blob: 0c2ac318aa7fb8bc11830e7c8c10fe6730f49c46 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
Eric Paris828dfe12008-04-17 13:17:49 -04007 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070010 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
Eric Paris2069f452008-07-04 09:47:13 +100012 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
Linus Torvalds1da177e2005-04-16 15:20:36 -070014 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
Eric Paris828dfe12008-04-17 13:17:49 -040015 * <dgoeddel@trustedcs.com>
Paul Mooreed6d76e2009-08-28 18:12:49 -040016 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
Paul Moore82c21bf2011-08-01 11:10:33 +000017 * Paul Moore <paul@paul-moore.com>
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +090018 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
Eric Paris828dfe12008-04-17 13:17:49 -040019 * Yuichi Nakamura <ynakam@hitachisoft.jp>
Linus Torvalds1da177e2005-04-16 15:20:36 -070020 *
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
Eric Paris828dfe12008-04-17 13:17:49 -040023 * as published by the Free Software Foundation.
Linus Torvalds1da177e2005-04-16 15:20:36 -070024 */
25
Linus Torvalds1da177e2005-04-16 15:20:36 -070026#include <linux/init.h>
Eric Paris0b24dcb2011-02-25 15:39:20 -050027#include <linux/kd.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070028#include <linux/kernel.h>
Roland McGrath0d094ef2008-07-25 19:45:49 -070029#include <linux/tracehook.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070030#include <linux/errno.h>
Ingo Molnar3f07c012017-02-08 18:51:30 +010031#include <linux/sched/signal.h>
Ingo Molnar29930022017-02-08 18:51:36 +010032#include <linux/sched/task.h>
Casey Schaufler3c4ed7b2015-05-02 15:10:46 -070033#include <linux/lsm_hooks.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070034#include <linux/xattr.h>
35#include <linux/capability.h>
36#include <linux/unistd.h>
37#include <linux/mm.h>
38#include <linux/mman.h>
39#include <linux/slab.h>
40#include <linux/pagemap.h>
Eric Paris0b24dcb2011-02-25 15:39:20 -050041#include <linux/proc_fs.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070042#include <linux/swap.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070043#include <linux/spinlock.h>
44#include <linux/syscalls.h>
Eric Paris2a7dba32011-02-01 11:05:39 -050045#include <linux/dcache.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070046#include <linux/file.h>
Al Viro9f3acc32008-04-24 07:44:08 -040047#include <linux/fdtable.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070048#include <linux/namei.h>
49#include <linux/mount.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070050#include <linux/netfilter_ipv4.h>
51#include <linux/netfilter_ipv6.h>
52#include <linux/tty.h>
53#include <net/icmp.h>
Stephen Hemminger227b60f2007-10-10 17:30:46 -070054#include <net/ip.h> /* for local_port_range[] */
Linus Torvalds1da177e2005-04-16 15:20:36 -070055#include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
Paul Moore47180062013-12-04 16:10:45 -050056#include <net/inet_connection_sock.h>
Paul Moore220deb92008-01-29 08:38:23 -050057#include <net/net_namespace.h>
Paul Moored621d352008-01-29 08:43:36 -050058#include <net/netlabel.h>
Eric Parisf5269712008-05-14 11:27:45 -040059#include <linux/uaccess.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070060#include <asm/ioctls.h>
Arun Sharma600634972011-07-26 16:09:06 -070061#include <linux/atomic.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070062#include <linux/bitops.h>
63#include <linux/interrupt.h>
64#include <linux/netdevice.h> /* for network interface checks */
Hong zhi guo77954982013-03-27 06:49:35 +000065#include <net/netlink.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070066#include <linux/tcp.h>
67#include <linux/udp.h>
James Morris2ee92d42006-11-13 16:09:01 -080068#include <linux/dccp.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070069#include <linux/quota.h>
70#include <linux/un.h> /* for Unix socket types */
71#include <net/af_unix.h> /* for Unix socket types */
72#include <linux/parser.h>
73#include <linux/nfs_mount.h>
74#include <net/ipv6.h>
75#include <linux/hugetlb.h>
76#include <linux/personality.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070077#include <linux/audit.h>
Eric Paris6931dfc2005-06-30 02:58:51 -070078#include <linux/string.h>
Catherine Zhang877ce7c2006-06-29 12:27:47 -070079#include <linux/selinux.h>
Eric Paris23970742006-09-25 23:32:01 -070080#include <linux/mutex.h>
Frank Mayharf06febc2008-09-12 09:54:39 -070081#include <linux/posix-timers.h>
Kees Cook00234592010-02-03 15:36:43 -080082#include <linux/syslog.h>
Serge E. Hallyn34867402011-03-23 16:43:17 -070083#include <linux/user_namespace.h>
Paul Gortmaker44fc7ea2011-05-26 20:52:10 -040084#include <linux/export.h>
Al Viro40401532012-02-13 03:58:52 +000085#include <linux/msg.h>
86#include <linux/shm.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070087
88#include "avc.h"
89#include "objsec.h"
90#include "netif.h"
Paul Moore224dfbd2008-01-29 08:38:13 -050091#include "netnode.h"
Paul Moore3e1121722008-04-10 10:48:14 -040092#include "netport.h"
Trent Jaegerd28d1e02005-12-13 23:12:40 -080093#include "xfrm.h"
Paul Moorec60475b2007-02-28 15:14:23 -050094#include "netlabel.h"
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +020095#include "audit.h"
James Morris7b98a582011-08-30 12:52:32 +100096#include "avc_ss.h"
Linus Torvalds1da177e2005-04-16 15:20:36 -070097
Paul Moored621d352008-01-29 08:43:36 -050098/* SECMARK reference count */
James Morris56a4ca92011-08-17 11:08:43 +100099static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
Paul Moored621d352008-01-29 08:43:36 -0500100
Linus Torvalds1da177e2005-04-16 15:20:36 -0700101#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
Eric Paris828dfe12008-04-17 13:17:49 -0400102int selinux_enforcing;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700103
104static int __init enforcing_setup(char *str)
105{
Eric Parisf5269712008-05-14 11:27:45 -0400106 unsigned long enforcing;
Jingoo Han29707b22014-02-05 15:13:14 +0900107 if (!kstrtoul(str, 0, &enforcing))
Eric Parisf5269712008-05-14 11:27:45 -0400108 selinux_enforcing = enforcing ? 1 : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700109 return 1;
110}
111__setup("enforcing=", enforcing_setup);
112#endif
113
114#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
115int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
116
117static int __init selinux_enabled_setup(char *str)
118{
Eric Parisf5269712008-05-14 11:27:45 -0400119 unsigned long enabled;
Jingoo Han29707b22014-02-05 15:13:14 +0900120 if (!kstrtoul(str, 0, &enabled))
Eric Parisf5269712008-05-14 11:27:45 -0400121 selinux_enabled = enabled ? 1 : 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700122 return 1;
123}
124__setup("selinux=", selinux_enabled_setup);
Stephen Smalley30d55282006-05-03 10:52:36 -0400125#else
126int selinux_enabled = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700127#endif
128
Christoph Lametere18b8902006-12-06 20:33:20 -0800129static struct kmem_cache *sel_inode_cache;
Sangwoo63205652015-10-21 17:44:30 -0400130static struct kmem_cache *file_security_cache;
James Morris7cae7e22006-03-22 00:09:22 -0800131
Paul Moored621d352008-01-29 08:43:36 -0500132/**
133 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
134 *
135 * Description:
136 * This function checks the SECMARK reference counter to see if any SECMARK
137 * targets are currently configured, if the reference counter is greater than
138 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
Chris PeBenito2be4d742013-05-03 09:05:39 -0400139 * enabled, false (0) if SECMARK is disabled. If the always_check_network
140 * policy capability is enabled, SECMARK is always considered enabled.
Paul Moored621d352008-01-29 08:43:36 -0500141 *
142 */
143static int selinux_secmark_enabled(void)
144{
Chris PeBenito2be4d742013-05-03 09:05:39 -0400145 return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
146}
147
148/**
149 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
150 *
151 * Description:
152 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
153 * (1) if any are enabled or false (0) if neither are enabled. If the
154 * always_check_network policy capability is enabled, peer labeling
155 * is always considered enabled.
156 *
157 */
158static int selinux_peerlbl_enabled(void)
159{
160 return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
Paul Moored621d352008-01-29 08:43:36 -0500161}
162
Paul Moore615e51f2014-06-26 14:33:56 -0400163static int selinux_netcache_avc_callback(u32 event)
164{
165 if (event == AVC_CALLBACK_RESET) {
166 sel_netif_flush();
167 sel_netnode_flush();
168 sel_netport_flush();
169 synchronize_net();
170 }
171 return 0;
172}
173
David Howellsd84f4f92008-11-14 10:39:23 +1100174/*
175 * initialise the security for the init task
176 */
177static void cred_init_security(void)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700178{
David Howells3b11a1d2008-11-14 10:39:26 +1100179 struct cred *cred = (struct cred *) current->real_cred;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700180 struct task_security_struct *tsec;
181
James Morris89d155e2005-10-30 14:59:21 -0800182 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700183 if (!tsec)
David Howellsd84f4f92008-11-14 10:39:23 +1100184 panic("SELinux: Failed to initialize initial task.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -0700185
David Howellsd84f4f92008-11-14 10:39:23 +1100186 tsec->osid = tsec->sid = SECINITSID_KERNEL;
David Howellsf1752ee2008-11-14 10:39:17 +1100187 cred->security = tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700188}
189
David Howells275bb412008-11-14 10:39:19 +1100190/*
David Howells88e67f32008-11-14 10:39:21 +1100191 * get the security ID of a set of credentials
192 */
193static inline u32 cred_sid(const struct cred *cred)
194{
195 const struct task_security_struct *tsec;
196
197 tsec = cred->security;
198 return tsec->sid;
199}
200
201/*
David Howells3b11a1d2008-11-14 10:39:26 +1100202 * get the objective security ID of a task
David Howells275bb412008-11-14 10:39:19 +1100203 */
204static inline u32 task_sid(const struct task_struct *task)
205{
David Howells275bb412008-11-14 10:39:19 +1100206 u32 sid;
207
208 rcu_read_lock();
David Howells88e67f32008-11-14 10:39:21 +1100209 sid = cred_sid(__task_cred(task));
David Howells275bb412008-11-14 10:39:19 +1100210 rcu_read_unlock();
211 return sid;
212}
213
David Howells88e67f32008-11-14 10:39:21 +1100214/* Allocate and free functions for each kind of security blob. */
215
Linus Torvalds1da177e2005-04-16 15:20:36 -0700216static int inode_alloc_security(struct inode *inode)
217{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700218 struct inode_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +1100219 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700220
Josef Bacika02fe132008-04-04 09:35:05 +1100221 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700222 if (!isec)
223 return -ENOMEM;
224
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +0100225 spin_lock_init(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700226 INIT_LIST_HEAD(&isec->list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700227 isec->inode = inode;
228 isec->sid = SECINITSID_UNLABELED;
229 isec->sclass = SECCLASS_FILE;
David Howells275bb412008-11-14 10:39:19 +1100230 isec->task_sid = sid;
Andreas Gruenbacher42059112016-11-10 22:18:27 +0100231 isec->initialized = LABEL_INVALID;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700232 inode->i_security = isec;
233
234 return 0;
235}
236
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500237static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
238
239/*
240 * Try reloading inode security labels that have been marked as invalid. The
241 * @may_sleep parameter indicates when sleeping and thus reloading labels is
Andreas Gruenbacher42059112016-11-10 22:18:27 +0100242 * allowed; when set to false, returns -ECHILD when the label is
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500243 * invalid. The @opt_dentry parameter should be set to a dentry of the inode;
244 * when no dentry is available, set it to NULL instead.
245 */
246static int __inode_security_revalidate(struct inode *inode,
247 struct dentry *opt_dentry,
248 bool may_sleep)
249{
250 struct inode_security_struct *isec = inode->i_security;
251
252 might_sleep_if(may_sleep);
253
Paul Moore1ac424762016-04-18 16:41:38 -0400254 if (ss_initialized && isec->initialized != LABEL_INITIALIZED) {
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500255 if (!may_sleep)
256 return -ECHILD;
257
258 /*
259 * Try reloading the inode security label. This will fail if
260 * @opt_dentry is NULL and no dentry for this inode can be
261 * found; in that case, continue using the old label.
262 */
263 inode_doinit_with_dentry(inode, opt_dentry);
264 }
265 return 0;
266}
267
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500268static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
269{
270 return inode->i_security;
271}
272
273static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
274{
275 int error;
276
277 error = __inode_security_revalidate(inode, NULL, !rcu);
278 if (error)
279 return ERR_PTR(error);
280 return inode->i_security;
281}
282
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500283/*
284 * Get the security label of an inode.
285 */
286static struct inode_security_struct *inode_security(struct inode *inode)
287{
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500288 __inode_security_revalidate(inode, NULL, true);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500289 return inode->i_security;
290}
291
Paul Moore2c971652016-04-19 16:36:28 -0400292static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
293{
294 struct inode *inode = d_backing_inode(dentry);
295
296 return inode->i_security;
297}
298
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500299/*
300 * Get the security label of a dentry's backing inode.
301 */
302static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
303{
304 struct inode *inode = d_backing_inode(dentry);
305
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -0500306 __inode_security_revalidate(inode, dentry, true);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500307 return inode->i_security;
308}
309
Steven Rostedt3dc91d42014-01-09 21:46:34 -0500310static void inode_free_rcu(struct rcu_head *head)
311{
312 struct inode_security_struct *isec;
313
314 isec = container_of(head, struct inode_security_struct, rcu);
315 kmem_cache_free(sel_inode_cache, isec);
316}
317
Linus Torvalds1da177e2005-04-16 15:20:36 -0700318static void inode_free_security(struct inode *inode)
319{
320 struct inode_security_struct *isec = inode->i_security;
321 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
322
Waiman Long9629d042015-07-10 17:19:56 -0400323 /*
324 * As not all inode security structures are in a list, we check for
325 * empty list outside of the lock to make sure that we won't waste
326 * time taking a lock doing nothing.
327 *
328 * The list_del_init() function can be safely called more than once.
329 * It should not be possible for this function to be called with
330 * concurrent list_add(), but for better safety against future changes
331 * in the code, we use list_empty_careful() here.
332 */
333 if (!list_empty_careful(&isec->list)) {
334 spin_lock(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700335 list_del_init(&isec->list);
Waiman Long9629d042015-07-10 17:19:56 -0400336 spin_unlock(&sbsec->isec_lock);
337 }
Linus Torvalds1da177e2005-04-16 15:20:36 -0700338
Steven Rostedt3dc91d42014-01-09 21:46:34 -0500339 /*
340 * The inode may still be referenced in a path walk and
341 * a call to selinux_inode_permission() can be made
342 * after inode_free_security() is called. Ideally, the VFS
343 * wouldn't do this, but fixing that is a much harder
344 * job. For now, simply free the i_security via RCU, and
345 * leave the current inode->i_security pointer intact.
346 * The inode will be freed after the RCU grace period too.
