ad, 0);
1612 /* Same as path_has_perm, but uses the inode from the file struct. */
1613 static inline int file_path_has_perm(const struct cred *cred,
1617 struct common_audit_data ad;
1619 ad.type = LSM_AUDIT_DATA_PATH;
1620 ad.u.path = file->f_path;
1621 return inode_has_perm(cred, file_inode(file), av, &ad, 0);
1624 /* Check whether a task can use an open file descriptor to
1625 access an inode in a given way. Check access to the
1626 descriptor itself, and then use dentry_has_perm to
1627 check a particular permission to the file.
1628 Access to the descriptor is implicitly granted if it
1629 has the same SID as the process. If av is zero, then
1630 access to the file is not checked, e.g. for cases
1631 where only the descriptor is affected like seek. */
1632 static int file_has_perm(const struct cred *cred,
1636 struct file_security_struct *fsec = file->f_security;
1637 struct inode *inode = file_inode(file);
1638 struct common_audit_data ad;
1639 u32 sid = cred_sid(cred);
1642 ad.type = LSM_AUDIT_DATA_PATH;
1643 ad.u.path = file->f_path;
1645 if (sid != fsec->sid) {
1646 rc = avc_has_perm(sid, fsec->sid,
1654 /* av is zero if only checking access to the descriptor. */
1657 rc = inode_has_perm(cred, inode, av, &ad, 0);
1663 /* Check whether a task can create a file. */
1664 static int may_create(struct inode *dir,
1665 struct dentry *dentry,
1668 const struct task_security_struct *tsec = current_security();
1669 struct inode_security_struct *dsec;
1670 struct superblock_security_struct *sbsec;
1672 struct common_audit_data ad;
1675 dsec = dir->i_security;
1676 sbsec = dir->i_sb->s_security;
1679 newsid = tsec->create_sid;
1681 ad.type = LSM_AUDIT_DATA_DENTRY;
1682 ad.u.dentry = dentry;
1684 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1685 DIR__ADD_NAME | DIR__SEARCH,
1690 if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
1691 rc = security_transition_sid(sid, dsec->sid, tclass,
1692 &dentry->d_name, &newsid);
1697 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1701 return avc_has_perm(newsid, sbsec->sid,
1702 SECCLASS_FILESYSTEM,
1703 FILESYSTEM__ASSOCIATE, &ad);
1706 /* Check whether a task can create a key. */
1707 static int may_create_key(u32 ksid,
1708 struct task_struct *ctx)
1710 u32 sid = task_sid(ctx);
1712 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1716 #define MAY_UNLINK 1
1719 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1720 static int may_link(struct inode *dir,
1721 struct dentry *dentry,
1725 struct inode_security_struct *dsec, *isec;
1726 struct common_audit_data ad;
1727 u32 sid = current_sid();
1731 dsec = dir->i_security;
1732 isec = dentry->d_inode->i_security;
1734 ad.type = LSM_AUDIT_DATA_DENTRY;
1735 ad.u.dentry = dentry;
1738 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1739 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1754 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1759 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1763 static inline int may_rename(struct inode *old_dir,
1764 struct dentry *old_dentry,
1765 struct inode *new_dir,
1766 struct dentry *new_dentry)
1768 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1769 struct common_audit_data ad;
1770 u32 sid = current_sid();
1772 int old_is_dir, new_is_dir;
1775 old_dsec = old_dir->i_security;
1776 old_isec = old_dentry->d_inode->i_security;
1777 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1778 new_dsec = new_dir->i_security;
1780 ad.type = LSM_AUDIT_DATA_DENTRY;
1782 ad.u.dentry = old_dentry;
1783 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1784 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1787 rc = avc_has_perm(sid, old_isec->sid,
1788 old_isec->sclass, FILE__RENAME, &ad);
1791 if (old_is_dir && new_dir != old_dir) {
1792 rc = avc_has_perm(sid, old_isec->sid,
1793 old_isec->sclass, DIR__REPARENT, &ad);
1798 ad.u.dentry = new_dentry;
1799 av = DIR__ADD_NAME | DIR__SEARCH;
1800 if (new_dentry->d_inode)
1801 av |= DIR__REMOVE_NAME;
1802 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1805 if (new_dentry->d_inode) {
1806 new_isec = new_dentry->d_inode->i_security;
1807 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1808 rc = avc_has_perm(sid, new_isec->sid,
1810 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1818 /* Check whether a task can perform a filesystem operation. */
1819 static int superblock_has_perm(const struct cred *cred,
1820 struct super_block *sb,
1822 struct common_audit_data *ad)
1824 struct superblock_security_struct *sbsec;
1825 u32 sid = cred_sid(cred);
1827 sbsec = sb->s_security;
1828 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1831 /* Convert a Linux mode and permission mask to an access vector. */
1832 static inline u32 file_mask_to_av(int mode, int mask)
1836 if (!S_ISDIR(mode)) {
1837 if (mask & MAY_EXEC)
1838 av |= FILE__EXECUTE;
1839 if (mask & MAY_READ)
1842 if (mask & MAY_APPEND)
1844 else if (mask & MAY_WRITE)
1848 if (mask & MAY_EXEC)
1850 if (mask & MAY_WRITE)
1852 if (mask & MAY_READ)
1859 /* Convert a Linux file to an access vector. */
1860 static inline u32 file_to_av(struct file *file)
1864 if (file->f_mode & FMODE_READ)
1866 if (file->f_mode & FMODE_WRITE) {
1867 if (file->f_flags & O_APPEND)
1874 * Special file opened with flags 3 for ioctl-only use.
1883 * Convert a file to an access vector and include the correct open
1886 static inline u32 open_file_to_av(struct file *file)
1888 u32 av = file_to_av(file);
1890 if (selinux_policycap_openperm)
1896 /* Hook functions begin here. */
1898 static int selinux_ptrace_access_check(struct task_struct *child,
1903 rc = cap_ptrace_access_check(child, mode);
1907 if (mode & PTRACE_MODE_READ) {
1908 u32 sid = current_sid();
1909 u32 csid = task_sid(child);
1910 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1913 return current_has_perm(child, PROCESS__PTRACE);
1916 static int selinux_ptrace_traceme(struct task_struct *parent)
1920 rc = cap_ptrace_traceme(parent);
1924 return task_has_perm(parent, current, PROCESS__PTRACE);
1927 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1928 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1932 error = current_has_perm(target, PROCESS__GETCAP);
1936 return cap_capget(target, effective, inheritable, permitted);
1939 static int selinux_capset(struct cred *new, const struct cred *old,
1940 const kernel_cap_t *effective,
1941 const kernel_cap_t *inheritable,
1942 const kernel_cap_t *permitted)
1946 error = cap_capset(new, old,
1947 effective, inheritable, permitted);
1951 return cred_has_perm(old, new, PROCESS__SETCAP);
1955 * (This comment used to live with the selinux_task_setuid hook,
1956 * which was removed).
1958 * Since setuid only affects the current process, and since the SELinux
1959 * controls are not based on the Linux identity attributes, SELinux does not
1960 * need to control this operation. However, SELinux does control the use of
1961 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1964 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1969 rc = cap_capable(cred, ns, cap, audit);
1973 return cred_has_capability(cred, cap, audit);
1976 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1978 const struct cred *cred = current_cred();
1990 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
1995 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
1998 rc = 0; /* let the kernel handle invalid cmds */
2004 static int selinux_quota_on(struct dentry *dentry)
2006 const struct cred *cred = current_cred();
2008 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2011 static int selinux_syslog(int type)
2016 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2017 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2018 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2020 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2021 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2022 /* Set level of messages printed to console */
2023 case SYSLOG_ACTION_CONSOLE_LEVEL:
2024 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2026 case SYSLOG_ACTION_CLOSE: /* Close log */
2027 case SYSLOG_ACTION_OPEN: /* Open log */
2028 case SYSLOG_ACTION_READ: /* Read from log */
2029 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
2030 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
2032 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2039 * Check that a process has enough memory to allocate a new virtual
2040 * mapping. 0 means there is enough memory for the allocation to
2041 * succeed and -ENOMEM implies there is not.
2043 * Do not audit the selinux permission check, as this is applied to all
2044 * processes that allocate mappings.
2046 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2048 int rc, cap_sys_admin = 0;
2050 rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
2051 SECURITY_CAP_NOAUDIT);
2055 return __vm_enough_memory(mm, pages, cap_sys_admin);
2058 /* binprm security operations */
2060 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2062 const struct task_security_struct *old_tsec;
2063 struct task_security_struct *new_tsec;
2064 struct inode_security_struct *isec;
2065 struct common_audit_data ad;
2066 struct inode *inode = file_inode(bprm->file);
2069 rc = cap_bprm_set_creds(bprm);
2073 /* SELinux context only depends on initial program or script and not
2074 * the script interpreter */
2075 if (bprm->cred_prepared)
2078 old_tsec = current_security();
2079 new_tsec = bprm->cred->security;
2080 isec = inode->i_security;
2082 /* Default to the current task SID. */
2083 new_tsec->sid = old_tsec->sid;
2084 new_tsec->osid = old_tsec->sid;
2086 /* Reset fs, key, and sock SIDs on execve. */
2087 new_tsec->create_sid = 0;
2088 new_tsec->keycreate_sid = 0;
2089 new_tsec->sockcreate_sid = 0;
2091 if (old_tsec->exec_sid) {
2092 new_tsec->sid = old_tsec->exec_sid;
2093 /* Reset exec SID on execve. */
2094 new_tsec->exec_sid = 0;
2097 * Minimize confusion: if no_new_privs and a transition is
2098 * explicitly requested, then fail the exec.
2100 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2103 /* Check for a default transition on this program. */
2104 rc = security_transition_sid(old_tsec->sid, isec->sid,
2105 SECCLASS_PROCESS, NULL,
2111 ad.type = LSM_AUDIT_DATA_PATH;
2112 ad.u.path = bprm->file->f_path;
2114 if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2115 (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2116 new_tsec->sid = old_tsec->sid;
2118 if (new_tsec->sid == old_tsec->sid) {
2119 rc = avc_has_perm(old_tsec->sid, isec->sid,
2120 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2124 /* Check permissions for the transition. */
2125 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2126 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2130 rc = avc_has_perm(new_tsec->sid, isec->sid,
2131 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2135 /* Check for shared state */
2136 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2137 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2138 SECCLASS_PROCESS, PROCESS__SHARE,
2144 /* Make sure that anyone attempting to ptrace over a task that
2145 * changes its SID has the appropriate permit */
2147 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2148 struct task_struct *tracer;
2149 struct task_security_struct *sec;
2153 tracer = ptrace_parent(current);
2154 if (likely(tracer != NULL)) {
2155 sec = __task_cred(tracer)->security;
2161 rc = avc_has_perm(ptsid, new_tsec->sid,
2163 PROCESS__PTRACE, NULL);
2169 /* Clear any possibly unsafe personality bits on exec: */
2170 bprm->per_clear |= PER_CLEAR_ON_SETID;
2176 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2178 const struct task_security_struct *tsec = current_security();
2186 /* Enable secure mode for SIDs transitions unless
2187 the noatsecure permission is granted between
2188 the two SIDs, i.e. ahp returns 0. */
2189 atsecure = avc_has_perm(osid, sid,
2191 PROCESS__NOATSECURE, NULL);
2194 return (atsecure || cap_bprm_secureexec(bprm));
2197 static int match_file(const void *p, struct file *file, unsigned fd)
2199 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2202 /* Derived from fs/exec.c:flush_old_files. */
2203 static inline void flush_unauthorized_files(const struct cred *cred,
2204 struct files_struct *files)
2206 struct file *file, *devnull = NULL;
2207 struct tty_struct *tty;
2211 tty = get_current_tty();
2213 spin_lock(&tty_files_lock);
2214 if (!list_empty(&tty->tty_files)) {
2215 struct tty_file_private *file_priv;
2217 /* Revalidate access to controlling tty.
