1 // SPDX-License-Identifier: GPL-2.0-only
3 * NSA Security-Enhanced Linux (SELinux) security module
5 * This file contains the SELinux hook function implementations.
7 * Authors: Stephen Smalley, <sds@tycho.nsa.gov>
8 * Chris Vance, <cvance@nai.com>
9 * Wayne Salamon, <wsalamon@nai.com>
10 * James Morris <jmorris@redhat.com>
12 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
13 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
14 * Eric Paris <eparis@redhat.com>
15 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
16 * <dgoeddel@trustedcs.com>
17 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
18 * Paul Moore <paul@paul-moore.com>
19 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
20 * Yuichi Nakamura <ynakam@hitachisoft.jp>
21 * Copyright (C) 2016 Mellanox Technologies
24 #include <linux/init.h>
26 #include <linux/kernel.h>
27 #include <linux/kernel_read_file.h>
28 #include <linux/tracehook.h>
29 #include <linux/errno.h>
30 #include <linux/sched/signal.h>
31 #include <linux/sched/task.h>
32 #include <linux/lsm_hooks.h>
33 #include <linux/xattr.h>
34 #include <linux/capability.h>
35 #include <linux/unistd.h>
37 #include <linux/mman.h>
38 #include <linux/slab.h>
39 #include <linux/pagemap.h>
40 #include <linux/proc_fs.h>
41 #include <linux/swap.h>
42 #include <linux/spinlock.h>
43 #include <linux/syscalls.h>
44 #include <linux/dcache.h>
45 #include <linux/file.h>
46 #include <linux/fdtable.h>
47 #include <linux/namei.h>
48 #include <linux/mount.h>
49 #include <linux/fs_context.h>
50 #include <linux/fs_parser.h>
51 #include <linux/netfilter_ipv4.h>
52 #include <linux/netfilter_ipv6.h>
53 #include <linux/tty.h>
55 #include <net/ip.h> /* for local_port_range[] */
56 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
57 #include <net/inet_connection_sock.h>
58 #include <net/net_namespace.h>
59 #include <net/netlabel.h>
60 #include <linux/uaccess.h>
61 #include <asm/ioctls.h>
62 #include <linux/atomic.h>
63 #include <linux/bitops.h>
64 #include <linux/interrupt.h>
65 #include <linux/netdevice.h> /* for network interface checks */
66 #include <net/netlink.h>
67 #include <linux/tcp.h>
68 #include <linux/udp.h>
69 #include <linux/dccp.h>
70 #include <linux/sctp.h>
71 #include <net/sctp/structs.h>
72 #include <linux/quota.h>
73 #include <linux/un.h> /* for Unix socket types */
74 #include <net/af_unix.h> /* for Unix socket types */
75 #include <linux/parser.h>
76 #include <linux/nfs_mount.h>
78 #include <linux/hugetlb.h>
79 #include <linux/personality.h>
80 #include <linux/audit.h>
81 #include <linux/string.h>
82 #include <linux/mutex.h>
83 #include <linux/posix-timers.h>
84 #include <linux/syslog.h>
85 #include <linux/user_namespace.h>
86 #include <linux/export.h>
87 #include <linux/msg.h>
88 #include <linux/shm.h>
89 #include <linux/bpf.h>
90 #include <linux/kernfs.h>
91 #include <linux/stringhash.h> /* for hashlen_string() */
92 #include <uapi/linux/mount.h>
93 #include <linux/fsnotify.h>
94 #include <linux/fanotify.h>
103 #include "netlabel.h"
107 struct selinux_state selinux_state;
109 /* SECMARK reference count */
110 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
112 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
113 static int selinux_enforcing_boot __initdata;
115 static int __init enforcing_setup(char *str)
117 unsigned long enforcing;
118 if (!kstrtoul(str, 0, &enforcing))
119 selinux_enforcing_boot = enforcing ? 1 : 0;
122 __setup("enforcing=", enforcing_setup);
124 #define selinux_enforcing_boot 1
127 int selinux_enabled_boot __initdata = 1;
128 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
129 static int __init selinux_enabled_setup(char *str)
131 unsigned long enabled;
132 if (!kstrtoul(str, 0, &enabled))
133 selinux_enabled_boot = enabled ? 1 : 0;
136 __setup("selinux=", selinux_enabled_setup);
139 static unsigned int selinux_checkreqprot_boot =
140 CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
142 static int __init checkreqprot_setup(char *str)
144 unsigned long checkreqprot;
146 if (!kstrtoul(str, 0, &checkreqprot)) {
147 selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
149 pr_warn("SELinux: checkreqprot set to 1 via kernel parameter. This is deprecated and will be rejected in a future kernel release.\n");
153 __setup("checkreqprot=", checkreqprot_setup);
156 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
159 * This function checks the SECMARK reference counter to see if any SECMARK
160 * targets are currently configured, if the reference counter is greater than
161 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
162 * enabled, false (0) if SECMARK is disabled. If the always_check_network
163 * policy capability is enabled, SECMARK is always considered enabled.
166 static int selinux_secmark_enabled(void)
168 return (selinux_policycap_alwaysnetwork() ||
169 atomic_read(&selinux_secmark_refcount));
173 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
176 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
177 * (1) if any are enabled or false (0) if neither are enabled. If the
178 * always_check_network policy capability is enabled, peer labeling
179 * is always considered enabled.
182 static int selinux_peerlbl_enabled(void)
184 return (selinux_policycap_alwaysnetwork() ||
185 netlbl_enabled() || selinux_xfrm_enabled());
188 static int selinux_netcache_avc_callback(u32 event)
190 if (event == AVC_CALLBACK_RESET) {
199 static int selinux_lsm_notifier_avc_callback(u32 event)
201 if (event == AVC_CALLBACK_RESET) {
203 call_blocking_lsm_notifier(LSM_POLICY_CHANGE, NULL);
210 * initialise the security for the init task
212 static void cred_init_security(void)
214 struct cred *cred = (struct cred *) current->real_cred;
215 struct task_security_struct *tsec;
217 tsec = selinux_cred(cred);
218 tsec->osid = tsec->sid = SECINITSID_KERNEL;
222 * get the security ID of a set of credentials
224 static inline u32 cred_sid(const struct cred *cred)
226 const struct task_security_struct *tsec;
228 tsec = selinux_cred(cred);
233 * get the subjective security ID of a task
235 static inline u32 task_sid_subj(const struct task_struct *task)
240 sid = cred_sid(rcu_dereference(task->cred));
246 * get the objective security ID of a task
248 static inline u32 task_sid_obj(const struct task_struct *task)
253 sid = cred_sid(__task_cred(task));
259 * get the security ID of a task for use with binder
261 static inline u32 task_sid_binder(const struct task_struct *task)
264 * In many case where this function is used we should be using the
265 * task's subjective SID, but we can't reliably access the subjective
266 * creds of a task other than our own so we must use the objective
267 * creds/SID, which are safe to access. The downside is that if a task
268 * is temporarily overriding it's creds it will not be reflected here;
269 * however, it isn't clear that binder would handle that case well
272 * If this ever changes and we can safely reference the subjective
273 * creds/SID of another task, this function will make it easier to
274 * identify the various places where we make use of the task SIDs in
275 * the binder code. It is also likely that we will need to adjust
276 * the main drivers/android binder code as well.
278 return task_sid_obj(task);
281 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
284 * Try reloading inode security labels that have been marked as invalid. The
285 * @may_sleep parameter indicates when sleeping and thus reloading labels is
286 * allowed; when set to false, returns -ECHILD when the label is
287 * invalid. The @dentry parameter should be set to a dentry of the inode.
289 static int __inode_security_revalidate(struct inode *inode,
290 struct dentry *dentry,
293 struct inode_security_struct *isec = selinux_inode(inode);
295 might_sleep_if(may_sleep);
297 if (selinux_initialized(&selinux_state) &&
298 isec->initialized != LABEL_INITIALIZED) {
303 * Try reloading the inode security label. This will fail if
304 * @opt_dentry is NULL and no dentry for this inode can be
305 * found; in that case, continue using the old label.
307 inode_doinit_with_dentry(inode, dentry);
312 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
314 return selinux_inode(inode);
317 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
321 error = __inode_security_revalidate(inode, NULL, !rcu);
323 return ERR_PTR(error);
324 return selinux_inode(inode);
328 * Get the security label of an inode.
330 static struct inode_security_struct *inode_security(struct inode *inode)
332 __inode_security_revalidate(inode, NULL, true);
333 return selinux_inode(inode);
336 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
338 struct inode *inode = d_backing_inode(dentry);
340 return selinux_inode(inode);
344 * Get the security label of a dentry's backing inode.
346 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
348 struct inode *inode = d_backing_inode(dentry);
350 __inode_security_revalidate(inode, dentry, true);
351 return selinux_inode(inode);
354 static void inode_free_security(struct inode *inode)
356 struct inode_security_struct *isec = selinux_inode(inode);
357 struct superblock_security_struct *sbsec;
361 sbsec = selinux_superblock(inode->i_sb);
363 * As not all inode security structures are in a list, we check for
364 * empty list outside of the lock to make sure that we won't waste
365 * time taking a lock doing nothing.
367 * The list_del_init() function can be safely called more than once.
368 * It should not be possible for this function to be called with
369 * concurrent list_add(), but for better safety against future changes
370 * in the code, we use list_empty_careful() here.
372 if (!list_empty_careful(&isec->list)) {
373 spin_lock(&sbsec->isec_lock);
374 list_del_init(&isec->list);
375 spin_unlock(&sbsec->isec_lock);
379 struct selinux_mnt_opts {
380 const char *fscontext, *context, *rootcontext, *defcontext;
383 static void selinux_free_mnt_opts(void *mnt_opts)
385 struct selinux_mnt_opts *opts = mnt_opts;
386 kfree(opts->fscontext);
387 kfree(opts->context);
388 kfree(opts->rootcontext);
389 kfree(opts->defcontext);
402 #define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg}
412 A(rootcontext, true),
417 static int match_opt_prefix(char *s, int l, char **arg)
421 for (i = 0; i < ARRAY_SIZE(tokens); i++) {
422 size_t len = tokens[i].len;
423 if (len > l || memcmp(s, tokens[i].name, len))
425 if (tokens[i].has_arg) {
426 if (len == l || s[len] != '=')
431 return tokens[i].opt;
436 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
438 static int may_context_mount_sb_relabel(u32 sid,
439 struct superblock_security_struct *sbsec,
440 const struct cred *cred)
442 const struct task_security_struct *tsec = selinux_cred(cred);
445 rc = avc_has_perm(&selinux_state,
446 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
447 FILESYSTEM__RELABELFROM, NULL);
451 rc = avc_has_perm(&selinux_state,
452 tsec->sid, sid, SECCLASS_FILESYSTEM,
453 FILESYSTEM__RELABELTO, NULL);
457 static int may_context_mount_inode_relabel(u32 sid,
458 struct superblock_security_struct *sbsec,
459 const struct cred *cred)
461 const struct task_security_struct *tsec = selinux_cred(cred);
463 rc = avc_has_perm(&selinux_state,
464 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
465 FILESYSTEM__RELABELFROM, NULL);
469 rc = avc_has_perm(&selinux_state,
470 sid, sbsec->sid, SECCLASS_FILESYSTEM,
471 FILESYSTEM__ASSOCIATE, NULL);
475 static int selinux_is_genfs_special_handling(struct super_block *sb)
477 /* Special handling. Genfs but also in-core setxattr handler */
478 return !strcmp(sb->s_type->name, "sysfs") ||
479 !strcmp(sb->s_type->name, "pstore") ||
480 !strcmp(sb->s_type->name, "debugfs") ||
481 !strcmp(sb->s_type->name, "tracefs") ||
482 !strcmp(sb->s_type->name, "rootfs") ||
483 (selinux_policycap_cgroupseclabel() &&
484 (!strcmp(sb->s_type->name, "cgroup") ||
485 !strcmp(sb->s_type->name, "cgroup2")));
488 static int selinux_is_sblabel_mnt(struct super_block *sb)
490 struct superblock_security_struct *sbsec = selinux_superblock(sb);
493 * IMPORTANT: Double-check logic in this function when adding a new
494 * SECURITY_FS_USE_* definition!
496 BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
498 switch (sbsec->behavior) {
499 case SECURITY_FS_USE_XATTR:
500 case SECURITY_FS_USE_TRANS:
501 case SECURITY_FS_USE_TASK:
502 case SECURITY_FS_USE_NATIVE:
505 case SECURITY_FS_USE_GENFS:
506 return selinux_is_genfs_special_handling(sb);
508 /* Never allow relabeling on context mounts */
509 case SECURITY_FS_USE_MNTPOINT:
510 case SECURITY_FS_USE_NONE:
516 static int sb_check_xattr_support(struct super_block *sb)
518 struct superblock_security_struct *sbsec = sb->s_security;
519 struct dentry *root = sb->s_root;
520 struct inode *root_inode = d_backing_inode(root);
525 * Make sure that the xattr handler exists and that no
526 * error other than -ENODATA is returned by getxattr on
527 * the root directory. -ENODATA is ok, as this may be
528 * the first boot of the SELinux kernel before we have
529 * assigned xattr values to the filesystem.
531 if (!(root_inode->i_opflags & IOP_XATTR)) {
532 pr_warn("SELinux: (dev %s, type %s) has no xattr support\n",
533 sb->s_id, sb->s_type->name);
537 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
538 if (rc < 0 && rc != -ENODATA) {
539 if (rc == -EOPNOTSUPP) {
540 pr_warn("SELinux: (dev %s, type %s) has no security xattr handler\n",
541 sb->s_id, sb->s_type->name);
544 pr_warn("SELinux: (dev %s, type %s) getxattr errno %d\n",
545 sb->s_id, sb->s_type->name, -rc);
552 /* No xattr support - try to fallback to genfs if possible. */
553 rc = security_genfs_sid(&selinux_state, sb->s_type->name, "/",
558 pr_warn("SELinux: (dev %s, type %s) falling back to genfs\n",
559 sb->s_id, sb->s_type->name);
560 sbsec->behavior = SECURITY_FS_USE_GENFS;
565 static int sb_finish_set_opts(struct super_block *sb)
567 struct superblock_security_struct *sbsec = selinux_superblock(sb);
568 struct dentry *root = sb->s_root;
569 struct inode *root_inode = d_backing_inode(root);
572 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
573 rc = sb_check_xattr_support(sb);
578 sbsec->flags |= SE_SBINITIALIZED;
581 * Explicitly set or clear SBLABEL_MNT. It's not sufficient to simply
582 * leave the flag untouched because sb_clone_mnt_opts might be handing
583 * us a superblock that needs the flag to be cleared.
585 if (selinux_is_sblabel_mnt(sb))
586 sbsec->flags |= SBLABEL_MNT;
588 sbsec->flags &= ~SBLABEL_MNT;
590 /* Initialize the root inode. */
591 rc = inode_doinit_with_dentry(root_inode, root);
593 /* Initialize any other inodes associated with the superblock, e.g.
594 inodes created prior to initial policy load or inodes created
595 during get_sb by a pseudo filesystem that directly
597 spin_lock(&sbsec->isec_lock);
598 while (!list_empty(&sbsec->isec_head)) {
599 struct inode_security_struct *isec =
600 list_first_entry(&sbsec->isec_head,
601 struct inode_security_struct, list);
602 struct inode *inode = isec->inode;
603 list_del_init(&isec->list);
604 spin_unlock(&sbsec->isec_lock);
605 inode = igrab(inode);
607 if (!IS_PRIVATE(inode))
608 inode_doinit_with_dentry(inode, NULL);
611 spin_lock(&sbsec->isec_lock);
613 spin_unlock(&sbsec->isec_lock);
617 static int bad_option(struct superblock_security_struct *sbsec, char flag,
618 u32 old_sid, u32 new_sid)
620 char mnt_flags = sbsec->flags & SE_MNTMASK;
622 /* check if the old mount command had the same options */
623 if (sbsec->flags & SE_SBINITIALIZED)
624 if (!(sbsec->flags & flag) ||
625 (old_sid != new_sid))
628 /* check if we were passed the same options twice,
629 * aka someone passed context=a,context=b
631 if (!(sbsec->flags & SE_SBINITIALIZED))
632 if (mnt_flags & flag)
637 static int parse_sid(struct super_block *sb, const char *s, u32 *sid)
639 int rc = security_context_str_to_sid(&selinux_state, s,
642 pr_warn("SELinux: security_context_str_to_sid"
643 "(%s) failed for (dev %s, type %s) errno=%d\n",
644 s, sb->s_id, sb->s_type->name, rc);
649 * Allow filesystems with binary mount data to explicitly set mount point
650 * labeling information.
652 static int selinux_set_mnt_opts(struct super_block *sb,
654 unsigned long kern_flags,
655 unsigned long *set_kern_flags)
657 const struct cred *cred = current_cred();
658 struct superblock_security_struct *sbsec = selinux_superblock(sb);
659 struct dentry *root = sb->s_root;
660 struct selinux_mnt_opts *opts = mnt_opts;
661 struct inode_security_struct *root_isec;
662 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
663 u32 defcontext_sid = 0;
666 mutex_lock(&sbsec->lock);
668 if (!selinux_initialized(&selinux_state)) {
670 /* Defer initialization until selinux_complete_init,
671 after the initial policy is loaded and the security
672 server is ready to handle calls. */
676 pr_warn("SELinux: Unable to set superblock options "
677 "before the security server is initialized\n");
680 if (kern_flags && !set_kern_flags) {
681 /* Specifying internal flags without providing a place to
682 * place the results is not allowed */
688 * Binary mount data FS will come through this function twice. Once
689 * from an explicit call and once from the generic calls from the vfs.
690 * Since the generic VFS calls will not contain any security mount data
691 * we need to skip the double mount verification.
693 * This does open a hole in which we will not notice if the first
694 * mount using this sb set explict options and a second mount using
695 * this sb does not set any security options. (The first options
696 * will be used for both mounts)
698 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
702 root_isec = backing_inode_security_novalidate(root);
705 * parse the mount options, check if they are valid sids.
706 * also check if someone is trying to mount the same sb more
707 * than once with different security options.
710 if (opts->fscontext) {
711 rc = parse_sid(sb, opts->fscontext, &fscontext_sid);
714 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
716 goto out_double_mount;
717 sbsec->flags |= FSCONTEXT_MNT;
720 rc = parse_sid(sb, opts->context, &context_sid);
723 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
725 goto out_double_mount;
726 sbsec->flags |= CONTEXT_MNT;
728 if (opts->rootcontext) {
729 rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid);
732 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
734 goto out_double_mount;
735 sbsec->flags |= ROOTCONTEXT_MNT;
737 if (opts->defcontext) {
738 rc = parse_sid(sb, opts->defcontext, &defcontext_sid);
741 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
743 goto out_double_mount;
744 sbsec->flags |= DEFCONTEXT_MNT;
748 if (sbsec->flags & SE_SBINITIALIZED) {
749 /* previously mounted with options, but not on this attempt? */
750 if ((sbsec->flags & SE_MNTMASK) && !opts)
751 goto out_double_mount;
756 if (strcmp(sb->s_type->name, "proc") == 0)
757 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
759 if (!strcmp(sb->s_type->name, "debugfs") ||
760 !strcmp(sb->s_type->name, "tracefs") ||
761 !strcmp(sb->s_type->name, "binder") ||
762 !strcmp(sb->s_type->name, "bpf") ||
763 !strcmp(sb->s_type->name, "pstore"))
764 sbsec->flags |= SE_SBGENFS;
766 if (!strcmp(sb->s_type->name, "sysfs") ||
767 !strcmp(sb->s_type->name, "cgroup") ||
768 !strcmp(sb->s_type->name, "cgroup2"))
769 sbsec->flags |= SE_SBGENFS | SE_SBGENFS_XATTR;
771 if (!sbsec->behavior) {
773 * Determine the labeling behavior to use for this
776 rc = security_fs_use(&selinux_state, sb);
778 pr_warn("%s: security_fs_use(%s) returned %d\n",
779 __func__, sb->s_type->name, rc);
785 * If this is a user namespace mount and the filesystem type is not
786 * explicitly whitelisted, then no contexts are allowed on the command
787 * line and security labels must be ignored.
789 if (sb->s_user_ns != &init_user_ns &&
790 strcmp(sb->s_type->name, "tmpfs") &&
791 strcmp(sb->s_type->name, "ramfs") &&
792 strcmp(sb->s_type->name, "devpts") &&
793 strcmp(sb->s_type->name, "overlay")) {
794 if (context_sid || fscontext_sid || rootcontext_sid ||
799 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
800 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
801 rc = security_transition_sid(&selinux_state,
805 &sbsec->mntpoint_sid);
812 /* sets the context of the superblock for the fs being mounted. */
814 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
818 sbsec->sid = fscontext_sid;
822 * Switch to using mount point labeling behavior.
823 * sets the label used on all file below the mountpoint, and will set
824 * the superblock context if not already set.