347 */
348 call_rcu(&isec->rcu, inode_free_rcu);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700349}
350
351static int file_alloc_security(struct file *file)
352{
Linus Torvalds1da177e2005-04-16 15:20:36 -0700353 struct file_security_struct *fsec;
David Howells275bb412008-11-14 10:39:19 +1100354 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -0700355
Sangwoo63205652015-10-21 17:44:30 -0400356 fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700357 if (!fsec)
358 return -ENOMEM;
359
David Howells275bb412008-11-14 10:39:19 +1100360 fsec->sid = sid;
361 fsec->fown_sid = sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700362 file->f_security = fsec;
363
364 return 0;
365}
366
367static void file_free_security(struct file *file)
368{
369 struct file_security_struct *fsec = file->f_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700370 file->f_security = NULL;
Sangwoo63205652015-10-21 17:44:30 -0400371 kmem_cache_free(file_security_cache, fsec);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700372}
373
374static int superblock_alloc_security(struct super_block *sb)
375{
376 struct superblock_security_struct *sbsec;
377
James Morris89d155e2005-10-30 14:59:21 -0800378 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700379 if (!sbsec)
380 return -ENOMEM;
381
Eric Parisbc7e9822006-09-25 23:32:02 -0700382 mutex_init(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700383 INIT_LIST_HEAD(&sbsec->isec_head);
384 spin_lock_init(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700385 sbsec->sb = sb;
386 sbsec->sid = SECINITSID_UNLABELED;
387 sbsec->def_sid = SECINITSID_FILE;
Eric Parisc312feb2006-07-10 04:43:53 -0700388 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700389 sb->s_security = sbsec;
390
391 return 0;
392}
393
394static void superblock_free_security(struct super_block *sb)
395{
396 struct superblock_security_struct *sbsec = sb->s_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700397 sb->s_security = NULL;
398 kfree(sbsec);
399}
400
Linus Torvalds1da177e2005-04-16 15:20:36 -0700401/* The file system's label must be initialized prior to use. */
402
David Quigleyeb9ae682013-05-22 12:50:37 -0400403static const char *labeling_behaviors[7] = {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700404 "uses xattr",
405 "uses transition SIDs",
406 "uses task SIDs",
407 "uses genfs_contexts",
408 "not configured for labeling",
409 "uses mountpoint labeling",
David Quigleyeb9ae682013-05-22 12:50:37 -0400410 "uses native labeling",
Linus Torvalds1da177e2005-04-16 15:20:36 -0700411};
412
Linus Torvalds1da177e2005-04-16 15:20:36 -0700413static inline int inode_doinit(struct inode *inode)
414{
415 return inode_doinit_with_dentry(inode, NULL);
416}
417
418enum {
Eric Paris31e87932007-09-19 17:19:12 -0400419 Opt_error = -1,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700420 Opt_context = 1,
421 Opt_fscontext = 2,
Eric Parisc9180a52007-11-30 13:00:35 -0500422 Opt_defcontext = 3,
423 Opt_rootcontext = 4,
David P. Quigley11689d42009-01-16 09:22:03 -0500424 Opt_labelsupport = 5,
Eric Parisd355987f2012-08-24 15:58:53 -0400425 Opt_nextmntopt = 6,
Linus Torvalds1da177e2005-04-16 15:20:36 -0700426};
427
Eric Parisd355987f2012-08-24 15:58:53 -0400428#define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1)
429
Steven Whitehousea447c092008-10-13 10:46:57 +0100430static const match_table_t tokens = {
Eric Paris832cbd92008-04-01 13:24:09 -0400431 {Opt_context, CONTEXT_STR "%s"},
432 {Opt_fscontext, FSCONTEXT_STR "%s"},
433 {Opt_defcontext, DEFCONTEXT_STR "%s"},
434 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
David P. Quigley11689d42009-01-16 09:22:03 -0500435 {Opt_labelsupport, LABELSUPP_STR},
Eric Paris31e87932007-09-19 17:19:12 -0400436 {Opt_error, NULL},
Linus Torvalds1da177e2005-04-16 15:20:36 -0700437};
438
439#define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
440
Eric Parisc312feb2006-07-10 04:43:53 -0700441static int may_context_mount_sb_relabel(u32 sid,
442 struct superblock_security_struct *sbsec,
David Howells275bb412008-11-14 10:39:19 +1100443 const struct cred *cred)
Eric Parisc312feb2006-07-10 04:43:53 -0700444{
David Howells275bb412008-11-14 10:39:19 +1100445 const struct task_security_struct *tsec = cred->security;
Eric Parisc312feb2006-07-10 04:43:53 -0700446 int rc;
447
448 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
449 FILESYSTEM__RELABELFROM, NULL);
450 if (rc)
451 return rc;
452
453 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
454 FILESYSTEM__RELABELTO, NULL);
455 return rc;
456}
457
Eric Paris08089252006-07-10 04:43:55 -0700458static int may_context_mount_inode_relabel(u32 sid,
459 struct superblock_security_struct *sbsec,
David Howells275bb412008-11-14 10:39:19 +1100460 const struct cred *cred)
Eric Paris08089252006-07-10 04:43:55 -0700461{
David Howells275bb412008-11-14 10:39:19 +1100462 const struct task_security_struct *tsec = cred->security;
Eric Paris08089252006-07-10 04:43:55 -0700463 int rc;
464 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
465 FILESYSTEM__RELABELFROM, NULL);
466 if (rc)
467 return rc;
468
469 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
470 FILESYSTEM__ASSOCIATE, NULL);
471 return rc;
472}
473
Eric Parisb43e7252012-10-10 14:27:35 -0400474static int selinux_is_sblabel_mnt(struct super_block *sb)
475{
476 struct superblock_security_struct *sbsec = sb->s_security;
477
Mark Salyzynd5f3a5f2015-02-04 11:34:30 -0500478 return sbsec->behavior == SECURITY_FS_USE_XATTR ||
479 sbsec->behavior == SECURITY_FS_USE_TRANS ||
480 sbsec->behavior == SECURITY_FS_USE_TASK ||
J. Bruce Fields9fc2b4b2015-06-04 15:57:25 -0400481 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
Mark Salyzynd5f3a5f2015-02-04 11:34:30 -0500482 /* Special handling. Genfs but also in-core setxattr handler */
483 !strcmp(sb->s_type->name, "sysfs") ||
484 !strcmp(sb->s_type->name, "pstore") ||
485 !strcmp(sb->s_type->name, "debugfs") ||
Yongqin Liua2c7c6fb2017-01-09 10:07:30 -0500486 !strcmp(sb->s_type->name, "tracefs") ||
Stephen Smalley2651225b2017-02-28 10:35:56 -0500487 !strcmp(sb->s_type->name, "rootfs") ||
488 (selinux_policycap_cgroupseclabel &&
489 (!strcmp(sb->s_type->name, "cgroup") ||
490 !strcmp(sb->s_type->name, "cgroup2")));
Eric Parisb43e7252012-10-10 14:27:35 -0400491}
492
Eric Parisc9180a52007-11-30 13:00:35 -0500493static int sb_finish_set_opts(struct super_block *sb)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700494{
495 struct superblock_security_struct *sbsec = sb->s_security;
496 struct dentry *root = sb->s_root;
David Howellsc6f493d2015-03-17 22:26:22 +0000497 struct inode *root_inode = d_backing_inode(root);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700498 int rc = 0;
499
Linus Torvalds1da177e2005-04-16 15:20:36 -0700500 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
501 /* Make sure that the xattr handler exists and that no
502 error other than -ENODATA is returned by getxattr on
503 the root directory. -ENODATA is ok, as this may be
504 the first boot of the SELinux kernel before we have
505 assigned xattr values to the filesystem. */
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +0200506 if (!(root_inode->i_opflags & IOP_XATTR)) {
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800507 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
508 "xattr support\n", sb->s_id, sb->s_type->name);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700509 rc = -EOPNOTSUPP;
510 goto out;
511 }
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +0200512
513 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700514 if (rc < 0 && rc != -ENODATA) {
515 if (rc == -EOPNOTSUPP)
516 printk(KERN_WARNING "SELinux: (dev %s, type "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800517 "%s) has no security xattr handler\n",
518 sb->s_id, sb->s_type->name);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700519 else
520 printk(KERN_WARNING "SELinux: (dev %s, type "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800521 "%s) getxattr errno %d\n", sb->s_id,
522 sb->s_type->name, -rc);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700523 goto out;
524 }
525 }
526
Eric Parisc9180a52007-11-30 13:00:35 -0500527 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800528 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
529 sb->s_id, sb->s_type->name);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700530
Eric Pariseadcabc2012-08-24 15:59:14 -0400531 sbsec->flags |= SE_SBINITIALIZED;
Eric Parisb43e7252012-10-10 14:27:35 -0400532 if (selinux_is_sblabel_mnt(sb))
Eric Paris12f348b2012-10-09 10:56:25 -0400533 sbsec->flags |= SBLABEL_MNT;
David P. Quigleyddd29ec2009-09-09 14:25:37 -0400534
Linus Torvalds1da177e2005-04-16 15:20:36 -0700535 /* Initialize the root inode. */
Eric Parisc9180a52007-11-30 13:00:35 -0500536 rc = inode_doinit_with_dentry(root_inode, root);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700537
538 /* Initialize any other inodes associated with the superblock, e.g.
539 inodes created prior to initial policy load or inodes created
540 during get_sb by a pseudo filesystem that directly
541 populates itself. */
542 spin_lock(&sbsec->isec_lock);
543next_inode:
544 if (!list_empty(&sbsec->isec_head)) {
545 struct inode_security_struct *isec =
546 list_entry(sbsec->isec_head.next,
Eric Parisc9180a52007-11-30 13:00:35 -0500547 struct inode_security_struct, list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700548 struct inode *inode = isec->inode;
Stephen Smalley923190d32014-10-06 16:32:52 -0400549 list_del_init(&isec->list);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700550 spin_unlock(&sbsec->isec_lock);
551 inode = igrab(inode);
552 if (inode) {
Eric Parisc9180a52007-11-30 13:00:35 -0500553 if (!IS_PRIVATE(inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700554 inode_doinit(inode);
555 iput(inode);
556 }
557 spin_lock(&sbsec->isec_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700558 goto next_inode;
559 }
560 spin_unlock(&sbsec->isec_lock);
561out:
Eric Parisc9180a52007-11-30 13:00:35 -0500562 return rc;
563}
564
565/*
566 * This function should allow an FS to ask what it's mount security
567 * options were so it can use those later for submounts, displaying
568 * mount options, or whatever.
569 */
570static int selinux_get_mnt_opts(const struct super_block *sb,
Eric Parise0007522008-03-05 10:31:54 -0500571 struct security_mnt_opts *opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500572{
573 int rc = 0, i;
574 struct superblock_security_struct *sbsec = sb->s_security;
575 char *context = NULL;
576 u32 len;
577 char tmp;
578
Eric Parise0007522008-03-05 10:31:54 -0500579 security_init_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500580
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500581 if (!(sbsec->flags & SE_SBINITIALIZED))
Eric Parisc9180a52007-11-30 13:00:35 -0500582 return -EINVAL;
583
584 if (!ss_initialized)
585 return -EINVAL;
586
Eric Parisaf8e50c2012-08-24 15:59:00 -0400587 /* make sure we always check enough bits to cover the mask */
588 BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
589
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500590 tmp = sbsec->flags & SE_MNTMASK;
Eric Parisc9180a52007-11-30 13:00:35 -0500591 /* count the number of mount options for this sb */
Eric Parisaf8e50c2012-08-24 15:59:00 -0400592 for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
Eric Parisc9180a52007-11-30 13:00:35 -0500593 if (tmp & 0x01)
Eric Parise0007522008-03-05 10:31:54 -0500594 opts->num_mnt_opts++;
Eric Parisc9180a52007-11-30 13:00:35 -0500595 tmp >>= 1;
596 }
David P. Quigley11689d42009-01-16 09:22:03 -0500597 /* Check if the Label support flag is set */
Eric Paris0b4bdb32013-08-28 13:32:42 -0400598 if (sbsec->flags & SBLABEL_MNT)
David P. Quigley11689d42009-01-16 09:22:03 -0500599 opts->num_mnt_opts++;
Eric Parisc9180a52007-11-30 13:00:35 -0500600
Eric Parise0007522008-03-05 10:31:54 -0500601 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
602 if (!opts->mnt_opts) {
Eric Parisc9180a52007-11-30 13:00:35 -0500603 rc = -ENOMEM;
604 goto out_free;
605 }
606
Eric Parise0007522008-03-05 10:31:54 -0500607 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
608 if (!opts->mnt_opts_flags) {
Eric Parisc9180a52007-11-30 13:00:35 -0500609 rc = -ENOMEM;
610 goto out_free;
611 }
612
613 i = 0;
614 if (sbsec->flags & FSCONTEXT_MNT) {
615 rc = security_sid_to_context(sbsec->sid, &context, &len);
616 if (rc)
617 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500618 opts->mnt_opts[i] = context;
619 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500620 }
621 if (sbsec->flags & CONTEXT_MNT) {
622 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
623 if (rc)
624 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500625 opts->mnt_opts[i] = context;
626 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500627 }
628 if (sbsec->flags & DEFCONTEXT_MNT) {
629 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
630 if (rc)
631 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500632 opts->mnt_opts[i] = context;
633 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500634 }
635 if (sbsec->flags & ROOTCONTEXT_MNT) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500636 struct dentry *root = sbsec->sb->s_root;
637 struct inode_security_struct *isec = backing_inode_security(root);
Eric Parisc9180a52007-11-30 13:00:35 -0500638
639 rc = security_sid_to_context(isec->sid, &context, &len);
640 if (rc)
641 goto out_free;
Eric Parise0007522008-03-05 10:31:54 -0500642 opts->mnt_opts[i] = context;
643 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
Eric Parisc9180a52007-11-30 13:00:35 -0500644 }
Eric Paris12f348b2012-10-09 10:56:25 -0400645 if (sbsec->flags & SBLABEL_MNT) {
David P. Quigley11689d42009-01-16 09:22:03 -0500646 opts->mnt_opts[i] = NULL;
Eric Paris12f348b2012-10-09 10:56:25 -0400647 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
David P. Quigley11689d42009-01-16 09:22:03 -0500648 }
Eric Parisc9180a52007-11-30 13:00:35 -0500649
Eric Parise0007522008-03-05 10:31:54 -0500650 BUG_ON(i != opts->num_mnt_opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500651
652 return 0;
653
654out_free:
Eric Parise0007522008-03-05 10:31:54 -0500655 security_free_mnt_opts(opts);
Eric Parisc9180a52007-11-30 13:00:35 -0500656 return rc;
657}
658
659static int bad_option(struct superblock_security_struct *sbsec, char flag,
660 u32 old_sid, u32 new_sid)
661{
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500662 char mnt_flags = sbsec->flags & SE_MNTMASK;
663
Eric Parisc9180a52007-11-30 13:00:35 -0500664 /* check if the old mount command had the same options */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500665 if (sbsec->flags & SE_SBINITIALIZED)
Eric Parisc9180a52007-11-30 13:00:35 -0500666 if (!(sbsec->flags & flag) ||
667 (old_sid != new_sid))
668 return 1;
669
670 /* check if we were passed the same options twice,
671 * aka someone passed context=a,context=b
672 */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500673 if (!(sbsec->flags & SE_SBINITIALIZED))
674 if (mnt_flags & flag)
Eric Parisc9180a52007-11-30 13:00:35 -0500675 return 1;
676 return 0;
677}
Eric Parise0007522008-03-05 10:31:54 -0500678
Eric Parisc9180a52007-11-30 13:00:35 -0500679/*
680 * Allow filesystems with binary mount data to explicitly set mount point
681 * labeling information.
682 */
Eric Parise0007522008-03-05 10:31:54 -0500683static int selinux_set_mnt_opts(struct super_block *sb,
David Quigley649f6e72013-05-22 12:50:36 -0400684 struct security_mnt_opts *opts,
685 unsigned long kern_flags,
686 unsigned long *set_kern_flags)
Eric Parisc9180a52007-11-30 13:00:35 -0500687{
David Howells275bb412008-11-14 10:39:19 +1100688 const struct cred *cred = current_cred();
Eric Parisc9180a52007-11-30 13:00:35 -0500689 int rc = 0, i;
Eric Parisc9180a52007-11-30 13:00:35 -0500690 struct superblock_security_struct *sbsec = sb->s_security;
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800691 const char *name = sb->s_type->name;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500692 struct dentry *root = sbsec->sb->s_root;
Paul Moore2c971652016-04-19 16:36:28 -0400693 struct inode_security_struct *root_isec;
Eric Parisc9180a52007-11-30 13:00:35 -0500694 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
695 u32 defcontext_sid = 0;
Eric Parise0007522008-03-05 10:31:54 -0500696 char **mount_options = opts->mnt_opts;
697 int *flags = opts->mnt_opts_flags;
698 int num_opts = opts->num_mnt_opts;
Eric Parisc9180a52007-11-30 13:00:35 -0500699
700 mutex_lock(&sbsec->lock);
701
702 if (!ss_initialized) {
703 if (!num_opts) {
704 /* Defer initialization until selinux_complete_init,
705 after the initial policy is loaded and the security
706 server is ready to handle calls. */
Eric Parisc9180a52007-11-30 13:00:35 -0500707 goto out;
708 }
709 rc = -EINVAL;
Eric Paris744ba352008-04-17 11:52:44 -0400710 printk(KERN_WARNING "SELinux: Unable to set superblock options "
711 "before the security server is initialized\n");
Eric Parisc9180a52007-11-30 13:00:35 -0500712 goto out;
713 }
David Quigley649f6e72013-05-22 12:50:36 -0400714 if (kern_flags && !set_kern_flags) {
715 /* Specifying internal flags without providing a place to
716 * place the results is not allowed */
717 rc = -EINVAL;
718 goto out;
719 }
Eric Parisc9180a52007-11-30 13:00:35 -0500720
721 /*
Eric Parise0007522008-03-05 10:31:54 -0500722 * Binary mount data FS will come through this function twice. Once
723 * from an explicit call and once from the generic calls from the vfs.
724 * Since the generic VFS calls will not contain any security mount data
725 * we need to skip the double mount verification.
726 *
727 * This does open a hole in which we will not notice if the first
728 * mount using this sb set explict options and a second mount using
729 * this sb does not set any security options. (The first options
730 * will be used for both mounts)
731 */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500732 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
Eric Parise0007522008-03-05 10:31:54 -0500733 && (num_opts == 0))
Eric Parisf5269712008-05-14 11:27:45 -0400734 goto out;
Eric Parise0007522008-03-05 10:31:54 -0500735
Paul Moore2c971652016-04-19 16:36:28 -0400736 root_isec = backing_inode_security_novalidate(root);
737
Eric Parise0007522008-03-05 10:31:54 -0500738 /*
Eric Parisc9180a52007-11-30 13:00:35 -0500739 * parse the mount options, check if they are valid sids.
740 * also check if someone is trying to mount the same sb more
741 * than once with different security options.