2218 Use file_path_has_perm on the tty path directly
2219 rather than using file_has_perm, as this particular
2220 open file may belong to another process and we are
2221 only interested in the inode-based check here. */
2222 file_priv = list_first_entry(&tty->tty_files,
2223 struct tty_file_private, list);
2224 file = file_priv->file;
2225 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2228 spin_unlock(&tty_files_lock);
2231 /* Reset controlling tty. */
2235 /* Revalidate access to inherited open files. */
2236 n = iterate_fd(files, 0, match_file, cred);
2237 if (!n) /* none found? */
2240 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2241 if (IS_ERR(devnull))
2243 /* replace all the matching ones with this */
2245 replace_fd(n - 1, devnull, 0);
2246 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2252 * Prepare a process for imminent new credential changes due to exec
2254 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2256 struct task_security_struct *new_tsec;
2257 struct rlimit *rlim, *initrlim;
2260 new_tsec = bprm->cred->security;
2261 if (new_tsec->sid == new_tsec->osid)
2264 /* Close files for which the new task SID is not authorized. */
2265 flush_unauthorized_files(bprm->cred, current->files);
2267 /* Always clear parent death signal on SID transitions. */
2268 current->pdeath_signal = 0;
2270 /* Check whether the new SID can inherit resource limits from the old
2271 * SID. If not, reset all soft limits to the lower of the current
2272 * task's hard limit and the init task's soft limit.
2274 * Note that the setting of hard limits (even to lower them) can be
2275 * controlled by the setrlimit check. The inclusion of the init task's
2276 * soft limit into the computation is to avoid resetting soft limits
2277 * higher than the default soft limit for cases where the default is
2278 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2280 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2281 PROCESS__RLIMITINH, NULL);
2283 /* protect against do_prlimit() */
2285 for (i = 0; i < RLIM_NLIMITS; i++) {
2286 rlim = current->signal->rlim + i;
2287 initrlim = init_task.signal->rlim + i;
2288 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2290 task_unlock(current);
2291 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2296 * Clean up the process immediately after the installation of new credentials
2299 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2301 const struct task_security_struct *tsec = current_security();
2302 struct itimerval itimer;
2312 /* Check whether the new SID can inherit signal state from the old SID.
2313 * If not, clear itimers to avoid subsequent signal generation and
2314 * flush and unblock signals.
2316 * This must occur _after_ the task SID has been updated so that any
2317 * kill done after the flush will be checked against the new SID.
2319 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2321 memset(&itimer, 0, sizeof itimer);
2322 for (i = 0; i < 3; i++)
2323 do_setitimer(i, &itimer, NULL);
2324 spin_lock_irq(¤t->sighand->siglock);
2325 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2326 __flush_signals(current);
2327 flush_signal_handlers(current, 1);
2328 sigemptyset(¤t->blocked);
2330 spin_unlock_irq(¤t->sighand->siglock);
2333 /* Wake up the parent if it is waiting so that it can recheck
2334 * wait permission to the new task SID. */
2335 read_lock(&tasklist_lock);
2336 __wake_up_parent(current, current->real_parent);
2337 read_unlock(&tasklist_lock);
2340 /* superblock security operations */
2342 static int selinux_sb_alloc_security(struct super_block *sb)
2344 return superblock_alloc_security(sb);
2347 static void selinux_sb_free_security(struct super_block *sb)
2349 superblock_free_security(sb);
2352 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2357 return !memcmp(prefix, option, plen);
2360 static inline int selinux_option(char *option, int len)
2362 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2363 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2364 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2365 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2366 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2369 static inline void take_option(char **to, char *from, int *first, int len)
2376 memcpy(*to, from, len);
2380 static inline void take_selinux_option(char **to, char *from, int *first,
2383 int current_size = 0;
2391 while (current_size < len) {
2401 static int selinux_sb_copy_data(char *orig, char *copy)
2403 int fnosec, fsec, rc = 0;
2404 char *in_save, *in_curr, *in_end;
2405 char *sec_curr, *nosec_save, *nosec;
2411 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2419 in_save = in_end = orig;
2423 open_quote = !open_quote;
2424 if ((*in_end == ',' && open_quote == 0) ||
2426 int len = in_end - in_curr;
2428 if (selinux_option(in_curr, len))
2429 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2431 take_option(&nosec, in_curr, &fnosec, len);
2433 in_curr = in_end + 1;
2435 } while (*in_end++);
2437 strcpy(in_save, nosec_save);
2438 free_page((unsigned long)nosec_save);
2443 static int selinux_sb_remount(struct super_block *sb, void *data)
2446 struct security_mnt_opts opts;
2447 char *secdata, **mount_options;
2448 struct superblock_security_struct *sbsec = sb->s_security;
2450 if (!(sbsec->flags & SE_SBINITIALIZED))
2456 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2459 security_init_mnt_opts(&opts);
2460 secdata = alloc_secdata();
2463 rc = selinux_sb_copy_data(data, secdata);
2465 goto out_free_secdata;
2467 rc = selinux_parse_opts_str(secdata, &opts);
2469 goto out_free_secdata;
2471 mount_options = opts.mnt_opts;
2472 flags = opts.mnt_opts_flags;
2474 for (i = 0; i < opts.num_mnt_opts; i++) {
2478 if (flags[i] == SBLABEL_MNT)
2480 len = strlen(mount_options[i]);
2481 rc = security_context_to_sid(mount_options[i], len, &sid);
2483 printk(KERN_WARNING "SELinux: security_context_to_sid"
2484 "(%s) failed for (dev %s, type "SB_TYPE_FMT") errno=%d\n",
2485 mount_options[i], sb->s_id, SB_TYPE_ARGS(sb), rc);
2491 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2492 goto out_bad_option;
2495 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2496 goto out_bad_option;
2498 case ROOTCONTEXT_MNT: {
2499 struct inode_security_struct *root_isec;
2500 root_isec = sb->s_root->d_inode->i_security;
2502 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2503 goto out_bad_option;
2506 case DEFCONTEXT_MNT:
2507 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2508 goto out_bad_option;
2517 security_free_mnt_opts(&opts);
2519 free_secdata(secdata);
2522 printk(KERN_WARNING "SELinux: unable to change security options "
2523 "during remount (dev %s, type "SB_TYPE_FMT")\n", sb->s_id,
2528 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2530 const struct cred *cred = current_cred();
2531 struct common_audit_data ad;
2534 rc = superblock_doinit(sb, data);
2538 /* Allow all mounts performed by the kernel */
2539 if (flags & MS_KERNMOUNT)
2542 ad.type = LSM_AUDIT_DATA_DENTRY;
2543 ad.u.dentry = sb->s_root;
2544 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2547 static int selinux_sb_statfs(struct dentry *dentry)
2549 const struct cred *cred = current_cred();
2550 struct common_audit_data ad;
2552 ad.type = LSM_AUDIT_DATA_DENTRY;
2553 ad.u.dentry = dentry->d_sb->s_root;
2554 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2557 static int selinux_mount(const char *dev_name,
2560 unsigned long flags,
2563 const struct cred *cred = current_cred();
2565 if (flags & MS_REMOUNT)
2566 return superblock_has_perm(cred, path->dentry->d_sb,
2567 FILESYSTEM__REMOUNT, NULL);
2569 return path_has_perm(cred, path, FILE__MOUNTON);
2572 static int selinux_umount(struct vfsmount *mnt, int flags)
2574 const struct cred *cred = current_cred();
2576 return superblock_has_perm(cred, mnt->mnt_sb,
2577 FILESYSTEM__UNMOUNT, NULL);
2580 /* inode security operations */
2582 static int selinux_inode_alloc_security(struct inode *inode)
2584 return inode_alloc_security(inode);
2587 static void selinux_inode_free_security(struct inode *inode)
2589 inode_free_security(inode);
2592 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2593 struct qstr *name, void **ctx,
2596 const struct cred *cred = current_cred();
2597 struct task_security_struct *tsec;
2598 struct inode_security_struct *dsec;
2599 struct superblock_security_struct *sbsec;
2600 struct inode *dir = dentry->d_parent->d_inode;
2604 tsec = cred->security;
2605 dsec = dir->i_security;
2606 sbsec = dir->i_sb->s_security;
2608 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2609 newsid = tsec->create_sid;
2611 rc = security_transition_sid(tsec->sid, dsec->sid,
2612 inode_mode_to_security_class(mode),
2617 "%s: security_transition_sid failed, rc=%d\n",
2623 return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2626 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2627 const struct qstr *qstr,
2629 void **value, size_t *len)
2631 const struct task_security_struct *tsec = current_security();
2632 struct inode_security_struct *dsec;
2633 struct superblock_security_struct *sbsec;
2634 u32 sid, newsid, clen;
2638 dsec = dir->i_security;
2639 sbsec = dir->i_sb->s_security;
2642 newsid = tsec->create_sid;
2644 if ((sbsec->flags & SE_SBINITIALIZED) &&
2645 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2646 newsid = sbsec->mntpoint_sid;
2647 else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
2648 rc = security_transition_sid(sid, dsec->sid,
2649 inode_mode_to_security_class(inode->i_mode),
2652 printk(KERN_WARNING "%s: "
2653 "security_transition_sid failed, rc=%d (dev=%s "
2656 -rc, inode->i_sb->s_id, inode->i_ino);
2661 /* Possibly defer initialization to selinux_complete_init. */
2662 if (sbsec->flags & SE_SBINITIALIZED) {
2663 struct inode_security_struct *isec = inode->i_security;
2664 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2666 isec->initialized = 1;
2669 if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2673 *name = XATTR_SELINUX_SUFFIX;
2676 rc = security_sid_to_context_force(newsid, &context, &clen);
2686 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2688 return may_create(dir, dentry, SECCLASS_FILE);
2691 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2693 return may_link(dir, old_dentry, MAY_LINK);
2696 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2698 return may_link(dir, dentry, MAY_UNLINK);
2701 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2703 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2706 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2708 return may_create(dir, dentry, SECCLASS_DIR);
2711 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2713 return may_link(dir, dentry, MAY_RMDIR);
2716 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2718 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2721 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2722 struct inode *new_inode, struct dentry *new_dentry)
2724 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2727 static int selinux_inode_readlink(struct dentry *dentry)
2729 const struct cred *cred = current_cred();
2731 return dentry_has_perm(cred, dentry, FILE__READ);
2734 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2736 const struct cred *cred = current_cred();
2738 return dentry_has_perm(cred, dentry, FILE__READ);
2741 static noinline int audit_inode_permission(struct inode *inode,
2742 u32 perms, u32 audited, u32 denied,
2745 struct common_audit_data ad;
2746 struct inode_security_struct *isec = inode->i_security;
2749 ad.type = LSM_AUDIT_DATA_INODE;
2752 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2753 audited, denied, &ad, flags);
2759 static int selinux_inode_permission(struct inode *inode, int mask)
2761 const struct cred *cred = current_cred();
2764 unsigned flags = mask & MAY_NOT_BLOCK;
2765 struct inode_security_struct *isec;
2767 struct av_decision avd;
2769 u32 audited, denied;
2771 from_access = mask & MAY_ACCESS;
2772 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2774 /* No permission to check. Existence test. */
2778 validate_creds(cred);
2780 if (unlikely(IS_PRIVATE(inode)))
2783 perms = file_mask_to_av(inode->i_mode, mask);
2785 sid = cred_sid(cred);
2786 isec = inode->i_security;
2788 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2789 audited = avc_audit_required(perms, &avd, rc,
2790 from_access ? FILE__AUDIT_ACCESS : 0,
2792 if (likely(!audited))
2795 rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
2801 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2803 const struct cred *cred = current_cred();
2804 unsigned int ia_valid = iattr->ia_valid;
2805 __u32 av = FILE__WRITE;
2807 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2808 if (ia_valid & ATTR_FORCE) {
2809 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2815 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2816 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2817 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2819 if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2822 return dentry_has_perm(cred, dentry, av);
2825 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2827 const struct cred *cred = current_cred();
2830 path.dentry = dentry;
2833 return path_has_perm(cred, &path, FILE__GETATTR);
2836 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2838 const struct cred *cred = current_cred();
2840 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2841 sizeof XATTR_SECURITY_PREFIX - 1)) {
2842 if (!strcmp(name, XATTR_NAME_CAPS)) {
2843 if (!capable(CAP_SETFCAP))
2845 } else if (!capable(CAP_SYS_ADMIN)) {
2846 /* A different attribute in the security namespace.