826 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
827 sbsec->behavior = SECURITY_FS_USE_NATIVE;
828 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
832 if (!fscontext_sid) {
833 rc = may_context_mount_sb_relabel(context_sid, sbsec,
837 sbsec->sid = context_sid;
839 rc = may_context_mount_inode_relabel(context_sid, sbsec,
844 if (!rootcontext_sid)
845 rootcontext_sid = context_sid;
847 sbsec->mntpoint_sid = context_sid;
848 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
851 if (rootcontext_sid) {
852 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
857 root_isec->sid = rootcontext_sid;
858 root_isec->initialized = LABEL_INITIALIZED;
861 if (defcontext_sid) {
862 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
863 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
865 pr_warn("SELinux: defcontext option is "
866 "invalid for this filesystem type\n");
870 if (defcontext_sid != sbsec->def_sid) {
871 rc = may_context_mount_inode_relabel(defcontext_sid,
877 sbsec->def_sid = defcontext_sid;
881 rc = sb_finish_set_opts(sb);
883 mutex_unlock(&sbsec->lock);
887 pr_warn("SELinux: mount invalid. Same superblock, different "
888 "security settings for (dev %s, type %s)\n", sb->s_id,
893 static int selinux_cmp_sb_context(const struct super_block *oldsb,
894 const struct super_block *newsb)
896 struct superblock_security_struct *old = selinux_superblock(oldsb);
897 struct superblock_security_struct *new = selinux_superblock(newsb);
898 char oldflags = old->flags & SE_MNTMASK;
899 char newflags = new->flags & SE_MNTMASK;
901 if (oldflags != newflags)
903 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
905 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
907 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
909 if (oldflags & ROOTCONTEXT_MNT) {
910 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
911 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
912 if (oldroot->sid != newroot->sid)
917 pr_warn("SELinux: mount invalid. Same superblock, "
918 "different security settings for (dev %s, "
919 "type %s)\n", newsb->s_id, newsb->s_type->name);
923 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
924 struct super_block *newsb,
925 unsigned long kern_flags,
926 unsigned long *set_kern_flags)
929 const struct superblock_security_struct *oldsbsec =
930 selinux_superblock(oldsb);
931 struct superblock_security_struct *newsbsec = selinux_superblock(newsb);
933 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
934 int set_context = (oldsbsec->flags & CONTEXT_MNT);
935 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
938 * if the parent was able to be mounted it clearly had no special lsm
939 * mount options. thus we can safely deal with this superblock later
941 if (!selinux_initialized(&selinux_state))
945 * Specifying internal flags without providing a place to
946 * place the results is not allowed.
948 if (kern_flags && !set_kern_flags)
951 /* how can we clone if the old one wasn't set up?? */
952 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
954 /* if fs is reusing a sb, make sure that the contexts match */
955 if (newsbsec->flags & SE_SBINITIALIZED) {
956 if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
957 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
958 return selinux_cmp_sb_context(oldsb, newsb);
961 mutex_lock(&newsbsec->lock);
963 newsbsec->flags = oldsbsec->flags;
965 newsbsec->sid = oldsbsec->sid;
966 newsbsec->def_sid = oldsbsec->def_sid;
967 newsbsec->behavior = oldsbsec->behavior;
969 if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
970 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
971 rc = security_fs_use(&selinux_state, newsb);
976 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
977 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
978 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
982 u32 sid = oldsbsec->mntpoint_sid;
986 if (!set_rootcontext) {
987 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
990 newsbsec->mntpoint_sid = sid;
992 if (set_rootcontext) {
993 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
994 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
996 newisec->sid = oldisec->sid;
999 sb_finish_set_opts(newsb);
1001 mutex_unlock(&newsbsec->lock);
1005 static int selinux_add_opt(int token, const char *s, void **mnt_opts)
1007 struct selinux_mnt_opts *opts = *mnt_opts;
1009 if (token == Opt_seclabel) /* eaten and completely ignored */
1013 opts = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
1022 if (opts->context || opts->defcontext)
1027 if (opts->fscontext)
1029 opts->fscontext = s;
1031 case Opt_rootcontext:
1032 if (opts->rootcontext)
1034 opts->rootcontext = s;
1036 case Opt_defcontext:
1037 if (opts->context || opts->defcontext)
1039 opts->defcontext = s;
1044 pr_warn(SEL_MOUNT_FAIL_MSG);
1048 static int selinux_add_mnt_opt(const char *option, const char *val, int len,
1051 int token = Opt_error;
1054 for (i = 0; i < ARRAY_SIZE(tokens); i++) {
1055 if (strcmp(option, tokens[i].name) == 0) {
1056 token = tokens[i].opt;
1061 if (token == Opt_error)
1064 if (token != Opt_seclabel) {
1065 val = kmemdup_nul(val, len, GFP_KERNEL);
1071 rc = selinux_add_opt(token, val, mnt_opts);
1080 selinux_free_mnt_opts(*mnt_opts);
1086 static int show_sid(struct seq_file *m, u32 sid)
1088 char *context = NULL;
1092 rc = security_sid_to_context(&selinux_state, sid,
1095 bool has_comma = context && strchr(context, ',');
1100 seq_escape(m, context, "\"\n\\");
1108 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1110 struct superblock_security_struct *sbsec = selinux_superblock(sb);
1113 if (!(sbsec->flags & SE_SBINITIALIZED))
1116 if (!selinux_initialized(&selinux_state))
1119 if (sbsec->flags & FSCONTEXT_MNT) {
1121 seq_puts(m, FSCONTEXT_STR);
1122 rc = show_sid(m, sbsec->sid);
1126 if (sbsec->flags & CONTEXT_MNT) {
1128 seq_puts(m, CONTEXT_STR);
1129 rc = show_sid(m, sbsec->mntpoint_sid);
1133 if (sbsec->flags & DEFCONTEXT_MNT) {
1135 seq_puts(m, DEFCONTEXT_STR);
1136 rc = show_sid(m, sbsec->def_sid);
1140 if (sbsec->flags & ROOTCONTEXT_MNT) {
1141 struct dentry *root = sb->s_root;
1142 struct inode_security_struct *isec = backing_inode_security(root);
1144 seq_puts(m, ROOTCONTEXT_STR);
1145 rc = show_sid(m, isec->sid);
1149 if (sbsec->flags & SBLABEL_MNT) {
1151 seq_puts(m, SECLABEL_STR);
1156 static inline u16 inode_mode_to_security_class(umode_t mode)
1158 switch (mode & S_IFMT) {
1160 return SECCLASS_SOCK_FILE;
1162 return SECCLASS_LNK_FILE;
1164 return SECCLASS_FILE;
1166 return SECCLASS_BLK_FILE;
1168 return SECCLASS_DIR;
1170 return SECCLASS_CHR_FILE;
1172 return SECCLASS_FIFO_FILE;
1176 return SECCLASS_FILE;
1179 static inline int default_protocol_stream(int protocol)
1181 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP ||
1182 protocol == IPPROTO_MPTCP);
1185 static inline int default_protocol_dgram(int protocol)
1187 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1190 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1192 int extsockclass = selinux_policycap_extsockclass();
1198 case SOCK_SEQPACKET:
1199 return SECCLASS_UNIX_STREAM_SOCKET;
1202 return SECCLASS_UNIX_DGRAM_SOCKET;
1209 case SOCK_SEQPACKET:
1210 if (default_protocol_stream(protocol))
1211 return SECCLASS_TCP_SOCKET;
1212 else if (extsockclass && protocol == IPPROTO_SCTP)
1213 return SECCLASS_SCTP_SOCKET;
1215 return SECCLASS_RAWIP_SOCKET;
1217 if (default_protocol_dgram(protocol))
1218 return SECCLASS_UDP_SOCKET;
1219 else if (extsockclass && (protocol == IPPROTO_ICMP ||
1220 protocol == IPPROTO_ICMPV6))
1221 return SECCLASS_ICMP_SOCKET;
1223 return SECCLASS_RAWIP_SOCKET;
1225 return SECCLASS_DCCP_SOCKET;
1227 return SECCLASS_RAWIP_SOCKET;
1233 return SECCLASS_NETLINK_ROUTE_SOCKET;
1234 case NETLINK_SOCK_DIAG:
1235 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1237 return SECCLASS_NETLINK_NFLOG_SOCKET;
1239 return SECCLASS_NETLINK_XFRM_SOCKET;
1240 case NETLINK_SELINUX:
1241 return SECCLASS_NETLINK_SELINUX_SOCKET;
1243 return SECCLASS_NETLINK_ISCSI_SOCKET;
1245 return SECCLASS_NETLINK_AUDIT_SOCKET;
1246 case NETLINK_FIB_LOOKUP:
1247 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1248 case NETLINK_CONNECTOR:
1249 return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1250 case NETLINK_NETFILTER:
1251 return SECCLASS_NETLINK_NETFILTER_SOCKET;
1252 case NETLINK_DNRTMSG:
1253 return SECCLASS_NETLINK_DNRT_SOCKET;
1254 case NETLINK_KOBJECT_UEVENT:
1255 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1256 case NETLINK_GENERIC:
1257 return SECCLASS_NETLINK_GENERIC_SOCKET;
1258 case NETLINK_SCSITRANSPORT:
1259 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1261 return SECCLASS_NETLINK_RDMA_SOCKET;
1262 case NETLINK_CRYPTO:
1263 return SECCLASS_NETLINK_CRYPTO_SOCKET;
1265 return SECCLASS_NETLINK_SOCKET;
1268 return SECCLASS_PACKET_SOCKET;
1270 return SECCLASS_KEY_SOCKET;
1272 return SECCLASS_APPLETALK_SOCKET;
1278 return SECCLASS_AX25_SOCKET;
1280 return SECCLASS_IPX_SOCKET;
1282 return SECCLASS_NETROM_SOCKET;
1284 return SECCLASS_ATMPVC_SOCKET;
1286 return SECCLASS_X25_SOCKET;
1288 return SECCLASS_ROSE_SOCKET;
1290 return SECCLASS_DECNET_SOCKET;
1292 return SECCLASS_ATMSVC_SOCKET;
1294 return SECCLASS_RDS_SOCKET;
1296 return SECCLASS_IRDA_SOCKET;
1298 return SECCLASS_PPPOX_SOCKET;
1300 return SECCLASS_LLC_SOCKET;
1302 return SECCLASS_CAN_SOCKET;
1304 return SECCLASS_TIPC_SOCKET;
1306 return SECCLASS_BLUETOOTH_SOCKET;
1308 return SECCLASS_IUCV_SOCKET;
1310 return SECCLASS_RXRPC_SOCKET;
1312 return SECCLASS_ISDN_SOCKET;
1314 return SECCLASS_PHONET_SOCKET;
1316 return SECCLASS_IEEE802154_SOCKET;
1318 return SECCLASS_CAIF_SOCKET;
1320 return SECCLASS_ALG_SOCKET;
1322 return SECCLASS_NFC_SOCKET;
1324 return SECCLASS_VSOCK_SOCKET;
1326 return SECCLASS_KCM_SOCKET;
1328 return SECCLASS_QIPCRTR_SOCKET;
1330 return SECCLASS_SMC_SOCKET;
1332 return SECCLASS_XDP_SOCKET;
1334 #error New address family defined, please update this function.
1339 return SECCLASS_SOCKET;
1342 static int selinux_genfs_get_sid(struct dentry *dentry,
1348 struct super_block *sb = dentry->d_sb;
1349 char *buffer, *path;
1351 buffer = (char *)__get_free_page(GFP_KERNEL);
1355 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1359 if (flags & SE_SBPROC) {
1360 /* each process gets a /proc/PID/ entry. Strip off the
1361 * PID part to get a valid selinux labeling.
1362 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1363 while (path[1] >= '0' && path[1] <= '9') {
1368 rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1370 if (rc == -ENOENT) {
1371 /* No match in policy, mark as unlabeled. */
1372 *sid = SECINITSID_UNLABELED;
1376 free_page((unsigned long)buffer);
1380 static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry,
1381 u32 def_sid, u32 *sid)
1383 #define INITCONTEXTLEN 255
1388 len = INITCONTEXTLEN;
1389 context = kmalloc(len + 1, GFP_NOFS);
1393 context[len] = '\0';
1394 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1395 if (rc == -ERANGE) {
1398 /* Need a larger buffer. Query for the right size. */
1399 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1404 context = kmalloc(len + 1, GFP_NOFS);
1408 context[len] = '\0';
1409 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX,
1414 if (rc != -ENODATA) {
1415 pr_warn("SELinux: %s: getxattr returned %d for dev=%s ino=%ld\n",
1416 __func__, -rc, inode->i_sb->s_id, inode->i_ino);
1423 rc = security_context_to_sid_default(&selinux_state, context, rc, sid,
1426 char *dev = inode->i_sb->s_id;
1427 unsigned long ino = inode->i_ino;
1429 if (rc == -EINVAL) {
1430 pr_notice_ratelimited("SELinux: inode=%lu on dev=%s was found to have an invalid context=%s. This indicates you may need to relabel the inode or the filesystem in question.\n",
1433 pr_warn("SELinux: %s: context_to_sid(%s) returned %d for dev=%s ino=%ld\n",
1434 __func__, context, -rc, dev, ino);
1441 /* The inode's security attributes must be initialized before first use. */
1442 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1444 struct superblock_security_struct *sbsec = NULL;
1445 struct inode_security_struct *isec = selinux_inode(inode);
1446 u32 task_sid, sid = 0;
1448 struct dentry *dentry;
1451 if (isec->initialized == LABEL_INITIALIZED)
1454 spin_lock(&isec->lock);
1455 if (isec->initialized == LABEL_INITIALIZED)
1458 if (isec->sclass == SECCLASS_FILE)
1459 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1461 sbsec = selinux_superblock(inode->i_sb);
1462 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1463 /* Defer initialization until selinux_complete_init,
1464 after the initial policy is loaded and the security
1465 server is ready to handle calls. */
1466 spin_lock(&sbsec->isec_lock);
1467 if (list_empty(&isec->list))
1468 list_add(&isec->list, &sbsec->isec_head);
1469 spin_unlock(&sbsec->isec_lock);
1473 sclass = isec->sclass;
1474 task_sid = isec->task_sid;
1476 isec->initialized = LABEL_PENDING;
1477 spin_unlock(&isec->lock);
1479 switch (sbsec->behavior) {
1480 case SECURITY_FS_USE_NATIVE:
1482 case SECURITY_FS_USE_XATTR:
1483 if (!(inode->i_opflags & IOP_XATTR)) {
1484 sid = sbsec->def_sid;
1487 /* Need a dentry, since the xattr API requires one.
1488 Life would be simpler if we could just pass the inode. */
1490 /* Called from d_instantiate or d_splice_alias. */
1491 dentry = dget(opt_dentry);
1494 * Called from selinux_complete_init, try to find a dentry.
1495 * Some filesystems really want a connected one, so try
1496 * that first. We could split SECURITY_FS_USE_XATTR in
1497 * two, depending upon that...
1499 dentry = d_find_alias(inode);
1501 dentry = d_find_any_alias(inode);
1505 * this is can be hit on boot when a file is accessed
1506 * before the policy is loaded. When we load policy we
1507 * may find inodes that have no dentry on the
1508 * sbsec->isec_head list. No reason to complain as these
1509 * will get fixed up the next time we go through
1510 * inode_doinit with a dentry, before these inodes could
1511 * be used again by userspace.
1516 rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
1522 case SECURITY_FS_USE_TASK:
1525 case SECURITY_FS_USE_TRANS:
1526 /* Default to the fs SID. */
1529 /* Try to obtain a transition SID. */
1530 rc = security_transition_sid(&selinux_state, task_sid, sid,
1531 sclass, NULL, &sid);
1535 case SECURITY_FS_USE_MNTPOINT:
1536 sid = sbsec->mntpoint_sid;
1539 /* Default to the fs superblock SID. */
1542 if ((sbsec->flags & SE_SBGENFS) &&
1543 (!S_ISLNK(inode->i_mode) ||
1544 selinux_policycap_genfs_seclabel_symlinks())) {
1545 /* We must have a dentry to determine the label on
1548 /* Called from d_instantiate or
1549 * d_splice_alias. */
1550 dentry = dget(opt_dentry);
1552 /* Called from selinux_complete_init, try to
1553 * find a dentry. Some filesystems really want
1554 * a connected one, so try that first.
1556 dentry = d_find_alias(inode);
1558 dentry = d_find_any_alias(inode);
1561 * This can be hit on boot when a file is accessed
1562 * before the policy is loaded. When we load policy we
1563 * may find inodes that have no dentry on the
1564 * sbsec->isec_head list. No reason to complain as
1565 * these will get fixed up the next time we go through
1566 * inode_doinit() with a dentry, before these inodes
1567 * could be used again by userspace.
1571 rc = selinux_genfs_get_sid(dentry, sclass,
1572 sbsec->flags, &sid);
1578 if ((sbsec->flags & SE_SBGENFS_XATTR) &&
1579 (inode->i_opflags & IOP_XATTR)) {
1580 rc = inode_doinit_use_xattr(inode, dentry,
1593 spin_lock(&isec->lock);
1594 if (isec->initialized == LABEL_PENDING) {
1596 isec->initialized = LABEL_INVALID;
1599 isec->initialized = LABEL_INITIALIZED;
1604 spin_unlock(&isec->lock);
1608 spin_lock(&isec->lock);
1609 if (isec->initialized == LABEL_PENDING) {
1610 isec->initialized = LABEL_INVALID;
1613 spin_unlock(&isec->lock);
1617 /* Convert a Linux signal to an access vector. */
1618 static inline u32 signal_to_av(int sig)
1624 /* Commonly granted from child to parent. */
1625 perm = PROCESS__SIGCHLD;
1628 /* Cannot be caught or ignored */
1629 perm = PROCESS__SIGKILL;
1632 /* Cannot be caught or ignored */
1633 perm = PROCESS__SIGSTOP;
1636 /* All other signals. */
1637 perm = PROCESS__SIGNAL;
1644 #if CAP_LAST_CAP > 63
1645 #error Fix SELinux to handle capabilities > 63.
1648 /* Check whether a task is allowed to use a capability. */
1649 static int cred_has_capability(const struct cred *cred,
1650 int cap, unsigned int opts, bool initns)
1652 struct common_audit_data ad;
1653 struct av_decision avd;
1655 u32 sid = cred_sid(cred);
1656 u32 av = CAP_TO_MASK(cap);
1659 ad.type = LSM_AUDIT_DATA_CAP;
1662 switch (CAP_TO_INDEX(cap)) {
1664 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1667 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1670 pr_err("SELinux: out of range capability %d\n", cap);
1675 rc = avc_has_perm_noaudit(&selinux_state,
1676 sid, sid, sclass, av, 0, &avd);
1677 if (!(opts & CAP_OPT_NOAUDIT)) {
1678 int rc2 = avc_audit(&selinux_state,
1679 sid, sid, sclass, av, &avd, rc, &ad);
1686 /* Check whether a task has a particular permission to an inode.
1687 The 'adp' parameter is optional and allows other audit
1688 data to be passed (e.g. the dentry). */
1689 static int inode_has_perm(const struct cred *cred,
1690 struct inode *inode,
1692 struct common_audit_data *adp)
1694 struct inode_security_struct *isec;
1697 validate_creds(cred);
1699 if (unlikely(IS_PRIVATE(inode)))
1702 sid = cred_sid(cred);
1703 isec = selinux_inode(inode);
1705 return avc_has_perm(&selinux_state,
1706 sid, isec->sid, isec->sclass, perms, adp);
1709 /* Same as inode_has_perm, but pass explicit audit data containing
1710 the dentry to help the auditing code to more easily generate the
1711 pathname if needed. */
1712 static inline int dentry_has_perm(const struct cred *cred,
1713 struct dentry *dentry,
1716 struct inode *inode = d_backing_inode(dentry);
1717 struct common_audit_data ad;
1719 ad.type = LSM_AUDIT_DATA_DENTRY;
1720 ad.u.dentry = dentry;
1721 __inode_security_revalidate(inode, dentry, true);
1722 return inode_has_perm(cred, inode, av, &ad);
1725 /* Same as inode_has_perm, but pass explicit audit data containing
1726 the path to help the auditing code to more easily generate the
1727 pathname if needed. */
1728 static inline int path_has_perm(const struct cred *cred,
1729 const struct path *path,
1732 struct inode *inode = d_backing_inode(path->dentry);
1733 struct common_audit_data ad;
1735 ad.type = LSM_AUDIT_DATA_PATH;
1737 __inode_security_revalidate(inode, path->dentry, true);
1738 return inode_has_perm(cred, inode, av, &ad);
1741 /* Same as path_has_perm, but uses the inode from the file struct. */
1742 static inline int file_path_has_perm(const struct cred *cred,
1746 struct common_audit_data ad;
1748 ad.type = LSM_AUDIT_DATA_FILE;
1750 return inode_has_perm(cred, file_inode(file), av, &ad);
1753 #ifdef CONFIG_BPF_SYSCALL
1754 static int bpf_fd_pass(struct file *file, u32 sid);
1757 /* Check whether a task can use an open file descriptor to
1758 access an inode in a given way. Check access to the
1759 descriptor itself, and then use dentry_has_perm to
1760 check a particular permission to the file.
1761 Access to the descriptor is implicitly granted if it
1762 has the same SID as the process. If av is zero, then
1763 access to the file is not checked, e.g. for cases
1764 where only the descriptor is affected like seek. */
1765 static int file_has_perm(const struct cred *cred,
1769 struct file_security_struct *fsec = selinux_file(file);
1770 struct inode *inode = file_inode(file);
1771 struct common_audit_data ad;
1772 u32 sid = cred_sid(cred);
1775 ad.type = LSM_AUDIT_DATA_FILE;
1778 if (sid != fsec->sid) {
1779 rc = avc_has_perm(&selinux_state,
1788 #ifdef CONFIG_BPF_SYSCALL
1789 rc = bpf_fd_pass(file, cred_sid(cred));
1794 /* av is zero if only checking access to the descriptor. */
1797 rc = inode_has_perm(cred, inode, av, &ad);
1804 * Determine the label for an inode that might be unioned.