742 */
743 for (i = 0; i < num_opts; i++) {
744 u32 sid;
David P. Quigley11689d42009-01-16 09:22:03 -0500745
Eric Paris12f348b2012-10-09 10:56:25 -0400746 if (flags[i] == SBLABEL_MNT)
David P. Quigley11689d42009-01-16 09:22:03 -0500747 continue;
Rasmus Villemoes44be2f62015-10-21 17:44:25 -0400748 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
Eric Parisc9180a52007-11-30 13:00:35 -0500749 if (rc) {
Rasmus Villemoes44be2f62015-10-21 17:44:25 -0400750 printk(KERN_WARNING "SELinux: security_context_str_to_sid"
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800751 "(%s) failed for (dev %s, type %s) errno=%d\n",
752 mount_options[i], sb->s_id, name, rc);
Eric Parisc9180a52007-11-30 13:00:35 -0500753 goto out;
754 }
755 switch (flags[i]) {
756 case FSCONTEXT_MNT:
757 fscontext_sid = sid;
758
759 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
760 fscontext_sid))
761 goto out_double_mount;
762
763 sbsec->flags |= FSCONTEXT_MNT;
764 break;
765 case CONTEXT_MNT:
766 context_sid = sid;
767
768 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
769 context_sid))
770 goto out_double_mount;
771
772 sbsec->flags |= CONTEXT_MNT;
773 break;
774 case ROOTCONTEXT_MNT:
775 rootcontext_sid = sid;
776
777 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
778 rootcontext_sid))
779 goto out_double_mount;
780
781 sbsec->flags |= ROOTCONTEXT_MNT;
782
783 break;
784 case DEFCONTEXT_MNT:
785 defcontext_sid = sid;
786
787 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
788 defcontext_sid))
789 goto out_double_mount;
790
791 sbsec->flags |= DEFCONTEXT_MNT;
792
793 break;
794 default:
795 rc = -EINVAL;
796 goto out;
797 }
798 }
799
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500800 if (sbsec->flags & SE_SBINITIALIZED) {
Eric Parisc9180a52007-11-30 13:00:35 -0500801 /* previously mounted with options, but not on this attempt? */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500802 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
Eric Parisc9180a52007-11-30 13:00:35 -0500803 goto out_double_mount;
804 rc = 0;
805 goto out;
806 }
807
James Morris089be432008-07-15 18:32:49 +1000808 if (strcmp(sb->s_type->name, "proc") == 0)
Stephen Smalley134509d2015-06-04 16:22:17 -0400809 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
810
Stephen Smalley8e014722015-06-04 16:22:17 -0400811 if (!strcmp(sb->s_type->name, "debugfs") ||
812 !strcmp(sb->s_type->name, "sysfs") ||
813 !strcmp(sb->s_type->name, "pstore"))
Stephen Smalley134509d2015-06-04 16:22:17 -0400814 sbsec->flags |= SE_SBGENFS;
Eric Parisc9180a52007-11-30 13:00:35 -0500815
David Quigleyeb9ae682013-05-22 12:50:37 -0400816 if (!sbsec->behavior) {
817 /*
818 * Determine the labeling behavior to use for this
819 * filesystem type.
820 */
Paul Moore98f700f2013-09-18 13:52:20 -0400821 rc = security_fs_use(sb);
David Quigleyeb9ae682013-05-22 12:50:37 -0400822 if (rc) {
823 printk(KERN_WARNING
824 "%s: security_fs_use(%s) returned %d\n",
825 __func__, sb->s_type->name, rc);
826 goto out;
827 }
Eric Parisc9180a52007-11-30 13:00:35 -0500828 }
Seth Forsheeaad82892016-04-26 14:36:20 -0500829
830 /*
Stephen Smalley01593d32017-01-09 10:07:31 -0500831 * If this is a user namespace mount and the filesystem type is not
832 * explicitly whitelisted, then no contexts are allowed on the command
833 * line and security labels must be ignored.
Seth Forsheeaad82892016-04-26 14:36:20 -0500834 */
Stephen Smalley01593d32017-01-09 10:07:31 -0500835 if (sb->s_user_ns != &init_user_ns &&
836 strcmp(sb->s_type->name, "tmpfs") &&
837 strcmp(sb->s_type->name, "ramfs") &&
838 strcmp(sb->s_type->name, "devpts")) {
Seth Forsheeaad82892016-04-26 14:36:20 -0500839 if (context_sid || fscontext_sid || rootcontext_sid ||
840 defcontext_sid) {
841 rc = -EACCES;
842 goto out;
843 }
844 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
845 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
846 rc = security_transition_sid(current_sid(), current_sid(),
847 SECCLASS_FILE, NULL,
848 &sbsec->mntpoint_sid);
849 if (rc)
850 goto out;
851 }
852 goto out_set_opts;
853 }
854
Eric Parisc9180a52007-11-30 13:00:35 -0500855 /* sets the context of the superblock for the fs being mounted. */
856 if (fscontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100857 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500858 if (rc)
859 goto out;
860
861 sbsec->sid = fscontext_sid;
862 }
863
864 /*
865 * Switch to using mount point labeling behavior.
866 * sets the label used on all file below the mountpoint, and will set
867 * the superblock context if not already set.
868 */
David Quigleyeb9ae682013-05-22 12:50:37 -0400869 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
870 sbsec->behavior = SECURITY_FS_USE_NATIVE;
871 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
872 }
873
Eric Parisc9180a52007-11-30 13:00:35 -0500874 if (context_sid) {
875 if (!fscontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100876 rc = may_context_mount_sb_relabel(context_sid, sbsec,
877 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500878 if (rc)
879 goto out;
880 sbsec->sid = context_sid;
881 } else {
David Howells275bb412008-11-14 10:39:19 +1100882 rc = may_context_mount_inode_relabel(context_sid, sbsec,
883 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500884 if (rc)
885 goto out;
886 }
887 if (!rootcontext_sid)
888 rootcontext_sid = context_sid;
889
890 sbsec->mntpoint_sid = context_sid;
891 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
892 }
893
894 if (rootcontext_sid) {
David Howells275bb412008-11-14 10:39:19 +1100895 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
896 cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500897 if (rc)
898 goto out;
899
900 root_isec->sid = rootcontext_sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -0500901 root_isec->initialized = LABEL_INITIALIZED;
Eric Parisc9180a52007-11-30 13:00:35 -0500902 }
903
904 if (defcontext_sid) {
David Quigleyeb9ae682013-05-22 12:50:37 -0400905 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
906 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
Eric Parisc9180a52007-11-30 13:00:35 -0500907 rc = -EINVAL;
908 printk(KERN_WARNING "SELinux: defcontext option is "
909 "invalid for this filesystem type\n");
910 goto out;
911 }
912
913 if (defcontext_sid != sbsec->def_sid) {
914 rc = may_context_mount_inode_relabel(defcontext_sid,
David Howells275bb412008-11-14 10:39:19 +1100915 sbsec, cred);
Eric Parisc9180a52007-11-30 13:00:35 -0500916 if (rc)
917 goto out;
918 }
919
920 sbsec->def_sid = defcontext_sid;
921 }
922
Seth Forsheeaad82892016-04-26 14:36:20 -0500923out_set_opts:
Eric Parisc9180a52007-11-30 13:00:35 -0500924 rc = sb_finish_set_opts(sb);
925out:
Eric Parisbc7e9822006-09-25 23:32:02 -0700926 mutex_unlock(&sbsec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700927 return rc;
Eric Parisc9180a52007-11-30 13:00:35 -0500928out_double_mount:
929 rc = -EINVAL;
930 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
Linus Torvalds29b1deb2013-12-15 11:17:45 -0800931 "security settings for (dev %s, type %s)\n", sb->s_id, name);
Eric Parisc9180a52007-11-30 13:00:35 -0500932 goto out;
933}
934
Jeff Layton094f7b62013-04-01 08:14:24 -0400935static int selinux_cmp_sb_context(const struct super_block *oldsb,
936 const struct super_block *newsb)
937{
938 struct superblock_security_struct *old = oldsb->s_security;
939 struct superblock_security_struct *new = newsb->s_security;
940 char oldflags = old->flags & SE_MNTMASK;
941 char newflags = new->flags & SE_MNTMASK;
942
943 if (oldflags != newflags)
944 goto mismatch;
945 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
946 goto mismatch;
947 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
948 goto mismatch;
949 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
950 goto mismatch;
951 if (oldflags & ROOTCONTEXT_MNT) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -0500952 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
953 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
Jeff Layton094f7b62013-04-01 08:14:24 -0400954 if (oldroot->sid != newroot->sid)
955 goto mismatch;
956 }
957 return 0;
958mismatch:
959 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, "
960 "different security settings for (dev %s, "
961 "type %s)\n", newsb->s_id, newsb->s_type->name);
962 return -EBUSY;
963}
964
965static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
Eric Parisc9180a52007-11-30 13:00:35 -0500966 struct super_block *newsb)
967{
968 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
969 struct superblock_security_struct *newsbsec = newsb->s_security;
970
971 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
972 int set_context = (oldsbsec->flags & CONTEXT_MNT);
973 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
974
Eric Paris0f5e6422008-04-21 16:24:11 -0400975 /*
976 * if the parent was able to be mounted it clearly had no special lsm
Al Viroe8c26252010-03-23 06:36:54 -0400977 * mount options. thus we can safely deal with this superblock later
Eric Paris0f5e6422008-04-21 16:24:11 -0400978 */
Al Viroe8c26252010-03-23 06:36:54 -0400979 if (!ss_initialized)
Jeff Layton094f7b62013-04-01 08:14:24 -0400980 return 0;
Eric Parisc9180a52007-11-30 13:00:35 -0500981
Eric Parisc9180a52007-11-30 13:00:35 -0500982 /* how can we clone if the old one wasn't set up?? */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500983 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
Eric Parisc9180a52007-11-30 13:00:35 -0500984
Jeff Layton094f7b62013-04-01 08:14:24 -0400985 /* if fs is reusing a sb, make sure that the contexts match */
David P. Quigley0d90a7e2009-01-16 09:22:02 -0500986 if (newsbsec->flags & SE_SBINITIALIZED)
Jeff Layton094f7b62013-04-01 08:14:24 -0400987 return selinux_cmp_sb_context(oldsb, newsb);
Eric Paris5a552612008-04-09 14:08:35 -0400988
Eric Parisc9180a52007-11-30 13:00:35 -0500989 mutex_lock(&newsbsec->lock);
990
991 newsbsec->flags = oldsbsec->flags;
992
993 newsbsec->sid = oldsbsec->sid;
994 newsbsec->def_sid = oldsbsec->def_sid;
995 newsbsec->behavior = oldsbsec->behavior;
996
997 if (set_context) {
998 u32 sid = oldsbsec->mntpoint_sid;
999
1000 if (!set_fscontext)
1001 newsbsec->sid = sid;
1002 if (!set_rootcontext) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001003 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
Eric Parisc9180a52007-11-30 13:00:35 -05001004 newisec->sid = sid;
1005 }
1006 newsbsec->mntpoint_sid = sid;
1007 }
1008 if (set_rootcontext) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001009 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
1010 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
Eric Parisc9180a52007-11-30 13:00:35 -05001011
1012 newisec->sid = oldisec->sid;
1013 }
1014
1015 sb_finish_set_opts(newsb);
1016 mutex_unlock(&newsbsec->lock);
Jeff Layton094f7b62013-04-01 08:14:24 -04001017 return 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001018}
1019
Adrian Bunk2e1479d2008-03-17 22:29:23 +02001020static int selinux_parse_opts_str(char *options,
1021 struct security_mnt_opts *opts)
Eric Parisc9180a52007-11-30 13:00:35 -05001022{
Eric Parise0007522008-03-05 10:31:54 -05001023 char *p;
Eric Parisc9180a52007-11-30 13:00:35 -05001024 char *context = NULL, *defcontext = NULL;
1025 char *fscontext = NULL, *rootcontext = NULL;
Eric Parise0007522008-03-05 10:31:54 -05001026 int rc, num_mnt_opts = 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001027
Eric Parise0007522008-03-05 10:31:54 -05001028 opts->num_mnt_opts = 0;
Eric Parisc9180a52007-11-30 13:00:35 -05001029
1030 /* Standard string-based options. */
1031 while ((p = strsep(&options, "|")) != NULL) {
1032 int token;
1033 substring_t args[MAX_OPT_ARGS];
1034
1035 if (!*p)
1036 continue;
1037
1038 token = match_token(p, tokens, args);
1039
1040 switch (token) {
1041 case Opt_context:
1042 if (context || defcontext) {
1043 rc = -EINVAL;
1044 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1045 goto out_err;
1046 }
1047 context = match_strdup(&args[0]);
1048 if (!context) {
1049 rc = -ENOMEM;
1050 goto out_err;
1051 }
1052 break;
1053
1054 case Opt_fscontext:
1055 if (fscontext) {
1056 rc = -EINVAL;
1057 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1058 goto out_err;
1059 }
1060 fscontext = match_strdup(&args[0]);
1061 if (!fscontext) {
1062 rc = -ENOMEM;
1063 goto out_err;
1064 }
1065 break;
1066
1067 case Opt_rootcontext:
1068 if (rootcontext) {
1069 rc = -EINVAL;
1070 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1071 goto out_err;
1072 }
1073 rootcontext = match_strdup(&args[0]);
1074 if (!rootcontext) {
1075 rc = -ENOMEM;
1076 goto out_err;
1077 }
1078 break;
1079
1080 case Opt_defcontext:
1081 if (context || defcontext) {
1082 rc = -EINVAL;
1083 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1084 goto out_err;
1085 }
1086 defcontext = match_strdup(&args[0]);
1087 if (!defcontext) {
1088 rc = -ENOMEM;
1089 goto out_err;
1090 }
1091 break;
David P. Quigley11689d42009-01-16 09:22:03 -05001092 case Opt_labelsupport:
1093 break;
Eric Parisc9180a52007-11-30 13:00:35 -05001094 default:
1095 rc = -EINVAL;
1096 printk(KERN_WARNING "SELinux: unknown mount option\n");
1097 goto out_err;
1098
1099 }
1100 }
1101
Eric Parise0007522008-03-05 10:31:54 -05001102 rc = -ENOMEM;
Tetsuo Handa8931c3b2016-11-14 20:16:12 +09001103 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_KERNEL);
Eric Parise0007522008-03-05 10:31:54 -05001104 if (!opts->mnt_opts)
1105 goto out_err;
1106
Tetsuo Handa8931c3b2016-11-14 20:16:12 +09001107 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int),
1108 GFP_KERNEL);
Eric Parise0007522008-03-05 10:31:54 -05001109 if (!opts->mnt_opts_flags) {
1110 kfree(opts->mnt_opts);
1111 goto out_err;
Eric Parisc9180a52007-11-30 13:00:35 -05001112 }
1113
Eric Parise0007522008-03-05 10:31:54 -05001114 if (fscontext) {
1115 opts->mnt_opts[num_mnt_opts] = fscontext;
1116 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1117 }
1118 if (context) {
1119 opts->mnt_opts[num_mnt_opts] = context;
1120 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1121 }
1122 if (rootcontext) {
1123 opts->mnt_opts[num_mnt_opts] = rootcontext;
1124 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1125 }
1126 if (defcontext) {
1127 opts->mnt_opts[num_mnt_opts] = defcontext;
1128 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1129 }
1130
1131 opts->num_mnt_opts = num_mnt_opts;
1132 return 0;
1133
Eric Parisc9180a52007-11-30 13:00:35 -05001134out_err:
1135 kfree(context);
1136 kfree(defcontext);
1137 kfree(fscontext);
1138 kfree(rootcontext);