2847 Restrict to administrator. */
2852 /* Not an attribute we recognize, so just check the
2853 ordinary setattr permission. */
2854 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2857 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2858 const void *value, size_t size, int flags)
2860 struct inode *inode = dentry->d_inode;
2861 struct inode_security_struct *isec = inode->i_security;
2862 struct superblock_security_struct *sbsec;
2863 struct common_audit_data ad;
2864 u32 newsid, sid = current_sid();
2867 if (strcmp(name, XATTR_NAME_SELINUX))
2868 return selinux_inode_setotherxattr(dentry, name);
2870 sbsec = inode->i_sb->s_security;
2871 if (!(sbsec->flags & SBLABEL_MNT))
2874 if (!inode_owner_or_capable(inode))
2877 ad.type = LSM_AUDIT_DATA_DENTRY;
2878 ad.u.dentry = dentry;
2880 rc = avc_has_perm(sid, isec->sid, isec->sclass,
2881 FILE__RELABELFROM, &ad);
2885 rc = security_context_to_sid(value, size, &newsid);
2886 if (rc == -EINVAL) {
2887 if (!capable(CAP_MAC_ADMIN)) {
2888 struct audit_buffer *ab;
2892 /* We strip a nul only if it is at the end, otherwise the
2893 * context contains a nul and we should audit that */
2896 if (str[size - 1] == '\0')
2897 audit_size = size - 1;
2904 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2905 audit_log_format(ab, "op=setxattr invalid_context=");
2906 audit_log_n_untrustedstring(ab, value, audit_size);
2911 rc = security_context_to_sid_force(value, size, &newsid);
2916 rc = avc_has_perm(sid, newsid, isec->sclass,
2917 FILE__RELABELTO, &ad);
2921 rc = security_validate_transition(isec->sid, newsid, sid,
2926 return avc_has_perm(newsid,
2928 SECCLASS_FILESYSTEM,
2929 FILESYSTEM__ASSOCIATE,
2933 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2934 const void *value, size_t size,
2937 struct inode *inode = dentry->d_inode;
2938 struct inode_security_struct *isec = inode->i_security;
2942 if (strcmp(name, XATTR_NAME_SELINUX)) {
2943 /* Not an attribute we recognize, so nothing to do. */
2947 rc = security_context_to_sid_force(value, size, &newsid);
2949 printk(KERN_ERR "SELinux: unable to map context to SID"
2950 "for (%s, %lu), rc=%d\n",
2951 inode->i_sb->s_id, inode->i_ino, -rc);
2955 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2957 isec->initialized = 1;
2962 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2964 const struct cred *cred = current_cred();
2966 return dentry_has_perm(cred, dentry, FILE__GETATTR);
2969 static int selinux_inode_listxattr(struct dentry *dentry)
2971 const struct cred *cred = current_cred();
2973 return dentry_has_perm(cred, dentry, FILE__GETATTR);
2976 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2978 if (strcmp(name, XATTR_NAME_SELINUX))
2979 return selinux_inode_setotherxattr(dentry, name);
2981 /* No one is allowed to remove a SELinux security label.
2982 You can change the label, but all data must be labeled. */
2987 * Copy the inode security context value to the user.
2989 * Permission check is handled by selinux_inode_getxattr hook.
2991 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2995 char *context = NULL;
2996 struct inode_security_struct *isec = inode->i_security;
2998 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3002 * If the caller has CAP_MAC_ADMIN, then get the raw context
3003 * value even if it is not defined by current policy; otherwise,
3004 * use the in-core value under current policy.
3005 * Use the non-auditing forms of the permission checks since
3006 * getxattr may be called by unprivileged processes commonly
3007 * and lack of permission just means that we fall back to the
3008 * in-core context value, not a denial.
3010 error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3011 SECURITY_CAP_NOAUDIT);
3013 error = security_sid_to_context_force(isec->sid, &context,
3016 error = security_sid_to_context(isec->sid, &context, &size);
3029 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3030 const void *value, size_t size, int flags)
3032 struct inode_security_struct *isec = inode->i_security;
3036 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3039 if (!value || !size)
3042 rc = security_context_to_sid((void *)value, size, &newsid);
3046 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3048 isec->initialized = 1;
3052 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3054 const int len = sizeof(XATTR_NAME_SELINUX);
3055 if (buffer && len <= buffer_size)
3056 memcpy(buffer, XATTR_NAME_SELINUX, len);
3060 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3062 struct inode_security_struct *isec = inode->i_security;
3066 /* file security operations */
3068 static int selinux_revalidate_file_permission(struct file *file, int mask)
3070 const struct cred *cred = current_cred();
3071 struct inode *inode = file_inode(file);
3073 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3074 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3077 return file_has_perm(cred, file,
3078 file_mask_to_av(inode->i_mode, mask));
3081 static int selinux_file_permission(struct file *file, int mask)
3083 struct inode *inode = file_inode(file);
3084 struct file_security_struct *fsec = file->f_security;
3085 struct inode_security_struct *isec = inode->i_security;
3086 u32 sid = current_sid();
3089 /* No permission to check. Existence test. */
3092 if (sid == fsec->sid && fsec->isid == isec->sid &&
3093 fsec->pseqno == avc_policy_seqno())
3094 /* No change since file_open check. */
3097 return selinux_revalidate_file_permission(file, mask);
3100 static int selinux_file_alloc_security(struct file *file)
3102 return file_alloc_security(file);
3105 static void selinux_file_free_security(struct file *file)
3107 file_free_security(file);
3110 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3113 const struct cred *cred = current_cred();
3123 case FS_IOC_GETFLAGS:
3125 case FS_IOC_GETVERSION:
3126 error = file_has_perm(cred, file, FILE__GETATTR);
3129 case FS_IOC_SETFLAGS:
3131 case FS_IOC_SETVERSION:
3132 error = file_has_perm(cred, file, FILE__SETATTR);
3135 /* sys_ioctl() checks */
3139 error = file_has_perm(cred, file, 0);
3144 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3145 SECURITY_CAP_AUDIT);
3148 /* default case assumes that the command will go
3149 * to the file's ioctl() function.
3152 error = file_has_perm(cred, file, FILE__IOCTL);
3157 static int default_noexec;
3159 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3161 const struct cred *cred = current_cred();
3164 if (default_noexec &&
3165 (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3167 * We are making executable an anonymous mapping or a
3168 * private file mapping that will also be writable.
3169 * This has an additional check.
3171 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3177 /* read access is always possible with a mapping */
3178 u32 av = FILE__READ;
3180 /* write access only matters if the mapping is shared */
3181 if (shared && (prot & PROT_WRITE))
3184 if (prot & PROT_EXEC)
3185 av |= FILE__EXECUTE;
3187 return file_has_perm(cred, file, av);
3194 static int selinux_mmap_addr(unsigned long addr)
3197 u32 sid = current_sid();
3200 * notice that we are intentionally putting the SELinux check before
3201 * the secondary cap_file_mmap check. This is such a likely attempt
3202 * at bad behaviour/exploit that we always want to get the AVC, even
3203 * if DAC would have also denied the operation.
3205 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3206 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3207 MEMPROTECT__MMAP_ZERO, NULL);
3212 /* do DAC check on address space usage */
3213 return cap_mmap_addr(addr);
3216 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3217 unsigned long prot, unsigned long flags)
3219 if (selinux_checkreqprot)
3222 return file_map_prot_check(file, prot,
3223 (flags & MAP_TYPE) == MAP_SHARED);
3226 static int selinux_file_mprotect(struct vm_area_struct *vma,
3227 unsigned long reqprot,
3230 const struct cred *cred = current_cred();
3232 if (selinux_checkreqprot)
3235 if (default_noexec &&
3236 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3238 if (vma->vm_start >= vma->vm_mm->start_brk &&
3239 vma->vm_end <= vma->vm_mm->brk) {
3240 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3241 } else if (!vma->vm_file &&
3242 vma->vm_start <= vma->vm_mm->start_stack &&
3243 vma->vm_end >= vma->vm_mm->start_stack) {
3244 rc = current_has_perm(current, PROCESS__EXECSTACK);
3245 } else if (vma->vm_file && vma->anon_vma) {
3247 * We are making executable a file mapping that has
3248 * had some COW done. Since pages might have been
3249 * written, check ability to execute the possibly
3250 * modified content. This typically should only
3251 * occur for text relocations.
3253 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3259 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3262 static int selinux_file_lock(struct file *file, unsigned int cmd)
3264 const struct cred *cred = current_cred();
3266 return file_has_perm(cred, file, FILE__LOCK);
3269 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3272 const struct cred *cred = current_cred();
3277 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3278 err = file_has_perm(cred, file, FILE__WRITE);
3287 case F_GETOWNER_UIDS:
3288 /* Just check FD__USE permission */
3289 err = file_has_perm(cred, file, 0);
3294 #if BITS_PER_LONG == 32
3299 err = file_has_perm(cred, file, FILE__LOCK);
3306 static int selinux_file_set_fowner(struct file *file)
3308 struct file_security_struct *fsec;
3310 fsec = file->f_security;
3311 fsec->fown_sid = current_sid();
3316 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3317 struct fown_struct *fown, int signum)
3320 u32 sid = task_sid(tsk);
3322 struct file_security_struct *fsec;
3324 /* struct fown_struct is never outside the context of a struct file */
3325 file = container_of(fown, struct file, f_owner);
3327 fsec = file->f_security;
3330 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3332 perm = signal_to_av(signum);
3334 return avc_has_perm(fsec->fown_sid, sid,
3335 SECCLASS_PROCESS, perm, NULL);
3338 static int selinux_file_receive(struct file *file)
3340 const struct cred *cred = current_cred();
3342 return file_has_perm(cred, file, file_to_av(file));
3345 static int selinux_file_open(struct file *file, const struct cred *cred)
3347 struct file_security_struct *fsec;
3348 struct inode_security_struct *isec;
3350 fsec = file->f_security;
3351 isec = file_inode(file)->i_security;
3353 * Save inode label and policy sequence number
3354 * at open-time so that selinux_file_permission
3355 * can determine whether revalidation is necessary.