1807 selinux_determine_inode_label(const struct task_security_struct *tsec,
1809 const struct qstr *name, u16 tclass,
1812 const struct superblock_security_struct *sbsec =
1813 selinux_superblock(dir->i_sb);
1815 if ((sbsec->flags & SE_SBINITIALIZED) &&
1816 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1817 *_new_isid = sbsec->mntpoint_sid;
1818 } else if ((sbsec->flags & SBLABEL_MNT) &&
1820 *_new_isid = tsec->create_sid;
1822 const struct inode_security_struct *dsec = inode_security(dir);
1823 return security_transition_sid(&selinux_state, tsec->sid,
1831 /* Check whether a task can create a file. */
1832 static int may_create(struct inode *dir,
1833 struct dentry *dentry,
1836 const struct task_security_struct *tsec = selinux_cred(current_cred());
1837 struct inode_security_struct *dsec;
1838 struct superblock_security_struct *sbsec;
1840 struct common_audit_data ad;
1843 dsec = inode_security(dir);
1844 sbsec = selinux_superblock(dir->i_sb);
1848 ad.type = LSM_AUDIT_DATA_DENTRY;
1849 ad.u.dentry = dentry;
1851 rc = avc_has_perm(&selinux_state,
1852 sid, dsec->sid, SECCLASS_DIR,
1853 DIR__ADD_NAME | DIR__SEARCH,
1858 rc = selinux_determine_inode_label(tsec, dir, &dentry->d_name, tclass,
1863 rc = avc_has_perm(&selinux_state,
1864 sid, newsid, tclass, FILE__CREATE, &ad);
1868 return avc_has_perm(&selinux_state,
1870 SECCLASS_FILESYSTEM,
1871 FILESYSTEM__ASSOCIATE, &ad);
1875 #define MAY_UNLINK 1
1878 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1879 static int may_link(struct inode *dir,
1880 struct dentry *dentry,
1884 struct inode_security_struct *dsec, *isec;
1885 struct common_audit_data ad;
1886 u32 sid = current_sid();
1890 dsec = inode_security(dir);
1891 isec = backing_inode_security(dentry);
1893 ad.type = LSM_AUDIT_DATA_DENTRY;
1894 ad.u.dentry = dentry;
1897 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1898 rc = avc_has_perm(&selinux_state,
1899 sid, dsec->sid, SECCLASS_DIR, av, &ad);
1914 pr_warn("SELinux: %s: unrecognized kind %d\n",
1919 rc = avc_has_perm(&selinux_state,
1920 sid, isec->sid, isec->sclass, av, &ad);
1924 static inline int may_rename(struct inode *old_dir,
1925 struct dentry *old_dentry,
1926 struct inode *new_dir,
1927 struct dentry *new_dentry)
1929 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1930 struct common_audit_data ad;
1931 u32 sid = current_sid();
1933 int old_is_dir, new_is_dir;
1936 old_dsec = inode_security(old_dir);
1937 old_isec = backing_inode_security(old_dentry);
1938 old_is_dir = d_is_dir(old_dentry);
1939 new_dsec = inode_security(new_dir);
1941 ad.type = LSM_AUDIT_DATA_DENTRY;
1943 ad.u.dentry = old_dentry;
1944 rc = avc_has_perm(&selinux_state,
1945 sid, old_dsec->sid, SECCLASS_DIR,
1946 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1949 rc = avc_has_perm(&selinux_state,
1951 old_isec->sclass, FILE__RENAME, &ad);
1954 if (old_is_dir && new_dir != old_dir) {
1955 rc = avc_has_perm(&selinux_state,
1957 old_isec->sclass, DIR__REPARENT, &ad);
1962 ad.u.dentry = new_dentry;
1963 av = DIR__ADD_NAME | DIR__SEARCH;
1964 if (d_is_positive(new_dentry))
1965 av |= DIR__REMOVE_NAME;
1966 rc = avc_has_perm(&selinux_state,
1967 sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1970 if (d_is_positive(new_dentry)) {
1971 new_isec = backing_inode_security(new_dentry);
1972 new_is_dir = d_is_dir(new_dentry);
1973 rc = avc_has_perm(&selinux_state,
1976 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1984 /* Check whether a task can perform a filesystem operation. */
1985 static int superblock_has_perm(const struct cred *cred,
1986 struct super_block *sb,
1988 struct common_audit_data *ad)
1990 struct superblock_security_struct *sbsec;
1991 u32 sid = cred_sid(cred);
1993 sbsec = selinux_superblock(sb);
1994 return avc_has_perm(&selinux_state,
1995 sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1998 /* Convert a Linux mode and permission mask to an access vector. */
1999 static inline u32 file_mask_to_av(int mode, int mask)
2003 if (!S_ISDIR(mode)) {
2004 if (mask & MAY_EXEC)
2005 av |= FILE__EXECUTE;
2006 if (mask & MAY_READ)
2009 if (mask & MAY_APPEND)
2011 else if (mask & MAY_WRITE)
2015 if (mask & MAY_EXEC)
2017 if (mask & MAY_WRITE)
2019 if (mask & MAY_READ)
2026 /* Convert a Linux file to an access vector. */
2027 static inline u32 file_to_av(struct file *file)
2031 if (file->f_mode & FMODE_READ)
2033 if (file->f_mode & FMODE_WRITE) {
2034 if (file->f_flags & O_APPEND)
2041 * Special file opened with flags 3 for ioctl-only use.
2050 * Convert a file to an access vector and include the correct
2053 static inline u32 open_file_to_av(struct file *file)
2055 u32 av = file_to_av(file);
2056 struct inode *inode = file_inode(file);
2058 if (selinux_policycap_openperm() &&
2059 inode->i_sb->s_magic != SOCKFS_MAGIC)
2065 /* Hook functions begin here. */
2067 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2069 return avc_has_perm(&selinux_state,
2070 current_sid(), task_sid_binder(mgr), SECCLASS_BINDER,
2071 BINDER__SET_CONTEXT_MGR, NULL);
2074 static int selinux_binder_transaction(struct task_struct *from,
2075 struct task_struct *to)
2077 u32 mysid = current_sid();
2078 u32 fromsid = task_sid_binder(from);
2081 if (mysid != fromsid) {
2082 rc = avc_has_perm(&selinux_state,
2083 mysid, fromsid, SECCLASS_BINDER,
2084 BINDER__IMPERSONATE, NULL);
2089 return avc_has_perm(&selinux_state, fromsid, task_sid_binder(to),
2090 SECCLASS_BINDER, BINDER__CALL, NULL);
2093 static int selinux_binder_transfer_binder(struct task_struct *from,
2094 struct task_struct *to)
2096 return avc_has_perm(&selinux_state,
2097 task_sid_binder(from), task_sid_binder(to),
2098 SECCLASS_BINDER, BINDER__TRANSFER,
2102 static int selinux_binder_transfer_file(struct task_struct *from,
2103 struct task_struct *to,
2106 u32 sid = task_sid_binder(to);
2107 struct file_security_struct *fsec = selinux_file(file);
2108 struct dentry *dentry = file->f_path.dentry;
2109 struct inode_security_struct *isec;
2110 struct common_audit_data ad;
2113 ad.type = LSM_AUDIT_DATA_PATH;
2114 ad.u.path = file->f_path;
2116 if (sid != fsec->sid) {
2117 rc = avc_has_perm(&selinux_state,
2126 #ifdef CONFIG_BPF_SYSCALL
2127 rc = bpf_fd_pass(file, sid);
2132 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2135 isec = backing_inode_security(dentry);
2136 return avc_has_perm(&selinux_state,
2137 sid, isec->sid, isec->sclass, file_to_av(file),
2141 static int selinux_ptrace_access_check(struct task_struct *child,
2144 u32 sid = current_sid();
2145 u32 csid = task_sid_obj(child);
2147 if (mode & PTRACE_MODE_READ)
2148 return avc_has_perm(&selinux_state,
2149 sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2151 return avc_has_perm(&selinux_state,
2152 sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2155 static int selinux_ptrace_traceme(struct task_struct *parent)
2157 return avc_has_perm(&selinux_state,
2158 task_sid_subj(parent), task_sid_obj(current),
2159 SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2162 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2163 kernel_cap_t *inheritable, kernel_cap_t *permitted)
2165 return avc_has_perm(&selinux_state,
2166 current_sid(), task_sid_obj(target), SECCLASS_PROCESS,
2167 PROCESS__GETCAP, NULL);
2170 static int selinux_capset(struct cred *new, const struct cred *old,
2171 const kernel_cap_t *effective,
2172 const kernel_cap_t *inheritable,
2173 const kernel_cap_t *permitted)
2175 return avc_has_perm(&selinux_state,
2176 cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2177 PROCESS__SETCAP, NULL);
2181 * (This comment used to live with the selinux_task_setuid hook,
2182 * which was removed).
2184 * Since setuid only affects the current process, and since the SELinux
2185 * controls are not based on the Linux identity attributes, SELinux does not
2186 * need to control this operation. However, SELinux does control the use of
2187 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2190 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2191 int cap, unsigned int opts)
2193 return cred_has_capability(cred, cap, opts, ns == &init_user_ns);
2196 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2198 const struct cred *cred = current_cred();
2213 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2221 case Q_XGETNEXTQUOTA:
2222 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2225 rc = 0; /* let the kernel handle invalid cmds */
2231 static int selinux_quota_on(struct dentry *dentry)
2233 const struct cred *cred = current_cred();
2235 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2238 static int selinux_syslog(int type)
2241 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2242 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2243 return avc_has_perm(&selinux_state,
2244 current_sid(), SECINITSID_KERNEL,
2245 SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2246 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2247 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2248 /* Set level of messages printed to console */
2249 case SYSLOG_ACTION_CONSOLE_LEVEL:
2250 return avc_has_perm(&selinux_state,
2251 current_sid(), SECINITSID_KERNEL,
2252 SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2255 /* All other syslog types */
2256 return avc_has_perm(&selinux_state,
2257 current_sid(), SECINITSID_KERNEL,
2258 SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2262 * Check that a process has enough memory to allocate a new virtual
2263 * mapping. 0 means there is enough memory for the allocation to
2264 * succeed and -ENOMEM implies there is not.
2266 * Do not audit the selinux permission check, as this is applied to all
2267 * processes that allocate mappings.
2269 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2271 int rc, cap_sys_admin = 0;
2273 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2274 CAP_OPT_NOAUDIT, true);
2278 return cap_sys_admin;
2281 /* binprm security operations */
2283 static u32 ptrace_parent_sid(void)
2286 struct task_struct *tracer;
2289 tracer = ptrace_parent(current);
2291 sid = task_sid_obj(tracer);
2297 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2298 const struct task_security_struct *old_tsec,
2299 const struct task_security_struct *new_tsec)
2301 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2302 int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2306 if (!nnp && !nosuid)
2307 return 0; /* neither NNP nor nosuid */
2309 if (new_tsec->sid == old_tsec->sid)
2310 return 0; /* No change in credentials */
2313 * If the policy enables the nnp_nosuid_transition policy capability,
2314 * then we permit transitions under NNP or nosuid if the
2315 * policy allows the corresponding permission between
2316 * the old and new contexts.
2318 if (selinux_policycap_nnp_nosuid_transition()) {
2321 av |= PROCESS2__NNP_TRANSITION;
2323 av |= PROCESS2__NOSUID_TRANSITION;
2324 rc = avc_has_perm(&selinux_state,
2325 old_tsec->sid, new_tsec->sid,
2326 SECCLASS_PROCESS2, av, NULL);
2332 * We also permit NNP or nosuid transitions to bounded SIDs,
2333 * i.e. SIDs that are guaranteed to only be allowed a subset
2334 * of the permissions of the current SID.
2336 rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2342 * On failure, preserve the errno values for NNP vs nosuid.
2343 * NNP: Operation not permitted for caller.
2344 * nosuid: Permission denied to file.
2351 static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
2353 const struct task_security_struct *old_tsec;
2354 struct task_security_struct *new_tsec;
2355 struct inode_security_struct *isec;
2356 struct common_audit_data ad;
2357 struct inode *inode = file_inode(bprm->file);
2360 /* SELinux context only depends on initial program or script and not
2361 * the script interpreter */
2363 old_tsec = selinux_cred(current_cred());
2364 new_tsec = selinux_cred(bprm->cred);
2365 isec = inode_security(inode);
2367 /* Default to the current task SID. */
2368 new_tsec->sid = old_tsec->sid;
2369 new_tsec->osid = old_tsec->sid;
2371 /* Reset fs, key, and sock SIDs on execve. */
2372 new_tsec->create_sid = 0;
2373 new_tsec->keycreate_sid = 0;
2374 new_tsec->sockcreate_sid = 0;
2376 if (old_tsec->exec_sid) {
2377 new_tsec->sid = old_tsec->exec_sid;
2378 /* Reset exec SID on execve. */
2379 new_tsec->exec_sid = 0;
2381 /* Fail on NNP or nosuid if not an allowed transition. */
2382 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2386 /* Check for a default transition on this program. */
2387 rc = security_transition_sid(&selinux_state, old_tsec->sid,
2388 isec->sid, SECCLASS_PROCESS, NULL,
2394 * Fallback to old SID on NNP or nosuid if not an allowed
2397 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2399 new_tsec->sid = old_tsec->sid;
2402 ad.type = LSM_AUDIT_DATA_FILE;
2403 ad.u.file = bprm->file;
2405 if (new_tsec->sid == old_tsec->sid) {
2406 rc = avc_has_perm(&selinux_state,
2407 old_tsec->sid, isec->sid,
2408 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2412 /* Check permissions for the transition. */
2413 rc = avc_has_perm(&selinux_state,
2414 old_tsec->sid, new_tsec->sid,
2415 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2419 rc = avc_has_perm(&selinux_state,
2420 new_tsec->sid, isec->sid,
2421 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2425 /* Check for shared state */
2426 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2427 rc = avc_has_perm(&selinux_state,
2428 old_tsec->sid, new_tsec->sid,
2429 SECCLASS_PROCESS, PROCESS__SHARE,
2435 /* Make sure that anyone attempting to ptrace over a task that
2436 * changes its SID has the appropriate permit */
2437 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2438 u32 ptsid = ptrace_parent_sid();
2440 rc = avc_has_perm(&selinux_state,
2441 ptsid, new_tsec->sid,
2443 PROCESS__PTRACE, NULL);
2449 /* Clear any possibly unsafe personality bits on exec: */
2450 bprm->per_clear |= PER_CLEAR_ON_SETID;
2452 /* Enable secure mode for SIDs transitions unless
2453 the noatsecure permission is granted between
2454 the two SIDs, i.e. ahp returns 0. */
2455 rc = avc_has_perm(&selinux_state,
2456 old_tsec->sid, new_tsec->sid,
2457 SECCLASS_PROCESS, PROCESS__NOATSECURE,
2459 bprm->secureexec |= !!rc;
2465 static int match_file(const void *p, struct file *file, unsigned fd)
2467 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2470 /* Derived from fs/exec.c:flush_old_files. */
2471 static inline void flush_unauthorized_files(const struct cred *cred,
2472 struct files_struct *files)
2474 struct file *file, *devnull = NULL;
2475 struct tty_struct *tty;
2479 tty = get_current_tty();
2481 spin_lock(&tty->files_lock);
2482 if (!list_empty(&tty->tty_files)) {
2483 struct tty_file_private *file_priv;
2485 /* Revalidate access to controlling tty.
2486 Use file_path_has_perm on the tty path directly
2487 rather than using file_has_perm, as this particular
2488 open file may belong to another process and we are
2489 only interested in the inode-based check here. */
2490 file_priv = list_first_entry(&tty->tty_files,
2491 struct tty_file_private, list);
2492 file = file_priv->file;
2493 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2496 spin_unlock(&tty->files_lock);
2499 /* Reset controlling tty. */
2503 /* Revalidate access to inherited open files. */
2504 n = iterate_fd(files, 0, match_file, cred);
2505 if (!n) /* none found? */
2508 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2509 if (IS_ERR(devnull))
2511 /* replace all the matching ones with this */
2513 replace_fd(n - 1, devnull, 0);
2514 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2520 * Prepare a process for imminent new credential changes due to exec
2522 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2524 struct task_security_struct *new_tsec;
2525 struct rlimit *rlim, *initrlim;
2528 new_tsec = selinux_cred(bprm->cred);
2529 if (new_tsec->sid == new_tsec->osid)
2532 /* Close files for which the new task SID is not authorized. */
2533 flush_unauthorized_files(bprm->cred, current->files);
2535 /* Always clear parent death signal on SID transitions. */
2536 current->pdeath_signal = 0;
2538 /* Check whether the new SID can inherit resource limits from the old
2539 * SID. If not, reset all soft limits to the lower of the current
2540 * task's hard limit and the init task's soft limit.
2542 * Note that the setting of hard limits (even to lower them) can be
2543 * controlled by the setrlimit check. The inclusion of the init task's
2544 * soft limit into the computation is to avoid resetting soft limits
2545 * higher than the default soft limit for cases where the default is
2546 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2548 rc = avc_has_perm(&selinux_state,
2549 new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2550 PROCESS__RLIMITINH, NULL);
2552 /* protect against do_prlimit() */
2554 for (i = 0; i < RLIM_NLIMITS; i++) {
2555 rlim = current->signal->rlim + i;
2556 initrlim = init_task.signal->rlim + i;
2557 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2559 task_unlock(current);
2560 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2561 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2566 * Clean up the process immediately after the installation of new credentials
2569 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2571 const struct task_security_struct *tsec = selinux_cred(current_cred());
2581 /* Check whether the new SID can inherit signal state from the old SID.
2582 * If not, clear itimers to avoid subsequent signal generation and
2583 * flush and unblock signals.
2585 * This must occur _after_ the task SID has been updated so that any
2586 * kill done after the flush will be checked against the new SID.
2588 rc = avc_has_perm(&selinux_state,
2589 osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2593 spin_lock_irq(¤t->sighand->siglock);
2594 if (!fatal_signal_pending(current)) {
2595 flush_sigqueue(¤t->pending);
2596 flush_sigqueue(¤t->signal->shared_pending);
2597 flush_signal_handlers(current, 1);
2598 sigemptyset(¤t->blocked);
2599 recalc_sigpending();
2601 spin_unlock_irq(¤t->sighand->siglock);
2604 /* Wake up the parent if it is waiting so that it can recheck
2605 * wait permission to the new task SID. */
2606 read_lock(&tasklist_lock);
2607 __wake_up_parent(current, current->real_parent);
2608 read_unlock(&tasklist_lock);
2611 /* superblock security operations */
2613 static int selinux_sb_alloc_security(struct super_block *sb)
2615 struct superblock_security_struct *sbsec = selinux_superblock(sb);
2617 mutex_init(&sbsec->lock);
2618 INIT_LIST_HEAD(&sbsec->isec_head);
2619 spin_lock_init(&sbsec->isec_lock);
2620 sbsec->sid = SECINITSID_UNLABELED;
2621 sbsec->def_sid = SECINITSID_FILE;
2622 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
2627 static inline int opt_len(const char *s)
2629 bool open_quote = false;
2633 for (len = 0; (c = s[len]) != '\0'; len++) {
2635 open_quote = !open_quote;
2636 if (c == ',' && !open_quote)
2642 static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
2644 char *from = options;
2650 int len = opt_len(from);
2654 token = match_opt_prefix(from, len, &arg);
2656 if (token != Opt_error) {
2661 for (p = q = arg; p < from + len; p++) {
2666 arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);
2672 rc = selinux_add_opt(token, arg, mnt_opts);
2678 if (!first) { // copy with preceding comma
2683 memmove(to, from, len);
2696 selinux_free_mnt_opts(*mnt_opts);
2702 static int selinux_sb_mnt_opts_compat(struct super_block *sb, void *mnt_opts)
2704 struct selinux_mnt_opts *opts = mnt_opts;
2705 struct superblock_security_struct *sbsec = sb->s_security;
2710 * Superblock not initialized (i.e. no options) - reject if any
2711 * options specified, otherwise accept.
2713 if (!(sbsec->flags & SE_SBINITIALIZED))
2714 return opts ? 1 : 0;
2717 * Superblock initialized and no options specified - reject if
2718 * superblock has any options set, otherwise accept.