1139 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001140}
Eric Parise0007522008-03-05 10:31:54 -05001141/*
1142 * string mount options parsing and call set the sbsec
1143 */
1144static int superblock_doinit(struct super_block *sb, void *data)
1145{
1146 int rc = 0;
1147 char *options = data;
1148 struct security_mnt_opts opts;
1149
1150 security_init_mnt_opts(&opts);
1151
1152 if (!data)
1153 goto out;
1154
1155 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1156
1157 rc = selinux_parse_opts_str(options, &opts);
1158 if (rc)
1159 goto out_err;
1160
1161out:
David Quigley649f6e72013-05-22 12:50:36 -04001162 rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
Eric Parise0007522008-03-05 10:31:54 -05001163
1164out_err:
1165 security_free_mnt_opts(&opts);
1166 return rc;
1167}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001168
Adrian Bunk3583a712008-07-22 20:21:23 +03001169static void selinux_write_opts(struct seq_file *m,
1170 struct security_mnt_opts *opts)
Eric Paris2069f452008-07-04 09:47:13 +10001171{
1172 int i;
1173 char *prefix;
1174
1175 for (i = 0; i < opts->num_mnt_opts; i++) {
David P. Quigley11689d42009-01-16 09:22:03 -05001176 char *has_comma;
1177
1178 if (opts->mnt_opts[i])
1179 has_comma = strchr(opts->mnt_opts[i], ',');
1180 else
1181 has_comma = NULL;
Eric Paris2069f452008-07-04 09:47:13 +10001182
1183 switch (opts->mnt_opts_flags[i]) {
1184 case CONTEXT_MNT:
1185 prefix = CONTEXT_STR;
1186 break;
1187 case FSCONTEXT_MNT:
1188 prefix = FSCONTEXT_STR;
1189 break;
1190 case ROOTCONTEXT_MNT:
1191 prefix = ROOTCONTEXT_STR;
1192 break;
1193 case DEFCONTEXT_MNT:
1194 prefix = DEFCONTEXT_STR;
1195 break;
Eric Paris12f348b2012-10-09 10:56:25 -04001196 case SBLABEL_MNT:
David P. Quigley11689d42009-01-16 09:22:03 -05001197 seq_putc(m, ',');
1198 seq_puts(m, LABELSUPP_STR);
1199 continue;
Eric Paris2069f452008-07-04 09:47:13 +10001200 default:
1201 BUG();
Eric Parisa35c6c832011-04-20 10:21:28 -04001202 return;
Eric Paris2069f452008-07-04 09:47:13 +10001203 };
1204 /* we need a comma before each option */
1205 seq_putc(m, ',');
1206 seq_puts(m, prefix);
1207 if (has_comma)
1208 seq_putc(m, '\"');
Kees Cooka068acf2015-09-04 15:44:57 -07001209 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
Eric Paris2069f452008-07-04 09:47:13 +10001210 if (has_comma)
1211 seq_putc(m, '\"');
1212 }
1213}
1214
1215static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1216{
1217 struct security_mnt_opts opts;
1218 int rc;
1219
1220 rc = selinux_get_mnt_opts(sb, &opts);
Eric Paris383795c2008-07-29 17:07:26 -04001221 if (rc) {
1222 /* before policy load we may get EINVAL, don't show anything */
1223 if (rc == -EINVAL)
1224 rc = 0;
Eric Paris2069f452008-07-04 09:47:13 +10001225 return rc;
Eric Paris383795c2008-07-29 17:07:26 -04001226 }
Eric Paris2069f452008-07-04 09:47:13 +10001227
1228 selinux_write_opts(m, &opts);
1229
1230 security_free_mnt_opts(&opts);
1231
1232 return rc;
1233}
1234
Linus Torvalds1da177e2005-04-16 15:20:36 -07001235static inline u16 inode_mode_to_security_class(umode_t mode)
1236{
1237 switch (mode & S_IFMT) {
1238 case S_IFSOCK:
1239 return SECCLASS_SOCK_FILE;
1240 case S_IFLNK:
1241 return SECCLASS_LNK_FILE;
1242 case S_IFREG:
1243 return SECCLASS_FILE;
1244 case S_IFBLK:
1245 return SECCLASS_BLK_FILE;
1246 case S_IFDIR:
1247 return SECCLASS_DIR;
1248 case S_IFCHR:
1249 return SECCLASS_CHR_FILE;
1250 case S_IFIFO:
1251 return SECCLASS_FIFO_FILE;
1252
1253 }
1254
1255 return SECCLASS_FILE;
1256}
1257
James Morris13402582005-09-30 14:24:34 -04001258static inline int default_protocol_stream(int protocol)
1259{
1260 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1261}
1262
1263static inline int default_protocol_dgram(int protocol)
1264{
1265 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1266}
1267
Linus Torvalds1da177e2005-04-16 15:20:36 -07001268static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1269{
Stephen Smalleyda69a532017-01-09 10:07:30 -05001270 int extsockclass = selinux_policycap_extsockclass;
1271
Linus Torvalds1da177e2005-04-16 15:20:36 -07001272 switch (family) {
1273 case PF_UNIX:
1274 switch (type) {
1275 case SOCK_STREAM:
1276 case SOCK_SEQPACKET:
1277 return SECCLASS_UNIX_STREAM_SOCKET;
1278 case SOCK_DGRAM:
1279 return SECCLASS_UNIX_DGRAM_SOCKET;
1280 }
1281 break;
1282 case PF_INET:
1283 case PF_INET6:
1284 switch (type) {
1285 case SOCK_STREAM:
Stephen Smalleyda69a532017-01-09 10:07:30 -05001286 case SOCK_SEQPACKET:
James Morris13402582005-09-30 14:24:34 -04001287 if (default_protocol_stream(protocol))
1288 return SECCLASS_TCP_SOCKET;
Stephen Smalleyda69a532017-01-09 10:07:30 -05001289 else if (extsockclass && protocol == IPPROTO_SCTP)
1290 return SECCLASS_SCTP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001291 else
1292 return SECCLASS_RAWIP_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001293 case SOCK_DGRAM:
James Morris13402582005-09-30 14:24:34 -04001294 if (default_protocol_dgram(protocol))
1295 return SECCLASS_UDP_SOCKET;
Stephen Smalleyef379792017-01-09 10:07:31 -05001296 else if (extsockclass && (protocol == IPPROTO_ICMP ||
1297 protocol == IPPROTO_ICMPV6))
Stephen Smalleyda69a532017-01-09 10:07:30 -05001298 return SECCLASS_ICMP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001299 else
1300 return SECCLASS_RAWIP_SOCKET;
James Morris2ee92d42006-11-13 16:09:01 -08001301 case SOCK_DCCP:
1302 return SECCLASS_DCCP_SOCKET;
James Morris13402582005-09-30 14:24:34 -04001303 default:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001304 return SECCLASS_RAWIP_SOCKET;
1305 }
1306 break;
1307 case PF_NETLINK:
1308 switch (protocol) {
1309 case NETLINK_ROUTE:
1310 return SECCLASS_NETLINK_ROUTE_SOCKET;
Pavel Emelyanov7f1fb602011-12-06 07:56:43 +00001311 case NETLINK_SOCK_DIAG:
Linus Torvalds1da177e2005-04-16 15:20:36 -07001312 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1313 case NETLINK_NFLOG:
1314 return SECCLASS_NETLINK_NFLOG_SOCKET;
1315 case NETLINK_XFRM:
1316 return SECCLASS_NETLINK_XFRM_SOCKET;
1317 case NETLINK_SELINUX:
1318 return SECCLASS_NETLINK_SELINUX_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001319 case NETLINK_ISCSI:
1320 return SECCLASS_NETLINK_ISCSI_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001321 case NETLINK_AUDIT:
1322 return SECCLASS_NETLINK_AUDIT_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001323 case NETLINK_FIB_LOOKUP:
1324 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1325 case NETLINK_CONNECTOR:
1326 return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1327 case NETLINK_NETFILTER:
1328 return SECCLASS_NETLINK_NETFILTER_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001329 case NETLINK_DNRTMSG:
1330 return SECCLASS_NETLINK_DNRT_SOCKET;
James Morris0c9b7942005-04-16 15:24:13 -07001331 case NETLINK_KOBJECT_UEVENT:
1332 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
Stephen Smalley6c6d2e92015-06-04 16:22:16 -04001333 case NETLINK_GENERIC:
1334 return SECCLASS_NETLINK_GENERIC_SOCKET;
1335 case NETLINK_SCSITRANSPORT:
1336 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1337 case NETLINK_RDMA:
1338 return SECCLASS_NETLINK_RDMA_SOCKET;
1339 case NETLINK_CRYPTO:
1340 return SECCLASS_NETLINK_CRYPTO_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001341 default:
1342 return SECCLASS_NETLINK_SOCKET;
1343 }
1344 case PF_PACKET:
1345 return SECCLASS_PACKET_SOCKET;
1346 case PF_KEY:
1347 return SECCLASS_KEY_SOCKET;
Christopher J. PeBenito3e3ff152006-06-09 00:25:03 -07001348 case PF_APPLETALK:
1349 return SECCLASS_APPLETALK_SOCKET;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001350 }
1351
Stephen Smalleyda69a532017-01-09 10:07:30 -05001352 if (extsockclass) {
1353 switch (family) {
1354 case PF_AX25:
1355 return SECCLASS_AX25_SOCKET;
1356 case PF_IPX:
1357 return SECCLASS_IPX_SOCKET;
1358 case PF_NETROM:
1359 return SECCLASS_NETROM_SOCKET;
Stephen Smalleyda69a532017-01-09 10:07:30 -05001360 case PF_ATMPVC:
1361 return SECCLASS_ATMPVC_SOCKET;
1362 case PF_X25:
1363 return SECCLASS_X25_SOCKET;
1364 case PF_ROSE:
1365 return SECCLASS_ROSE_SOCKET;
1366 case PF_DECnet:
1367 return SECCLASS_DECNET_SOCKET;
1368 case PF_ATMSVC:
1369 return SECCLASS_ATMSVC_SOCKET;
1370 case PF_RDS:
1371 return SECCLASS_RDS_SOCKET;
1372 case PF_IRDA:
1373 return SECCLASS_IRDA_SOCKET;
1374 case PF_PPPOX:
1375 return SECCLASS_PPPOX_SOCKET;
1376 case PF_LLC:
1377 return SECCLASS_LLC_SOCKET;
Stephen Smalleyda69a532017-01-09 10:07:30 -05001378 case PF_CAN:
1379 return SECCLASS_CAN_SOCKET;
1380 case PF_TIPC:
1381 return SECCLASS_TIPC_SOCKET;
1382 case PF_BLUETOOTH:
1383 return SECCLASS_BLUETOOTH_SOCKET;
1384 case PF_IUCV:
1385 return SECCLASS_IUCV_SOCKET;
1386 case PF_RXRPC:
1387 return SECCLASS_RXRPC_SOCKET;
1388 case PF_ISDN:
1389 return SECCLASS_ISDN_SOCKET;
1390 case PF_PHONET:
1391 return SECCLASS_PHONET_SOCKET;
1392 case PF_IEEE802154:
1393 return SECCLASS_IEEE802154_SOCKET;
1394 case PF_CAIF:
1395 return SECCLASS_CAIF_SOCKET;
1396 case PF_ALG:
1397 return SECCLASS_ALG_SOCKET;
1398 case PF_NFC:
1399 return SECCLASS_NFC_SOCKET;
1400 case PF_VSOCK:
1401 return SECCLASS_VSOCK_SOCKET;
1402 case PF_KCM:
1403 return SECCLASS_KCM_SOCKET;
1404 case PF_QIPCRTR:
1405 return SECCLASS_QIPCRTR_SOCKET;
Linus Torvalds3051bf32017-02-22 10:15:09 -08001406 case PF_SMC:
1407 return SECCLASS_SMC_SOCKET;
1408#if PF_MAX > 44
Stephen Smalleyda69a532017-01-09 10:07:30 -05001409#error New address family defined, please update this function.
1410#endif
1411 }
1412 }
1413
Linus Torvalds1da177e2005-04-16 15:20:36 -07001414 return SECCLASS_SOCKET;
1415}
1416
Stephen Smalley134509d2015-06-04 16:22:17 -04001417static int selinux_genfs_get_sid(struct dentry *dentry,
1418 u16 tclass,
1419 u16 flags,
1420 u32 *sid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001421{
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001422 int rc;
Al Virofc640052016-04-10 01:33:30 -04001423 struct super_block *sb = dentry->d_sb;
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001424 char *buffer, *path;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001425
Eric Paris828dfe12008-04-17 13:17:49 -04001426 buffer = (char *)__get_free_page(GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001427 if (!buffer)
1428 return -ENOMEM;
1429
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001430 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1431 if (IS_ERR(path))
1432 rc = PTR_ERR(path);
1433 else {
Stephen Smalley134509d2015-06-04 16:22:17 -04001434 if (flags & SE_SBPROC) {
1435 /* each process gets a /proc/PID/ entry. Strip off the
1436 * PID part to get a valid selinux labeling.
1437 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1438 while (path[1] >= '0' && path[1] <= '9') {
1439 path[1] = '/';
1440 path++;
1441 }
Lucian Adrian Grijincu8e6c9692011-02-01 18:42:22 +02001442 }
Stephen Smalley134509d2015-06-04 16:22:17 -04001443 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001444 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001445 free_page((unsigned long)buffer);
1446 return rc;
1447}
Linus Torvalds1da177e2005-04-16 15:20:36 -07001448
1449/* The inode's security attributes must be initialized before first use. */
1450static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1451{
1452 struct superblock_security_struct *sbsec = NULL;
1453 struct inode_security_struct *isec = inode->i_security;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001454 u32 task_sid, sid = 0;
1455 u16 sclass;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001456 struct dentry *dentry;
1457#define INITCONTEXTLEN 255
1458 char *context = NULL;
1459 unsigned len = 0;
1460 int rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001461
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05001462 if (isec->initialized == LABEL_INITIALIZED)
Andreas Gruenbacher13457d02016-11-10 22:18:29 +01001463 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001464
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001465 spin_lock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05001466 if (isec->initialized == LABEL_INITIALIZED)
Eric Paris23970742006-09-25 23:32:01 -07001467 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001468
Andreas Gruenbacher13457d02016-11-10 22:18:29 +01001469 if (isec->sclass == SECCLASS_FILE)
1470 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1471
Linus Torvalds1da177e2005-04-16 15:20:36 -07001472 sbsec = inode->i_sb->s_security;
David P. Quigley0d90a7e2009-01-16 09:22:02 -05001473 if (!(sbsec->flags & SE_SBINITIALIZED)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07001474 /* Defer initialization until selinux_complete_init,
1475 after the initial policy is loaded and the security
1476 server is ready to handle calls. */
1477 spin_lock(&sbsec->isec_lock);
1478 if (list_empty(&isec->list))
1479 list_add(&isec->list, &sbsec->isec_head);
1480 spin_unlock(&sbsec->isec_lock);
Eric Paris23970742006-09-25 23:32:01 -07001481 goto out_unlock;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001482 }
1483
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001484 sclass = isec->sclass;
1485 task_sid = isec->task_sid;
1486 sid = isec->sid;
1487 isec->initialized = LABEL_PENDING;
1488 spin_unlock(&isec->lock);
1489
Linus Torvalds1da177e2005-04-16 15:20:36 -07001490 switch (sbsec->behavior) {
David Quigleyeb9ae682013-05-22 12:50:37 -04001491 case SECURITY_FS_USE_NATIVE:
1492 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001493 case SECURITY_FS_USE_XATTR:
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001494 if (!(inode->i_opflags & IOP_XATTR)) {
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001495 sid = sbsec->def_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001496 break;
1497 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001498 /* Need a dentry, since the xattr API requires one.
1499 Life would be simpler if we could just pass the inode. */
1500 if (opt_dentry) {
1501 /* Called from d_instantiate or d_splice_alias. */
1502 dentry = dget(opt_dentry);
1503 } else {
1504 /* Called from selinux_complete_init, try to find a dentry. */
1505 dentry = d_find_alias(inode);
1506 }
1507 if (!dentry) {
Eric Parisdf7f54c2009-03-09 14:35:58 -04001508 /*
1509 * this is can be hit on boot when a file is accessed
1510 * before the policy is loaded. When we load policy we
1511 * may find inodes that have no dentry on the
1512 * sbsec->isec_head list. No reason to complain as these
1513 * will get fixed up the next time we go through
1514 * inode_doinit with a dentry, before these inodes could
1515 * be used again by userspace.