3356 * Task label is already saved in the file security
3357 * struct as its SID.
3359 fsec->isid = isec->sid;
3360 fsec->pseqno = avc_policy_seqno();
3362 * Since the inode label or policy seqno may have changed
3363 * between the selinux_inode_permission check and the saving
3364 * of state above, recheck that access is still permitted.
3365 * Otherwise, access might never be revalidated against the
3366 * new inode label or new policy.
3367 * This check is not redundant - do not remove.
3369 return file_path_has_perm(cred, file, open_file_to_av(file));
3372 /* task security operations */
3374 static int selinux_task_create(unsigned long clone_flags)
3376 return current_has_perm(current, PROCESS__FORK);
3380 * allocate the SELinux part of blank credentials
3382 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3384 struct task_security_struct *tsec;
3386 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3390 cred->security = tsec;
3395 * detach and free the LSM part of a set of credentials
3397 static void selinux_cred_free(struct cred *cred)
3399 struct task_security_struct *tsec = cred->security;
3402 * cred->security == NULL if security_cred_alloc_blank() or
3403 * security_prepare_creds() returned an error.
3405 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3406 cred->security = (void *) 0x7UL;
3411 * prepare a new set of credentials for modification
3413 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3416 const struct task_security_struct *old_tsec;
3417 struct task_security_struct *tsec;
3419 old_tsec = old->security;
3421 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3425 new->security = tsec;
3430 * transfer the SELinux data to a blank set of creds
3432 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3434 const struct task_security_struct *old_tsec = old->security;
3435 struct task_security_struct *tsec = new->security;
3441 * set the security data for a kernel service
3442 * - all the creation contexts are set to unlabelled
3444 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3446 struct task_security_struct *tsec = new->security;
3447 u32 sid = current_sid();
3450 ret = avc_has_perm(sid, secid,
3451 SECCLASS_KERNEL_SERVICE,
3452 KERNEL_SERVICE__USE_AS_OVERRIDE,
3456 tsec->create_sid = 0;
3457 tsec->keycreate_sid = 0;
3458 tsec->sockcreate_sid = 0;
3464 * set the file creation context in a security record to the same as the
3465 * objective context of the specified inode
3467 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3469 struct inode_security_struct *isec = inode->i_security;
3470 struct task_security_struct *tsec = new->security;
3471 u32 sid = current_sid();
3474 ret = avc_has_perm(sid, isec->sid,
3475 SECCLASS_KERNEL_SERVICE,
3476 KERNEL_SERVICE__CREATE_FILES_AS,
3480 tsec->create_sid = isec->sid;
3484 static int selinux_kernel_module_request(char *kmod_name)
3487 struct common_audit_data ad;
3489 sid = task_sid(current);
3491 ad.type = LSM_AUDIT_DATA_KMOD;
3492 ad.u.kmod_name = kmod_name;
3494 return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3495 SYSTEM__MODULE_REQUEST, &ad);
3498 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3500 return current_has_perm(p, PROCESS__SETPGID);
3503 static int selinux_task_getpgid(struct task_struct *p)
3505 return current_has_perm(p, PROCESS__GETPGID);
3508 static int selinux_task_getsid(struct task_struct *p)
3510 return current_has_perm(p, PROCESS__GETSESSION);
3513 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3515 *secid = task_sid(p);
3518 static int selinux_task_setnice(struct task_struct *p, int nice)
3522 rc = cap_task_setnice(p, nice);
3526 return current_has_perm(p, PROCESS__SETSCHED);
3529 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3533 rc = cap_task_setioprio(p, ioprio);
3537 return current_has_perm(p, PROCESS__SETSCHED);
3540 static int selinux_task_getioprio(struct task_struct *p)
3542 return current_has_perm(p, PROCESS__GETSCHED);
3545 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3546 struct rlimit *new_rlim)
3548 struct rlimit *old_rlim = p->signal->rlim + resource;
3550 /* Control the ability to change the hard limit (whether
3551 lowering or raising it), so that the hard limit can
3552 later be used as a safe reset point for the soft limit
3553 upon context transitions. See selinux_bprm_committing_creds. */
3554 if (old_rlim->rlim_max != new_rlim->rlim_max)
3555 return current_has_perm(p, PROCESS__SETRLIMIT);
3560 static int selinux_task_setscheduler(struct task_struct *p)
3564 rc = cap_task_setscheduler(p);
3568 return current_has_perm(p, PROCESS__SETSCHED);
3571 static int selinux_task_getscheduler(struct task_struct *p)
3573 return current_has_perm(p, PROCESS__GETSCHED);
3576 static int selinux_task_movememory(struct task_struct *p)
3578 return current_has_perm(p, PROCESS__SETSCHED);
3581 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3588 perm = PROCESS__SIGNULL; /* null signal; existence test */
3590 perm = signal_to_av(sig);
3592 rc = avc_has_perm(secid, task_sid(p),
3593 SECCLASS_PROCESS, perm, NULL);
3595 rc = current_has_perm(p, perm);
3599 static int selinux_task_wait(struct task_struct *p)
3601 return task_has_perm(p, current, PROCESS__SIGCHLD);
3604 static void selinux_task_to_inode(struct task_struct *p,
3605 struct inode *inode)
3607 struct inode_security_struct *isec = inode->i_security;
3608 u32 sid = task_sid(p);
3611 isec->initialized = 1;
3614 /* Returns error only if unable to parse addresses */
3615 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3616 struct common_audit_data *ad, u8 *proto)
3618 int offset, ihlen, ret = -EINVAL;
3619 struct iphdr _iph, *ih;
3621 offset = skb_network_offset(skb);
3622 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3626 ihlen = ih->ihl * 4;
3627 if (ihlen < sizeof(_iph))
3630 ad->u.net->v4info.saddr = ih->saddr;
3631 ad->u.net->v4info.daddr = ih->daddr;
3635 *proto = ih->protocol;
3637 switch (ih->protocol) {
3639 struct tcphdr _tcph, *th;
3641 if (ntohs(ih->frag_off) & IP_OFFSET)
3645 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3649 ad->u.net->sport = th->source;
3650 ad->u.net->dport = th->dest;
3655 struct udphdr _udph, *uh;
3657 if (ntohs(ih->frag_off) & IP_OFFSET)
3661 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3665 ad->u.net->sport = uh->source;
3666 ad->u.net->dport = uh->dest;
3670 case IPPROTO_DCCP: {
3671 struct dccp_hdr _dccph, *dh;
3673 if (ntohs(ih->frag_off) & IP_OFFSET)
3677 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3681 ad->u.net->sport = dh->dccph_sport;
3682 ad->u.net->dport = dh->dccph_dport;
3693 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3695 /* Returns error only if unable to parse addresses */
3696 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3697 struct common_audit_data *ad, u8 *proto)
3700 int ret = -EINVAL, offset;
3701 struct ipv6hdr _ipv6h, *ip6;
3704 offset = skb_network_offset(skb);
3705 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3709 ad->u.net->v6info.saddr = ip6->saddr;
3710 ad->u.net->v6info.daddr = ip6->daddr;
3713 nexthdr = ip6->nexthdr;
3714 offset += sizeof(_ipv6h);
3715 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3724 struct tcphdr _tcph, *th;
3726 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3730 ad->u.net->sport = th->source;
3731 ad->u.net->dport = th->dest;
3736 struct udphdr _udph, *uh;
3738 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3742 ad->u.net->sport = uh->source;
3743 ad->u.net->dport = uh->dest;
3747 case IPPROTO_DCCP: {
3748 struct dccp_hdr _dccph, *dh;
3750 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3754 ad->u.net->sport = dh->dccph_sport;
3755 ad->u.net->dport = dh->dccph_dport;
3759 /* includes fragments */
3769 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3770 char **_addrp, int src, u8 *proto)
3775 switch (ad->u.net->family) {
3777 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3780 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3781 &ad->u.net->v4info.daddr);
3784 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3786 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3789 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3790 &ad->u.net->v6info.daddr);
3800 "SELinux: failure in selinux_parse_skb(),"
3801 " unable to parse packet\n");
3811 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3813 * @family: protocol family
3814 * @sid: the packet's peer label SID
3817 * Check the various different forms of network peer labeling and determine
3818 * the peer label/SID for the packet; most of the magic actually occurs in
3819 * the security server function security_net_peersid_cmp(). The function
3820 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3821 * or -EACCES if @sid is invalid due to inconsistencies with the different
3825 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3832 err = selinux_skb_xfrm_sid(skb, &xfrm_sid);
3835 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3839 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3840 if (unlikely(err)) {
3842 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3843 " unable to determine packet's peer label\n");
3850 /* socket security operations */
3852 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3853 u16 secclass, u32 *socksid)
3855 if (tsec->sockcreate_sid > SECSID_NULL) {
3856 *socksid = tsec->sockcreate_sid;
3860 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3864 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3866 struct sk_security_struct *sksec = sk->sk_security;
3867 struct common_audit_data ad;
3868 struct lsm_network_audit net = {0,};
3869 u32 tsid = task_sid(task);
3871 if (sksec->sid == SECINITSID_KERNEL)
3874 ad.type = LSM_AUDIT_DATA_NET;
3878 return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3881 static int selinux_socket_create(int family, int type,
3882 int protocol, int kern)
3884 const struct task_security_struct *tsec = current_security();
3892 secclass = socket_type_to_security_class(family, type, protocol);
3893 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3897 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3900 static int selinux_socket_post_create(struct socket *sock, int family,
3901 int type, int protocol, int kern)
3903 const struct task_security_struct *tsec = current_security();
3904 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3905 struct sk_security_struct *sksec;
3908 isec->sclass = socket_type_to_security_class(family, type, protocol);
3911 isec->sid = SECINITSID_KERNEL;
3913 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3918 isec->initialized = 1;
3921 sksec = sock->sk->sk_security;
3922 sksec->sid = isec->sid;
3923 sksec->sclass = isec->sclass;
3924 err = selinux_netlbl_socket_post_create(sock->sk, family);
3930 /* Range of port numbers used to automatically bind.
3931 Need to determine whether we should perform a name_bind
3932 permission check between the socket and the port number. */
3934 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3936 struct sock *sk = sock->sk;
3940 err = sock_has_perm(current, sk, SOCKET__BIND);
3945 * If PF_INET or PF_INET6, check name_bind permission for the port.
3946 * Multiple address binding for SCTP is not supported yet: we just
3947 * check the first address now.