2721 return (sbsec->flags & SE_MNTMASK) ? 1 : 0;
2723 if (opts->fscontext) {
2724 rc = parse_sid(sb, opts->fscontext, &sid);
2727 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2730 if (opts->context) {
2731 rc = parse_sid(sb, opts->context, &sid);
2734 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2737 if (opts->rootcontext) {
2738 struct inode_security_struct *root_isec;
2740 root_isec = backing_inode_security(sb->s_root);
2741 rc = parse_sid(sb, opts->rootcontext, &sid);
2744 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2747 if (opts->defcontext) {
2748 rc = parse_sid(sb, opts->defcontext, &sid);
2751 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2757 static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
2759 struct selinux_mnt_opts *opts = mnt_opts;
2760 struct superblock_security_struct *sbsec = selinux_superblock(sb);
2764 if (!(sbsec->flags & SE_SBINITIALIZED))
2770 if (opts->fscontext) {
2771 rc = parse_sid(sb, opts->fscontext, &sid);
2774 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2775 goto out_bad_option;
2777 if (opts->context) {
2778 rc = parse_sid(sb, opts->context, &sid);
2781 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2782 goto out_bad_option;
2784 if (opts->rootcontext) {
2785 struct inode_security_struct *root_isec;
2786 root_isec = backing_inode_security(sb->s_root);
2787 rc = parse_sid(sb, opts->rootcontext, &sid);
2790 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2791 goto out_bad_option;
2793 if (opts->defcontext) {
2794 rc = parse_sid(sb, opts->defcontext, &sid);
2797 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2798 goto out_bad_option;
2803 pr_warn("SELinux: unable to change security options "
2804 "during remount (dev %s, type=%s)\n", sb->s_id,
2809 static int selinux_sb_kern_mount(struct super_block *sb)
2811 const struct cred *cred = current_cred();
2812 struct common_audit_data ad;
2814 ad.type = LSM_AUDIT_DATA_DENTRY;
2815 ad.u.dentry = sb->s_root;
2816 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2819 static int selinux_sb_statfs(struct dentry *dentry)
2821 const struct cred *cred = current_cred();
2822 struct common_audit_data ad;
2824 ad.type = LSM_AUDIT_DATA_DENTRY;
2825 ad.u.dentry = dentry->d_sb->s_root;
2826 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2829 static int selinux_mount(const char *dev_name,
2830 const struct path *path,
2832 unsigned long flags,
2835 const struct cred *cred = current_cred();
2837 if (flags & MS_REMOUNT)
2838 return superblock_has_perm(cred, path->dentry->d_sb,
2839 FILESYSTEM__REMOUNT, NULL);
2841 return path_has_perm(cred, path, FILE__MOUNTON);
2844 static int selinux_move_mount(const struct path *from_path,
2845 const struct path *to_path)
2847 const struct cred *cred = current_cred();
2849 return path_has_perm(cred, to_path, FILE__MOUNTON);
2852 static int selinux_umount(struct vfsmount *mnt, int flags)
2854 const struct cred *cred = current_cred();
2856 return superblock_has_perm(cred, mnt->mnt_sb,
2857 FILESYSTEM__UNMOUNT, NULL);
2860 static int selinux_fs_context_dup(struct fs_context *fc,
2861 struct fs_context *src_fc)
2863 const struct selinux_mnt_opts *src = src_fc->security;
2864 struct selinux_mnt_opts *opts;
2869 fc->security = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
2873 opts = fc->security;
2875 if (src->fscontext) {
2876 opts->fscontext = kstrdup(src->fscontext, GFP_KERNEL);
2877 if (!opts->fscontext)
2881 opts->context = kstrdup(src->context, GFP_KERNEL);
2885 if (src->rootcontext) {
2886 opts->rootcontext = kstrdup(src->rootcontext, GFP_KERNEL);
2887 if (!opts->rootcontext)
2890 if (src->defcontext) {
2891 opts->defcontext = kstrdup(src->defcontext, GFP_KERNEL);
2892 if (!opts->defcontext)
2898 static const struct fs_parameter_spec selinux_fs_parameters[] = {
2899 fsparam_string(CONTEXT_STR, Opt_context),
2900 fsparam_string(DEFCONTEXT_STR, Opt_defcontext),
2901 fsparam_string(FSCONTEXT_STR, Opt_fscontext),
2902 fsparam_string(ROOTCONTEXT_STR, Opt_rootcontext),
2903 fsparam_flag (SECLABEL_STR, Opt_seclabel),
2907 static int selinux_fs_context_parse_param(struct fs_context *fc,
2908 struct fs_parameter *param)
2910 struct fs_parse_result result;
2913 opt = fs_parse(fc, selinux_fs_parameters, param, &result);
2917 rc = selinux_add_opt(opt, param->string, &fc->security);
2919 param->string = NULL;
2925 /* inode security operations */
2927 static int selinux_inode_alloc_security(struct inode *inode)
2929 struct inode_security_struct *isec = selinux_inode(inode);
2930 u32 sid = current_sid();
2932 spin_lock_init(&isec->lock);
2933 INIT_LIST_HEAD(&isec->list);
2934 isec->inode = inode;
2935 isec->sid = SECINITSID_UNLABELED;
2936 isec->sclass = SECCLASS_FILE;
2937 isec->task_sid = sid;
2938 isec->initialized = LABEL_INVALID;
2943 static void selinux_inode_free_security(struct inode *inode)
2945 inode_free_security(inode);
2948 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2949 const struct qstr *name, void **ctx,
2955 rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2956 d_inode(dentry->d_parent), name,
2957 inode_mode_to_security_class(mode),
2962 return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
2966 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2968 const struct cred *old,
2973 struct task_security_struct *tsec;
2975 rc = selinux_determine_inode_label(selinux_cred(old),
2976 d_inode(dentry->d_parent), name,
2977 inode_mode_to_security_class(mode),
2982 tsec = selinux_cred(new);
2983 tsec->create_sid = newsid;
2987 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2988 const struct qstr *qstr,
2990 void **value, size_t *len)
2992 const struct task_security_struct *tsec = selinux_cred(current_cred());
2993 struct superblock_security_struct *sbsec;
2998 sbsec = selinux_superblock(dir->i_sb);
3000 newsid = tsec->create_sid;
3002 rc = selinux_determine_inode_label(tsec, dir, qstr,
3003 inode_mode_to_security_class(inode->i_mode),
3008 /* Possibly defer initialization to selinux_complete_init. */
3009 if (sbsec->flags & SE_SBINITIALIZED) {
3010 struct inode_security_struct *isec = selinux_inode(inode);
3011 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3013 isec->initialized = LABEL_INITIALIZED;
3016 if (!selinux_initialized(&selinux_state) ||
3017 !(sbsec->flags & SBLABEL_MNT))
3021 *name = XATTR_SELINUX_SUFFIX;
3024 rc = security_sid_to_context_force(&selinux_state, newsid,
3035 static int selinux_inode_init_security_anon(struct inode *inode,
3036 const struct qstr *name,
3037 const struct inode *context_inode)
3039 const struct task_security_struct *tsec = selinux_cred(current_cred());
3040 struct common_audit_data ad;
3041 struct inode_security_struct *isec;
3044 if (unlikely(!selinux_initialized(&selinux_state)))
3047 isec = selinux_inode(inode);
3050 * We only get here once per ephemeral inode. The inode has
3051 * been initialized via inode_alloc_security but is otherwise
3055 if (context_inode) {
3056 struct inode_security_struct *context_isec =
3057 selinux_inode(context_inode);
3058 if (context_isec->initialized != LABEL_INITIALIZED) {
3059 pr_err("SELinux: context_inode is not initialized");
3063 isec->sclass = context_isec->sclass;
3064 isec->sid = context_isec->sid;
3066 isec->sclass = SECCLASS_ANON_INODE;
3067 rc = security_transition_sid(
3068 &selinux_state, tsec->sid, tsec->sid,
3069 isec->sclass, name, &isec->sid);
3074 isec->initialized = LABEL_INITIALIZED;
3076 * Now that we've initialized security, check whether we're
3077 * allowed to actually create this type of anonymous inode.
3080 ad.type = LSM_AUDIT_DATA_INODE;
3083 return avc_has_perm(&selinux_state,
3091 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
3093 return may_create(dir, dentry, SECCLASS_FILE);
3096 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
3098 return may_link(dir, old_dentry, MAY_LINK);
3101 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
3103 return may_link(dir, dentry, MAY_UNLINK);
3106 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
3108 return may_create(dir, dentry, SECCLASS_LNK_FILE);
3111 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
3113 return may_create(dir, dentry, SECCLASS_DIR);
3116 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
3118 return may_link(dir, dentry, MAY_RMDIR);
3121 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
3123 return may_create(dir, dentry, inode_mode_to_security_class(mode));
3126 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
3127 struct inode *new_inode, struct dentry *new_dentry)
3129 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
3132 static int selinux_inode_readlink(struct dentry *dentry)
3134 const struct cred *cred = current_cred();
3136 return dentry_has_perm(cred, dentry, FILE__READ);
3139 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
3142 const struct cred *cred = current_cred();
3143 struct common_audit_data ad;
3144 struct inode_security_struct *isec;
3147 validate_creds(cred);
3149 ad.type = LSM_AUDIT_DATA_DENTRY;
3150 ad.u.dentry = dentry;
3151 sid = cred_sid(cred);
3152 isec = inode_security_rcu(inode, rcu);
3154 return PTR_ERR(isec);
3156 return avc_has_perm(&selinux_state,
3157 sid, isec->sid, isec->sclass, FILE__READ, &ad);
3160 static noinline int audit_inode_permission(struct inode *inode,
3161 u32 perms, u32 audited, u32 denied,
3164 struct common_audit_data ad;
3165 struct inode_security_struct *isec = selinux_inode(inode);
3167 ad.type = LSM_AUDIT_DATA_INODE;
3170 return slow_avc_audit(&selinux_state,
3171 current_sid(), isec->sid, isec->sclass, perms,
3172 audited, denied, result, &ad);
3175 static int selinux_inode_permission(struct inode *inode, int mask)
3177 const struct cred *cred = current_cred();
3180 bool no_block = mask & MAY_NOT_BLOCK;
3181 struct inode_security_struct *isec;
3183 struct av_decision avd;
3185 u32 audited, denied;
3187 from_access = mask & MAY_ACCESS;
3188 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3190 /* No permission to check. Existence test. */
3194 validate_creds(cred);
3196 if (unlikely(IS_PRIVATE(inode)))
3199 perms = file_mask_to_av(inode->i_mode, mask);
3201 sid = cred_sid(cred);
3202 isec = inode_security_rcu(inode, no_block);
3204 return PTR_ERR(isec);
3206 rc = avc_has_perm_noaudit(&selinux_state,
3207 sid, isec->sid, isec->sclass, perms, 0,
3209 audited = avc_audit_required(perms, &avd, rc,
3210 from_access ? FILE__AUDIT_ACCESS : 0,
3212 if (likely(!audited))
3215 rc2 = audit_inode_permission(inode, perms, audited, denied, rc);
3221 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3223 const struct cred *cred = current_cred();
3224 struct inode *inode = d_backing_inode(dentry);
3225 unsigned int ia_valid = iattr->ia_valid;
3226 __u32 av = FILE__WRITE;
3228 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3229 if (ia_valid & ATTR_FORCE) {
3230 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3236 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3237 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3238 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3240 if (selinux_policycap_openperm() &&
3241 inode->i_sb->s_magic != SOCKFS_MAGIC &&
3242 (ia_valid & ATTR_SIZE) &&
3243 !(ia_valid & ATTR_FILE))
3246 return dentry_has_perm(cred, dentry, av);
3249 static int selinux_inode_getattr(const struct path *path)
3251 return path_has_perm(current_cred(), path, FILE__GETATTR);
3254 static bool has_cap_mac_admin(bool audit)
3256 const struct cred *cred = current_cred();
3257 unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT;
3259 if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, opts))
3261 if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, true))
3266 static int selinux_inode_setxattr(struct user_namespace *mnt_userns,
3267 struct dentry *dentry, const char *name,
3268 const void *value, size_t size, int flags)
3270 struct inode *inode = d_backing_inode(dentry);
3271 struct inode_security_struct *isec;
3272 struct superblock_security_struct *sbsec;
3273 struct common_audit_data ad;
3274 u32 newsid, sid = current_sid();
3277 if (strcmp(name, XATTR_NAME_SELINUX)) {
3278 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3282 /* Not an attribute we recognize, so just check the
3283 ordinary setattr permission. */
3284 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3287 if (!selinux_initialized(&selinux_state))
3288 return (inode_owner_or_capable(mnt_userns, inode) ? 0 : -EPERM);
3290 sbsec = selinux_superblock(inode->i_sb);
3291 if (!(sbsec->flags & SBLABEL_MNT))
3294 if (!inode_owner_or_capable(mnt_userns, inode))
3297 ad.type = LSM_AUDIT_DATA_DENTRY;
3298 ad.u.dentry = dentry;
3300 isec = backing_inode_security(dentry);
3301 rc = avc_has_perm(&selinux_state,
3302 sid, isec->sid, isec->sclass,
3303 FILE__RELABELFROM, &ad);
3307 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3309 if (rc == -EINVAL) {
3310 if (!has_cap_mac_admin(true)) {
3311 struct audit_buffer *ab;
3314 /* We strip a nul only if it is at the end, otherwise the
3315 * context contains a nul and we should audit that */
3317 const char *str = value;
3319 if (str[size - 1] == '\0')
3320 audit_size = size - 1;
3326 ab = audit_log_start(audit_context(),
3327 GFP_ATOMIC, AUDIT_SELINUX_ERR);
3328 audit_log_format(ab, "op=setxattr invalid_context=");
3329 audit_log_n_untrustedstring(ab, value, audit_size);
3334 rc = security_context_to_sid_force(&selinux_state, value,
3340 rc = avc_has_perm(&selinux_state,
3341 sid, newsid, isec->sclass,
3342 FILE__RELABELTO, &ad);
3346 rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3351 return avc_has_perm(&selinux_state,
3354 SECCLASS_FILESYSTEM,
3355 FILESYSTEM__ASSOCIATE,
3359 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3360 const void *value, size_t size,
3363 struct inode *inode = d_backing_inode(dentry);
3364 struct inode_security_struct *isec;
3368 if (strcmp(name, XATTR_NAME_SELINUX)) {
3369 /* Not an attribute we recognize, so nothing to do. */
3373 if (!selinux_initialized(&selinux_state)) {
3374 /* If we haven't even been initialized, then we can't validate
3375 * against a policy, so leave the label as invalid. It may
3376 * resolve to a valid label on the next revalidation try if
3377 * we've since initialized.
3382 rc = security_context_to_sid_force(&selinux_state, value, size,
3385 pr_err("SELinux: unable to map context to SID"
3386 "for (%s, %lu), rc=%d\n",
3387 inode->i_sb->s_id, inode->i_ino, -rc);
3391 isec = backing_inode_security(dentry);
3392 spin_lock(&isec->lock);
3393 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3395 isec->initialized = LABEL_INITIALIZED;
3396 spin_unlock(&isec->lock);
3401 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3403 const struct cred *cred = current_cred();
3405 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3408 static int selinux_inode_listxattr(struct dentry *dentry)
3410 const struct cred *cred = current_cred();
3412 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3415 static int selinux_inode_removexattr(struct user_namespace *mnt_userns,
3416 struct dentry *dentry, const char *name)
3418 if (strcmp(name, XATTR_NAME_SELINUX)) {
3419 int rc = cap_inode_removexattr(mnt_userns, dentry, name);
3423 /* Not an attribute we recognize, so just check the
3424 ordinary setattr permission. */
3425 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3428 if (!selinux_initialized(&selinux_state))
3431 /* No one is allowed to remove a SELinux security label.
3432 You can change the label, but all data must be labeled. */
3436 static int selinux_path_notify(const struct path *path, u64 mask,
3437 unsigned int obj_type)
3442 struct common_audit_data ad;
3444 ad.type = LSM_AUDIT_DATA_PATH;
3448 * Set permission needed based on the type of mark being set.
3449 * Performs an additional check for sb watches.
3452 case FSNOTIFY_OBJ_TYPE_VFSMOUNT:
3453 perm = FILE__WATCH_MOUNT;
3455 case FSNOTIFY_OBJ_TYPE_SB:
3456 perm = FILE__WATCH_SB;
3457 ret = superblock_has_perm(current_cred(), path->dentry->d_sb,
3458 FILESYSTEM__WATCH, &ad);
3462 case FSNOTIFY_OBJ_TYPE_INODE:
3469 /* blocking watches require the file:watch_with_perm permission */
3470 if (mask & (ALL_FSNOTIFY_PERM_EVENTS))
3471 perm |= FILE__WATCH_WITH_PERM;
3473 /* watches on read-like events need the file:watch_reads permission */
3474 if (mask & (FS_ACCESS | FS_ACCESS_PERM | FS_CLOSE_NOWRITE))
3475 perm |= FILE__WATCH_READS;
3477 return path_has_perm(current_cred(), path, perm);
3481 * Copy the inode security context value to the user.
3483 * Permission check is handled by selinux_inode_getxattr hook.
3485 static int selinux_inode_getsecurity(struct user_namespace *mnt_userns,
3486 struct inode *inode, const char *name,
3487 void **buffer, bool alloc)
3491 char *context = NULL;
3492 struct inode_security_struct *isec;
3495 * If we're not initialized yet, then we can't validate contexts, so
3496 * just let vfs_getxattr fall back to using the on-disk xattr.
3498 if (!selinux_initialized(&selinux_state) ||
3499 strcmp(name, XATTR_SELINUX_SUFFIX))
3503 * If the caller has CAP_MAC_ADMIN, then get the raw context
3504 * value even if it is not defined by current policy; otherwise,
3505 * use the in-core value under current policy.
3506 * Use the non-auditing forms of the permission checks since
3507 * getxattr may be called by unprivileged processes commonly
3508 * and lack of permission just means that we fall back to the
3509 * in-core context value, not a denial.
3511 isec = inode_security(inode);
3512 if (has_cap_mac_admin(false))
3513 error = security_sid_to_context_force(&selinux_state,
3514 isec->sid, &context,
3517 error = security_sid_to_context(&selinux_state, isec->sid,
3531 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3532 const void *value, size_t size, int flags)
3534 struct inode_security_struct *isec = inode_security_novalidate(inode);
3535 struct superblock_security_struct *sbsec;
3539 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3542 sbsec = selinux_superblock(inode->i_sb);
3543 if (!(sbsec->flags & SBLABEL_MNT))
3546 if (!value || !size)
3549 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3554 spin_lock(&isec->lock);
3555 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3557 isec->initialized = LABEL_INITIALIZED;
3558 spin_unlock(&isec->lock);
3562 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3564 const int len = sizeof(XATTR_NAME_SELINUX);
3566 if (!selinux_initialized(&selinux_state))
3569 if (buffer && len <= buffer_size)
3570 memcpy(buffer, XATTR_NAME_SELINUX, len);
3574 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3576 struct inode_security_struct *isec = inode_security_novalidate(inode);
3580 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3583 struct task_security_struct *tsec;
3584 struct cred *new_creds = *new;
3586 if (new_creds == NULL) {
3587 new_creds = prepare_creds();
3592 tsec = selinux_cred(new_creds);
3593 /* Get label from overlay inode and set it in create_sid */
3594 selinux_inode_getsecid(d_inode(src), &sid);
3595 tsec->create_sid = sid;
3600 static int selinux_inode_copy_up_xattr(const char *name)
3602 /* The copy_up hook above sets the initial context on an inode, but we
3603 * don't then want to overwrite it by blindly copying all the lower
3604 * xattrs up. Instead, we have to filter out SELinux-related xattrs.
3606 if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3607 return 1; /* Discard */
3609 * Any other attribute apart from SELINUX is not claimed, supported
3615 /* kernfs node operations */
3617 static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
3618 struct kernfs_node *kn)
3620 const struct task_security_struct *tsec = selinux_cred(current_cred());
3621 u32 parent_sid, newsid, clen;
3625 rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, NULL, 0);
3632 context = kmalloc(clen, GFP_KERNEL);
3636 rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, context, clen);
3642 rc = security_context_to_sid(&selinux_state, context, clen, &parent_sid,
3648 if (tsec->create_sid) {
3649 newsid = tsec->create_sid;
3651 u16 secclass = inode_mode_to_security_class(kn->mode);
3655 q.hash_len = hashlen_string(kn_dir, kn->name);
3657 rc = security_transition_sid(&selinux_state, tsec->sid,
3658 parent_sid, secclass, &q,
3664 rc = security_sid_to_context_force(&selinux_state, newsid,
3669 rc = kernfs_xattr_set(kn, XATTR_NAME_SELINUX, context, clen,
3676 /* file security operations */
3678 static int selinux_revalidate_file_permission(struct file *file, int mask)
3680 const struct cred *cred = current_cred();
3681 struct inode *inode = file_inode(file);
3683 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3684 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3687 return file_has_perm(cred, file,
3688 file_mask_to_av(inode->i_mode, mask));
3691 static int selinux_file_permission(struct file *file, int mask)
3693 struct inode *inode = file_inode(file);
3694 struct file_security_struct *fsec = selinux_file(file);
3695 struct inode_security_struct *isec;
3696 u32 sid = current_sid();
3699 /* No permission to check. Existence test. */
3702 isec = inode_security(inode);
3703 if (sid == fsec->sid && fsec->isid == isec->sid &&
3704 fsec->pseqno == avc_policy_seqno(&selinux_state))
3705 /* No change since file_open check. */
3708 return selinux_revalidate_file_permission(file, mask);
3711 static int selinux_file_alloc_security(struct file *file)
3713 struct file_security_struct *fsec = selinux_file(file);
3714 u32 sid = current_sid();
3717 fsec->fown_sid = sid;
3723 * Check whether a task has the ioctl permission and cmd
3724 * operation to an inode.
3726 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3727 u32 requested, u16 cmd)
3729 struct common_audit_data ad;
3730 struct file_security_struct *fsec = selinux_file(file);
3731 struct inode *inode = file_inode(file);
3732 struct inode_security_struct *isec;
3733 struct lsm_ioctlop_audit ioctl;
3734 u32 ssid = cred_sid(cred);
3736 u8 driver = cmd >> 8;
3737 u8 xperm = cmd & 0xff;
3739 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3742 ad.u.op->path = file->f_path;
3744 if (ssid != fsec->sid) {
3745 rc = avc_has_perm(&selinux_state,
3754 if (unlikely(IS_PRIVATE(inode)))
3757 isec = inode_security(inode);
3758 rc = avc_has_extended_perms(&selinux_state,
3759 ssid, isec->sid, isec->sclass,
3760 requested, driver, xperm, &ad);
3765 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3768 const struct cred *cred = current_cred();
3775 case FS_IOC_GETFLAGS:
3776 case FS_IOC_GETVERSION:
3777 error = file_has_perm(cred, file, FILE__GETATTR);
3780 case FS_IOC_SETFLAGS:
3781 case FS_IOC_SETVERSION:
3782 error = file_has_perm(cred, file, FILE__SETATTR);
3785 /* sys_ioctl() checks */
3788 error = file_has_perm(cred, file, 0);
3793 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3794 CAP_OPT_NONE, true);
3797 /* default case assumes that the command will go
3798 * to the file's ioctl() function.