1516 */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001517 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001518 }
1519
1520 len = INITCONTEXTLEN;
Eric Paris4cb912f2009-02-12 14:50:05 -05001521 context = kmalloc(len+1, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001522 if (!context) {
1523 rc = -ENOMEM;
1524 dput(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001525 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001526 }
Eric Paris4cb912f2009-02-12 14:50:05 -05001527 context[len] = '\0';
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001528 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001529 if (rc == -ERANGE) {
James Morris314dabb2009-08-10 22:00:13 +10001530 kfree(context);
1531
Linus Torvalds1da177e2005-04-16 15:20:36 -07001532 /* Need a larger buffer. Query for the right size. */
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001533 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001534 if (rc < 0) {
1535 dput(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001536 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001537 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001538 len = rc;
Eric Paris4cb912f2009-02-12 14:50:05 -05001539 context = kmalloc(len+1, GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001540 if (!context) {
1541 rc = -ENOMEM;
1542 dput(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001543 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001544 }
Eric Paris4cb912f2009-02-12 14:50:05 -05001545 context[len] = '\0';
Andreas Gruenbacher5d6c3192016-09-29 17:48:42 +02001546 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001547 }
1548 dput(dentry);
1549 if (rc < 0) {
1550 if (rc != -ENODATA) {
Eric Paris744ba352008-04-17 11:52:44 -04001551 printk(KERN_WARNING "SELinux: %s: getxattr returned "
Harvey Harrisondd6f9532008-03-06 10:03:59 +11001552 "%d for dev=%s ino=%ld\n", __func__,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001553 -rc, inode->i_sb->s_id, inode->i_ino);
1554 kfree(context);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001555 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001556 }
1557 /* Map ENODATA to the default file SID */
1558 sid = sbsec->def_sid;
1559 rc = 0;
1560 } else {
James Morrisf5c1d5b2005-07-28 01:07:37 -07001561 rc = security_context_to_sid_default(context, rc, &sid,
Stephen Smalley869ab512008-04-04 08:46:05 -04001562 sbsec->def_sid,
1563 GFP_NOFS);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001564 if (rc) {
Eric Paris4ba0a8a2009-02-12 15:01:10 -05001565 char *dev = inode->i_sb->s_id;
1566 unsigned long ino = inode->i_ino;
1567
1568 if (rc == -EINVAL) {
1569 if (printk_ratelimit())
1570 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1571 "context=%s. This indicates you may need to relabel the inode or the "
1572 "filesystem in question.\n", ino, dev, context);
1573 } else {
1574 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1575 "returned %d for dev=%s ino=%ld\n",
1576 __func__, context, -rc, dev, ino);
1577 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001578 kfree(context);
1579 /* Leave with the unlabeled SID */
1580 rc = 0;
1581 break;
1582 }
1583 }
1584 kfree(context);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001585 break;
1586 case SECURITY_FS_USE_TASK:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001587 sid = task_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001588 break;
1589 case SECURITY_FS_USE_TRANS:
1590 /* Default to the fs SID. */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001591 sid = sbsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001592
1593 /* Try to obtain a transition SID. */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001594 rc = security_transition_sid(task_sid, sid, sclass, NULL, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001595 if (rc)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001596 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001597 break;
Eric Parisc312feb2006-07-10 04:43:53 -07001598 case SECURITY_FS_USE_MNTPOINT:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001599 sid = sbsec->mntpoint_sid;
Eric Parisc312feb2006-07-10 04:43:53 -07001600 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001601 default:
Eric Parisc312feb2006-07-10 04:43:53 -07001602 /* Default to the fs superblock SID. */
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001603 sid = sbsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001604
Stephen Smalley134509d2015-06-04 16:22:17 -04001605 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
Paul Mooref64410e2014-03-19 16:46:18 -04001606 /* We must have a dentry to determine the label on
1607 * procfs inodes */
1608 if (opt_dentry)
1609 /* Called from d_instantiate or
1610 * d_splice_alias. */
1611 dentry = dget(opt_dentry);
1612 else
1613 /* Called from selinux_complete_init, try to
1614 * find a dentry. */
1615 dentry = d_find_alias(inode);
1616 /*
1617 * This can be hit on boot when a file is accessed
1618 * before the policy is loaded. When we load policy we
1619 * may find inodes that have no dentry on the
1620 * sbsec->isec_head list. No reason to complain as
1621 * these will get fixed up the next time we go through
1622 * inode_doinit() with a dentry, before these inodes
1623 * could be used again by userspace.
1624 */
1625 if (!dentry)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001626 goto out;
1627 rc = selinux_genfs_get_sid(dentry, sclass,
Stephen Smalley134509d2015-06-04 16:22:17 -04001628 sbsec->flags, &sid);
Paul Mooref64410e2014-03-19 16:46:18 -04001629 dput(dentry);
1630 if (rc)
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001631 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001632 }
1633 break;
1634 }
1635
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001636out:
1637 spin_lock(&isec->lock);
1638 if (isec->initialized == LABEL_PENDING) {
1639 if (!sid || rc) {
1640 isec->initialized = LABEL_INVALID;
1641 goto out_unlock;
1642 }
1643
1644 isec->initialized = LABEL_INITIALIZED;
1645 isec->sid = sid;
1646 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07001647
Eric Paris23970742006-09-25 23:32:01 -07001648out_unlock:
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01001649 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001650 return rc;
1651}
1652
1653/* Convert a Linux signal to an access vector. */
1654static inline u32 signal_to_av(int sig)
1655{
1656 u32 perm = 0;
1657
1658 switch (sig) {
1659 case SIGCHLD:
1660 /* Commonly granted from child to parent. */
1661 perm = PROCESS__SIGCHLD;
1662 break;
1663 case SIGKILL:
1664 /* Cannot be caught or ignored */
1665 perm = PROCESS__SIGKILL;
1666 break;
1667 case SIGSTOP:
1668 /* Cannot be caught or ignored */
1669 perm = PROCESS__SIGSTOP;
1670 break;
1671 default:
1672 /* All other signals. */
1673 perm = PROCESS__SIGNAL;
1674 break;
1675 }
1676
1677 return perm;
1678}
1679
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001680#if CAP_LAST_CAP > 63
1681#error Fix SELinux to handle capabilities > 63.
1682#endif
1683
Linus Torvalds1da177e2005-04-16 15:20:36 -07001684/* Check whether a task is allowed to use a capability. */
Eric Paris6a9de492012-01-03 12:25:14 -05001685static int cred_has_capability(const struct cred *cred,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001686 int cap, int audit, bool initns)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001687{
Thomas Liu2bf49692009-07-14 12:14:09 -04001688 struct common_audit_data ad;
Eric Paris06112162008-11-11 22:02:50 +11001689 struct av_decision avd;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001690 u16 sclass;
David Howells3699c532009-01-06 22:27:01 +00001691 u32 sid = cred_sid(cred);
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001692 u32 av = CAP_TO_MASK(cap);
Eric Paris06112162008-11-11 22:02:50 +11001693 int rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001694
Eric Paris50c205f2012-04-04 15:01:43 -04001695 ad.type = LSM_AUDIT_DATA_CAP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001696 ad.u.cap = cap;
1697
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001698 switch (CAP_TO_INDEX(cap)) {
1699 case 0:
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001700 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001701 break;
1702 case 1:
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04001703 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001704 break;
1705 default:
1706 printk(KERN_ERR
1707 "SELinux: out of range capability %d\n", cap);
1708 BUG();
Eric Parisa35c6c832011-04-20 10:21:28 -04001709 return -EINVAL;
Stephen Smalleyb68e4182008-02-07 11:21:04 -05001710 }
Eric Paris06112162008-11-11 22:02:50 +11001711
David Howells275bb412008-11-14 10:39:19 +11001712 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
Eric Paris9ade0cf2011-04-25 16:26:29 -04001713 if (audit == SECURITY_CAP_AUDIT) {
NeilBrown7b20ea22015-03-23 13:37:39 +11001714 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
Eric Paris9ade0cf2011-04-25 16:26:29 -04001715 if (rc2)
1716 return rc2;
1717 }
Eric Paris06112162008-11-11 22:02:50 +11001718 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001719}
1720
Linus Torvalds1da177e2005-04-16 15:20:36 -07001721/* Check whether a task has a particular permission to an inode.
1722 The 'adp' parameter is optional and allows other audit
1723 data to be passed (e.g. the dentry). */
David Howells88e67f32008-11-14 10:39:21 +11001724static int inode_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001725 struct inode *inode,
1726 u32 perms,
Linus Torvalds19e49832013-10-04 12:54:11 -07001727 struct common_audit_data *adp)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001728{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001729 struct inode_security_struct *isec;
David Howells275bb412008-11-14 10:39:19 +11001730 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001731
David Howellse0e81732009-09-02 09:13:40 +01001732 validate_creds(cred);
1733
Eric Paris828dfe12008-04-17 13:17:49 -04001734 if (unlikely(IS_PRIVATE(inode)))
Stephen Smalleybbaca6c2007-02-14 00:34:16 -08001735 return 0;
1736
David Howells88e67f32008-11-14 10:39:21 +11001737 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001738 isec = inode->i_security;
1739
Linus Torvalds19e49832013-10-04 12:54:11 -07001740 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001741}
1742
1743/* Same as inode_has_perm, but pass explicit audit data containing
1744 the dentry to help the auditing code to more easily generate the
1745 pathname if needed. */
David Howells88e67f32008-11-14 10:39:21 +11001746static inline int dentry_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001747 struct dentry *dentry,
1748 u32 av)
1749{
David Howellsc6f493d2015-03-17 22:26:22 +00001750 struct inode *inode = d_backing_inode(dentry);
Thomas Liu2bf49692009-07-14 12:14:09 -04001751 struct common_audit_data ad;
David Howells88e67f32008-11-14 10:39:21 +11001752
Eric Paris50c205f2012-04-04 15:01:43 -04001753 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Paris2875fa02011-04-28 16:04:24 -04001754 ad.u.dentry = dentry;
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05001755 __inode_security_revalidate(inode, dentry, true);
Linus Torvalds19e49832013-10-04 12:54:11 -07001756 return inode_has_perm(cred, inode, av, &ad);
Eric Paris2875fa02011-04-28 16:04:24 -04001757}
1758
1759/* Same as inode_has_perm, but pass explicit audit data containing
1760 the path to help the auditing code to more easily generate the
1761 pathname if needed. */
1762static inline int path_has_perm(const struct cred *cred,
Al Viro3f7036a2015-03-08 19:28:30 -04001763 const struct path *path,
Eric Paris2875fa02011-04-28 16:04:24 -04001764 u32 av)
1765{
David Howellsc6f493d2015-03-17 22:26:22 +00001766 struct inode *inode = d_backing_inode(path->dentry);
Eric Paris2875fa02011-04-28 16:04:24 -04001767 struct common_audit_data ad;
1768
Eric Paris50c205f2012-04-04 15:01:43 -04001769 ad.type = LSM_AUDIT_DATA_PATH;
Eric Paris2875fa02011-04-28 16:04:24 -04001770 ad.u.path = *path;
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05001771 __inode_security_revalidate(inode, path->dentry, true);
Linus Torvalds19e49832013-10-04 12:54:11 -07001772 return inode_has_perm(cred, inode, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001773}
1774
David Howells13f8e982013-06-13 23:37:55 +01001775/* Same as path_has_perm, but uses the inode from the file struct. */
1776static inline int file_path_has_perm(const struct cred *cred,
1777 struct file *file,
1778 u32 av)
1779{
1780 struct common_audit_data ad;
1781
Vivek Goyal43af5de2016-09-09 11:37:49 -04001782 ad.type = LSM_AUDIT_DATA_FILE;
1783 ad.u.file = file;
Linus Torvalds19e49832013-10-04 12:54:11 -07001784 return inode_has_perm(cred, file_inode(file), av, &ad);
David Howells13f8e982013-06-13 23:37:55 +01001785}
1786
Linus Torvalds1da177e2005-04-16 15:20:36 -07001787/* Check whether a task can use an open file descriptor to
1788 access an inode in a given way. Check access to the
1789 descriptor itself, and then use dentry_has_perm to
1790 check a particular permission to the file.
1791 Access to the descriptor is implicitly granted if it
1792 has the same SID as the process. If av is zero, then
1793 access to the file is not checked, e.g. for cases
1794 where only the descriptor is affected like seek. */
David Howells88e67f32008-11-14 10:39:21 +11001795static int file_has_perm(const struct cred *cred,
1796 struct file *file,
1797 u32 av)
Linus Torvalds1da177e2005-04-16 15:20:36 -07001798{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001799 struct file_security_struct *fsec = file->f_security;
Al Viro496ad9a2013-01-23 17:07:38 -05001800 struct inode *inode = file_inode(file);
Thomas Liu2bf49692009-07-14 12:14:09 -04001801 struct common_audit_data ad;
David Howells88e67f32008-11-14 10:39:21 +11001802 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001803 int rc;
1804
Vivek Goyal43af5de2016-09-09 11:37:49 -04001805 ad.type = LSM_AUDIT_DATA_FILE;
1806 ad.u.file = file;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001807
David Howells275bb412008-11-14 10:39:19 +11001808 if (sid != fsec->sid) {
1809 rc = avc_has_perm(sid, fsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001810 SECCLASS_FD,
1811 FD__USE,
1812 &ad);
1813 if (rc)
David Howells88e67f32008-11-14 10:39:21 +11001814 goto out;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001815 }
1816
1817 /* av is zero if only checking access to the descriptor. */
David Howells88e67f32008-11-14 10:39:21 +11001818 rc = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001819 if (av)
Linus Torvalds19e49832013-10-04 12:54:11 -07001820 rc = inode_has_perm(cred, inode, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001821
David Howells88e67f32008-11-14 10:39:21 +11001822out:
1823 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001824}
1825
David Howellsc3c188b2015-07-10 17:19:58 -04001826/*
1827 * Determine the label for an inode that might be unioned.
1828 */
Vivek Goyalc957f6d2016-07-13 10:44:51 -04001829static int
1830selinux_determine_inode_label(const struct task_security_struct *tsec,
1831 struct inode *dir,
1832 const struct qstr *name, u16 tclass,
1833 u32 *_new_isid)
David Howellsc3c188b2015-07-10 17:19:58 -04001834{
1835 const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
David Howellsc3c188b2015-07-10 17:19:58 -04001836
1837 if ((sbsec->flags & SE_SBINITIALIZED) &&
1838 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1839 *_new_isid = sbsec->mntpoint_sid;
1840 } else if ((sbsec->flags & SBLABEL_MNT) &&
1841 tsec->create_sid) {
1842 *_new_isid = tsec->create_sid;
1843 } else {
Paul Moore20cdef82016-04-04 14:14:42 -04001844 const struct inode_security_struct *dsec = inode_security(dir);
David Howellsc3c188b2015-07-10 17:19:58 -04001845 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1846 name, _new_isid);
1847 }
1848
1849 return 0;
1850}
1851
Linus Torvalds1da177e2005-04-16 15:20:36 -07001852/* Check whether a task can create a file. */
1853static int may_create(struct inode *dir,
1854 struct dentry *dentry,
1855 u16 tclass)
1856{
Paul Moore5fb49872010-04-22 14:46:19 -04001857 const struct task_security_struct *tsec = current_security();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001858 struct inode_security_struct *dsec;
1859 struct superblock_security_struct *sbsec;
David Howells275bb412008-11-14 10:39:19 +11001860 u32 sid, newsid;
Thomas Liu2bf49692009-07-14 12:14:09 -04001861 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001862 int rc;
1863
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001864 dsec = inode_security(dir);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001865 sbsec = dir->i_sb->s_security;
1866
David Howells275bb412008-11-14 10:39:19 +11001867 sid = tsec->sid;
David Howells275bb412008-11-14 10:39:19 +11001868
Eric Paris50c205f2012-04-04 15:01:43 -04001869 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04001870 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001871
David Howells275bb412008-11-14 10:39:19 +11001872 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001873 DIR__ADD_NAME | DIR__SEARCH,
1874 &ad);
1875 if (rc)
1876 return rc;
1877
Vivek Goyalc957f6d2016-07-13 10:44:51 -04001878 rc = selinux_determine_inode_label(current_security(), dir,
1879 &dentry->d_name, tclass, &newsid);
David Howellsc3c188b2015-07-10 17:19:58 -04001880 if (rc)
1881 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001882
David Howells275bb412008-11-14 10:39:19 +11001883 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001884 if (rc)
1885 return rc;
1886
1887 return avc_has_perm(newsid, sbsec->sid,
1888 SECCLASS_FILESYSTEM,
1889 FILESYSTEM__ASSOCIATE, &ad);
1890}
1891
Eric Paris828dfe12008-04-17 13:17:49 -04001892#define MAY_LINK 0
1893#define MAY_UNLINK 1
1894#define MAY_RMDIR 2
Linus Torvalds1da177e2005-04-16 15:20:36 -07001895
1896/* Check whether a task can link, unlink, or rmdir a file/directory. */
1897static int may_link(struct inode *dir,
1898 struct dentry *dentry,
1899 int kind)
1900
1901{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001902 struct inode_security_struct *dsec, *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04001903 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11001904 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001905 u32 av;
1906 int rc;
1907
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001908 dsec = inode_security(dir);
1909 isec = backing_inode_security(dentry);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001910
Eric Paris50c205f2012-04-04 15:01:43 -04001911 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04001912 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001913
1914 av = DIR__SEARCH;
1915 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
David Howells275bb412008-11-14 10:39:19 +11001916 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001917 if (rc)
1918 return rc;
1919
1920 switch (kind) {
1921 case MAY_LINK:
1922 av = FILE__LINK;
1923 break;
1924 case MAY_UNLINK:
1925 av = FILE__UNLINK;
1926 break;
1927 case MAY_RMDIR:
1928 av = DIR__RMDIR;
1929 break;
1930 default:
Eric Paris744ba352008-04-17 11:52:44 -04001931 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1932 __func__, kind);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001933 return 0;
1934 }
1935
David Howells275bb412008-11-14 10:39:19 +11001936 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001937 return rc;
1938}
1939
1940static inline int may_rename(struct inode *old_dir,
1941 struct dentry *old_dentry,
1942 struct inode *new_dir,
1943 struct dentry *new_dentry)
1944{
Linus Torvalds1da177e2005-04-16 15:20:36 -07001945 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04001946 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11001947 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07001948 u32 av;
1949 int old_is_dir, new_is_dir;
1950 int rc;
1951
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001952 old_dsec = inode_security(old_dir);
1953 old_isec = backing_inode_security(old_dentry);
David Howellse36cb0b2015-01-29 12:02:35 +00001954 old_is_dir = d_is_dir(old_dentry);
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001955 new_dsec = inode_security(new_dir);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001956
Eric Paris50c205f2012-04-04 15:01:43 -04001957 ad.type = LSM_AUDIT_DATA_DENTRY;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001958
Eric Parisa2694342011-04-25 13:10:27 -04001959 ad.u.dentry = old_dentry;
David Howells275bb412008-11-14 10:39:19 +11001960 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001961 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1962 if (rc)
1963 return rc;
David Howells275bb412008-11-14 10:39:19 +11001964 rc = avc_has_perm(sid, old_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001965 old_isec->sclass, FILE__RENAME, &ad);
1966 if (rc)
1967 return rc;
1968 if (old_is_dir && new_dir != old_dir) {
David Howells275bb412008-11-14 10:39:19 +11001969 rc = avc_has_perm(sid, old_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001970 old_isec->sclass, DIR__REPARENT, &ad);
1971 if (rc)
1972 return rc;
1973 }
1974
Eric Parisa2694342011-04-25 13:10:27 -04001975 ad.u.dentry = new_dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07001976 av = DIR__ADD_NAME | DIR__SEARCH;
David Howells2c616d42015-01-29 12:02:33 +00001977 if (d_is_positive(new_dentry))
Linus Torvalds1da177e2005-04-16 15:20:36 -07001978 av |= DIR__REMOVE_NAME;
David Howells275bb412008-11-14 10:39:19 +11001979 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07001980 if (rc)
1981 return rc;
David Howells2c616d42015-01-29 12:02:33 +00001982 if (d_is_positive(new_dentry)) {
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05001983 new_isec = backing_inode_security(new_dentry);
David Howellse36cb0b2015-01-29 12:02:35 +00001984 new_is_dir = d_is_dir(new_dentry);
David Howells275bb412008-11-14 10:39:19 +11001985 rc = avc_has_perm(sid, new_isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001986 new_isec->sclass,
1987 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1988 if (rc)
1989 return rc;
1990 }
1991
1992 return 0;
1993}
1994
1995/* Check whether a task can perform a filesystem operation. */
David Howells88e67f32008-11-14 10:39:21 +11001996static int superblock_has_perm(const struct cred *cred,
Linus Torvalds1da177e2005-04-16 15:20:36 -07001997 struct super_block *sb,
1998 u32 perms,
Thomas Liu2bf49692009-07-14 12:14:09 -04001999 struct common_audit_data *ad)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002000{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002001 struct superblock_security_struct *sbsec;
David Howells88e67f32008-11-14 10:39:21 +11002002 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002003
Linus Torvalds1da177e2005-04-16 15:20:36 -07002004 sbsec = sb->s_security;
David Howells275bb412008-11-14 10:39:19 +11002005 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002006}
2007
2008/* Convert a Linux mode and permission mask to an access vector. */
2009static inline u32 file_mask_to_av(int mode, int mask)
2010{
2011 u32 av = 0;
2012
Al Virodba19c62011-07-25 20:49:29 -04002013 if (!S_ISDIR(mode)) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002014 if (mask & MAY_EXEC)
2015 av |= FILE__EXECUTE;
2016 if (mask & MAY_READ)
2017 av |= FILE__READ;
2018
2019 if (mask & MAY_APPEND)
2020 av |= FILE__APPEND;
2021 else if (mask & MAY_WRITE)
2022 av |= FILE__WRITE;
2023
2024 } else {
2025 if (mask & MAY_EXEC)
2026 av |= DIR__SEARCH;
2027 if (mask & MAY_WRITE)
2028 av |= DIR__WRITE;
2029 if (mask & MAY_READ)
2030 av |= DIR__READ;
2031 }
2032
2033 return av;
2034}
2035
2036/* Convert a Linux file to an access vector. */
2037static inline u32 file_to_av(struct file *file)
2038{
2039 u32 av = 0;
2040
2041 if (file->f_mode & FMODE_READ)
2042 av |= FILE__READ;
2043 if (file->f_mode & FMODE_WRITE) {
2044 if (file->f_flags & O_APPEND)
2045 av |= FILE__APPEND;
2046 else
2047 av |= FILE__WRITE;
2048 }
Stephen Smalley0794c662008-03-17 08:55:18 -04002049 if (!av) {
2050 /*
2051 * Special file opened with flags 3 for ioctl-only use.