3949 family = sk->sk_family;
3950 if (family == PF_INET || family == PF_INET6) {
3952 struct sk_security_struct *sksec = sk->sk_security;
3953 struct common_audit_data ad;
3954 struct lsm_network_audit net = {0,};
3955 struct sockaddr_in *addr4 = NULL;
3956 struct sockaddr_in6 *addr6 = NULL;
3957 unsigned short snum;
3960 if (family == PF_INET) {
3961 addr4 = (struct sockaddr_in *)address;
3962 snum = ntohs(addr4->sin_port);
3963 addrp = (char *)&addr4->sin_addr.s_addr;
3965 addr6 = (struct sockaddr_in6 *)address;
3966 snum = ntohs(addr6->sin6_port);
3967 addrp = (char *)&addr6->sin6_addr.s6_addr;
3973 inet_get_local_port_range(&low, &high);
3975 if (snum < max(PROT_SOCK, low) || snum > high) {
3976 err = sel_netport_sid(sk->sk_protocol,
3980 ad.type = LSM_AUDIT_DATA_NET;
3982 ad.u.net->sport = htons(snum);
3983 ad.u.net->family = family;
3984 err = avc_has_perm(sksec->sid, sid,
3986 SOCKET__NAME_BIND, &ad);
3992 switch (sksec->sclass) {
3993 case SECCLASS_TCP_SOCKET:
3994 node_perm = TCP_SOCKET__NODE_BIND;
3997 case SECCLASS_UDP_SOCKET:
3998 node_perm = UDP_SOCKET__NODE_BIND;
4001 case SECCLASS_DCCP_SOCKET:
4002 node_perm = DCCP_SOCKET__NODE_BIND;
4006 node_perm = RAWIP_SOCKET__NODE_BIND;
4010 err = sel_netnode_sid(addrp, family, &sid);
4014 ad.type = LSM_AUDIT_DATA_NET;
4016 ad.u.net->sport = htons(snum);
4017 ad.u.net->family = family;
4019 if (family == PF_INET)
4020 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4022 ad.u.net->v6info.saddr = addr6->sin6_addr;
4024 err = avc_has_perm(sksec->sid, sid,
4025 sksec->sclass, node_perm, &ad);
4033 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4035 struct sock *sk = sock->sk;
4036 struct sk_security_struct *sksec = sk->sk_security;
4039 err = sock_has_perm(current, sk, SOCKET__CONNECT);
4044 * If a TCP or DCCP socket, check name_connect permission for the port.
4046 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4047 sksec->sclass == SECCLASS_DCCP_SOCKET) {
4048 struct common_audit_data ad;
4049 struct lsm_network_audit net = {0,};
4050 struct sockaddr_in *addr4 = NULL;
4051 struct sockaddr_in6 *addr6 = NULL;
4052 unsigned short snum;
4055 if (sk->sk_family == PF_INET) {
4056 addr4 = (struct sockaddr_in *)address;
4057 if (addrlen < sizeof(struct sockaddr_in))
4059 snum = ntohs(addr4->sin_port);
4061 addr6 = (struct sockaddr_in6 *)address;
4062 if (addrlen < SIN6_LEN_RFC2133)
4064 snum = ntohs(addr6->sin6_port);
4067 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4071 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4072 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4074 ad.type = LSM_AUDIT_DATA_NET;
4076 ad.u.net->dport = htons(snum);
4077 ad.u.net->family = sk->sk_family;
4078 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4083 err = selinux_netlbl_socket_connect(sk, address);
4089 static int selinux_socket_listen(struct socket *sock, int backlog)
4091 return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4094 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4097 struct inode_security_struct *isec;
4098 struct inode_security_struct *newisec;
4100 err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4104 newisec = SOCK_INODE(newsock)->i_security;
4106 isec = SOCK_INODE(sock)->i_security;
4107 newisec->sclass = isec->sclass;
4108 newisec->sid = isec->sid;
4109 newisec->initialized = 1;
4114 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4117 return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4120 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4121 int size, int flags)
4123 return sock_has_perm(current, sock->sk, SOCKET__READ);
4126 static int selinux_socket_getsockname(struct socket *sock)
4128 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4131 static int selinux_socket_getpeername(struct socket *sock)
4133 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4136 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4140 err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4144 return selinux_netlbl_socket_setsockopt(sock, level, optname);
4147 static int selinux_socket_getsockopt(struct socket *sock, int level,
4150 return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4153 static int selinux_socket_shutdown(struct socket *sock, int how)
4155 return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4158 static int selinux_socket_unix_stream_connect(struct sock *sock,
4162 struct sk_security_struct *sksec_sock = sock->sk_security;
4163 struct sk_security_struct *sksec_other = other->sk_security;
4164 struct sk_security_struct *sksec_new = newsk->sk_security;
4165 struct common_audit_data ad;
4166 struct lsm_network_audit net = {0,};
4169 ad.type = LSM_AUDIT_DATA_NET;
4171 ad.u.net->sk = other;
4173 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4174 sksec_other->sclass,
4175 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4179 /* server child socket */
4180 sksec_new->peer_sid = sksec_sock->sid;
4181 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4186 /* connecting socket */
4187 sksec_sock->peer_sid = sksec_new->sid;
4192 static int selinux_socket_unix_may_send(struct socket *sock,
4193 struct socket *other)
4195 struct sk_security_struct *ssec = sock->sk->sk_security;
4196 struct sk_security_struct *osec = other->sk->sk_security;
4197 struct common_audit_data ad;
4198 struct lsm_network_audit net = {0,};
4200 ad.type = LSM_AUDIT_DATA_NET;
4202 ad.u.net->sk = other->sk;
4204 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4208 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4210 struct common_audit_data *ad)
4216 err = sel_netif_sid(ifindex, &if_sid);
4219 err = avc_has_perm(peer_sid, if_sid,
4220 SECCLASS_NETIF, NETIF__INGRESS, ad);
4224 err = sel_netnode_sid(addrp, family, &node_sid);
4227 return avc_has_perm(peer_sid, node_sid,
4228 SECCLASS_NODE, NODE__RECVFROM, ad);
4231 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4235 struct sk_security_struct *sksec = sk->sk_security;
4236 u32 sk_sid = sksec->sid;
4237 struct common_audit_data ad;
4238 struct lsm_network_audit net = {0,};
4241 ad.type = LSM_AUDIT_DATA_NET;
4243 ad.u.net->netif = skb->skb_iif;
4244 ad.u.net->family = family;
4245 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4249 if (selinux_secmark_enabled()) {
4250 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4256 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4259 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4264 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4267 struct sk_security_struct *sksec = sk->sk_security;
4268 u16 family = sk->sk_family;
4269 u32 sk_sid = sksec->sid;
4270 struct common_audit_data ad;
4271 struct lsm_network_audit net = {0,};
4276 if (family != PF_INET && family != PF_INET6)
4279 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4280 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4283 /* If any sort of compatibility mode is enabled then handoff processing
4284 * to the selinux_sock_rcv_skb_compat() function to deal with the
4285 * special handling. We do this in an attempt to keep this function
4286 * as fast and as clean as possible. */
4287 if (!selinux_policycap_netpeer)
4288 return selinux_sock_rcv_skb_compat(sk, skb, family);
4290 secmark_active = selinux_secmark_enabled();
4291 peerlbl_active = selinux_peerlbl_enabled();
4292 if (!secmark_active && !peerlbl_active)
4295 ad.type = LSM_AUDIT_DATA_NET;
4297 ad.u.net->netif = skb->skb_iif;
4298 ad.u.net->family = family;
4299 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4303 if (peerlbl_active) {
4306 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4309 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4312 selinux_netlbl_err(skb, err, 0);
4315 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4318 selinux_netlbl_err(skb, err, 0);
4321 if (secmark_active) {
4322 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4331 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4332 int __user *optlen, unsigned len)
4337 struct sk_security_struct *sksec = sock->sk->sk_security;
4338 u32 peer_sid = SECSID_NULL;
4340 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4341 sksec->sclass == SECCLASS_TCP_SOCKET)
4342 peer_sid = sksec->peer_sid;
4343 if (peer_sid == SECSID_NULL)
4344 return -ENOPROTOOPT;
4346 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4350 if (scontext_len > len) {
4355 if (copy_to_user(optval, scontext, scontext_len))
4359 if (put_user(scontext_len, optlen))
4365 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4367 u32 peer_secid = SECSID_NULL;
4370 if (skb && skb->protocol == htons(ETH_P_IP))
4372 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4375 family = sock->sk->sk_family;
4379 if (sock && family == PF_UNIX)
4380 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4382 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4385 *secid = peer_secid;
4386 if (peer_secid == SECSID_NULL)
4391 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4393 struct sk_security_struct *sksec;
4395 sksec = kzalloc(sizeof(*sksec), priority);
4399 sksec->peer_sid = SECINITSID_UNLABELED;
4400 sksec->sid = SECINITSID_UNLABELED;
4401 selinux_netlbl_sk_security_reset(sksec);
4402 sk->sk_security = sksec;
4407 static void selinux_sk_free_security(struct sock *sk)
4409 struct sk_security_struct *sksec = sk->sk_security;
4411 sk->sk_security = NULL;
4412 selinux_netlbl_sk_security_free(sksec);
4416 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4418 struct sk_security_struct *sksec = sk->sk_security;
4419 struct sk_security_struct *newsksec = newsk->sk_security;
4421 newsksec->sid = sksec->sid;
4422 newsksec->peer_sid = sksec->peer_sid;
4423 newsksec->sclass = sksec->sclass;
4425 selinux_netlbl_sk_security_reset(newsksec);
4428 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4431 *secid = SECINITSID_ANY_SOCKET;
4433 struct sk_security_struct *sksec = sk->sk_security;
4435 *secid = sksec->sid;
4439 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4441 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4442 struct sk_security_struct *sksec = sk->sk_security;
4444 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4445 sk->sk_family == PF_UNIX)
4446 isec->sid = sksec->sid;
4447 sksec->sclass = isec->sclass;
4450 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4451 struct request_sock *req)
4453 struct sk_security_struct *sksec = sk->sk_security;
4455 u16 family = sk->sk_family;
4459 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4460 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4463 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4466 if (peersid == SECSID_NULL) {
4467 req->secid = sksec->sid;
4468 req->peer_secid = SECSID_NULL;
4470 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4473 req->secid = newsid;
4474 req->peer_secid = peersid;
4477 return selinux_netlbl_inet_conn_request(req, family);
4480 static void selinux_inet_csk_clone(struct sock *newsk,
4481 const struct request_sock *req)
4483 struct sk_security_struct *newsksec = newsk->sk_security;
4485 newsksec->sid = req->secid;
4486 newsksec->peer_sid = req->peer_secid;
4487 /* NOTE: Ideally, we should also get the isec->sid for the
4488 new socket in sync, but we don't have the isec available yet.