3801 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3806 static int default_noexec __ro_after_init;
3808 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3810 const struct cred *cred = current_cred();
3811 u32 sid = cred_sid(cred);
3814 if (default_noexec &&
3815 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3816 (!shared && (prot & PROT_WRITE)))) {
3818 * We are making executable an anonymous mapping or a
3819 * private file mapping that will also be writable.
3820 * This has an additional check.
3822 rc = avc_has_perm(&selinux_state,
3823 sid, sid, SECCLASS_PROCESS,
3824 PROCESS__EXECMEM, NULL);
3830 /* read access is always possible with a mapping */
3831 u32 av = FILE__READ;
3833 /* write access only matters if the mapping is shared */
3834 if (shared && (prot & PROT_WRITE))
3837 if (prot & PROT_EXEC)
3838 av |= FILE__EXECUTE;
3840 return file_has_perm(cred, file, av);
3847 static int selinux_mmap_addr(unsigned long addr)
3851 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3852 u32 sid = current_sid();
3853 rc = avc_has_perm(&selinux_state,
3854 sid, sid, SECCLASS_MEMPROTECT,
3855 MEMPROTECT__MMAP_ZERO, NULL);
3861 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3862 unsigned long prot, unsigned long flags)
3864 struct common_audit_data ad;
3868 ad.type = LSM_AUDIT_DATA_FILE;
3870 rc = inode_has_perm(current_cred(), file_inode(file),
3876 if (checkreqprot_get(&selinux_state))
3879 return file_map_prot_check(file, prot,
3880 (flags & MAP_TYPE) == MAP_SHARED);
3883 static int selinux_file_mprotect(struct vm_area_struct *vma,
3884 unsigned long reqprot,
3887 const struct cred *cred = current_cred();
3888 u32 sid = cred_sid(cred);
3890 if (checkreqprot_get(&selinux_state))
3893 if (default_noexec &&
3894 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3896 if (vma->vm_start >= vma->vm_mm->start_brk &&
3897 vma->vm_end <= vma->vm_mm->brk) {
3898 rc = avc_has_perm(&selinux_state,
3899 sid, sid, SECCLASS_PROCESS,
3900 PROCESS__EXECHEAP, NULL);
3901 } else if (!vma->vm_file &&
3902 ((vma->vm_start <= vma->vm_mm->start_stack &&
3903 vma->vm_end >= vma->vm_mm->start_stack) ||
3904 vma_is_stack_for_current(vma))) {
3905 rc = avc_has_perm(&selinux_state,
3906 sid, sid, SECCLASS_PROCESS,
3907 PROCESS__EXECSTACK, NULL);
3908 } else if (vma->vm_file && vma->anon_vma) {
3910 * We are making executable a file mapping that has
3911 * had some COW done. Since pages might have been
3912 * written, check ability to execute the possibly
3913 * modified content. This typically should only
3914 * occur for text relocations.
3916 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3922 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3925 static int selinux_file_lock(struct file *file, unsigned int cmd)
3927 const struct cred *cred = current_cred();
3929 return file_has_perm(cred, file, FILE__LOCK);
3932 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3935 const struct cred *cred = current_cred();
3940 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3941 err = file_has_perm(cred, file, FILE__WRITE);
3950 case F_GETOWNER_UIDS:
3951 /* Just check FD__USE permission */
3952 err = file_has_perm(cred, file, 0);
3960 #if BITS_PER_LONG == 32
3965 err = file_has_perm(cred, file, FILE__LOCK);
3972 static void selinux_file_set_fowner(struct file *file)
3974 struct file_security_struct *fsec;
3976 fsec = selinux_file(file);
3977 fsec->fown_sid = current_sid();
3980 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3981 struct fown_struct *fown, int signum)
3984 u32 sid = task_sid_obj(tsk);
3986 struct file_security_struct *fsec;
3988 /* struct fown_struct is never outside the context of a struct file */
3989 file = container_of(fown, struct file, f_owner);
3991 fsec = selinux_file(file);
3994 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3996 perm = signal_to_av(signum);
3998 return avc_has_perm(&selinux_state,
3999 fsec->fown_sid, sid,
4000 SECCLASS_PROCESS, perm, NULL);
4003 static int selinux_file_receive(struct file *file)
4005 const struct cred *cred = current_cred();
4007 return file_has_perm(cred, file, file_to_av(file));
4010 static int selinux_file_open(struct file *file)
4012 struct file_security_struct *fsec;
4013 struct inode_security_struct *isec;
4015 fsec = selinux_file(file);
4016 isec = inode_security(file_inode(file));
4018 * Save inode label and policy sequence number
4019 * at open-time so that selinux_file_permission
4020 * can determine whether revalidation is necessary.
4021 * Task label is already saved in the file security
4022 * struct as its SID.
4024 fsec->isid = isec->sid;
4025 fsec->pseqno = avc_policy_seqno(&selinux_state);
4027 * Since the inode label or policy seqno may have changed
4028 * between the selinux_inode_permission check and the saving
4029 * of state above, recheck that access is still permitted.
4030 * Otherwise, access might never be revalidated against the
4031 * new inode label or new policy.
4032 * This check is not redundant - do not remove.
4034 return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
4037 /* task security operations */
4039 static int selinux_task_alloc(struct task_struct *task,
4040 unsigned long clone_flags)
4042 u32 sid = current_sid();
4044 return avc_has_perm(&selinux_state,
4045 sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
4049 * prepare a new set of credentials for modification
4051 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
4054 const struct task_security_struct *old_tsec = selinux_cred(old);
4055 struct task_security_struct *tsec = selinux_cred(new);
4062 * transfer the SELinux data to a blank set of creds
4064 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
4066 const struct task_security_struct *old_tsec = selinux_cred(old);
4067 struct task_security_struct *tsec = selinux_cred(new);
4072 static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
4074 *secid = cred_sid(c);
4078 * set the security data for a kernel service
4079 * - all the creation contexts are set to unlabelled
4081 static int selinux_kernel_act_as(struct cred *new, u32 secid)
4083 struct task_security_struct *tsec = selinux_cred(new);
4084 u32 sid = current_sid();
4087 ret = avc_has_perm(&selinux_state,
4089 SECCLASS_KERNEL_SERVICE,
4090 KERNEL_SERVICE__USE_AS_OVERRIDE,
4094 tsec->create_sid = 0;
4095 tsec->keycreate_sid = 0;
4096 tsec->sockcreate_sid = 0;
4102 * set the file creation context in a security record to the same as the
4103 * objective context of the specified inode
4105 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
4107 struct inode_security_struct *isec = inode_security(inode);
4108 struct task_security_struct *tsec = selinux_cred(new);
4109 u32 sid = current_sid();
4112 ret = avc_has_perm(&selinux_state,
4114 SECCLASS_KERNEL_SERVICE,
4115 KERNEL_SERVICE__CREATE_FILES_AS,
4119 tsec->create_sid = isec->sid;
4123 static int selinux_kernel_module_request(char *kmod_name)
4125 struct common_audit_data ad;
4127 ad.type = LSM_AUDIT_DATA_KMOD;
4128 ad.u.kmod_name = kmod_name;
4130 return avc_has_perm(&selinux_state,
4131 current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
4132 SYSTEM__MODULE_REQUEST, &ad);
4135 static int selinux_kernel_module_from_file(struct file *file)
4137 struct common_audit_data ad;
4138 struct inode_security_struct *isec;
4139 struct file_security_struct *fsec;
4140 u32 sid = current_sid();
4145 return avc_has_perm(&selinux_state,
4146 sid, sid, SECCLASS_SYSTEM,
4147 SYSTEM__MODULE_LOAD, NULL);
4151 ad.type = LSM_AUDIT_DATA_FILE;
4154 fsec = selinux_file(file);
4155 if (sid != fsec->sid) {
4156 rc = avc_has_perm(&selinux_state,
4157 sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
4162 isec = inode_security(file_inode(file));
4163 return avc_has_perm(&selinux_state,
4164 sid, isec->sid, SECCLASS_SYSTEM,
4165 SYSTEM__MODULE_LOAD, &ad);
4168 static int selinux_kernel_read_file(struct file *file,
4169 enum kernel_read_file_id id,
4175 case READING_MODULE:
4176 rc = selinux_kernel_module_from_file(contents ? file : NULL);
4185 static int selinux_kernel_load_data(enum kernel_load_data_id id, bool contents)
4190 case LOADING_MODULE:
4191 rc = selinux_kernel_module_from_file(NULL);
4200 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
4202 return avc_has_perm(&selinux_state,
4203 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4204 PROCESS__SETPGID, NULL);
4207 static int selinux_task_getpgid(struct task_struct *p)
4209 return avc_has_perm(&selinux_state,
4210 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4211 PROCESS__GETPGID, NULL);
4214 static int selinux_task_getsid(struct task_struct *p)
4216 return avc_has_perm(&selinux_state,
4217 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4218 PROCESS__GETSESSION, NULL);
4221 static void selinux_task_getsecid_subj(struct task_struct *p, u32 *secid)
4223 *secid = task_sid_subj(p);
4226 static void selinux_task_getsecid_obj(struct task_struct *p, u32 *secid)
4228 *secid = task_sid_obj(p);
4231 static int selinux_task_setnice(struct task_struct *p, int nice)
4233 return avc_has_perm(&selinux_state,
4234 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4235 PROCESS__SETSCHED, NULL);
4238 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4240 return avc_has_perm(&selinux_state,
4241 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4242 PROCESS__SETSCHED, NULL);
4245 static int selinux_task_getioprio(struct task_struct *p)
4247 return avc_has_perm(&selinux_state,
4248 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4249 PROCESS__GETSCHED, NULL);
4252 static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4259 if (flags & LSM_PRLIMIT_WRITE)
4260 av |= PROCESS__SETRLIMIT;
4261 if (flags & LSM_PRLIMIT_READ)
4262 av |= PROCESS__GETRLIMIT;
4263 return avc_has_perm(&selinux_state,
4264 cred_sid(cred), cred_sid(tcred),
4265 SECCLASS_PROCESS, av, NULL);
4268 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4269 struct rlimit *new_rlim)
4271 struct rlimit *old_rlim = p->signal->rlim + resource;
4273 /* Control the ability to change the hard limit (whether
4274 lowering or raising it), so that the hard limit can
4275 later be used as a safe reset point for the soft limit
4276 upon context transitions. See selinux_bprm_committing_creds. */
4277 if (old_rlim->rlim_max != new_rlim->rlim_max)
4278 return avc_has_perm(&selinux_state,
4279 current_sid(), task_sid_obj(p),
4280 SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
4285 static int selinux_task_setscheduler(struct task_struct *p)
4287 return avc_has_perm(&selinux_state,
4288 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4289 PROCESS__SETSCHED, NULL);
4292 static int selinux_task_getscheduler(struct task_struct *p)
4294 return avc_has_perm(&selinux_state,
4295 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4296 PROCESS__GETSCHED, NULL);
4299 static int selinux_task_movememory(struct task_struct *p)
4301 return avc_has_perm(&selinux_state,
4302 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4303 PROCESS__SETSCHED, NULL);
4306 static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
4307 int sig, const struct cred *cred)
4313 perm = PROCESS__SIGNULL; /* null signal; existence test */
4315 perm = signal_to_av(sig);
4317 secid = current_sid();
4319 secid = cred_sid(cred);
4320 return avc_has_perm(&selinux_state,
4321 secid, task_sid_obj(p), SECCLASS_PROCESS, perm, NULL);
4324 static void selinux_task_to_inode(struct task_struct *p,
4325 struct inode *inode)
4327 struct inode_security_struct *isec = selinux_inode(inode);
4328 u32 sid = task_sid_obj(p);
4330 spin_lock(&isec->lock);
4331 isec->sclass = inode_mode_to_security_class(inode->i_mode);
4333 isec->initialized = LABEL_INITIALIZED;
4334 spin_unlock(&isec->lock);
4337 /* Returns error only if unable to parse addresses */
4338 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4339 struct common_audit_data *ad, u8 *proto)
4341 int offset, ihlen, ret = -EINVAL;
4342 struct iphdr _iph, *ih;
4344 offset = skb_network_offset(skb);
4345 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4349 ihlen = ih->ihl * 4;
4350 if (ihlen < sizeof(_iph))
4353 ad->u.net->v4info.saddr = ih->saddr;
4354 ad->u.net->v4info.daddr = ih->daddr;
4358 *proto = ih->protocol;
4360 switch (ih->protocol) {
4362 struct tcphdr _tcph, *th;
4364 if (ntohs(ih->frag_off) & IP_OFFSET)
4368 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4372 ad->u.net->sport = th->source;
4373 ad->u.net->dport = th->dest;
4378 struct udphdr _udph, *uh;
4380 if (ntohs(ih->frag_off) & IP_OFFSET)
4384 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4388 ad->u.net->sport = uh->source;
4389 ad->u.net->dport = uh->dest;
4393 case IPPROTO_DCCP: {
4394 struct dccp_hdr _dccph, *dh;
4396 if (ntohs(ih->frag_off) & IP_OFFSET)
4400 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4404 ad->u.net->sport = dh->dccph_sport;
4405 ad->u.net->dport = dh->dccph_dport;
4409 #if IS_ENABLED(CONFIG_IP_SCTP)
4410 case IPPROTO_SCTP: {
4411 struct sctphdr _sctph, *sh;
4413 if (ntohs(ih->frag_off) & IP_OFFSET)
4417 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4421 ad->u.net->sport = sh->source;
4422 ad->u.net->dport = sh->dest;
4433 #if IS_ENABLED(CONFIG_IPV6)
4435 /* Returns error only if unable to parse addresses */
4436 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4437 struct common_audit_data *ad, u8 *proto)
4440 int ret = -EINVAL, offset;
4441 struct ipv6hdr _ipv6h, *ip6;
4444 offset = skb_network_offset(skb);
4445 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4449 ad->u.net->v6info.saddr = ip6->saddr;
4450 ad->u.net->v6info.daddr = ip6->daddr;
4453 nexthdr = ip6->nexthdr;
4454 offset += sizeof(_ipv6h);
4455 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4464 struct tcphdr _tcph, *th;
4466 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4470 ad->u.net->sport = th->source;
4471 ad->u.net->dport = th->dest;
4476 struct udphdr _udph, *uh;
4478 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4482 ad->u.net->sport = uh->source;
4483 ad->u.net->dport = uh->dest;
4487 case IPPROTO_DCCP: {
4488 struct dccp_hdr _dccph, *dh;
4490 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4494 ad->u.net->sport = dh->dccph_sport;
4495 ad->u.net->dport = dh->dccph_dport;
4499 #if IS_ENABLED(CONFIG_IP_SCTP)
4500 case IPPROTO_SCTP: {
4501 struct sctphdr _sctph, *sh;
4503 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4507 ad->u.net->sport = sh->source;
4508 ad->u.net->dport = sh->dest;
4512 /* includes fragments */
4522 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4523 char **_addrp, int src, u8 *proto)
4528 switch (ad->u.net->family) {
4530 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4533 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4534 &ad->u.net->v4info.daddr);
4537 #if IS_ENABLED(CONFIG_IPV6)
4539 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4542 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4543 &ad->u.net->v6info.daddr);
4553 "SELinux: failure in selinux_parse_skb(),"
4554 " unable to parse packet\n");
4564 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4566 * @family: protocol family
4567 * @sid: the packet's peer label SID
4570 * Check the various different forms of network peer labeling and determine
4571 * the peer label/SID for the packet; most of the magic actually occurs in
4572 * the security server function security_net_peersid_cmp(). The function
4573 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4574 * or -EACCES if @sid is invalid due to inconsistencies with the different
4578 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4585 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4588 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4592 err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4593 nlbl_type, xfrm_sid, sid);
4594 if (unlikely(err)) {
4596 "SELinux: failure in selinux_skb_peerlbl_sid(),"
4597 " unable to determine packet's peer label\n");
4605 * selinux_conn_sid - Determine the child socket label for a connection
4606 * @sk_sid: the parent socket's SID
4607 * @skb_sid: the packet's SID
4608 * @conn_sid: the resulting connection SID
4610 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4611 * combined with the MLS information from @skb_sid in order to create
4612 * @conn_sid. If @skb_sid is not valid then @conn_sid is simply a copy
4613 * of @sk_sid. Returns zero on success, negative values on failure.
4616 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4620 if (skb_sid != SECSID_NULL)
4621 err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4629 /* socket security operations */
4631 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4632 u16 secclass, u32 *socksid)
4634 if (tsec->sockcreate_sid > SECSID_NULL) {
4635 *socksid = tsec->sockcreate_sid;
4639 return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4640 secclass, NULL, socksid);
4643 static int sock_has_perm(struct sock *sk, u32 perms)
4645 struct sk_security_struct *sksec = sk->sk_security;
4646 struct common_audit_data ad;
4647 struct lsm_network_audit net = {0,};
4649 if (sksec->sid == SECINITSID_KERNEL)
4652 ad.type = LSM_AUDIT_DATA_NET;
4656 return avc_has_perm(&selinux_state,
4657 current_sid(), sksec->sid, sksec->sclass, perms,
4661 static int selinux_socket_create(int family, int type,
4662 int protocol, int kern)
4664 const struct task_security_struct *tsec = selinux_cred(current_cred());
4672 secclass = socket_type_to_security_class(family, type, protocol);
4673 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4677 return avc_has_perm(&selinux_state,
4678 tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4681 static int selinux_socket_post_create(struct socket *sock, int family,
4682 int type, int protocol, int kern)
4684 const struct task_security_struct *tsec = selinux_cred(current_cred());
4685 struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4686 struct sk_security_struct *sksec;
4687 u16 sclass = socket_type_to_security_class(family, type, protocol);
4688 u32 sid = SECINITSID_KERNEL;
4692 err = socket_sockcreate_sid(tsec, sclass, &sid);
4697 isec->sclass = sclass;
4699 isec->initialized = LABEL_INITIALIZED;
4702 sksec = sock->sk->sk_security;
4703 sksec->sclass = sclass;
4705 /* Allows detection of the first association on this socket */
4706 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4707 sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4709 err = selinux_netlbl_socket_post_create(sock->sk, family);
4715 static int selinux_socket_socketpair(struct socket *socka,
4716 struct socket *sockb)
4718 struct sk_security_struct *sksec_a = socka->sk->sk_security;
4719 struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4721 sksec_a->peer_sid = sksec_b->sid;
4722 sksec_b->peer_sid = sksec_a->sid;
4727 /* Range of port numbers used to automatically bind.
4728 Need to determine whether we should perform a name_bind
4729 permission check between the socket and the port number. */
4731 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4733 struct sock *sk = sock->sk;
4734 struct sk_security_struct *sksec = sk->sk_security;
4738 err = sock_has_perm(sk, SOCKET__BIND);
4742 /* If PF_INET or PF_INET6, check name_bind permission for the port. */
4743 family = sk->sk_family;
4744 if (family == PF_INET || family == PF_INET6) {
4746 struct common_audit_data ad;
4747 struct lsm_network_audit net = {0,};
4748 struct sockaddr_in *addr4 = NULL;
4749 struct sockaddr_in6 *addr6 = NULL;
4751 unsigned short snum;
4755 * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4756 * that validates multiple binding addresses. Because of this
4757 * need to check address->sa_family as it is possible to have
4758 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4760 if (addrlen < offsetofend(struct sockaddr, sa_family))
4762 family_sa = address->sa_family;
4763 switch (family_sa) {
4766 if (addrlen < sizeof(struct sockaddr_in))
4768 addr4 = (struct sockaddr_in *)address;
4769 if (family_sa == AF_UNSPEC) {
4770 /* see __inet_bind(), we only want to allow
4771 * AF_UNSPEC if the address is INADDR_ANY
4773 if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4775 family_sa = AF_INET;
4777 snum = ntohs(addr4->sin_port);
4778 addrp = (char *)&addr4->sin_addr.s_addr;
4781 if (addrlen < SIN6_LEN_RFC2133)
4783 addr6 = (struct sockaddr_in6 *)address;
4784 snum = ntohs(addr6->sin6_port);
4785 addrp = (char *)&addr6->sin6_addr.s6_addr;
4791 ad.type = LSM_AUDIT_DATA_NET;
4793 ad.u.net->sport = htons(snum);
4794 ad.u.net->family = family_sa;
4799 inet_get_local_port_range(sock_net(sk), &low, &high);
4801 if (inet_port_requires_bind_service(sock_net(sk), snum) ||
4802 snum < low || snum > high) {
4803 err = sel_netport_sid(sk->sk_protocol,
4807 err = avc_has_perm(&selinux_state,
4810 SOCKET__NAME_BIND, &ad);
4816 switch (sksec->sclass) {
4817 case SECCLASS_TCP_SOCKET:
4818 node_perm = TCP_SOCKET__NODE_BIND;
4821 case SECCLASS_UDP_SOCKET:
4822 node_perm = UDP_SOCKET__NODE_BIND;
4825 case SECCLASS_DCCP_SOCKET:
4826 node_perm = DCCP_SOCKET__NODE_BIND;
4829 case SECCLASS_SCTP_SOCKET:
4830 node_perm = SCTP_SOCKET__NODE_BIND;
4834 node_perm = RAWIP_SOCKET__NODE_BIND;
4838 err = sel_netnode_sid(addrp, family_sa, &sid);
4842 if (family_sa == AF_INET)
4843 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4845 ad.u.net->v6info.saddr = addr6->sin6_addr;
4847 err = avc_has_perm(&selinux_state,
4849 sksec->sclass, node_perm, &ad);
4856 /* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4857 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4859 return -EAFNOSUPPORT;
4862 /* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4863 * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst
4865 static int selinux_socket_connect_helper(struct socket *sock,
4866 struct sockaddr *address, int addrlen)
4868 struct sock *sk = sock->sk;
4869 struct sk_security_struct *sksec = sk->sk_security;
4872 err = sock_has_perm(sk, SOCKET__CONNECT);
4875 if (addrlen < offsetofend(struct sockaddr, sa_family))
4878 /* connect(AF_UNSPEC) has special handling, as it is a documented
4879 * way to disconnect the socket
4881 if (address->sa_family == AF_UNSPEC)
4885 * If a TCP, DCCP or SCTP socket, check name_connect permission
4888 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4889 sksec->sclass == SECCLASS_DCCP_SOCKET ||
4890 sksec->sclass == SECCLASS_SCTP_SOCKET) {
4891 struct common_audit_data ad;
4892 struct lsm_network_audit net = {0,};
4893 struct sockaddr_in *addr4 = NULL;
4894 struct sockaddr_in6 *addr6 = NULL;
4895 unsigned short snum;
4898 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4899 * that validates multiple connect addresses. Because of this
4900 * need to check address->sa_family as it is possible to have
4901 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4903 switch (address->sa_family) {
4905 addr4 = (struct sockaddr_in *)address;
4906 if (addrlen < sizeof(struct sockaddr_in))
4908 snum = ntohs(addr4->sin_port);
4911 addr6 = (struct sockaddr_in6 *)address;
4912 if (addrlen < SIN6_LEN_RFC2133)
4914 snum = ntohs(addr6->sin6_port);
4917 /* Note that SCTP services expect -EINVAL, whereas
4918 * others expect -EAFNOSUPPORT.