2052 */
2053 av = FILE__IOCTL;
2054 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002055
2056 return av;
2057}
2058
Eric Paris8b6a5a32008-10-29 17:06:46 -04002059/*
2060 * Convert a file to an access vector and include the correct open
2061 * open permission.
2062 */
2063static inline u32 open_file_to_av(struct file *file)
2064{
2065 u32 av = file_to_av(file);
2066
Eric Paris49b7b8d2010-07-23 11:44:09 -04002067 if (selinux_policycap_openperm)
2068 av |= FILE__OPEN;
2069
Eric Paris8b6a5a32008-10-29 17:06:46 -04002070 return av;
2071}
2072
Linus Torvalds1da177e2005-04-16 15:20:36 -07002073/* Hook functions begin here. */
2074
Stephen Smalley79af73072015-01-21 10:54:10 -05002075static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2076{
2077 u32 mysid = current_sid();
2078 u32 mgrsid = task_sid(mgr);
2079
2080 return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
2081 BINDER__SET_CONTEXT_MGR, NULL);
2082}
2083
2084static int selinux_binder_transaction(struct task_struct *from,
2085 struct task_struct *to)
2086{
2087 u32 mysid = current_sid();
2088 u32 fromsid = task_sid(from);
2089 u32 tosid = task_sid(to);
2090 int rc;
2091
2092 if (mysid != fromsid) {
2093 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
2094 BINDER__IMPERSONATE, NULL);
2095 if (rc)
2096 return rc;
2097 }
2098
2099 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2100 NULL);
2101}
2102
2103static int selinux_binder_transfer_binder(struct task_struct *from,
2104 struct task_struct *to)
2105{
2106 u32 fromsid = task_sid(from);
2107 u32 tosid = task_sid(to);
2108
2109 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2110 NULL);
2111}
2112
2113static int selinux_binder_transfer_file(struct task_struct *from,
2114 struct task_struct *to,
2115 struct file *file)
2116{
2117 u32 sid = task_sid(to);
2118 struct file_security_struct *fsec = file->f_security;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002119 struct dentry *dentry = file->f_path.dentry;
Paul Moore20cdef82016-04-04 14:14:42 -04002120 struct inode_security_struct *isec;
Stephen Smalley79af73072015-01-21 10:54:10 -05002121 struct common_audit_data ad;
2122 int rc;
2123
2124 ad.type = LSM_AUDIT_DATA_PATH;
2125 ad.u.path = file->f_path;
2126
2127 if (sid != fsec->sid) {
2128 rc = avc_has_perm(sid, fsec->sid,
2129 SECCLASS_FD,
2130 FD__USE,
2131 &ad);
2132 if (rc)
2133 return rc;
2134 }
2135
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002136 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
Stephen Smalley79af73072015-01-21 10:54:10 -05002137 return 0;
2138
Paul Moore20cdef82016-04-04 14:14:42 -04002139 isec = backing_inode_security(dentry);
Stephen Smalley79af73072015-01-21 10:54:10 -05002140 return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2141 &ad);
2142}
2143
Ingo Molnar9e488582009-05-07 19:26:19 +10002144static int selinux_ptrace_access_check(struct task_struct *child,
David Howells5cd9c582008-08-14 11:37:28 +01002145 unsigned int mode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002146{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002147 u32 sid = current_sid();
2148 u32 csid = task_sid(child);
Stephen Smalley006ebb42008-05-19 08:32:49 -04002149
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002150 if (mode & PTRACE_MODE_READ)
2151 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2152
2153 return avc_has_perm(sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
David Howells5cd9c582008-08-14 11:37:28 +01002154}
2155
2156static int selinux_ptrace_traceme(struct task_struct *parent)
2157{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002158 return avc_has_perm(task_sid(parent), current_sid(), SECCLASS_PROCESS,
2159 PROCESS__PTRACE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002160}
2161
2162static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
Eric Paris828dfe12008-04-17 13:17:49 -04002163 kernel_cap_t *inheritable, kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002164{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002165 return avc_has_perm(current_sid(), task_sid(target), SECCLASS_PROCESS,
2166 PROCESS__GETCAP, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002167}
2168
David Howellsd84f4f92008-11-14 10:39:23 +11002169static int selinux_capset(struct cred *new, const struct cred *old,
2170 const kernel_cap_t *effective,
2171 const kernel_cap_t *inheritable,
2172 const kernel_cap_t *permitted)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002173{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002174 return avc_has_perm(cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2175 PROCESS__SETCAP, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002176}
2177
James Morris5626d3e2009-01-30 10:05:06 +11002178/*
2179 * (This comment used to live with the selinux_task_setuid hook,
2180 * which was removed).
2181 *
2182 * Since setuid only affects the current process, and since the SELinux
2183 * controls are not based on the Linux identity attributes, SELinux does not
2184 * need to control this operation. However, SELinux does control the use of
2185 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2186 */
2187
Eric Paris6a9de492012-01-03 12:25:14 -05002188static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2189 int cap, int audit)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002190{
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04002191 return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002192}
2193
Linus Torvalds1da177e2005-04-16 15:20:36 -07002194static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2195{
David Howells88e67f32008-11-14 10:39:21 +11002196 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002197 int rc = 0;
2198
2199 if (!sb)
2200 return 0;
2201
2202 switch (cmds) {
Eric Paris828dfe12008-04-17 13:17:49 -04002203 case Q_SYNC:
2204 case Q_QUOTAON:
2205 case Q_QUOTAOFF:
2206 case Q_SETINFO:
2207 case Q_SETQUOTA:
David Howells88e67f32008-11-14 10:39:21 +11002208 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04002209 break;
2210 case Q_GETFMT:
2211 case Q_GETINFO:
2212 case Q_GETQUOTA:
David Howells88e67f32008-11-14 10:39:21 +11002213 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
Eric Paris828dfe12008-04-17 13:17:49 -04002214 break;
2215 default:
2216 rc = 0; /* let the kernel handle invalid cmds */
2217 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002218 }
2219 return rc;
2220}
2221
2222static int selinux_quota_on(struct dentry *dentry)
2223{
David Howells88e67f32008-11-14 10:39:21 +11002224 const struct cred *cred = current_cred();
2225
Eric Paris2875fa02011-04-28 16:04:24 -04002226 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002227}
2228
Eric Paris12b30522010-11-15 18:36:29 -05002229static int selinux_syslog(int type)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002230{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002231 switch (type) {
Kees Cookd78ca3c2010-02-03 15:37:13 -08002232 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2233 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002234 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2235 SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
Kees Cookd78ca3c2010-02-03 15:37:13 -08002236 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2237 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2238 /* Set level of messages printed to console */
2239 case SYSLOG_ACTION_CONSOLE_LEVEL:
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002240 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2241 SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2242 NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002243 }
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002244 /* All other syslog types */
2245 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2246 SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002247}
2248
2249/*
2250 * Check that a process has enough memory to allocate a new virtual
2251 * mapping. 0 means there is enough memory for the allocation to
2252 * succeed and -ENOMEM implies there is not.
2253 *
Linus Torvalds1da177e2005-04-16 15:20:36 -07002254 * Do not audit the selinux permission check, as this is applied to all
2255 * processes that allocate mappings.
2256 */
Alan Cox34b4e4a2007-08-22 14:01:28 -07002257static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002258{
2259 int rc, cap_sys_admin = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002260
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07002261 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04002262 SECURITY_CAP_NOAUDIT, true);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002263 if (rc == 0)
2264 cap_sys_admin = 1;
2265
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07002266 return cap_sys_admin;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002267}
2268
2269/* binprm security operations */
2270
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002271static u32 ptrace_parent_sid(void)
Paul Moore0c6181c2016-03-30 21:41:21 -04002272{
2273 u32 sid = 0;
2274 struct task_struct *tracer;
2275
2276 rcu_read_lock();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002277 tracer = ptrace_parent(current);
Paul Moore0c6181c2016-03-30 21:41:21 -04002278 if (tracer)
2279 sid = task_sid(tracer);
2280 rcu_read_unlock();
2281
2282 return sid;
2283}
2284
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002285static int check_nnp_nosuid(const struct linux_binprm *bprm,
2286 const struct task_security_struct *old_tsec,
2287 const struct task_security_struct *new_tsec)
2288{
2289 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
Andy Lutomirski380cf5b2016-06-23 16:41:05 -05002290 int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002291 int rc;
2292
2293 if (!nnp && !nosuid)
2294 return 0; /* neither NNP nor nosuid */
2295
2296 if (new_tsec->sid == old_tsec->sid)
2297 return 0; /* No change in credentials */
2298
2299 /*
2300 * The only transitions we permit under NNP or nosuid
2301 * are transitions to bounded SIDs, i.e. SIDs that are
2302 * guaranteed to only be allowed a subset of the permissions
2303 * of the current SID.
2304 */
2305 rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2306 if (rc) {
2307 /*
2308 * On failure, preserve the errno values for NNP vs nosuid.
2309 * NNP: Operation not permitted for caller.
2310 * nosuid: Permission denied to file.
2311 */
2312 if (nnp)
2313 return -EPERM;
2314 else
2315 return -EACCES;
2316 }
2317 return 0;
2318}
2319
David Howellsa6f76f22008-11-14 10:39:24 +11002320static int selinux_bprm_set_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002321{
David Howellsa6f76f22008-11-14 10:39:24 +11002322 const struct task_security_struct *old_tsec;
2323 struct task_security_struct *new_tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002324 struct inode_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04002325 struct common_audit_data ad;
Al Viro496ad9a2013-01-23 17:07:38 -05002326 struct inode *inode = file_inode(bprm->file);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002327 int rc;
2328
David Howellsa6f76f22008-11-14 10:39:24 +11002329 /* SELinux context only depends on initial program or script and not
2330 * the script interpreter */
2331 if (bprm->cred_prepared)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002332 return 0;
2333
David Howellsa6f76f22008-11-14 10:39:24 +11002334 old_tsec = current_security();
2335 new_tsec = bprm->cred->security;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002336 isec = inode_security(inode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002337
2338 /* Default to the current task SID. */
David Howellsa6f76f22008-11-14 10:39:24 +11002339 new_tsec->sid = old_tsec->sid;
2340 new_tsec->osid = old_tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002341
Michael LeMay28eba5b2006-06-27 02:53:42 -07002342 /* Reset fs, key, and sock SIDs on execve. */
David Howellsa6f76f22008-11-14 10:39:24 +11002343 new_tsec->create_sid = 0;
2344 new_tsec->keycreate_sid = 0;
2345 new_tsec->sockcreate_sid = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002346
David Howellsa6f76f22008-11-14 10:39:24 +11002347 if (old_tsec->exec_sid) {
2348 new_tsec->sid = old_tsec->exec_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002349 /* Reset exec SID on execve. */
David Howellsa6f76f22008-11-14 10:39:24 +11002350 new_tsec->exec_sid = 0;
Andy Lutomirski259e5e62012-04-12 16:47:50 -05002351
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002352 /* Fail on NNP or nosuid if not an allowed transition. */
2353 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2354 if (rc)
2355 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002356 } else {
2357 /* Check for a default transition on this program. */
David Howellsa6f76f22008-11-14 10:39:24 +11002358 rc = security_transition_sid(old_tsec->sid, isec->sid,
Eric Paris652bb9b2011-02-01 11:05:40 -05002359 SECCLASS_PROCESS, NULL,
2360 &new_tsec->sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002361 if (rc)
2362 return rc;
Stephen Smalley7b0d0b42014-08-04 13:36:49 -04002363
2364 /*
2365 * Fallback to old SID on NNP or nosuid if not an allowed
2366 * transition.