4489 So we will wait until sock_graft to do it, by which
4490 time it will have been created and available. */
4492 /* We don't need to take any sort of lock here as we are the only
4493 * thread with access to newsksec */
4494 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4497 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4499 u16 family = sk->sk_family;
4500 struct sk_security_struct *sksec = sk->sk_security;
4502 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4503 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4506 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4509 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4511 skb_set_owner_w(skb, sk);
4514 static int selinux_secmark_relabel_packet(u32 sid)
4516 const struct task_security_struct *__tsec;
4519 __tsec = current_security();
4522 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4525 static void selinux_secmark_refcount_inc(void)
4527 atomic_inc(&selinux_secmark_refcount);
4530 static void selinux_secmark_refcount_dec(void)
4532 atomic_dec(&selinux_secmark_refcount);
4535 static void selinux_req_classify_flow(const struct request_sock *req,
4538 fl->flowi_secid = req->secid;
4541 static int selinux_tun_dev_alloc_security(void **security)
4543 struct tun_security_struct *tunsec;
4545 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4548 tunsec->sid = current_sid();
4554 static void selinux_tun_dev_free_security(void *security)
4559 static int selinux_tun_dev_create(void)
4561 u32 sid = current_sid();
4563 /* we aren't taking into account the "sockcreate" SID since the socket
4564 * that is being created here is not a socket in the traditional sense,
4565 * instead it is a private sock, accessible only to the kernel, and
4566 * representing a wide range of network traffic spanning multiple
4567 * connections unlike traditional sockets - check the TUN driver to
4568 * get a better understanding of why this socket is special */
4570 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4574 static int selinux_tun_dev_attach_queue(void *security)
4576 struct tun_security_struct *tunsec = security;
4578 return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4579 TUN_SOCKET__ATTACH_QUEUE, NULL);
4582 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4584 struct tun_security_struct *tunsec = security;
4585 struct sk_security_struct *sksec = sk->sk_security;
4587 /* we don't currently perform any NetLabel based labeling here and it
4588 * isn't clear that we would want to do so anyway; while we could apply
4589 * labeling without the support of the TUN user the resulting labeled
4590 * traffic from the other end of the connection would almost certainly
4591 * cause confusion to the TUN user that had no idea network labeling
4592 * protocols were being used */
4594 sksec->sid = tunsec->sid;
4595 sksec->sclass = SECCLASS_TUN_SOCKET;
4600 static int selinux_tun_dev_open(void *security)
4602 struct tun_security_struct *tunsec = security;
4603 u32 sid = current_sid();
4606 err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4607 TUN_SOCKET__RELABELFROM, NULL);
4610 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4611 TUN_SOCKET__RELABELTO, NULL);
4619 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4623 struct nlmsghdr *nlh;
4624 struct sk_security_struct *sksec = sk->sk_security;
4626 if (skb->len < NLMSG_HDRLEN) {
4630 nlh = nlmsg_hdr(skb);
4632 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4634 if (err == -EINVAL) {
4635 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4636 "SELinux: unrecognized netlink message"
4637 " type=%hu for sclass=%hu\n",
4638 nlh->nlmsg_type, sksec->sclass);
4639 if (!selinux_enforcing || security_get_allow_unknown())
4649 err = sock_has_perm(current, sk, perm);
4654 #ifdef CONFIG_NETFILTER
4656 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4662 struct common_audit_data ad;
4663 struct lsm_network_audit net = {0,};
4668 if (!selinux_policycap_netpeer)
4671 secmark_active = selinux_secmark_enabled();
4672 netlbl_active = netlbl_enabled();
4673 peerlbl_active = selinux_peerlbl_enabled();
4674 if (!secmark_active && !peerlbl_active)
4677 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4680 ad.type = LSM_AUDIT_DATA_NET;
4682 ad.u.net->netif = ifindex;
4683 ad.u.net->family = family;
4684 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4687 if (peerlbl_active) {
4688 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4691 selinux_netlbl_err(skb, err, 1);
4697 if (avc_has_perm(peer_sid, skb->secmark,
4698 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4702 /* we do this in the FORWARD path and not the POST_ROUTING
4703 * path because we want to make sure we apply the necessary
4704 * labeling before IPsec is applied so we can leverage AH
4706 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4712 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4713 struct sk_buff *skb,
4714 const struct net_device *in,
4715 const struct net_device *out,
4716 int (*okfn)(struct sk_buff *))
4718 return selinux_ip_forward(skb, in->ifindex, PF_INET);
4721 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4722 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4723 struct sk_buff *skb,
4724 const struct net_device *in,
4725 const struct net_device *out,
4726 int (*okfn)(struct sk_buff *))
4728 return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4732 static unsigned int selinux_ip_output(struct sk_buff *skb,
4737 if (!netlbl_enabled())
4740 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4741 * because we want to make sure we apply the necessary labeling
4742 * before IPsec is applied so we can leverage AH protection */
4744 struct sk_security_struct *sksec = skb->sk->sk_security;
4747 sid = SECINITSID_KERNEL;
4748 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4754 static unsigned int selinux_ipv4_output(unsigned int hooknum,
4755 struct sk_buff *skb,
4756 const struct net_device *in,
4757 const struct net_device *out,
4758 int (*okfn)(struct sk_buff *))
4760 return selinux_ip_output(skb, PF_INET);
4763 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4767 struct sock *sk = skb->sk;
4768 struct sk_security_struct *sksec;
4769 struct common_audit_data ad;
4770 struct lsm_network_audit net = {0,};
4776 sksec = sk->sk_security;
4778 ad.type = LSM_AUDIT_DATA_NET;
4780 ad.u.net->netif = ifindex;
4781 ad.u.net->family = family;
4782 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4785 if (selinux_secmark_enabled())
4786 if (avc_has_perm(sksec->sid, skb->secmark,
4787 SECCLASS_PACKET, PACKET__SEND, &ad))
4788 return NF_DROP_ERR(-ECONNREFUSED);
4790 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4791 return NF_DROP_ERR(-ECONNREFUSED);
4796 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4802 struct common_audit_data ad;
4803 struct lsm_network_audit net = {0,};
4808 /* If any sort of compatibility mode is enabled then handoff processing
4809 * to the selinux_ip_postroute_compat() function to deal with the
4810 * special handling. We do this in an attempt to keep this function
4811 * as fast and as clean as possible. */
4812 if (!selinux_policycap_netpeer)
4813 return selinux_ip_postroute_compat(skb, ifindex, family);
4815 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4816 * packet transformation so allow the packet to pass without any checks
4817 * since we'll have another chance to perform access control checks
4818 * when the packet is on it's final way out.
4819 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4820 * is NULL, in this case go ahead and apply access control. */
4821 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
4824 secmark_active = selinux_secmark_enabled();
4825 peerlbl_active = selinux_peerlbl_enabled();
4826 if (!secmark_active && !peerlbl_active)
4829 /* if the packet is being forwarded then get the peer label from the
4830 * packet itself; otherwise check to see if it is from a local
4831 * application or the kernel, if from an application get the peer label
4832 * from the sending socket, otherwise use the kernel's sid */
4836 secmark_perm = PACKET__FORWARD_OUT;
4837 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4840 secmark_perm = PACKET__SEND;
4841 peer_sid = SECINITSID_KERNEL;
4844 struct sk_security_struct *sksec = sk->sk_security;
4845 peer_sid = sksec->sid;
4846 secmark_perm = PACKET__SEND;
4849 ad.type = LSM_AUDIT_DATA_NET;
4851 ad.u.net->netif = ifindex;
4852 ad.u.net->family = family;
4853 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4857 if (avc_has_perm(peer_sid, skb->secmark,
4858 SECCLASS_PACKET, secmark_perm, &ad))
4859 return NF_DROP_ERR(-ECONNREFUSED);
4861 if (peerlbl_active) {
4865 if (sel_netif_sid(ifindex, &if_sid))
4867 if (avc_has_perm(peer_sid, if_sid,
4868 SECCLASS_NETIF, NETIF__EGRESS, &ad))
4869 return NF_DROP_ERR(-ECONNREFUSED);
4871 if (sel_netnode_sid(addrp, family, &node_sid))
4873 if (avc_has_perm(peer_sid, node_sid,
4874 SECCLASS_NODE, NODE__SENDTO, &ad))
4875 return NF_DROP_ERR(-ECONNREFUSED);
4881 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4882 struct sk_buff *skb,
4883 const struct net_device *in,
4884 const struct net_device *out,
4885 int (*okfn)(struct sk_buff *))
4887 return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4890 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4891 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4892 struct sk_buff *skb,
4893 const struct net_device *in,
4894 const struct net_device *out,
4895 int (*okfn)(struct sk_buff *))
4897 return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4901 #endif /* CONFIG_NETFILTER */
4903 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4907 err = cap_netlink_send(sk, skb);
4911 return selinux_nlmsg_perm(sk, skb);
4914 static int ipc_alloc_security(struct task_struct *task,
4915 struct kern_ipc_perm *perm,
4918 struct ipc_security_struct *isec;
4921 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4925 sid = task_sid(task);
4926 isec->sclass = sclass;
4928 perm->security = isec;
4933 static void ipc_free_security(struct kern_ipc_perm *perm)
4935 struct ipc_security_struct *isec = perm->security;
4936 perm->security = NULL;
4940 static int msg_msg_alloc_security(struct msg_msg *msg)
4942 struct msg_security_struct *msec;
4944 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4948 msec->sid = SECINITSID_UNLABELED;
4949 msg->security = msec;
4954 static void msg_msg_free_security(struct msg_msg *msg)
4956 struct msg_security_struct *msec = msg->security;
4958 msg->security = NULL;
4962 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4965 struct ipc_security_struct *isec;
4966 struct common_audit_data ad;
4967 u32 sid = current_sid();
4969 isec = ipc_perms->security;
4971 ad.type = LSM_AUDIT_DATA_IPC;
4972 ad.u.ipc_id = ipc_perms->key;
4974 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
4977 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4979 return msg_msg_alloc_security(msg);
4982 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4984 msg_msg_free_security(msg);
4987 /* message queue security operations */
4988 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4990 struct ipc_security_struct *isec;
4991 struct common_audit_data ad;
4992 u32 sid = current_sid();
4995 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4999 isec = msq->q_perm.security;
5001 ad.type = LSM_AUDIT_DATA_IPC;
5002 ad.u.ipc_id = msq->q_perm.key;
5004 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5007 ipc_free_security(&msq->q_perm);
5013 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5015 ipc_free_security(&msq->q_perm);
5018 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5020 struct ipc_security_struct *isec;