4920 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4923 return -EAFNOSUPPORT;
4926 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4930 switch (sksec->sclass) {
4931 case SECCLASS_TCP_SOCKET:
4932 perm = TCP_SOCKET__NAME_CONNECT;
4934 case SECCLASS_DCCP_SOCKET:
4935 perm = DCCP_SOCKET__NAME_CONNECT;
4937 case SECCLASS_SCTP_SOCKET:
4938 perm = SCTP_SOCKET__NAME_CONNECT;
4942 ad.type = LSM_AUDIT_DATA_NET;
4944 ad.u.net->dport = htons(snum);
4945 ad.u.net->family = address->sa_family;
4946 err = avc_has_perm(&selinux_state,
4947 sksec->sid, sid, sksec->sclass, perm, &ad);
4955 /* Supports connect(2), see comments in selinux_socket_connect_helper() */
4956 static int selinux_socket_connect(struct socket *sock,
4957 struct sockaddr *address, int addrlen)
4960 struct sock *sk = sock->sk;
4962 err = selinux_socket_connect_helper(sock, address, addrlen);
4966 return selinux_netlbl_socket_connect(sk, address);
4969 static int selinux_socket_listen(struct socket *sock, int backlog)
4971 return sock_has_perm(sock->sk, SOCKET__LISTEN);
4974 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4977 struct inode_security_struct *isec;
4978 struct inode_security_struct *newisec;
4982 err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4986 isec = inode_security_novalidate(SOCK_INODE(sock));
4987 spin_lock(&isec->lock);
4988 sclass = isec->sclass;
4990 spin_unlock(&isec->lock);
4992 newisec = inode_security_novalidate(SOCK_INODE(newsock));
4993 newisec->sclass = sclass;
4995 newisec->initialized = LABEL_INITIALIZED;
5000 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
5003 return sock_has_perm(sock->sk, SOCKET__WRITE);
5006 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
5007 int size, int flags)
5009 return sock_has_perm(sock->sk, SOCKET__READ);
5012 static int selinux_socket_getsockname(struct socket *sock)
5014 return sock_has_perm(sock->sk, SOCKET__GETATTR);
5017 static int selinux_socket_getpeername(struct socket *sock)
5019 return sock_has_perm(sock->sk, SOCKET__GETATTR);
5022 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
5026 err = sock_has_perm(sock->sk, SOCKET__SETOPT);
5030 return selinux_netlbl_socket_setsockopt(sock, level, optname);
5033 static int selinux_socket_getsockopt(struct socket *sock, int level,
5036 return sock_has_perm(sock->sk, SOCKET__GETOPT);
5039 static int selinux_socket_shutdown(struct socket *sock, int how)
5041 return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
5044 static int selinux_socket_unix_stream_connect(struct sock *sock,
5048 struct sk_security_struct *sksec_sock = sock->sk_security;
5049 struct sk_security_struct *sksec_other = other->sk_security;
5050 struct sk_security_struct *sksec_new = newsk->sk_security;
5051 struct common_audit_data ad;
5052 struct lsm_network_audit net = {0,};
5055 ad.type = LSM_AUDIT_DATA_NET;
5057 ad.u.net->sk = other;
5059 err = avc_has_perm(&selinux_state,
5060 sksec_sock->sid, sksec_other->sid,
5061 sksec_other->sclass,
5062 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
5066 /* server child socket */
5067 sksec_new->peer_sid = sksec_sock->sid;
5068 err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
5069 sksec_sock->sid, &sksec_new->sid);
5073 /* connecting socket */
5074 sksec_sock->peer_sid = sksec_new->sid;
5079 static int selinux_socket_unix_may_send(struct socket *sock,
5080 struct socket *other)
5082 struct sk_security_struct *ssec = sock->sk->sk_security;
5083 struct sk_security_struct *osec = other->sk->sk_security;
5084 struct common_audit_data ad;
5085 struct lsm_network_audit net = {0,};
5087 ad.type = LSM_AUDIT_DATA_NET;
5089 ad.u.net->sk = other->sk;
5091 return avc_has_perm(&selinux_state,
5092 ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
5096 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
5097 char *addrp, u16 family, u32 peer_sid,
5098 struct common_audit_data *ad)
5104 err = sel_netif_sid(ns, ifindex, &if_sid);
5107 err = avc_has_perm(&selinux_state,
5109 SECCLASS_NETIF, NETIF__INGRESS, ad);
5113 err = sel_netnode_sid(addrp, family, &node_sid);
5116 return avc_has_perm(&selinux_state,
5118 SECCLASS_NODE, NODE__RECVFROM, ad);
5121 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
5125 struct sk_security_struct *sksec = sk->sk_security;
5126 u32 sk_sid = sksec->sid;
5127 struct common_audit_data ad;
5128 struct lsm_network_audit net = {0,};
5131 ad.type = LSM_AUDIT_DATA_NET;
5133 ad.u.net->netif = skb->skb_iif;
5134 ad.u.net->family = family;
5135 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5139 if (selinux_secmark_enabled()) {
5140 err = avc_has_perm(&selinux_state,
5141 sk_sid, skb->secmark, SECCLASS_PACKET,
5147 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
5150 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
5155 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
5158 struct sk_security_struct *sksec = sk->sk_security;
5159 u16 family = sk->sk_family;
5160 u32 sk_sid = sksec->sid;
5161 struct common_audit_data ad;
5162 struct lsm_network_audit net = {0,};
5167 if (family != PF_INET && family != PF_INET6)
5170 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
5171 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5174 /* If any sort of compatibility mode is enabled then handoff processing
5175 * to the selinux_sock_rcv_skb_compat() function to deal with the
5176 * special handling. We do this in an attempt to keep this function
5177 * as fast and as clean as possible. */
5178 if (!selinux_policycap_netpeer())
5179 return selinux_sock_rcv_skb_compat(sk, skb, family);
5181 secmark_active = selinux_secmark_enabled();
5182 peerlbl_active = selinux_peerlbl_enabled();
5183 if (!secmark_active && !peerlbl_active)
5186 ad.type = LSM_AUDIT_DATA_NET;
5188 ad.u.net->netif = skb->skb_iif;
5189 ad.u.net->family = family;
5190 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5194 if (peerlbl_active) {
5197 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
5200 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
5201 addrp, family, peer_sid, &ad);
5203 selinux_netlbl_err(skb, family, err, 0);
5206 err = avc_has_perm(&selinux_state,
5207 sk_sid, peer_sid, SECCLASS_PEER,
5210 selinux_netlbl_err(skb, family, err, 0);
5215 if (secmark_active) {
5216 err = avc_has_perm(&selinux_state,
5217 sk_sid, skb->secmark, SECCLASS_PACKET,
5226 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
5227 int __user *optlen, unsigned len)
5232 struct sk_security_struct *sksec = sock->sk->sk_security;
5233 u32 peer_sid = SECSID_NULL;
5235 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
5236 sksec->sclass == SECCLASS_TCP_SOCKET ||
5237 sksec->sclass == SECCLASS_SCTP_SOCKET)
5238 peer_sid = sksec->peer_sid;
5239 if (peer_sid == SECSID_NULL)
5240 return -ENOPROTOOPT;
5242 err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
5247 if (scontext_len > len) {
5252 if (copy_to_user(optval, scontext, scontext_len))
5256 if (put_user(scontext_len, optlen))
5262 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
5264 u32 peer_secid = SECSID_NULL;
5266 struct inode_security_struct *isec;
5268 if (skb && skb->protocol == htons(ETH_P_IP))
5270 else if (skb && skb->protocol == htons(ETH_P_IPV6))
5273 family = sock->sk->sk_family;
5277 if (sock && family == PF_UNIX) {
5278 isec = inode_security_novalidate(SOCK_INODE(sock));
5279 peer_secid = isec->sid;
5281 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
5284 *secid = peer_secid;
5285 if (peer_secid == SECSID_NULL)
5290 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
5292 struct sk_security_struct *sksec;
5294 sksec = kzalloc(sizeof(*sksec), priority);
5298 sksec->peer_sid = SECINITSID_UNLABELED;
5299 sksec->sid = SECINITSID_UNLABELED;
5300 sksec->sclass = SECCLASS_SOCKET;
5301 selinux_netlbl_sk_security_reset(sksec);
5302 sk->sk_security = sksec;
5307 static void selinux_sk_free_security(struct sock *sk)
5309 struct sk_security_struct *sksec = sk->sk_security;
5311 sk->sk_security = NULL;
5312 selinux_netlbl_sk_security_free(sksec);
5316 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5318 struct sk_security_struct *sksec = sk->sk_security;
5319 struct sk_security_struct *newsksec = newsk->sk_security;
5321 newsksec->sid = sksec->sid;
5322 newsksec->peer_sid = sksec->peer_sid;
5323 newsksec->sclass = sksec->sclass;
5325 selinux_netlbl_sk_security_reset(newsksec);
5328 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
5331 *secid = SECINITSID_ANY_SOCKET;
5333 struct sk_security_struct *sksec = sk->sk_security;
5335 *secid = sksec->sid;
5339 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
5341 struct inode_security_struct *isec =
5342 inode_security_novalidate(SOCK_INODE(parent));
5343 struct sk_security_struct *sksec = sk->sk_security;
5345 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5346 sk->sk_family == PF_UNIX)
5347 isec->sid = sksec->sid;
5348 sksec->sclass = isec->sclass;
5351 /* Called whenever SCTP receives an INIT chunk. This happens when an incoming
5352 * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
5355 static int selinux_sctp_assoc_request(struct sctp_endpoint *ep,
5356 struct sk_buff *skb)
5358 struct sk_security_struct *sksec = ep->base.sk->sk_security;
5359 struct common_audit_data ad;
5360 struct lsm_network_audit net = {0,};
5362 u32 peer_sid = SECINITSID_UNLABELED;
5366 if (!selinux_policycap_extsockclass())
5369 peerlbl_active = selinux_peerlbl_enabled();
5371 if (peerlbl_active) {
5372 /* This will return peer_sid = SECSID_NULL if there are
5373 * no peer labels, see security_net_peersid_resolve().
5375 err = selinux_skb_peerlbl_sid(skb, ep->base.sk->sk_family,
5380 if (peer_sid == SECSID_NULL)
5381 peer_sid = SECINITSID_UNLABELED;
5384 if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5385 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5387 /* Here as first association on socket. As the peer SID
5388 * was allowed by peer recv (and the netif/node checks),
5389 * then it is approved by policy and used as the primary
5390 * peer SID for getpeercon(3).
5392 sksec->peer_sid = peer_sid;
5393 } else if (sksec->peer_sid != peer_sid) {
5394 /* Other association peer SIDs are checked to enforce
5395 * consistency among the peer SIDs.
5397 ad.type = LSM_AUDIT_DATA_NET;
5399 ad.u.net->sk = ep->base.sk;
5400 err = avc_has_perm(&selinux_state,
5401 sksec->peer_sid, peer_sid, sksec->sclass,
5402 SCTP_SOCKET__ASSOCIATION, &ad);
5407 /* Compute the MLS component for the connection and store
5408 * the information in ep. This will be used by SCTP TCP type
5409 * sockets and peeled off connections as they cause a new
5410 * socket to be generated. selinux_sctp_sk_clone() will then
5411 * plug this into the new socket.
5413 err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
5417 ep->secid = conn_sid;
5418 ep->peer_secid = peer_sid;
5420 /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5421 return selinux_netlbl_sctp_assoc_request(ep, skb);
5424 /* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5425 * based on their @optname.
5427 static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5428 struct sockaddr *address,
5431 int len, err = 0, walk_size = 0;
5433 struct sockaddr *addr;
5434 struct socket *sock;
5436 if (!selinux_policycap_extsockclass())
5439 /* Process one or more addresses that may be IPv4 or IPv6 */
5440 sock = sk->sk_socket;
5443 while (walk_size < addrlen) {
5444 if (walk_size + sizeof(sa_family_t) > addrlen)
5448 switch (addr->sa_family) {
5451 len = sizeof(struct sockaddr_in);
5454 len = sizeof(struct sockaddr_in6);
5460 if (walk_size + len > addrlen)
5466 case SCTP_PRIMARY_ADDR:
5467 case SCTP_SET_PEER_PRIMARY_ADDR:
5468 case SCTP_SOCKOPT_BINDX_ADD:
5469 err = selinux_socket_bind(sock, addr, len);
5471 /* Connect checks */
5472 case SCTP_SOCKOPT_CONNECTX:
5473 case SCTP_PARAM_SET_PRIMARY:
5474 case SCTP_PARAM_ADD_IP:
5475 case SCTP_SENDMSG_CONNECT:
5476 err = selinux_socket_connect_helper(sock, addr, len);
5480 /* As selinux_sctp_bind_connect() is called by the
5481 * SCTP protocol layer, the socket is already locked,
5482 * therefore selinux_netlbl_socket_connect_locked()
5483 * is called here. The situations handled are:
5484 * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5485 * whenever a new IP address is added or when a new
5486 * primary address is selected.
5487 * Note that an SCTP connect(2) call happens before
5488 * the SCTP protocol layer and is handled via
5489 * selinux_socket_connect().
5491 err = selinux_netlbl_socket_connect_locked(sk, addr);
5505 /* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5506 static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
5509 struct sk_security_struct *sksec = sk->sk_security;
5510 struct sk_security_struct *newsksec = newsk->sk_security;
5512 /* If policy does not support SECCLASS_SCTP_SOCKET then call
5513 * the non-sctp clone version.
5515 if (!selinux_policycap_extsockclass())
5516 return selinux_sk_clone_security(sk, newsk);
5518 newsksec->sid = ep->secid;
5519 newsksec->peer_sid = ep->peer_secid;
5520 newsksec->sclass = sksec->sclass;
5521 selinux_netlbl_sctp_sk_clone(sk, newsk);
5524 static int selinux_inet_conn_request(const struct sock *sk, struct sk_buff *skb,
5525 struct request_sock *req)
5527 struct sk_security_struct *sksec = sk->sk_security;
5529 u16 family = req->rsk_ops->family;
5533 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
5536 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5539 req->secid = connsid;
5540 req->peer_secid = peersid;
5542 return selinux_netlbl_inet_conn_request(req, family);
5545 static void selinux_inet_csk_clone(struct sock *newsk,
5546 const struct request_sock *req)
5548 struct sk_security_struct *newsksec = newsk->sk_security;
5550 newsksec->sid = req->secid;
5551 newsksec->peer_sid = req->peer_secid;
5552 /* NOTE: Ideally, we should also get the isec->sid for the
5553 new socket in sync, but we don't have the isec available yet.
5554 So we will wait until sock_graft to do it, by which
5555 time it will have been created and available. */
5557 /* We don't need to take any sort of lock here as we are the only
5558 * thread with access to newsksec */
5559 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
5562 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
5564 u16 family = sk->sk_family;
5565 struct sk_security_struct *sksec = sk->sk_security;
5567 /* handle mapped IPv4 packets arriving via IPv6 sockets */
5568 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5571 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
5574 static int selinux_secmark_relabel_packet(u32 sid)
5576 const struct task_security_struct *__tsec;
5579 __tsec = selinux_cred(current_cred());
5582 return avc_has_perm(&selinux_state,
5583 tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5587 static void selinux_secmark_refcount_inc(void)
5589 atomic_inc(&selinux_secmark_refcount);
5592 static void selinux_secmark_refcount_dec(void)
5594 atomic_dec(&selinux_secmark_refcount);
5597 static void selinux_req_classify_flow(const struct request_sock *req,
5598 struct flowi_common *flic)
5600 flic->flowic_secid = req->secid;
5603 static int selinux_tun_dev_alloc_security(void **security)
5605 struct tun_security_struct *tunsec;
5607 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5610 tunsec->sid = current_sid();
5616 static void selinux_tun_dev_free_security(void *security)
5621 static int selinux_tun_dev_create(void)
5623 u32 sid = current_sid();
5625 /* we aren't taking into account the "sockcreate" SID since the socket
5626 * that is being created here is not a socket in the traditional sense,
5627 * instead it is a private sock, accessible only to the kernel, and
5628 * representing a wide range of network traffic spanning multiple
5629 * connections unlike traditional sockets - check the TUN driver to
5630 * get a better understanding of why this socket is special */
5632 return avc_has_perm(&selinux_state,
5633 sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5637 static int selinux_tun_dev_attach_queue(void *security)
5639 struct tun_security_struct *tunsec = security;
5641 return avc_has_perm(&selinux_state,
5642 current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5643 TUN_SOCKET__ATTACH_QUEUE, NULL);
5646 static int selinux_tun_dev_attach(struct sock *sk, void *security)
5648 struct tun_security_struct *tunsec = security;
5649 struct sk_security_struct *sksec = sk->sk_security;
5651 /* we don't currently perform any NetLabel based labeling here and it
5652 * isn't clear that we would want to do so anyway; while we could apply
5653 * labeling without the support of the TUN user the resulting labeled
5654 * traffic from the other end of the connection would almost certainly
5655 * cause confusion to the TUN user that had no idea network labeling
5656 * protocols were being used */
5658 sksec->sid = tunsec->sid;
5659 sksec->sclass = SECCLASS_TUN_SOCKET;
5664 static int selinux_tun_dev_open(void *security)
5666 struct tun_security_struct *tunsec = security;
5667 u32 sid = current_sid();
5670 err = avc_has_perm(&selinux_state,
5671 sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5672 TUN_SOCKET__RELABELFROM, NULL);
5675 err = avc_has_perm(&selinux_state,
5676 sid, sid, SECCLASS_TUN_SOCKET,
5677 TUN_SOCKET__RELABELTO, NULL);
5685 #ifdef CONFIG_NETFILTER
5687 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5688 const struct net_device *indev,
5694 struct common_audit_data ad;
5695 struct lsm_network_audit net = {0,};
5700 if (!selinux_policycap_netpeer())
5703 secmark_active = selinux_secmark_enabled();
5704 netlbl_active = netlbl_enabled();
5705 peerlbl_active = selinux_peerlbl_enabled();
5706 if (!secmark_active && !peerlbl_active)
5709 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5712 ad.type = LSM_AUDIT_DATA_NET;
5714 ad.u.net->netif = indev->ifindex;
5715 ad.u.net->family = family;
5716 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5719 if (peerlbl_active) {
5720 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5721 addrp, family, peer_sid, &ad);
5723 selinux_netlbl_err(skb, family, err, 1);
5729 if (avc_has_perm(&selinux_state,
5730 peer_sid, skb->secmark,
5731 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5735 /* we do this in the FORWARD path and not the POST_ROUTING
5736 * path because we want to make sure we apply the necessary
5737 * labeling before IPsec is applied so we can leverage AH
5739 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5745 static unsigned int selinux_ipv4_forward(void *priv,
5746 struct sk_buff *skb,
5747 const struct nf_hook_state *state)
5749 return selinux_ip_forward(skb, state->in, PF_INET);
5752 #if IS_ENABLED(CONFIG_IPV6)
5753 static unsigned int selinux_ipv6_forward(void *priv,
5754 struct sk_buff *skb,
5755 const struct nf_hook_state *state)
5757 return selinux_ip_forward(skb, state->in, PF_INET6);
5761 static unsigned int selinux_ip_output(struct sk_buff *skb,
5767 if (!netlbl_enabled())
5770 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5771 * because we want to make sure we apply the necessary labeling
5772 * before IPsec is applied so we can leverage AH protection */
5775 struct sk_security_struct *sksec;
5777 if (sk_listener(sk))
5778 /* if the socket is the listening state then this
5779 * packet is a SYN-ACK packet which means it needs to
5780 * be labeled based on the connection/request_sock and
5781 * not the parent socket. unfortunately, we can't
5782 * lookup the request_sock yet as it isn't queued on
5783 * the parent socket until after the SYN-ACK is sent.