2367 */
2368 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2369 if (rc)
2370 new_tsec->sid = old_tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002371 }
2372
Vivek Goyal43af5de2016-09-09 11:37:49 -04002373 ad.type = LSM_AUDIT_DATA_FILE;
2374 ad.u.file = bprm->file;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002375
David Howellsa6f76f22008-11-14 10:39:24 +11002376 if (new_tsec->sid == old_tsec->sid) {
2377 rc = avc_has_perm(old_tsec->sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002378 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2379 if (rc)
2380 return rc;
2381 } else {
2382 /* Check permissions for the transition. */
David Howellsa6f76f22008-11-14 10:39:24 +11002383 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002384 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2385 if (rc)
2386 return rc;
2387
David Howellsa6f76f22008-11-14 10:39:24 +11002388 rc = avc_has_perm(new_tsec->sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07002389 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2390 if (rc)
2391 return rc;
2392
David Howellsa6f76f22008-11-14 10:39:24 +11002393 /* Check for shared state */
2394 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2395 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2396 SECCLASS_PROCESS, PROCESS__SHARE,
2397 NULL);
2398 if (rc)
2399 return -EPERM;
2400 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002401
David Howellsa6f76f22008-11-14 10:39:24 +11002402 /* Make sure that anyone attempting to ptrace over a task that
2403 * changes its SID has the appropriate permit */
Eric W. Biederman9227dd22017-01-23 17:26:31 +13002404 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
Stephen Smalleybe0554c2017-01-09 10:07:31 -05002405 u32 ptsid = ptrace_parent_sid();
David Howellsa6f76f22008-11-14 10:39:24 +11002406 if (ptsid != 0) {
2407 rc = avc_has_perm(ptsid, new_tsec->sid,
2408 SECCLASS_PROCESS,
2409 PROCESS__PTRACE, NULL);
2410 if (rc)
2411 return -EPERM;
2412 }
2413 }
2414
2415 /* Clear any possibly unsafe personality bits on exec: */
2416 bprm->per_clear |= PER_CLEAR_ON_SETID;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002417 }
2418
Linus Torvalds1da177e2005-04-16 15:20:36 -07002419 return 0;
2420}
2421
Eric Paris828dfe12008-04-17 13:17:49 -04002422static int selinux_bprm_secureexec(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002423{
Paul Moore5fb49872010-04-22 14:46:19 -04002424 const struct task_security_struct *tsec = current_security();
David Howells275bb412008-11-14 10:39:19 +11002425 u32 sid, osid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002426 int atsecure = 0;
2427
David Howells275bb412008-11-14 10:39:19 +11002428 sid = tsec->sid;
2429 osid = tsec->osid;
2430
2431 if (osid != sid) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002432 /* Enable secure mode for SIDs transitions unless
2433 the noatsecure permission is granted between
2434 the two SIDs, i.e. ahp returns 0. */
David Howells275bb412008-11-14 10:39:19 +11002435 atsecure = avc_has_perm(osid, sid,
David Howellsa6f76f22008-11-14 10:39:24 +11002436 SECCLASS_PROCESS,
2437 PROCESS__NOATSECURE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002438 }
2439
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07002440 return !!atsecure;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002441}
2442
Al Viroc3c073f2012-08-21 22:32:06 -04002443static int match_file(const void *p, struct file *file, unsigned fd)
2444{
2445 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2446}
2447
Linus Torvalds1da177e2005-04-16 15:20:36 -07002448/* Derived from fs/exec.c:flush_old_files. */
David Howells745ca242008-11-14 10:39:22 +11002449static inline void flush_unauthorized_files(const struct cred *cred,
2450 struct files_struct *files)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002451{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002452 struct file *file, *devnull = NULL;
Stephen Smalleyb20c8122006-09-25 23:32:03 -07002453 struct tty_struct *tty;
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002454 int drop_tty = 0;
Al Viroc3c073f2012-08-21 22:32:06 -04002455 unsigned n;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002456
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002457 tty = get_current_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002458 if (tty) {
Peter Hurley4a510962016-01-09 21:35:23 -08002459 spin_lock(&tty->files_lock);
Eric Paris37dd0bd2008-10-31 17:40:00 -04002460 if (!list_empty(&tty->tty_files)) {
Nick Piggind996b622010-08-18 04:37:36 +10002461 struct tty_file_private *file_priv;
Eric Paris37dd0bd2008-10-31 17:40:00 -04002462
Linus Torvalds1da177e2005-04-16 15:20:36 -07002463 /* Revalidate access to controlling tty.
David Howells13f8e982013-06-13 23:37:55 +01002464 Use file_path_has_perm on the tty path directly
2465 rather than using file_has_perm, as this particular
2466 open file may belong to another process and we are
2467 only interested in the inode-based check here. */
Nick Piggind996b622010-08-18 04:37:36 +10002468 file_priv = list_first_entry(&tty->tty_files,
2469 struct tty_file_private, list);
2470 file = file_priv->file;
David Howells13f8e982013-06-13 23:37:55 +01002471 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
Peter Zijlstra24ec8392006-12-08 02:36:04 -08002472 drop_tty = 1;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002473 }
Peter Hurley4a510962016-01-09 21:35:23 -08002474 spin_unlock(&tty->files_lock);
Alan Cox452a00d2008-10-13 10:39:13 +01002475 tty_kref_put(tty);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002476 }
Eric W. Biederman98a27ba2007-05-08 00:26:56 -07002477 /* Reset controlling tty. */
2478 if (drop_tty)
2479 no_tty();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002480
2481 /* Revalidate access to inherited open files. */
Al Viroc3c073f2012-08-21 22:32:06 -04002482 n = iterate_fd(files, 0, match_file, cred);
2483 if (!n) /* none found? */
2484 return;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002485
Al Viroc3c073f2012-08-21 22:32:06 -04002486 devnull = dentry_open(&selinux_null, O_RDWR, cred);
Al Viro45525b22012-10-16 13:30:07 -04002487 if (IS_ERR(devnull))
2488 devnull = NULL;
2489 /* replace all the matching ones with this */
2490 do {
2491 replace_fd(n - 1, devnull, 0);
2492 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2493 if (devnull)
Al Viroc3c073f2012-08-21 22:32:06 -04002494 fput(devnull);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002495}
2496
Linus Torvalds1da177e2005-04-16 15:20:36 -07002497/*
David Howellsa6f76f22008-11-14 10:39:24 +11002498 * Prepare a process for imminent new credential changes due to exec
Linus Torvalds1da177e2005-04-16 15:20:36 -07002499 */
David Howellsa6f76f22008-11-14 10:39:24 +11002500static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002501{
David Howellsa6f76f22008-11-14 10:39:24 +11002502 struct task_security_struct *new_tsec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002503 struct rlimit *rlim, *initrlim;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002504 int rc, i;
2505
David Howellsa6f76f22008-11-14 10:39:24 +11002506 new_tsec = bprm->cred->security;
2507 if (new_tsec->sid == new_tsec->osid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002508 return;
2509
2510 /* Close files for which the new task SID is not authorized. */
David Howellsa6f76f22008-11-14 10:39:24 +11002511 flush_unauthorized_files(bprm->cred, current->files);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002512
David Howellsa6f76f22008-11-14 10:39:24 +11002513 /* Always clear parent death signal on SID transitions. */
2514 current->pdeath_signal = 0;
2515
2516 /* Check whether the new SID can inherit resource limits from the old
2517 * SID. If not, reset all soft limits to the lower of the current
2518 * task's hard limit and the init task's soft limit.
2519 *
2520 * Note that the setting of hard limits (even to lower them) can be
2521 * controlled by the setrlimit check. The inclusion of the init task's
2522 * soft limit into the computation is to avoid resetting soft limits
2523 * higher than the default soft limit for cases where the default is
2524 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2525 */
2526 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2527 PROCESS__RLIMITINH, NULL);
2528 if (rc) {
Oleg Nesteroveb2d55a2010-06-23 22:43:32 +02002529 /* protect against do_prlimit() */
2530 task_lock(current);
David Howellsa6f76f22008-11-14 10:39:24 +11002531 for (i = 0; i < RLIM_NLIMITS; i++) {
2532 rlim = current->signal->rlim + i;
2533 initrlim = init_task.signal->rlim + i;
2534 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2535 }
Oleg Nesteroveb2d55a2010-06-23 22:43:32 +02002536 task_unlock(current);
Nicolas Pitrebaa73d92016-11-11 00:10:10 -05002537 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2538 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
David Howellsa6f76f22008-11-14 10:39:24 +11002539 }
2540}
2541
2542/*
2543 * Clean up the process immediately after the installation of new credentials
2544 * due to exec
2545 */
2546static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2547{
2548 const struct task_security_struct *tsec = current_security();
2549 struct itimerval itimer;
David Howellsa6f76f22008-11-14 10:39:24 +11002550 u32 osid, sid;
2551 int rc, i;
David Howellsa6f76f22008-11-14 10:39:24 +11002552
David Howellsa6f76f22008-11-14 10:39:24 +11002553 osid = tsec->osid;
2554 sid = tsec->sid;
2555
2556 if (sid == osid)
2557 return;
2558
2559 /* Check whether the new SID can inherit signal state from the old SID.
2560 * If not, clear itimers to avoid subsequent signal generation and
2561 * flush and unblock signals.
2562 *
2563 * This must occur _after_ the task SID has been updated so that any
2564 * kill done after the flush will be checked against the new SID.
2565 */
2566 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002567 if (rc) {
Nicolas Pitrebaa73d92016-11-11 00:10:10 -05002568 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) {
2569 memset(&itimer, 0, sizeof itimer);
2570 for (i = 0; i < 3; i++)
2571 do_setitimer(i, &itimer, NULL);
2572 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002573 spin_lock_irq(&current->sighand->siglock);
Oleg Nesterov9e7c8f82015-06-04 16:22:16 -04002574 if (!fatal_signal_pending(current)) {
2575 flush_sigqueue(&current->pending);
2576 flush_sigqueue(&current->signal->shared_pending);
David Howells3bcac022009-04-29 13:45:05 +01002577 flush_signal_handlers(current, 1);
2578 sigemptyset(&current->blocked);
Oleg Nesterov9e7c8f82015-06-04 16:22:16 -04002579 recalc_sigpending();
David Howells3bcac022009-04-29 13:45:05 +01002580 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07002581 spin_unlock_irq(&current->sighand->siglock);
2582 }
2583
David Howellsa6f76f22008-11-14 10:39:24 +11002584 /* Wake up the parent if it is waiting so that it can recheck
2585 * wait permission to the new task SID. */
Oleg Nesterovecd6de32009-04-29 16:02:24 +02002586 read_lock(&tasklist_lock);
Oleg Nesterov0b7570e2009-09-23 15:56:46 -07002587 __wake_up_parent(current, current->real_parent);
Oleg Nesterovecd6de32009-04-29 16:02:24 +02002588 read_unlock(&tasklist_lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002589}
2590
2591/* superblock security operations */
2592
2593static int selinux_sb_alloc_security(struct super_block *sb)
2594{
2595 return superblock_alloc_security(sb);
2596}
2597
2598static void selinux_sb_free_security(struct super_block *sb)
2599{
2600 superblock_free_security(sb);
2601}
2602
2603static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2604{
2605 if (plen > olen)
2606 return 0;
2607
2608 return !memcmp(prefix, option, plen);
2609}
2610
2611static inline int selinux_option(char *option, int len)
2612{
Eric Paris832cbd92008-04-01 13:24:09 -04002613 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2614 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2615 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
David P. Quigley11689d42009-01-16 09:22:03 -05002616 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2617 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
Linus Torvalds1da177e2005-04-16 15:20:36 -07002618}
2619
2620static inline void take_option(char **to, char *from, int *first, int len)
2621{
2622 if (!*first) {
2623 **to = ',';
2624 *to += 1;
Cory Olmo3528a952006-09-29 01:58:44 -07002625 } else
Linus Torvalds1da177e2005-04-16 15:20:36 -07002626 *first = 0;
2627 memcpy(*to, from, len);
2628 *to += len;
2629}
2630
Eric Paris828dfe12008-04-17 13:17:49 -04002631static inline void take_selinux_option(char **to, char *from, int *first,
2632 int len)
Cory Olmo3528a952006-09-29 01:58:44 -07002633{
2634 int current_size = 0;
2635
2636 if (!*first) {
2637 **to = '|';
2638 *to += 1;
Eric Paris828dfe12008-04-17 13:17:49 -04002639 } else
Cory Olmo3528a952006-09-29 01:58:44 -07002640 *first = 0;
2641
2642 while (current_size < len) {
2643 if (*from != '"') {
2644 **to = *from;
2645 *to += 1;
2646 }
2647 from += 1;
2648 current_size += 1;
2649 }
2650}
2651
Eric Parise0007522008-03-05 10:31:54 -05002652static int selinux_sb_copy_data(char *orig, char *copy)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002653{
2654 int fnosec, fsec, rc = 0;
2655 char *in_save, *in_curr, *in_end;
2656 char *sec_curr, *nosec_save, *nosec;
Cory Olmo3528a952006-09-29 01:58:44 -07002657 int open_quote = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002658
2659 in_curr = orig;
2660 sec_curr = copy;
2661
Linus Torvalds1da177e2005-04-16 15:20:36 -07002662 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2663 if (!nosec) {
2664 rc = -ENOMEM;
2665 goto out;
2666 }
2667
2668 nosec_save = nosec;
2669 fnosec = fsec = 1;
2670 in_save = in_end = orig;
2671
2672 do {
Cory Olmo3528a952006-09-29 01:58:44 -07002673 if (*in_end == '"')
2674 open_quote = !open_quote;
2675 if ((*in_end == ',' && open_quote == 0) ||
2676 *in_end == '\0') {
Linus Torvalds1da177e2005-04-16 15:20:36 -07002677 int len = in_end - in_curr;
2678
2679 if (selinux_option(in_curr, len))
Cory Olmo3528a952006-09-29 01:58:44 -07002680 take_selinux_option(&sec_curr, in_curr, &fsec, len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002681 else
2682 take_option(&nosec, in_curr, &fnosec, len);
2683
2684 in_curr = in_end + 1;
2685 }
2686 } while (*in_end++);
2687
Eric Paris6931dfc2005-06-30 02:58:51 -07002688 strcpy(in_save, nosec_save);
Gerald Schaeferda3caa22005-06-21 17:15:18 -07002689 free_page((unsigned long)nosec_save);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002690out:
2691 return rc;
2692}
2693
Eric Paris026eb162011-03-03 16:09:14 -05002694static int selinux_sb_remount(struct super_block *sb, void *data)
2695{
2696 int rc, i, *flags;
2697 struct security_mnt_opts opts;
2698 char *secdata, **mount_options;
2699 struct superblock_security_struct *sbsec = sb->s_security;
2700
2701 if (!(sbsec->flags & SE_SBINITIALIZED))
2702 return 0;
2703
2704 if (!data)
2705 return 0;
2706
2707 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2708 return 0;
2709
2710 security_init_mnt_opts(&opts);
2711 secdata = alloc_secdata();
2712 if (!secdata)
2713 return -ENOMEM;
2714 rc = selinux_sb_copy_data(data, secdata);
2715 if (rc)
2716 goto out_free_secdata;
2717
2718 rc = selinux_parse_opts_str(secdata, &opts);
2719 if (rc)
2720 goto out_free_secdata;
2721
2722 mount_options = opts.mnt_opts;
2723 flags = opts.mnt_opts_flags;
2724
2725 for (i = 0; i < opts.num_mnt_opts; i++) {
2726 u32 sid;
Eric Paris026eb162011-03-03 16:09:14 -05002727
Eric Paris12f348b2012-10-09 10:56:25 -04002728 if (flags[i] == SBLABEL_MNT)
Eric Paris026eb162011-03-03 16:09:14 -05002729 continue;
Rasmus Villemoes44be2f62015-10-21 17:44:25 -04002730 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
Eric Paris026eb162011-03-03 16:09:14 -05002731 if (rc) {
Rasmus Villemoes44be2f62015-10-21 17:44:25 -04002732 printk(KERN_WARNING "SELinux: security_context_str_to_sid"
Linus Torvalds29b1deb2013-12-15 11:17:45 -08002733 "(%s) failed for (dev %s, type %s) errno=%d\n",
2734 mount_options[i], sb->s_id, sb->s_type->name, rc);
Eric Paris026eb162011-03-03 16:09:14 -05002735 goto out_free_opts;
2736 }
2737 rc = -EINVAL;
2738 switch (flags[i]) {
2739 case FSCONTEXT_MNT:
2740 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2741 goto out_bad_option;
2742 break;
2743 case CONTEXT_MNT:
2744 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2745 goto out_bad_option;
2746 break;
2747 case ROOTCONTEXT_MNT: {
2748 struct inode_security_struct *root_isec;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05002749 root_isec = backing_inode_security(sb->s_root);
Eric Paris026eb162011-03-03 16:09:14 -05002750
2751 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2752 goto out_bad_option;
2753 break;
2754 }
2755 case DEFCONTEXT_MNT:
2756 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2757 goto out_bad_option;
2758 break;
2759 default:
2760 goto out_free_opts;
2761 }
2762 }
2763
2764 rc = 0;
2765out_free_opts:
2766 security_free_mnt_opts(&opts);
2767out_free_secdata:
2768 free_secdata(secdata);
2769 return rc;
2770out_bad_option:
2771 printk(KERN_WARNING "SELinux: unable to change security options "
Linus Torvalds29b1deb2013-12-15 11:17:45 -08002772 "during remount (dev %s, type=%s)\n", sb->s_id,
2773 sb->s_type->name);
Eric Paris026eb162011-03-03 16:09:14 -05002774 goto out_free_opts;
2775}
2776
James Morris12204e22008-12-19 10:44:42 +11002777static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002778{
David Howells88e67f32008-11-14 10:39:21 +11002779 const struct cred *cred = current_cred();
Thomas Liu2bf49692009-07-14 12:14:09 -04002780 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002781 int rc;
2782
2783 rc = superblock_doinit(sb, data);