5021 struct common_audit_data ad;
5022 u32 sid = current_sid();
5024 isec = msq->q_perm.security;
5026 ad.type = LSM_AUDIT_DATA_IPC;
5027 ad.u.ipc_id = msq->q_perm.key;
5029 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5030 MSGQ__ASSOCIATE, &ad);
5033 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5041 /* No specific object, just general system-wide information. */
5042 return task_has_system(current, SYSTEM__IPC_INFO);
5045 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5048 perms = MSGQ__SETATTR;
5051 perms = MSGQ__DESTROY;
5057 err = ipc_has_perm(&msq->q_perm, perms);
5061 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5063 struct ipc_security_struct *isec;
5064 struct msg_security_struct *msec;
5065 struct common_audit_data ad;
5066 u32 sid = current_sid();
5069 isec = msq->q_perm.security;
5070 msec = msg->security;
5073 * First time through, need to assign label to the message
5075 if (msec->sid == SECINITSID_UNLABELED) {
5077 * Compute new sid based on current process and
5078 * message queue this message will be stored in
5080 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5086 ad.type = LSM_AUDIT_DATA_IPC;
5087 ad.u.ipc_id = msq->q_perm.key;
5089 /* Can this process write to the queue? */
5090 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5093 /* Can this process send the message */
5094 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5097 /* Can the message be put in the queue? */
5098 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5099 MSGQ__ENQUEUE, &ad);
5104 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5105 struct task_struct *target,
5106 long type, int mode)
5108 struct ipc_security_struct *isec;
5109 struct msg_security_struct *msec;
5110 struct common_audit_data ad;
5111 u32 sid = task_sid(target);
5114 isec = msq->q_perm.security;
5115 msec = msg->security;
5117 ad.type = LSM_AUDIT_DATA_IPC;
5118 ad.u.ipc_id = msq->q_perm.key;
5120 rc = avc_has_perm(sid, isec->sid,
5121 SECCLASS_MSGQ, MSGQ__READ, &ad);
5123 rc = avc_has_perm(sid, msec->sid,
5124 SECCLASS_MSG, MSG__RECEIVE, &ad);
5128 /* Shared Memory security operations */
5129 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5131 struct ipc_security_struct *isec;
5132 struct common_audit_data ad;
5133 u32 sid = current_sid();
5136 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5140 isec = shp->shm_perm.security;
5142 ad.type = LSM_AUDIT_DATA_IPC;
5143 ad.u.ipc_id = shp->shm_perm.key;
5145 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5148 ipc_free_security(&shp->shm_perm);
5154 static void selinux_shm_free_security(struct shmid_kernel *shp)
5156 ipc_free_security(&shp->shm_perm);
5159 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5161 struct ipc_security_struct *isec;
5162 struct common_audit_data ad;
5163 u32 sid = current_sid();
5165 isec = shp->shm_perm.security;
5167 ad.type = LSM_AUDIT_DATA_IPC;
5168 ad.u.ipc_id = shp->shm_perm.key;
5170 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5171 SHM__ASSOCIATE, &ad);
5174 /* Note, at this point, shp is locked down */
5175 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5183 /* No specific object, just general system-wide information. */
5184 return task_has_system(current, SYSTEM__IPC_INFO);
5187 perms = SHM__GETATTR | SHM__ASSOCIATE;
5190 perms = SHM__SETATTR;
5197 perms = SHM__DESTROY;
5203 err = ipc_has_perm(&shp->shm_perm, perms);
5207 static int selinux_shm_shmat(struct shmid_kernel *shp,
5208 char __user *shmaddr, int shmflg)
5212 if (shmflg & SHM_RDONLY)
5215 perms = SHM__READ | SHM__WRITE;
5217 return ipc_has_perm(&shp->shm_perm, perms);
5220 /* Semaphore security operations */
5221 static int selinux_sem_alloc_security(struct sem_array *sma)
5223 struct ipc_security_struct *isec;
5224 struct common_audit_data ad;
5225 u32 sid = current_sid();
5228 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5232 isec = sma->sem_perm.security;
5234 ad.type = LSM_AUDIT_DATA_IPC;
5235 ad.u.ipc_id = sma->sem_perm.key;
5237 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5240 ipc_free_security(&sma->sem_perm);
5246 static void selinux_sem_free_security(struct sem_array *sma)
5248 ipc_free_security(&sma->sem_perm);
5251 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5253 struct ipc_security_struct *isec;
5254 struct common_audit_data ad;
5255 u32 sid = current_sid();
5257 isec = sma->sem_perm.security;
5259 ad.type = LSM_AUDIT_DATA_IPC;
5260 ad.u.ipc_id = sma->sem_perm.key;
5262 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5263 SEM__ASSOCIATE, &ad);
5266 /* Note, at this point, sma is locked down */
5267 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5275 /* No specific object, just general system-wide information. */
5276 return task_has_system(current, SYSTEM__IPC_INFO);
5280 perms = SEM__GETATTR;
5291 perms = SEM__DESTROY;
5294 perms = SEM__SETATTR;
5298 perms = SEM__GETATTR | SEM__ASSOCIATE;
5304 err = ipc_has_perm(&sma->sem_perm, perms);
5308 static int selinux_sem_semop(struct sem_array *sma,
5309 struct sembuf *sops, unsigned nsops, int alter)
5314 perms = SEM__READ | SEM__WRITE;
5318 return ipc_has_perm(&sma->sem_perm, perms);
5321 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5327 av |= IPC__UNIX_READ;
5329 av |= IPC__UNIX_WRITE;
5334 return ipc_has_perm(ipcp, av);
5337 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5339 struct ipc_security_struct *isec = ipcp->security;
5343 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5346 inode_doinit_with_dentry(inode, dentry);
5349 static int selinux_getprocattr(struct task_struct *p,
5350 char *name, char **value)
5352 const struct task_security_struct *__tsec;
5358 error = current_has_perm(p, PROCESS__GETATTR);
5364 __tsec = __task_cred(p)->security;
5366 if (!strcmp(name, "current"))
5368 else if (!strcmp(name, "prev"))
5370 else if (!strcmp(name, "exec"))
5371 sid = __tsec->exec_sid;
5372 else if (!strcmp(name, "fscreate"))
5373 sid = __tsec->create_sid;
5374 else if (!strcmp(name, "keycreate"))
5375 sid = __tsec->keycreate_sid;
5376 else if (!strcmp(name, "sockcreate"))
5377 sid = __tsec->sockcreate_sid;
5385 error = security_sid_to_context(sid, value, &len);
5395 static int selinux_setprocattr(struct task_struct *p,
5396 char *name, void *value, size_t size)
5398 struct task_security_struct *tsec;
5399 struct task_struct *tracer;
5406 /* SELinux only allows a process to change its own
5407 security attributes. */
5412 * Basic control over ability to set these attributes at all.
5413 * current == p, but we'll pass them separately in case the
5414 * above restriction is ever removed.
5416 if (!strcmp(name, "exec"))
5417 error = current_has_perm(p, PROCESS__SETEXEC);
5418 else if (!strcmp(name, "fscreate"))
5419 error = current_has_perm(p, PROCESS__SETFSCREATE);
5420 else if (!strcmp(name, "keycreate"))
5421 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5422 else if (!strcmp(name, "sockcreate"))
5423 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5424 else if (!strcmp(name, "current"))
5425 error = current_has_perm(p, PROCESS__SETCURRENT);
5431 /* Obtain a SID for the context, if one was specified. */
5432 if (size && str[1] && str[1] != '\n') {
5433 if (str[size-1] == '\n') {
5437 error = security_context_to_sid(value, size, &sid);
5438 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5439 if (!capable(CAP_MAC_ADMIN)) {
5440 struct audit_buffer *ab;
5443 /* We strip a nul only if it is at the end, otherwise the
5444 * context contains a nul and we should audit that */
5445 if (str[size - 1] == '\0')
5446 audit_size = size - 1;
5449 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5450 audit_log_format(ab, "op=fscreate invalid_context=");
5451 audit_log_n_untrustedstring(ab, value, audit_size);
5456 error = security_context_to_sid_force(value, size,
5463 new = prepare_creds();
5467 /* Permission checking based on the specified context is
5468 performed during the actual operation (execve,
5469 open/mkdir/...), when we know the full context of the
5470 operation. See selinux_bprm_set_creds for the execve
5471 checks and may_create for the file creation checks. The
5472 operation will then fail if the context is not permitted. */
5473 tsec = new->security;
5474 if (!strcmp(name, "exec")) {
5475 tsec->exec_sid = sid;
5476 } else if (!strcmp(name, "fscreate")) {
5477 tsec->create_sid = sid;
5478 } else if (!strcmp(name, "keycreate")) {
5479 error = may_create_key(sid, p);
5482 tsec->keycreate_sid = sid;
5483 } else if (!strcmp(name, "sockcreate")) {
5484 tsec->sockcreate_sid = sid;
5485 } else if (!strcmp(name, "current")) {
5490 /* Only allow single threaded processes to change context */
5492 if (!current_is_single_threaded()) {
5493 error = security_bounded_transition(tsec->sid, sid);
5498 /* Check permissions for the transition. */
5499 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5500 PROCESS__DYNTRANSITION, NULL);
5504 /* Check for ptracing, and update the task SID if ok.
5505 Otherwise, leave SID unchanged and fail. */
5508 tracer = ptrace_parent(p);
5510 ptsid = task_sid(tracer);
5514 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5515 PROCESS__PTRACE, NULL);
5534 static int selinux_ismaclabel(const char *name)
5536 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5539 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5541 return security_sid_to_context(secid, secdata, seclen);
5544 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5546 return security_context_to_sid(secdata, seclen, secid);
5549 static void selinux_release_secctx(char *secdata, u32 seclen)
5555 * called with inode->i_mutex locked
5557 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5559 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5563 * called with inode->i_mutex locked
5565 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5567 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5570 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5573 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5582 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5583 unsigned long flags)
5585 const struct task_security_struct *tsec;
5586 struct key_security_struct *ksec;
5588 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5592 tsec = cred->security;
5593 if (tsec->keycreate_sid)
5594 ksec->sid = tsec->keycreate_sid;
5596 ksec->sid = tsec->sid;
5602 static void selinux_key_free(struct key *k)
5604 struct key_security_struct *ksec = k->security;
5610 static int selinux_key_permission(key_ref_t key_ref,
5611 const struct cred *cred,
5615 struct key_security_struct *ksec;
5618 /* if no specific permissions are requested, we skip the
5619 permission check. No serious, additional covert channels
5620 appear to be created. */
5624 sid = cred_sid(cred);
5626 key = key_ref_to_ptr(key_ref);
5627 ksec = key->security;
5629 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5632 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5634 struct key_security_struct *ksec = key->security;
5635 char *context = NULL;
5639 rc = security_sid_to_context(ksec->sid, &context, &len);
5648 static struct security_operations selinux_ops = {
5651 .ptrace_access_check = selinux_ptrace_access_check,
5652 .ptrace_traceme = selinux_ptrace_traceme,
5653 .capget = selinux_capget,
5654 .capset = selinux_capset,
5655 .capable = selinux_capable,
5656 .quotactl = selinux_quotactl,
5657 .quota_on = selinux_quota_on,
5658 .syslog = selinux_syslog,
5659 .vm_enough_memory = selinux_vm_enough_memory,
5661 .netlink_send = selinux_netlink_send,
5663 .bprm_set_creds = selinux_bprm_set_creds,
5664 .bprm_committing_creds = selinux_bprm_committing_creds,