5784 * the "solution" is to simply pass the packet as-is
5785 * as any IP option based labeling should be copied
5786 * from the initial connection request (in the IP
5787 * layer). it is far from ideal, but until we get a
5788 * security label in the packet itself this is the
5789 * best we can do. */
5792 /* standard practice, label using the parent socket */
5793 sksec = sk->sk_security;
5796 sid = SECINITSID_KERNEL;
5797 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5803 static unsigned int selinux_ipv4_output(void *priv,
5804 struct sk_buff *skb,
5805 const struct nf_hook_state *state)
5807 return selinux_ip_output(skb, PF_INET);
5810 #if IS_ENABLED(CONFIG_IPV6)
5811 static unsigned int selinux_ipv6_output(void *priv,
5812 struct sk_buff *skb,
5813 const struct nf_hook_state *state)
5815 return selinux_ip_output(skb, PF_INET6);
5819 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5823 struct sock *sk = skb_to_full_sk(skb);
5824 struct sk_security_struct *sksec;
5825 struct common_audit_data ad;
5826 struct lsm_network_audit net = {0,};
5832 sksec = sk->sk_security;
5834 ad.type = LSM_AUDIT_DATA_NET;
5836 ad.u.net->netif = ifindex;
5837 ad.u.net->family = family;
5838 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5841 if (selinux_secmark_enabled())
5842 if (avc_has_perm(&selinux_state,
5843 sksec->sid, skb->secmark,
5844 SECCLASS_PACKET, PACKET__SEND, &ad))
5845 return NF_DROP_ERR(-ECONNREFUSED);
5847 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5848 return NF_DROP_ERR(-ECONNREFUSED);
5853 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5854 const struct net_device *outdev,
5859 int ifindex = outdev->ifindex;
5861 struct common_audit_data ad;
5862 struct lsm_network_audit net = {0,};
5867 /* If any sort of compatibility mode is enabled then handoff processing
5868 * to the selinux_ip_postroute_compat() function to deal with the
5869 * special handling. We do this in an attempt to keep this function
5870 * as fast and as clean as possible. */
5871 if (!selinux_policycap_netpeer())
5872 return selinux_ip_postroute_compat(skb, ifindex, family);
5874 secmark_active = selinux_secmark_enabled();
5875 peerlbl_active = selinux_peerlbl_enabled();
5876 if (!secmark_active && !peerlbl_active)
5879 sk = skb_to_full_sk(skb);
5882 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5883 * packet transformation so allow the packet to pass without any checks
5884 * since we'll have another chance to perform access control checks
5885 * when the packet is on it's final way out.
5886 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5887 * is NULL, in this case go ahead and apply access control.
5888 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5889 * TCP listening state we cannot wait until the XFRM processing
5890 * is done as we will miss out on the SA label if we do;
5891 * unfortunately, this means more work, but it is only once per
5893 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5894 !(sk && sk_listener(sk)))
5899 /* Without an associated socket the packet is either coming
5900 * from the kernel or it is being forwarded; check the packet
5901 * to determine which and if the packet is being forwarded
5902 * query the packet directly to determine the security label. */
5904 secmark_perm = PACKET__FORWARD_OUT;
5905 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5908 secmark_perm = PACKET__SEND;
5909 peer_sid = SECINITSID_KERNEL;
5911 } else if (sk_listener(sk)) {
5912 /* Locally generated packet but the associated socket is in the
5913 * listening state which means this is a SYN-ACK packet. In
5914 * this particular case the correct security label is assigned
5915 * to the connection/request_sock but unfortunately we can't
5916 * query the request_sock as it isn't queued on the parent
5917 * socket until after the SYN-ACK packet is sent; the only
5918 * viable choice is to regenerate the label like we do in
5919 * selinux_inet_conn_request(). See also selinux_ip_output()
5920 * for similar problems. */
5922 struct sk_security_struct *sksec;
5924 sksec = sk->sk_security;
5925 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5927 /* At this point, if the returned skb peerlbl is SECSID_NULL
5928 * and the packet has been through at least one XFRM
5929 * transformation then we must be dealing with the "final"
5930 * form of labeled IPsec packet; since we've already applied
5931 * all of our access controls on this packet we can safely
5932 * pass the packet. */
5933 if (skb_sid == SECSID_NULL) {
5936 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5940 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5944 return NF_DROP_ERR(-ECONNREFUSED);
5947 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5949 secmark_perm = PACKET__SEND;
5951 /* Locally generated packet, fetch the security label from the
5952 * associated socket. */
5953 struct sk_security_struct *sksec = sk->sk_security;
5954 peer_sid = sksec->sid;
5955 secmark_perm = PACKET__SEND;
5958 ad.type = LSM_AUDIT_DATA_NET;
5960 ad.u.net->netif = ifindex;
5961 ad.u.net->family = family;
5962 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5966 if (avc_has_perm(&selinux_state,
5967 peer_sid, skb->secmark,
5968 SECCLASS_PACKET, secmark_perm, &ad))
5969 return NF_DROP_ERR(-ECONNREFUSED);
5971 if (peerlbl_active) {
5975 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5977 if (avc_has_perm(&selinux_state,
5979 SECCLASS_NETIF, NETIF__EGRESS, &ad))
5980 return NF_DROP_ERR(-ECONNREFUSED);
5982 if (sel_netnode_sid(addrp, family, &node_sid))
5984 if (avc_has_perm(&selinux_state,
5986 SECCLASS_NODE, NODE__SENDTO, &ad))
5987 return NF_DROP_ERR(-ECONNREFUSED);
5993 static unsigned int selinux_ipv4_postroute(void *priv,
5994 struct sk_buff *skb,
5995 const struct nf_hook_state *state)
5997 return selinux_ip_postroute(skb, state->out, PF_INET);
6000 #if IS_ENABLED(CONFIG_IPV6)
6001 static unsigned int selinux_ipv6_postroute(void *priv,
6002 struct sk_buff *skb,
6003 const struct nf_hook_state *state)
6005 return selinux_ip_postroute(skb, state->out, PF_INET6);
6009 #endif /* CONFIG_NETFILTER */
6011 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
6014 unsigned int msg_len;
6015 unsigned int data_len = skb->len;
6016 unsigned char *data = skb->data;
6017 struct nlmsghdr *nlh;
6018 struct sk_security_struct *sksec = sk->sk_security;
6019 u16 sclass = sksec->sclass;
6022 while (data_len >= nlmsg_total_size(0)) {
6023 nlh = (struct nlmsghdr *)data;
6025 /* NOTE: the nlmsg_len field isn't reliably set by some netlink
6026 * users which means we can't reject skb's with bogus
6027 * length fields; our solution is to follow what
6028 * netlink_rcv_skb() does and simply skip processing at
6029 * messages with length fields that are clearly junk
6031 if (nlh->nlmsg_len < NLMSG_HDRLEN || nlh->nlmsg_len > data_len)
6034 rc = selinux_nlmsg_lookup(sclass, nlh->nlmsg_type, &perm);
6036 rc = sock_has_perm(sk, perm);
6039 } else if (rc == -EINVAL) {
6040 /* -EINVAL is a missing msg/perm mapping */
6041 pr_warn_ratelimited("SELinux: unrecognized netlink"
6042 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
6043 " pid=%d comm=%s\n",
6044 sk->sk_protocol, nlh->nlmsg_type,
6045 secclass_map[sclass - 1].name,
6046 task_pid_nr(current), current->comm);
6047 if (enforcing_enabled(&selinux_state) &&
6048 !security_get_allow_unknown(&selinux_state))
6051 } else if (rc == -ENOENT) {
6052 /* -ENOENT is a missing socket/class mapping, ignore */
6058 /* move to the next message after applying netlink padding */
6059 msg_len = NLMSG_ALIGN(nlh->nlmsg_len);
6060 if (msg_len >= data_len)
6062 data_len -= msg_len;
6069 static void ipc_init_security(struct ipc_security_struct *isec, u16 sclass)
6071 isec->sclass = sclass;
6072 isec->sid = current_sid();
6075 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
6078 struct ipc_security_struct *isec;
6079 struct common_audit_data ad;
6080 u32 sid = current_sid();
6082 isec = selinux_ipc(ipc_perms);
6084 ad.type = LSM_AUDIT_DATA_IPC;
6085 ad.u.ipc_id = ipc_perms->key;
6087 return avc_has_perm(&selinux_state,
6088 sid, isec->sid, isec->sclass, perms, &ad);
6091 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
6093 struct msg_security_struct *msec;
6095 msec = selinux_msg_msg(msg);
6096 msec->sid = SECINITSID_UNLABELED;
6101 /* message queue security operations */
6102 static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
6104 struct ipc_security_struct *isec;
6105 struct common_audit_data ad;
6106 u32 sid = current_sid();
6109 isec = selinux_ipc(msq);
6110 ipc_init_security(isec, SECCLASS_MSGQ);
6112 ad.type = LSM_AUDIT_DATA_IPC;
6113 ad.u.ipc_id = msq->key;
6115 rc = avc_has_perm(&selinux_state,
6116 sid, isec->sid, SECCLASS_MSGQ,
6121 static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
6123 struct ipc_security_struct *isec;
6124 struct common_audit_data ad;
6125 u32 sid = current_sid();
6127 isec = selinux_ipc(msq);
6129 ad.type = LSM_AUDIT_DATA_IPC;
6130 ad.u.ipc_id = msq->key;
6132 return avc_has_perm(&selinux_state,
6133 sid, isec->sid, SECCLASS_MSGQ,
6134 MSGQ__ASSOCIATE, &ad);
6137 static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
6145 /* No specific object, just general system-wide information. */
6146 return avc_has_perm(&selinux_state,
6147 current_sid(), SECINITSID_KERNEL,
6148 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6152 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
6155 perms = MSGQ__SETATTR;
6158 perms = MSGQ__DESTROY;
6164 err = ipc_has_perm(msq, perms);
6168 static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
6170 struct ipc_security_struct *isec;
6171 struct msg_security_struct *msec;
6172 struct common_audit_data ad;
6173 u32 sid = current_sid();
6176 isec = selinux_ipc(msq);
6177 msec = selinux_msg_msg(msg);
6180 * First time through, need to assign label to the message
6182 if (msec->sid == SECINITSID_UNLABELED) {
6184 * Compute new sid based on current process and
6185 * message queue this message will be stored in
6187 rc = security_transition_sid(&selinux_state, sid, isec->sid,
6188 SECCLASS_MSG, NULL, &msec->sid);
6193 ad.type = LSM_AUDIT_DATA_IPC;
6194 ad.u.ipc_id = msq->key;
6196 /* Can this process write to the queue? */
6197 rc = avc_has_perm(&selinux_state,
6198 sid, isec->sid, SECCLASS_MSGQ,
6201 /* Can this process send the message */
6202 rc = avc_has_perm(&selinux_state,
6203 sid, msec->sid, SECCLASS_MSG,
6206 /* Can the message be put in the queue? */
6207 rc = avc_has_perm(&selinux_state,
6208 msec->sid, isec->sid, SECCLASS_MSGQ,
6209 MSGQ__ENQUEUE, &ad);
6214 static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
6215 struct task_struct *target,
6216 long type, int mode)
6218 struct ipc_security_struct *isec;
6219 struct msg_security_struct *msec;
6220 struct common_audit_data ad;
6221 u32 sid = task_sid_subj(target);
6224 isec = selinux_ipc(msq);
6225 msec = selinux_msg_msg(msg);
6227 ad.type = LSM_AUDIT_DATA_IPC;
6228 ad.u.ipc_id = msq->key;
6230 rc = avc_has_perm(&selinux_state,
6232 SECCLASS_MSGQ, MSGQ__READ, &ad);
6234 rc = avc_has_perm(&selinux_state,
6236 SECCLASS_MSG, MSG__RECEIVE, &ad);
6240 /* Shared Memory security operations */
6241 static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
6243 struct ipc_security_struct *isec;
6244 struct common_audit_data ad;
6245 u32 sid = current_sid();
6248 isec = selinux_ipc(shp);
6249 ipc_init_security(isec, SECCLASS_SHM);
6251 ad.type = LSM_AUDIT_DATA_IPC;
6252 ad.u.ipc_id = shp->key;
6254 rc = avc_has_perm(&selinux_state,
6255 sid, isec->sid, SECCLASS_SHM,
6260 static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
6262 struct ipc_security_struct *isec;
6263 struct common_audit_data ad;
6264 u32 sid = current_sid();
6266 isec = selinux_ipc(shp);
6268 ad.type = LSM_AUDIT_DATA_IPC;
6269 ad.u.ipc_id = shp->key;
6271 return avc_has_perm(&selinux_state,
6272 sid, isec->sid, SECCLASS_SHM,
6273 SHM__ASSOCIATE, &ad);
6276 /* Note, at this point, shp is locked down */
6277 static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
6285 /* No specific object, just general system-wide information. */
6286 return avc_has_perm(&selinux_state,
6287 current_sid(), SECINITSID_KERNEL,
6288 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6292 perms = SHM__GETATTR | SHM__ASSOCIATE;
6295 perms = SHM__SETATTR;
6302 perms = SHM__DESTROY;
6308 err = ipc_has_perm(shp, perms);
6312 static int selinux_shm_shmat(struct kern_ipc_perm *shp,
6313 char __user *shmaddr, int shmflg)
6317 if (shmflg & SHM_RDONLY)
6320 perms = SHM__READ | SHM__WRITE;
6322 return ipc_has_perm(shp, perms);
6325 /* Semaphore security operations */
6326 static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
6328 struct ipc_security_struct *isec;
6329 struct common_audit_data ad;
6330 u32 sid = current_sid();
6333 isec = selinux_ipc(sma);
6334 ipc_init_security(isec, SECCLASS_SEM);
6336 ad.type = LSM_AUDIT_DATA_IPC;
6337 ad.u.ipc_id = sma->key;
6339 rc = avc_has_perm(&selinux_state,
6340 sid, isec->sid, SECCLASS_SEM,
6345 static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
6347 struct ipc_security_struct *isec;
6348 struct common_audit_data ad;
6349 u32 sid = current_sid();
6351 isec = selinux_ipc(sma);
6353 ad.type = LSM_AUDIT_DATA_IPC;
6354 ad.u.ipc_id = sma->key;
6356 return avc_has_perm(&selinux_state,
6357 sid, isec->sid, SECCLASS_SEM,
6358 SEM__ASSOCIATE, &ad);
6361 /* Note, at this point, sma is locked down */
6362 static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
6370 /* No specific object, just general system-wide information. */
6371 return avc_has_perm(&selinux_state,
6372 current_sid(), SECINITSID_KERNEL,
6373 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6377 perms = SEM__GETATTR;
6388 perms = SEM__DESTROY;
6391 perms = SEM__SETATTR;
6396 perms = SEM__GETATTR | SEM__ASSOCIATE;
6402 err = ipc_has_perm(sma, perms);
6406 static int selinux_sem_semop(struct kern_ipc_perm *sma,
6407 struct sembuf *sops, unsigned nsops, int alter)
6412 perms = SEM__READ | SEM__WRITE;
6416 return ipc_has_perm(sma, perms);
6419 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6425 av |= IPC__UNIX_READ;
6427 av |= IPC__UNIX_WRITE;
6432 return ipc_has_perm(ipcp, av);
6435 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6437 struct ipc_security_struct *isec = selinux_ipc(ipcp);
6441 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
6444 inode_doinit_with_dentry(inode, dentry);
6447 static int selinux_getprocattr(struct task_struct *p,
6448 char *name, char **value)
6450 const struct task_security_struct *__tsec;
6456 __tsec = selinux_cred(__task_cred(p));
6459 error = avc_has_perm(&selinux_state,
6460 current_sid(), __tsec->sid,
6461 SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6466 if (!strcmp(name, "current"))
6468 else if (!strcmp(name, "prev"))
6470 else if (!strcmp(name, "exec"))
6471 sid = __tsec->exec_sid;
6472 else if (!strcmp(name, "fscreate"))
6473 sid = __tsec->create_sid;
6474 else if (!strcmp(name, "keycreate"))
6475 sid = __tsec->keycreate_sid;
6476 else if (!strcmp(name, "sockcreate"))
6477 sid = __tsec->sockcreate_sid;
6487 error = security_sid_to_context(&selinux_state, sid, value, &len);
6497 static int selinux_setprocattr(const char *name, void *value, size_t size)
6499 struct task_security_struct *tsec;
6501 u32 mysid = current_sid(), sid = 0, ptsid;
6506 * Basic control over ability to set these attributes at all.
6508 if (!strcmp(name, "exec"))
6509 error = avc_has_perm(&selinux_state,
6510 mysid, mysid, SECCLASS_PROCESS,
6511 PROCESS__SETEXEC, NULL);
6512 else if (!strcmp(name, "fscreate"))
6513 error = avc_has_perm(&selinux_state,
6514 mysid, mysid, SECCLASS_PROCESS,
6515 PROCESS__SETFSCREATE, NULL);
6516 else if (!strcmp(name, "keycreate"))
6517 error = avc_has_perm(&selinux_state,
6518 mysid, mysid, SECCLASS_PROCESS,
6519 PROCESS__SETKEYCREATE, NULL);
6520 else if (!strcmp(name, "sockcreate"))
6521 error = avc_has_perm(&selinux_state,
6522 mysid, mysid, SECCLASS_PROCESS,
6523 PROCESS__SETSOCKCREATE, NULL);
6524 else if (!strcmp(name, "current"))
6525 error = avc_has_perm(&selinux_state,
6526 mysid, mysid, SECCLASS_PROCESS,
6527 PROCESS__SETCURRENT, NULL);
6533 /* Obtain a SID for the context, if one was specified. */
6534 if (size && str[0] && str[0] != '\n') {
6535 if (str[size-1] == '\n') {
6539 error = security_context_to_sid(&selinux_state, value, size,
6541 if (error == -EINVAL && !strcmp(name, "fscreate")) {
6542 if (!has_cap_mac_admin(true)) {
6543 struct audit_buffer *ab;
6546 /* We strip a nul only if it is at the end, otherwise the
6547 * context contains a nul and we should audit that */
6548 if (str[size - 1] == '\0')
6549 audit_size = size - 1;
6552 ab = audit_log_start(audit_context(),
6555 audit_log_format(ab, "op=fscreate invalid_context=");
6556 audit_log_n_untrustedstring(ab, value, audit_size);
6561 error = security_context_to_sid_force(
6569 new = prepare_creds();
6573 /* Permission checking based on the specified context is
6574 performed during the actual operation (execve,
6575 open/mkdir/...), when we know the full context of the
6576 operation. See selinux_bprm_creds_for_exec for the execve
6577 checks and may_create for the file creation checks. The
6578 operation will then fail if the context is not permitted. */
6579 tsec = selinux_cred(new);
6580 if (!strcmp(name, "exec")) {
6581 tsec->exec_sid = sid;
6582 } else if (!strcmp(name, "fscreate")) {
6583 tsec->create_sid = sid;
6584 } else if (!strcmp(name, "keycreate")) {
6586 error = avc_has_perm(&selinux_state, mysid, sid,
6587 SECCLASS_KEY, KEY__CREATE, NULL);
6591 tsec->keycreate_sid = sid;
6592 } else if (!strcmp(name, "sockcreate")) {
6593 tsec->sockcreate_sid = sid;
6594 } else if (!strcmp(name, "current")) {
6599 /* Only allow single threaded processes to change context */
6601 if (!current_is_single_threaded()) {
6602 error = security_bounded_transition(&selinux_state,
6608 /* Check permissions for the transition. */
6609 error = avc_has_perm(&selinux_state,
6610 tsec->sid, sid, SECCLASS_PROCESS,
6611 PROCESS__DYNTRANSITION, NULL);
6615 /* Check for ptracing, and update the task SID if ok.