5665 .bprm_committed_creds = selinux_bprm_committed_creds,
5666 .bprm_secureexec = selinux_bprm_secureexec,
5668 .sb_alloc_security = selinux_sb_alloc_security,
5669 .sb_free_security = selinux_sb_free_security,
5670 .sb_copy_data = selinux_sb_copy_data,
5671 .sb_remount = selinux_sb_remount,
5672 .sb_kern_mount = selinux_sb_kern_mount,
5673 .sb_show_options = selinux_sb_show_options,
5674 .sb_statfs = selinux_sb_statfs,
5675 .sb_mount = selinux_mount,
5676 .sb_umount = selinux_umount,
5677 .sb_set_mnt_opts = selinux_set_mnt_opts,
5678 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
5679 .sb_parse_opts_str = selinux_parse_opts_str,
5681 .dentry_init_security = selinux_dentry_init_security,
5683 .inode_alloc_security = selinux_inode_alloc_security,
5684 .inode_free_security = selinux_inode_free_security,
5685 .inode_init_security = selinux_inode_init_security,
5686 .inode_create = selinux_inode_create,
5687 .inode_link = selinux_inode_link,
5688 .inode_unlink = selinux_inode_unlink,
5689 .inode_symlink = selinux_inode_symlink,
5690 .inode_mkdir = selinux_inode_mkdir,
5691 .inode_rmdir = selinux_inode_rmdir,
5692 .inode_mknod = selinux_inode_mknod,
5693 .inode_rename = selinux_inode_rename,
5694 .inode_readlink = selinux_inode_readlink,
5695 .inode_follow_link = selinux_inode_follow_link,
5696 .inode_permission = selinux_inode_permission,
5697 .inode_setattr = selinux_inode_setattr,
5698 .inode_getattr = selinux_inode_getattr,
5699 .inode_setxattr = selinux_inode_setxattr,
5700 .inode_post_setxattr = selinux_inode_post_setxattr,
5701 .inode_getxattr = selinux_inode_getxattr,
5702 .inode_listxattr = selinux_inode_listxattr,
5703 .inode_removexattr = selinux_inode_removexattr,
5704 .inode_getsecurity = selinux_inode_getsecurity,
5705 .inode_setsecurity = selinux_inode_setsecurity,
5706 .inode_listsecurity = selinux_inode_listsecurity,
5707 .inode_getsecid = selinux_inode_getsecid,
5709 .file_permission = selinux_file_permission,
5710 .file_alloc_security = selinux_file_alloc_security,
5711 .file_free_security = selinux_file_free_security,
5712 .file_ioctl = selinux_file_ioctl,
5713 .mmap_file = selinux_mmap_file,
5714 .mmap_addr = selinux_mmap_addr,
5715 .file_mprotect = selinux_file_mprotect,
5716 .file_lock = selinux_file_lock,
5717 .file_fcntl = selinux_file_fcntl,
5718 .file_set_fowner = selinux_file_set_fowner,
5719 .file_send_sigiotask = selinux_file_send_sigiotask,
5720 .file_receive = selinux_file_receive,
5722 .file_open = selinux_file_open,
5724 .task_create = selinux_task_create,
5725 .cred_alloc_blank = selinux_cred_alloc_blank,
5726 .cred_free = selinux_cred_free,
5727 .cred_prepare = selinux_cred_prepare,
5728 .cred_transfer = selinux_cred_transfer,
5729 .kernel_act_as = selinux_kernel_act_as,
5730 .kernel_create_files_as = selinux_kernel_create_files_as,
5731 .kernel_module_request = selinux_kernel_module_request,
5732 .task_setpgid = selinux_task_setpgid,
5733 .task_getpgid = selinux_task_getpgid,
5734 .task_getsid = selinux_task_getsid,
5735 .task_getsecid = selinux_task_getsecid,
5736 .task_setnice = selinux_task_setnice,
5737 .task_setioprio = selinux_task_setioprio,
5738 .task_getioprio = selinux_task_getioprio,
5739 .task_setrlimit = selinux_task_setrlimit,
5740 .task_setscheduler = selinux_task_setscheduler,
5741 .task_getscheduler = selinux_task_getscheduler,
5742 .task_movememory = selinux_task_movememory,
5743 .task_kill = selinux_task_kill,
5744 .task_wait = selinux_task_wait,
5745 .task_to_inode = selinux_task_to_inode,
5747 .ipc_permission = selinux_ipc_permission,
5748 .ipc_getsecid = selinux_ipc_getsecid,
5750 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5751 .msg_msg_free_security = selinux_msg_msg_free_security,
5753 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5754 .msg_queue_free_security = selinux_msg_queue_free_security,
5755 .msg_queue_associate = selinux_msg_queue_associate,
5756 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5757 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5758 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5760 .shm_alloc_security = selinux_shm_alloc_security,
5761 .shm_free_security = selinux_shm_free_security,
5762 .shm_associate = selinux_shm_associate,
5763 .shm_shmctl = selinux_shm_shmctl,
5764 .shm_shmat = selinux_shm_shmat,
5766 .sem_alloc_security = selinux_sem_alloc_security,
5767 .sem_free_security = selinux_sem_free_security,
5768 .sem_associate = selinux_sem_associate,
5769 .sem_semctl = selinux_sem_semctl,
5770 .sem_semop = selinux_sem_semop,
5772 .d_instantiate = selinux_d_instantiate,
5774 .getprocattr = selinux_getprocattr,
5775 .setprocattr = selinux_setprocattr,
5777 .ismaclabel = selinux_ismaclabel,
5778 .secid_to_secctx = selinux_secid_to_secctx,
5779 .secctx_to_secid = selinux_secctx_to_secid,
5780 .release_secctx = selinux_release_secctx,
5781 .inode_notifysecctx = selinux_inode_notifysecctx,
5782 .inode_setsecctx = selinux_inode_setsecctx,
5783 .inode_getsecctx = selinux_inode_getsecctx,
5785 .unix_stream_connect = selinux_socket_unix_stream_connect,
5786 .unix_may_send = selinux_socket_unix_may_send,
5788 .socket_create = selinux_socket_create,
5789 .socket_post_create = selinux_socket_post_create,
5790 .socket_bind = selinux_socket_bind,
5791 .socket_connect = selinux_socket_connect,
5792 .socket_listen = selinux_socket_listen,
5793 .socket_accept = selinux_socket_accept,
5794 .socket_sendmsg = selinux_socket_sendmsg,
5795 .socket_recvmsg = selinux_socket_recvmsg,
5796 .socket_getsockname = selinux_socket_getsockname,
5797 .socket_getpeername = selinux_socket_getpeername,
5798 .socket_getsockopt = selinux_socket_getsockopt,
5799 .socket_setsockopt = selinux_socket_setsockopt,
5800 .socket_shutdown = selinux_socket_shutdown,
5801 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
5802 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
5803 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
5804 .sk_alloc_security = selinux_sk_alloc_security,
5805 .sk_free_security = selinux_sk_free_security,
5806 .sk_clone_security = selinux_sk_clone_security,
5807 .sk_getsecid = selinux_sk_getsecid,
5808 .sock_graft = selinux_sock_graft,
5809 .inet_conn_request = selinux_inet_conn_request,
5810 .inet_csk_clone = selinux_inet_csk_clone,
5811 .inet_conn_established = selinux_inet_conn_established,
5812 .secmark_relabel_packet = selinux_secmark_relabel_packet,
5813 .secmark_refcount_inc = selinux_secmark_refcount_inc,
5814 .secmark_refcount_dec = selinux_secmark_refcount_dec,
5815 .req_classify_flow = selinux_req_classify_flow,
5816 .tun_dev_alloc_security = selinux_tun_dev_alloc_security,
5817 .tun_dev_free_security = selinux_tun_dev_free_security,
5818 .tun_dev_create = selinux_tun_dev_create,
5819 .tun_dev_attach_queue = selinux_tun_dev_attach_queue,
5820 .tun_dev_attach = selinux_tun_dev_attach,
5821 .tun_dev_open = selinux_tun_dev_open,
5822 .skb_owned_by = selinux_skb_owned_by,
5824 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5825 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
5826 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
5827 .xfrm_policy_free_security = selinux_xfrm_policy_free,
5828 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
5829 .xfrm_state_alloc = selinux_xfrm_state_alloc,
5830 .xfrm_state_alloc_acquire = selinux_xfrm_state_alloc_acquire,
5831 .xfrm_state_free_security = selinux_xfrm_state_free,
5832 .xfrm_state_delete_security = selinux_xfrm_state_delete,
5833 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
5834 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
5835 .xfrm_decode_session = selinux_xfrm_decode_session,
5839 .key_alloc = selinux_key_alloc,
5840 .key_free = selinux_key_free,
5841 .key_permission = selinux_key_permission,
5842 .key_getsecurity = selinux_key_getsecurity,
5846 .audit_rule_init = selinux_audit_rule_init,
5847 .audit_rule_known = selinux_audit_rule_known,
5848 .audit_rule_match = selinux_audit_rule_match,
5849 .audit_rule_free = selinux_audit_rule_free,
5853 static __init int selinux_init(void)
5855 if (!security_module_enable(&selinux_ops)) {
5856 selinux_enabled = 0;
5860 if (!selinux_enabled) {
5861 printk(KERN_INFO "SELinux: Disabled at boot.\n");
5865 printk(KERN_INFO "SELinux: Initializing.\n");
5867 /* Set the security state for the initial task. */
5868 cred_init_security();
5870 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5872 sel_inode_cache = kmem_cache_create("selinux_inode_security",
5873 sizeof(struct inode_security_struct),
5874 0, SLAB_PANIC, NULL);
5877 if (register_security(&selinux_ops))
5878 panic("SELinux: Unable to register with kernel.\n");
5880 if (selinux_enforcing)
5881 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
5883 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
5888 static void delayed_superblock_init(struct super_block *sb, void *unused)
5890 superblock_doinit(sb, NULL);
5893 void selinux_complete_init(void)
5895 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
5897 /* Set up any superblocks initialized prior to the policy load. */
5898 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
5899 iterate_supers(delayed_superblock_init, NULL);
5902 /* SELinux requires early initialization in order to label
5903 all processes and objects when they are created. */
5904 security_initcall(selinux_init);
5906 #if defined(CONFIG_NETFILTER)
5908 static struct nf_hook_ops selinux_ipv4_ops[] = {
5910 .hook = selinux_ipv4_postroute,
5911 .owner = THIS_MODULE,
5913 .hooknum = NF_INET_POST_ROUTING,
5914 .priority = NF_IP_PRI_SELINUX_LAST,
5917 .hook = selinux_ipv4_forward,
5918 .owner = THIS_MODULE,
5920 .hooknum = NF_INET_FORWARD,
5921 .priority = NF_IP_PRI_SELINUX_FIRST,
5924 .hook = selinux_ipv4_output,
5925 .owner = THIS_MODULE,
5927 .hooknum = NF_INET_LOCAL_OUT,
5928 .priority = NF_IP_PRI_SELINUX_FIRST,
5932 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5934 static struct nf_hook_ops selinux_ipv6_ops[] = {
5936 .hook = selinux_ipv6_postroute,
5937 .owner = THIS_MODULE,
5939 .hooknum = NF_INET_POST_ROUTING,
5940 .priority = NF_IP6_PRI_SELINUX_LAST,
5943 .hook = selinux_ipv6_forward,
5944 .owner = THIS_MODULE,
5946 .hooknum = NF_INET_FORWARD,
5947 .priority = NF_IP6_PRI_SELINUX_FIRST,
5953 static int __init selinux_nf_ip_init(void)
5957 if (!selinux_enabled)
5960 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
5962 err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5964 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
5966 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5967 err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5969 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5976 __initcall(selinux_nf_ip_init);
5978 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5979 static void selinux_nf_ip_exit(void)
5981 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
5983 nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5984 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5985 nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5990 #else /* CONFIG_NETFILTER */
5992 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5993 #define selinux_nf_ip_exit()
5996 #endif /* CONFIG_NETFILTER */
5998 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5999 static int selinux_disabled;
6001 int selinux_disable(void)
6003 if (ss_initialized) {
6004 /* Not permitted after initial policy load. */
6008 if (selinux_disabled) {
6009 /* Only do this once. */
6013 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
6015 selinux_disabled = 1;
6016 selinux_enabled = 0;
6018 reset_security_ops();
6020 /* Try to destroy the avc node cache */
6023 /* Unregister netfilter hooks. */
6024 selinux_nf_ip_exit();
6026 /* Unregister selinuxfs. */