6616 Otherwise, leave SID unchanged and fail. */
6617 ptsid = ptrace_parent_sid();
6619 error = avc_has_perm(&selinux_state,
6620 ptsid, sid, SECCLASS_PROCESS,
6621 PROCESS__PTRACE, NULL);
6640 static int selinux_ismaclabel(const char *name)
6642 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6645 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6647 return security_sid_to_context(&selinux_state, secid,
6651 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6653 return security_context_to_sid(&selinux_state, secdata, seclen,
6657 static void selinux_release_secctx(char *secdata, u32 seclen)
6662 static void selinux_inode_invalidate_secctx(struct inode *inode)
6664 struct inode_security_struct *isec = selinux_inode(inode);
6666 spin_lock(&isec->lock);
6667 isec->initialized = LABEL_INVALID;
6668 spin_unlock(&isec->lock);
6672 * called with inode->i_mutex locked
6674 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6676 int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
6678 /* Do not return error when suppressing label (SBLABEL_MNT not set). */
6679 return rc == -EOPNOTSUPP ? 0 : rc;
6683 * called with inode->i_mutex locked
6685 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6687 return __vfs_setxattr_noperm(&init_user_ns, dentry, XATTR_NAME_SELINUX,
6691 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6694 len = selinux_inode_getsecurity(&init_user_ns, inode,
6695 XATTR_SELINUX_SUFFIX, ctx, true);
6703 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6704 unsigned long flags)
6706 const struct task_security_struct *tsec;
6707 struct key_security_struct *ksec;
6709 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6713 tsec = selinux_cred(cred);
6714 if (tsec->keycreate_sid)
6715 ksec->sid = tsec->keycreate_sid;
6717 ksec->sid = tsec->sid;
6723 static void selinux_key_free(struct key *k)
6725 struct key_security_struct *ksec = k->security;
6731 static int selinux_key_permission(key_ref_t key_ref,
6732 const struct cred *cred,
6733 enum key_need_perm need_perm)
6736 struct key_security_struct *ksec;
6739 switch (need_perm) {
6746 case KEY_NEED_WRITE:
6749 case KEY_NEED_SEARCH:
6755 case KEY_NEED_SETATTR:
6756 perm = KEY__SETATTR;
6758 case KEY_NEED_UNLINK:
6759 case KEY_SYSADMIN_OVERRIDE:
6760 case KEY_AUTHTOKEN_OVERRIDE:
6761 case KEY_DEFER_PERM_CHECK:
6769 sid = cred_sid(cred);
6770 key = key_ref_to_ptr(key_ref);
6771 ksec = key->security;
6773 return avc_has_perm(&selinux_state,
6774 sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6777 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6779 struct key_security_struct *ksec = key->security;
6780 char *context = NULL;
6784 rc = security_sid_to_context(&selinux_state, ksec->sid,
6792 #ifdef CONFIG_KEY_NOTIFICATIONS
6793 static int selinux_watch_key(struct key *key)
6795 struct key_security_struct *ksec = key->security;
6796 u32 sid = current_sid();
6798 return avc_has_perm(&selinux_state,
6799 sid, ksec->sid, SECCLASS_KEY, KEY__VIEW, NULL);
6804 #ifdef CONFIG_SECURITY_INFINIBAND
6805 static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6807 struct common_audit_data ad;
6810 struct ib_security_struct *sec = ib_sec;
6811 struct lsm_ibpkey_audit ibpkey;
6813 err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6817 ad.type = LSM_AUDIT_DATA_IBPKEY;
6818 ibpkey.subnet_prefix = subnet_prefix;
6819 ibpkey.pkey = pkey_val;
6820 ad.u.ibpkey = &ibpkey;
6821 return avc_has_perm(&selinux_state,
6823 SECCLASS_INFINIBAND_PKEY,
6824 INFINIBAND_PKEY__ACCESS, &ad);
6827 static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6830 struct common_audit_data ad;
6833 struct ib_security_struct *sec = ib_sec;
6834 struct lsm_ibendport_audit ibendport;
6836 err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6842 ad.type = LSM_AUDIT_DATA_IBENDPORT;
6843 ibendport.dev_name = dev_name;
6844 ibendport.port = port_num;
6845 ad.u.ibendport = &ibendport;
6846 return avc_has_perm(&selinux_state,
6848 SECCLASS_INFINIBAND_ENDPORT,
6849 INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6852 static int selinux_ib_alloc_security(void **ib_sec)
6854 struct ib_security_struct *sec;
6856 sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6859 sec->sid = current_sid();
6865 static void selinux_ib_free_security(void *ib_sec)
6871 #ifdef CONFIG_BPF_SYSCALL
6872 static int selinux_bpf(int cmd, union bpf_attr *attr,
6875 u32 sid = current_sid();
6879 case BPF_MAP_CREATE:
6880 ret = avc_has_perm(&selinux_state,
6881 sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
6885 ret = avc_has_perm(&selinux_state,
6886 sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
6897 static u32 bpf_map_fmode_to_av(fmode_t fmode)
6901 if (fmode & FMODE_READ)
6902 av |= BPF__MAP_READ;
6903 if (fmode & FMODE_WRITE)
6904 av |= BPF__MAP_WRITE;
6908 /* This function will check the file pass through unix socket or binder to see
6909 * if it is a bpf related object. And apply correspinding checks on the bpf
6910 * object based on the type. The bpf maps and programs, not like other files and
6911 * socket, are using a shared anonymous inode inside the kernel as their inode.
6912 * So checking that inode cannot identify if the process have privilege to
6913 * access the bpf object and that's why we have to add this additional check in
6914 * selinux_file_receive and selinux_binder_transfer_files.
6916 static int bpf_fd_pass(struct file *file, u32 sid)
6918 struct bpf_security_struct *bpfsec;
6919 struct bpf_prog *prog;
6920 struct bpf_map *map;
6923 if (file->f_op == &bpf_map_fops) {
6924 map = file->private_data;
6925 bpfsec = map->security;
6926 ret = avc_has_perm(&selinux_state,
6927 sid, bpfsec->sid, SECCLASS_BPF,
6928 bpf_map_fmode_to_av(file->f_mode), NULL);
6931 } else if (file->f_op == &bpf_prog_fops) {
6932 prog = file->private_data;
6933 bpfsec = prog->aux->security;
6934 ret = avc_has_perm(&selinux_state,
6935 sid, bpfsec->sid, SECCLASS_BPF,
6936 BPF__PROG_RUN, NULL);
6943 static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6945 u32 sid = current_sid();
6946 struct bpf_security_struct *bpfsec;
6948 bpfsec = map->security;
6949 return avc_has_perm(&selinux_state,
6950 sid, bpfsec->sid, SECCLASS_BPF,
6951 bpf_map_fmode_to_av(fmode), NULL);
6954 static int selinux_bpf_prog(struct bpf_prog *prog)
6956 u32 sid = current_sid();
6957 struct bpf_security_struct *bpfsec;
6959 bpfsec = prog->aux->security;
6960 return avc_has_perm(&selinux_state,
6961 sid, bpfsec->sid, SECCLASS_BPF,
6962 BPF__PROG_RUN, NULL);
6965 static int selinux_bpf_map_alloc(struct bpf_map *map)
6967 struct bpf_security_struct *bpfsec;
6969 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6973 bpfsec->sid = current_sid();
6974 map->security = bpfsec;
6979 static void selinux_bpf_map_free(struct bpf_map *map)
6981 struct bpf_security_struct *bpfsec = map->security;
6983 map->security = NULL;
6987 static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6989 struct bpf_security_struct *bpfsec;
6991 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6995 bpfsec->sid = current_sid();
6996 aux->security = bpfsec;
7001 static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
7003 struct bpf_security_struct *bpfsec = aux->security;
7005 aux->security = NULL;
7010 static int selinux_lockdown(enum lockdown_reason what)
7012 struct common_audit_data ad;
7013 u32 sid = current_sid();
7014 int invalid_reason = (what <= LOCKDOWN_NONE) ||
7015 (what == LOCKDOWN_INTEGRITY_MAX) ||
7016 (what >= LOCKDOWN_CONFIDENTIALITY_MAX);
7018 if (WARN(invalid_reason, "Invalid lockdown reason")) {
7019 audit_log(audit_context(),
7020 GFP_ATOMIC, AUDIT_SELINUX_ERR,
7021 "lockdown_reason=invalid");
7025 ad.type = LSM_AUDIT_DATA_LOCKDOWN;
7028 if (what <= LOCKDOWN_INTEGRITY_MAX)
7029 return avc_has_perm(&selinux_state,
7030 sid, sid, SECCLASS_LOCKDOWN,
7031 LOCKDOWN__INTEGRITY, &ad);
7033 return avc_has_perm(&selinux_state,
7034 sid, sid, SECCLASS_LOCKDOWN,
7035 LOCKDOWN__CONFIDENTIALITY, &ad);
7038 struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = {
7039 .lbs_cred = sizeof(struct task_security_struct),
7040 .lbs_file = sizeof(struct file_security_struct),
7041 .lbs_inode = sizeof(struct inode_security_struct),
7042 .lbs_ipc = sizeof(struct ipc_security_struct),
7043 .lbs_msg_msg = sizeof(struct msg_security_struct),
7044 .lbs_superblock = sizeof(struct superblock_security_struct),
7047 #ifdef CONFIG_PERF_EVENTS
7048 static int selinux_perf_event_open(struct perf_event_attr *attr, int type)
7050 u32 requested, sid = current_sid();
7052 if (type == PERF_SECURITY_OPEN)
7053 requested = PERF_EVENT__OPEN;
7054 else if (type == PERF_SECURITY_CPU)
7055 requested = PERF_EVENT__CPU;
7056 else if (type == PERF_SECURITY_KERNEL)
7057 requested = PERF_EVENT__KERNEL;
7058 else if (type == PERF_SECURITY_TRACEPOINT)
7059 requested = PERF_EVENT__TRACEPOINT;
7063 return avc_has_perm(&selinux_state, sid, sid, SECCLASS_PERF_EVENT,
7067 static int selinux_perf_event_alloc(struct perf_event *event)
7069 struct perf_event_security_struct *perfsec;
7071 perfsec = kzalloc(sizeof(*perfsec), GFP_KERNEL);
7075 perfsec->sid = current_sid();
7076 event->security = perfsec;
7081 static void selinux_perf_event_free(struct perf_event *event)
7083 struct perf_event_security_struct *perfsec = event->security;
7085 event->security = NULL;
7089 static int selinux_perf_event_read(struct perf_event *event)
7091 struct perf_event_security_struct *perfsec = event->security;
7092 u32 sid = current_sid();
7094 return avc_has_perm(&selinux_state, sid, perfsec->sid,
7095 SECCLASS_PERF_EVENT, PERF_EVENT__READ, NULL);
7098 static int selinux_perf_event_write(struct perf_event *event)
7100 struct perf_event_security_struct *perfsec = event->security;
7101 u32 sid = current_sid();
7103 return avc_has_perm(&selinux_state, sid, perfsec->sid,
7104 SECCLASS_PERF_EVENT, PERF_EVENT__WRITE, NULL);
7109 * IMPORTANT NOTE: When adding new hooks, please be careful to keep this order:
7110 * 1. any hooks that don't belong to (2.) or (3.) below,
7111 * 2. hooks that both access structures allocated by other hooks, and allocate
7112 * structures that can be later accessed by other hooks (mostly "cloning"
7114 * 3. hooks that only allocate structures that can be later accessed by other
7115 * hooks ("allocating" hooks).
7117 * Please follow block comment delimiters in the list to keep this order.
7119 * This ordering is needed for SELinux runtime disable to work at least somewhat
7120 * safely. Breaking the ordering rules above might lead to NULL pointer derefs
7121 * when disabling SELinux at runtime.
7123 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
7124 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
7125 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
7126 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
7127 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
7129 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
7130 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
7131 LSM_HOOK_INIT(capget, selinux_capget),
7132 LSM_HOOK_INIT(capset, selinux_capset),
7133 LSM_HOOK_INIT(capable, selinux_capable),
7134 LSM_HOOK_INIT(quotactl, selinux_quotactl),
7135 LSM_HOOK_INIT(quota_on, selinux_quota_on),
7136 LSM_HOOK_INIT(syslog, selinux_syslog),
7137 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
7139 LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
7141 LSM_HOOK_INIT(bprm_creds_for_exec, selinux_bprm_creds_for_exec),
7142 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
7143 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
7145 LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts),
7146 LSM_HOOK_INIT(sb_mnt_opts_compat, selinux_sb_mnt_opts_compat),
7147 LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
7148 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
7149 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
7150 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
7151 LSM_HOOK_INIT(sb_mount, selinux_mount),
7152 LSM_HOOK_INIT(sb_umount, selinux_umount),
7153 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
7154 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
7156 LSM_HOOK_INIT(move_mount, selinux_move_mount),
7158 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
7159 LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
7161 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
7162 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
7163 LSM_HOOK_INIT(inode_init_security_anon, selinux_inode_init_security_anon),
7164 LSM_HOOK_INIT(inode_create, selinux_inode_create),
7165 LSM_HOOK_INIT(inode_link, selinux_inode_link),
7166 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
7167 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
7168 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
7169 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
7170 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
7171 LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
7172 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
7173 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
7174 LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
7175 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
7176 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
7177 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
7178 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
7179 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
7180 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
7181 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
7182 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
7183 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
7184 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
7185 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
7186 LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
7187 LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
7188 LSM_HOOK_INIT(path_notify, selinux_path_notify),
7190 LSM_HOOK_INIT(kernfs_init_security, selinux_kernfs_init_security),
7192 LSM_HOOK_INIT(file_permission, selinux_file_permission),
7193 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
7194 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
7195 LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
7196 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
7197 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
7198 LSM_HOOK_INIT(file_lock, selinux_file_lock),
7199 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
7200 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
7201 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
7202 LSM_HOOK_INIT(file_receive, selinux_file_receive),
7204 LSM_HOOK_INIT(file_open, selinux_file_open),
7206 LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
7207 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
7208 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
7209 LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
7210 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
7211 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
7212 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
7213 LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
7214 LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
7215 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
7216 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
7217 LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
7218 LSM_HOOK_INIT(task_getsecid_subj, selinux_task_getsecid_subj),
7219 LSM_HOOK_INIT(task_getsecid_obj, selinux_task_getsecid_obj),
7220 LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
7221 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
7222 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
7223 LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
7224 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
7225 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
7226 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
7227 LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
7228 LSM_HOOK_INIT(task_kill, selinux_task_kill),
7229 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
7231 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
7232 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
7234 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
7235 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
7236 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
7237 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
7239 LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
7240 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
7241 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
7243 LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
7244 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
7245 LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
7247 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
7249 LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
7250 LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
7252 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
7253 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
7254 LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
7255 LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
7256 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
7257 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
7259 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
7260 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
7262 LSM_HOOK_INIT(socket_create, selinux_socket_create),
7263 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
7264 LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
7265 LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
7266 LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
7267 LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
7268 LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
7269 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
7270 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
7271 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
7272 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
7273 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
7274 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
7275 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
7276 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
7277 LSM_HOOK_INIT(socket_getpeersec_stream,
7278 selinux_socket_getpeersec_stream),
7279 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
7280 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
7281 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
7282 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
7283 LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
7284 LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
7285 LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
7286 LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
7287 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
7288 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
7289 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
7290 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
7291 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
7292 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
7293 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
7294 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
7295 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
7296 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
7297 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
7298 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
7299 #ifdef CONFIG_SECURITY_INFINIBAND
7300 LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
7301 LSM_HOOK_INIT(ib_endport_manage_subnet,
7302 selinux_ib_endport_manage_subnet),
7303 LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
7305 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7306 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
7307 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
7308 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
7309 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
7310 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
7311 LSM_HOOK_INIT(xfrm_state_pol_flow_match,
7312 selinux_xfrm_state_pol_flow_match),
7313 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
7317 LSM_HOOK_INIT(key_free, selinux_key_free),
7318 LSM_HOOK_INIT(key_permission, selinux_key_permission),
7319 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
7320 #ifdef CONFIG_KEY_NOTIFICATIONS
7321 LSM_HOOK_INIT(watch_key, selinux_watch_key),
7326 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
7327 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
7328 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
7331 #ifdef CONFIG_BPF_SYSCALL
7332 LSM_HOOK_INIT(bpf, selinux_bpf),
7333 LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
7334 LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
7335 LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
7336 LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
7339 #ifdef CONFIG_PERF_EVENTS
7340 LSM_HOOK_INIT(perf_event_open, selinux_perf_event_open),
7341 LSM_HOOK_INIT(perf_event_free, selinux_perf_event_free),
7342 LSM_HOOK_INIT(perf_event_read, selinux_perf_event_read),
7343 LSM_HOOK_INIT(perf_event_write, selinux_perf_event_write),
7346 LSM_HOOK_INIT(locked_down, selinux_lockdown),
7349 * PUT "CLONING" (ACCESSING + ALLOCATING) HOOKS HERE
7351 LSM_HOOK_INIT(fs_context_dup, selinux_fs_context_dup),
7352 LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param),
7353 LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts),
7354 LSM_HOOK_INIT(sb_add_mnt_opt, selinux_add_mnt_opt),
7355 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7356 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
7360 * PUT "ALLOCATING" HOOKS HERE
7362 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
7363 LSM_HOOK_INIT(msg_queue_alloc_security,
7364 selinux_msg_queue_alloc_security),
7365 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
7366 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
7367 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
7368 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
7369 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
7370 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
7371 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
7372 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
7373 #ifdef CONFIG_SECURITY_INFINIBAND
7374 LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
7376 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7377 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
7378 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
7379 LSM_HOOK_INIT(xfrm_state_alloc_acquire,
7380 selinux_xfrm_state_alloc_acquire),
7383 LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
7386 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
7388 #ifdef CONFIG_BPF_SYSCALL
7389 LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
7390 LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
7392 #ifdef CONFIG_PERF_EVENTS
7393 LSM_HOOK_INIT(perf_event_alloc, selinux_perf_event_alloc),
7397 static __init int selinux_init(void)
7399 pr_info("SELinux: Initializing.\n");
7401 memset(&selinux_state, 0, sizeof(selinux_state));
7402 enforcing_set(&selinux_state, selinux_enforcing_boot);
7403 checkreqprot_set(&selinux_state, selinux_checkreqprot_boot);
7404 selinux_avc_init(&selinux_state.avc);
7405 mutex_init(&selinux_state.status_lock);
7406 mutex_init(&selinux_state.policy_mutex);
7408 /* Set the security state for the initial task. */
7409 cred_init_security();
7411 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
7417 ebitmap_cache_init();
7419 hashtab_cache_init();
7421 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
7423 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
7424 panic("SELinux: Unable to register AVC netcache callback\n");
7426 if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7427 panic("SELinux: Unable to register AVC LSM notifier callback\n");
7429 if (selinux_enforcing_boot)
7430 pr_debug("SELinux: Starting in enforcing mode\n");
7432 pr_debug("SELinux: Starting in permissive mode\n");
7434 fs_validate_description("selinux", selinux_fs_parameters);
7439 static void delayed_superblock_init(struct super_block *sb, void *unused)
7441 selinux_set_mnt_opts(sb, NULL, 0, NULL);
7444 void selinux_complete_init(void)
7446 pr_debug("SELinux: Completing initialization.\n");
7448 /* Set up any superblocks initialized prior to the policy load. */
7449 pr_debug("SELinux: Setting up existing superblocks.\n");
7450 iterate_supers(delayed_superblock_init, NULL);
7453 /* SELinux requires early initialization in order to label
7454 all processes and objects when they are created. */
7455 DEFINE_LSM(selinux) = {
7457 .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
7458 .enabled = &selinux_enabled_boot,
7459 .blobs = &selinux_blob_sizes,
7460 .init = selinux_init,
7463 #if defined(CONFIG_NETFILTER)
7465 static const struct nf_hook_ops selinux_nf_ops[] = {
7467 .hook = selinux_ipv4_postroute,
7469 .hooknum = NF_INET_POST_ROUTING,
7470 .priority = NF_IP_PRI_SELINUX_LAST,
7473 .hook = selinux_ipv4_forward,
7475 .hooknum = NF_INET_FORWARD,
7476 .priority = NF_IP_PRI_SELINUX_FIRST,
7479 .hook = selinux_ipv4_output,
7481 .hooknum = NF_INET_LOCAL_OUT,
7482 .priority = NF_IP_PRI_SELINUX_FIRST,
7484 #if IS_ENABLED(CONFIG_IPV6)
7486 .hook = selinux_ipv6_postroute,
7488 .hooknum = NF_INET_POST_ROUTING,
7489 .priority = NF_IP6_PRI_SELINUX_LAST,
7492 .hook = selinux_ipv6_forward,
7494 .hooknum = NF_INET_FORWARD,
7495 .priority = NF_IP6_PRI_SELINUX_FIRST,
7498 .hook = selinux_ipv6_output,
7500 .hooknum = NF_INET_LOCAL_OUT,
7501 .priority = NF_IP6_PRI_SELINUX_FIRST,
7506 static int __net_init selinux_nf_register(struct net *net)
7508 return nf_register_net_hooks(net, selinux_nf_ops,
7509 ARRAY_SIZE(selinux_nf_ops));
7512 static void __net_exit selinux_nf_unregister(struct net *net)
7514 nf_unregister_net_hooks(net, selinux_nf_ops,
7515 ARRAY_SIZE(selinux_nf_ops));
7518 static struct pernet_operations selinux_net_ops = {
7519 .init = selinux_nf_register,
7520 .exit = selinux_nf_unregister,
7523 static int __init selinux_nf_ip_init(void)
7527 if (!selinux_enabled_boot)
7530 pr_debug("SELinux: Registering netfilter hooks\n");
7532 err = register_pernet_subsys(&selinux_net_ops);
7534 panic("SELinux: register_pernet_subsys: error %d\n", err);
7538 __initcall(selinux_nf_ip_init);
7540 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7541 static void selinux_nf_ip_exit(void)
7543 pr_debug("SELinux: Unregistering netfilter hooks\n");
7545 unregister_pernet_subsys(&selinux_net_ops);
7549 #else /* CONFIG_NETFILTER */
7551 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7552 #define selinux_nf_ip_exit()
7555 #endif /* CONFIG_NETFILTER */
7557 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7558 int selinux_disable(struct selinux_state *state)
7560 if (selinux_initialized(state)) {
7561 /* Not permitted after initial policy load. */
7565 if (selinux_disabled(state)) {
7566 /* Only do this once. */
7570 selinux_mark_disabled(state);
7572 pr_info("SELinux: Disabled at runtime.\n");
7575 * Unregister netfilter hooks.
7576 * Must be done before security_delete_hooks() to avoid breaking
7579 selinux_nf_ip_exit();
7581 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
7583 /* Try to destroy the avc node cache */
7586 /* Unregister selinuxfs. */