2784 if (rc)
2785 return rc;
2786
James Morris74192242008-12-19 11:41:10 +11002787 /* Allow all mounts performed by the kernel */
2788 if (flags & MS_KERNMOUNT)
2789 return 0;
2790
Eric Paris50c205f2012-04-04 15:01:43 -04002791 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04002792 ad.u.dentry = sb->s_root;
David Howells88e67f32008-11-14 10:39:21 +11002793 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002794}
2795
David Howells726c3342006-06-23 02:02:58 -07002796static int selinux_sb_statfs(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002797{
David Howells88e67f32008-11-14 10:39:21 +11002798 const struct cred *cred = current_cred();
Thomas Liu2bf49692009-07-14 12:14:09 -04002799 struct common_audit_data ad;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002800
Eric Paris50c205f2012-04-04 15:01:43 -04002801 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04002802 ad.u.dentry = dentry->d_sb->s_root;
David Howells88e67f32008-11-14 10:39:21 +11002803 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002804}
2805
Al Viro808d4e32012-10-11 11:42:01 -04002806static int selinux_mount(const char *dev_name,
Al Viro8a04c432016-03-25 14:52:53 -04002807 const struct path *path,
Al Viro808d4e32012-10-11 11:42:01 -04002808 const char *type,
Eric Paris828dfe12008-04-17 13:17:49 -04002809 unsigned long flags,
2810 void *data)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002811{
David Howells88e67f32008-11-14 10:39:21 +11002812 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002813
2814 if (flags & MS_REMOUNT)
Al Virod8c95842011-12-07 18:16:57 -05002815 return superblock_has_perm(cred, path->dentry->d_sb,
Eric Paris828dfe12008-04-17 13:17:49 -04002816 FILESYSTEM__REMOUNT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002817 else
Eric Paris2875fa02011-04-28 16:04:24 -04002818 return path_has_perm(cred, path, FILE__MOUNTON);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002819}
2820
2821static int selinux_umount(struct vfsmount *mnt, int flags)
2822{
David Howells88e67f32008-11-14 10:39:21 +11002823 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07002824
David Howells88e67f32008-11-14 10:39:21 +11002825 return superblock_has_perm(cred, mnt->mnt_sb,
Eric Paris828dfe12008-04-17 13:17:49 -04002826 FILESYSTEM__UNMOUNT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002827}
2828
2829/* inode security operations */
2830
2831static int selinux_inode_alloc_security(struct inode *inode)
2832{
2833 return inode_alloc_security(inode);
2834}
2835
2836static void selinux_inode_free_security(struct inode *inode)
2837{
2838 inode_free_security(inode);
2839}
2840
David Quigleyd47be3d2013-05-22 12:50:34 -04002841static int selinux_dentry_init_security(struct dentry *dentry, int mode,
Al Viro4f3ccd72016-07-20 16:06:15 -04002842 const struct qstr *name, void **ctx,
David Quigleyd47be3d2013-05-22 12:50:34 -04002843 u32 *ctxlen)
2844{
David Quigleyd47be3d2013-05-22 12:50:34 -04002845 u32 newsid;
2846 int rc;
2847
Vivek Goyalc957f6d2016-07-13 10:44:51 -04002848 rc = selinux_determine_inode_label(current_security(),
2849 d_inode(dentry->d_parent), name,
David Howellsc3c188b2015-07-10 17:19:58 -04002850 inode_mode_to_security_class(mode),
2851 &newsid);
2852 if (rc)
2853 return rc;
David Quigleyd47be3d2013-05-22 12:50:34 -04002854
2855 return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2856}
2857
Vivek Goyala518b0a2016-07-13 10:44:53 -04002858static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2859 struct qstr *name,
2860 const struct cred *old,
2861 struct cred *new)
2862{
2863 u32 newsid;
2864 int rc;
2865 struct task_security_struct *tsec;
2866
2867 rc = selinux_determine_inode_label(old->security,
2868 d_inode(dentry->d_parent), name,
2869 inode_mode_to_security_class(mode),
2870 &newsid);
2871 if (rc)
2872 return rc;
2873
2874 tsec = new->security;
2875 tsec->create_sid = newsid;
2876 return 0;
2877}
2878
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002879static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
Tetsuo Handa95489062013-07-25 05:44:02 +09002880 const struct qstr *qstr,
2881 const char **name,
Eric Paris2a7dba32011-02-01 11:05:39 -05002882 void **value, size_t *len)
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002883{
Paul Moore5fb49872010-04-22 14:46:19 -04002884 const struct task_security_struct *tsec = current_security();
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002885 struct superblock_security_struct *sbsec;
David Howells275bb412008-11-14 10:39:19 +11002886 u32 sid, newsid, clen;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002887 int rc;
Tetsuo Handa95489062013-07-25 05:44:02 +09002888 char *context;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002889
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002890 sbsec = dir->i_sb->s_security;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002891
David Howells275bb412008-11-14 10:39:19 +11002892 sid = tsec->sid;
2893 newsid = tsec->create_sid;
2894
Vivek Goyalc957f6d2016-07-13 10:44:51 -04002895 rc = selinux_determine_inode_label(current_security(),
David Howellsc3c188b2015-07-10 17:19:58 -04002896 dir, qstr,
2897 inode_mode_to_security_class(inode->i_mode),
2898 &newsid);
2899 if (rc)
2900 return rc;
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002901
Eric Paris296fddf2006-09-25 23:32:00 -07002902 /* Possibly defer initialization to selinux_complete_init. */
David P. Quigley0d90a7e2009-01-16 09:22:02 -05002903 if (sbsec->flags & SE_SBINITIALIZED) {
Eric Paris296fddf2006-09-25 23:32:00 -07002904 struct inode_security_struct *isec = inode->i_security;
2905 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2906 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05002907 isec->initialized = LABEL_INITIALIZED;
Eric Paris296fddf2006-09-25 23:32:00 -07002908 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002909
Eric Paris12f348b2012-10-09 10:56:25 -04002910 if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
Stephen Smalley25a74f32005-11-08 21:34:33 -08002911 return -EOPNOTSUPP;
2912
Tetsuo Handa95489062013-07-25 05:44:02 +09002913 if (name)
2914 *name = XATTR_SELINUX_SUFFIX;
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002915
2916 if (value && len) {
Stephen Smalley12b29f32008-05-07 13:03:20 -04002917 rc = security_sid_to_context_force(newsid, &context, &clen);
Tetsuo Handa95489062013-07-25 05:44:02 +09002918 if (rc)
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002919 return rc;
Stephen Smalley570bc1c2005-09-09 13:01:43 -07002920 *value = context;
2921 *len = clen;
2922 }
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002923
Stephen Smalley5e41ff92005-09-09 13:01:35 -07002924 return 0;
2925}
2926
Al Viro4acdaf22011-07-26 01:42:34 -04002927static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002928{
2929 return may_create(dir, dentry, SECCLASS_FILE);
2930}
2931
Linus Torvalds1da177e2005-04-16 15:20:36 -07002932static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2933{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002934 return may_link(dir, old_dentry, MAY_LINK);
2935}
2936
Linus Torvalds1da177e2005-04-16 15:20:36 -07002937static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2938{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002939 return may_link(dir, dentry, MAY_UNLINK);
2940}
2941
2942static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2943{
2944 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2945}
2946
Al Viro18bb1db2011-07-26 01:41:39 -04002947static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002948{
2949 return may_create(dir, dentry, SECCLASS_DIR);
2950}
2951
Linus Torvalds1da177e2005-04-16 15:20:36 -07002952static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2953{
2954 return may_link(dir, dentry, MAY_RMDIR);
2955}
2956
Al Viro1a67aaf2011-07-26 01:52:52 -04002957static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002958{
Linus Torvalds1da177e2005-04-16 15:20:36 -07002959 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2960}
2961
Linus Torvalds1da177e2005-04-16 15:20:36 -07002962static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
Eric Paris828dfe12008-04-17 13:17:49 -04002963 struct inode *new_inode, struct dentry *new_dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002964{
2965 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2966}
2967
Linus Torvalds1da177e2005-04-16 15:20:36 -07002968static int selinux_inode_readlink(struct dentry *dentry)
2969{
David Howells88e67f32008-11-14 10:39:21 +11002970 const struct cred *cred = current_cred();
2971
Eric Paris2875fa02011-04-28 16:04:24 -04002972 return dentry_has_perm(cred, dentry, FILE__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002973}
2974
NeilBrownbda0be72015-03-23 13:37:39 +11002975static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2976 bool rcu)
Linus Torvalds1da177e2005-04-16 15:20:36 -07002977{
David Howells88e67f32008-11-14 10:39:21 +11002978 const struct cred *cred = current_cred();
NeilBrownbda0be72015-03-23 13:37:39 +11002979 struct common_audit_data ad;
2980 struct inode_security_struct *isec;
2981 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07002982
NeilBrownbda0be72015-03-23 13:37:39 +11002983 validate_creds(cred);
2984
2985 ad.type = LSM_AUDIT_DATA_DENTRY;
2986 ad.u.dentry = dentry;
2987 sid = cred_sid(cred);
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05002988 isec = inode_security_rcu(inode, rcu);
2989 if (IS_ERR(isec))
2990 return PTR_ERR(isec);
NeilBrownbda0be72015-03-23 13:37:39 +11002991
2992 return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2993 rcu ? MAY_NOT_BLOCK : 0);
Linus Torvalds1da177e2005-04-16 15:20:36 -07002994}
2995
Eric Parisd4cf970d2012-04-04 15:01:42 -04002996static noinline int audit_inode_permission(struct inode *inode,
2997 u32 perms, u32 audited, u32 denied,
Stephen Smalley626b9742014-04-29 11:29:04 -07002998 int result,
Eric Parisd4cf970d2012-04-04 15:01:42 -04002999 unsigned flags)
3000{
3001 struct common_audit_data ad;
Eric Parisd4cf970d2012-04-04 15:01:42 -04003002 struct inode_security_struct *isec = inode->i_security;
3003 int rc;
3004
Eric Paris50c205f2012-04-04 15:01:43 -04003005 ad.type = LSM_AUDIT_DATA_INODE;
Eric Parisd4cf970d2012-04-04 15:01:42 -04003006 ad.u.inode = inode;
3007
3008 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
Stephen Smalley626b9742014-04-29 11:29:04 -07003009 audited, denied, result, &ad, flags);
Eric Parisd4cf970d2012-04-04 15:01:42 -04003010 if (rc)
3011 return rc;
3012 return 0;
3013}
3014
Al Viroe74f71e2011-06-20 19:38:15 -04003015static int selinux_inode_permission(struct inode *inode, int mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003016{
David Howells88e67f32008-11-14 10:39:21 +11003017 const struct cred *cred = current_cred();
Eric Parisb782e0a2010-07-23 11:44:03 -04003018 u32 perms;
3019 bool from_access;
Al Virocf1dd1d2011-06-20 19:44:08 -04003020 unsigned flags = mask & MAY_NOT_BLOCK;
Eric Paris2e3340572012-04-04 15:01:42 -04003021 struct inode_security_struct *isec;
3022 u32 sid;
3023 struct av_decision avd;
3024 int rc, rc2;
3025 u32 audited, denied;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003026
Eric Parisb782e0a2010-07-23 11:44:03 -04003027 from_access = mask & MAY_ACCESS;
Eric Parisd09ca732010-07-23 11:43:57 -04003028 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3029
Eric Parisb782e0a2010-07-23 11:44:03 -04003030 /* No permission to check. Existence test. */
3031 if (!mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003032 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003033
Eric Paris2e3340572012-04-04 15:01:42 -04003034 validate_creds(cred);
Eric Parisb782e0a2010-07-23 11:44:03 -04003035
Eric Paris2e3340572012-04-04 15:01:42 -04003036 if (unlikely(IS_PRIVATE(inode)))
3037 return 0;
Eric Parisb782e0a2010-07-23 11:44:03 -04003038
3039 perms = file_mask_to_av(inode->i_mode, mask);
3040
Eric Paris2e3340572012-04-04 15:01:42 -04003041 sid = cred_sid(cred);
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05003042 isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3043 if (IS_ERR(isec))
3044 return PTR_ERR(isec);
Eric Paris2e3340572012-04-04 15:01:42 -04003045
3046 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
3047 audited = avc_audit_required(perms, &avd, rc,
3048 from_access ? FILE__AUDIT_ACCESS : 0,
3049 &denied);
3050 if (likely(!audited))
3051 return rc;
3052
Stephen Smalley626b9742014-04-29 11:29:04 -07003053 rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
Eric Paris2e3340572012-04-04 15:01:42 -04003054 if (rc2)
3055 return rc2;
3056 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003057}
3058
3059static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3060{
David Howells88e67f32008-11-14 10:39:21 +11003061 const struct cred *cred = current_cred();
Amerigo Wangbc6a6002009-08-20 19:29:02 -07003062 unsigned int ia_valid = iattr->ia_valid;
Eric Paris95dbf732012-04-04 13:45:34 -04003063 __u32 av = FILE__WRITE;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003064
Amerigo Wangbc6a6002009-08-20 19:29:02 -07003065 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3066 if (ia_valid & ATTR_FORCE) {
3067 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3068 ATTR_FORCE);
3069 if (!ia_valid)
3070 return 0;
3071 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003072
Amerigo Wangbc6a6002009-08-20 19:29:02 -07003073 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3074 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
Eric Paris2875fa02011-04-28 16:04:24 -04003075 return dentry_has_perm(cred, dentry, FILE__SETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003076
Jeff Vander Stoep44d37ad2015-10-21 17:44:25 -04003077 if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE)
3078 && !(ia_valid & ATTR_FILE))
Eric Paris95dbf732012-04-04 13:45:34 -04003079 av |= FILE__OPEN;
3080
3081 return dentry_has_perm(cred, dentry, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003082}
3083
Al Viro3f7036a2015-03-08 19:28:30 -04003084static int selinux_inode_getattr(const struct path *path)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003085{
Al Viro3f7036a2015-03-08 19:28:30 -04003086 return path_has_perm(current_cred(), path, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003087}
3088
David Howells8f0cfa52008-04-29 00:59:41 -07003089static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
Serge E. Hallynb5376772007-10-16 23:31:36 -07003090{
David Howells88e67f32008-11-14 10:39:21 +11003091 const struct cred *cred = current_cred();
3092
Serge E. Hallynb5376772007-10-16 23:31:36 -07003093 if (!strncmp(name, XATTR_SECURITY_PREFIX,
3094 sizeof XATTR_SECURITY_PREFIX - 1)) {
3095 if (!strcmp(name, XATTR_NAME_CAPS)) {
3096 if (!capable(CAP_SETFCAP))
3097 return -EPERM;
3098 } else if (!capable(CAP_SYS_ADMIN)) {
3099 /* A different attribute in the security namespace.
3100 Restrict to administrator. */
3101 return -EPERM;
3102 }
3103 }
3104
3105 /* Not an attribute we recognize, so just check the
3106 ordinary setattr permission. */
Eric Paris2875fa02011-04-28 16:04:24 -04003107 return dentry_has_perm(cred, dentry, FILE__SETATTR);
Serge E. Hallynb5376772007-10-16 23:31:36 -07003108}
3109
David Howells8f0cfa52008-04-29 00:59:41 -07003110static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3111 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003112{
David Howellsc6f493d2015-03-17 22:26:22 +00003113 struct inode *inode = d_backing_inode(dentry);
Paul Moore20cdef82016-04-04 14:14:42 -04003114 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003115 struct superblock_security_struct *sbsec;
Thomas Liu2bf49692009-07-14 12:14:09 -04003116 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11003117 u32 newsid, sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003118 int rc = 0;
3119
Serge E. Hallynb5376772007-10-16 23:31:36 -07003120 if (strcmp(name, XATTR_NAME_SELINUX))
3121 return selinux_inode_setotherxattr(dentry, name);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003122
3123 sbsec = inode->i_sb->s_security;
Eric Paris12f348b2012-10-09 10:56:25 -04003124 if (!(sbsec->flags & SBLABEL_MNT))
Linus Torvalds1da177e2005-04-16 15:20:36 -07003125 return -EOPNOTSUPP;
3126
Serge E. Hallyn2e149672011-03-23 16:43:26 -07003127 if (!inode_owner_or_capable(inode))
Linus Torvalds1da177e2005-04-16 15:20:36 -07003128 return -EPERM;
3129
Eric Paris50c205f2012-04-04 15:01:43 -04003130 ad.type = LSM_AUDIT_DATA_DENTRY;
Eric Parisa2694342011-04-25 13:10:27 -04003131 ad.u.dentry = dentry;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003132
Paul Moore20cdef82016-04-04 14:14:42 -04003133 isec = backing_inode_security(dentry);
David Howells275bb412008-11-14 10:39:19 +11003134 rc = avc_has_perm(sid, isec->sid, isec->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003135 FILE__RELABELFROM, &ad);
3136 if (rc)
3137 return rc;
3138
Nikolay Aleksandrov52a4c642014-03-07 12:44:19 +01003139 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
Stephen Smalley12b29f32008-05-07 13:03:20 -04003140 if (rc == -EINVAL) {
Eric Parisd6ea83e2012-04-04 13:45:49 -04003141 if (!capable(CAP_MAC_ADMIN)) {
3142 struct audit_buffer *ab;
3143 size_t audit_size;
3144 const char *str;
3145
3146 /* We strip a nul only if it is at the end, otherwise the
3147 * context contains a nul and we should audit that */
Al Viroe3fea3f2012-06-09 08:15:16 +01003148 if (value) {
3149 str = value;
3150 if (str[size - 1] == '\0')
3151 audit_size = size - 1;
3152 else
3153 audit_size = size;
3154 } else {
3155 str = "";
3156 audit_size = 0;
3157 }
Eric Parisd6ea83e2012-04-04 13:45:49 -04003158 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3159 audit_log_format(ab, "op=setxattr invalid_context=");
3160 audit_log_n_untrustedstring(ab, value, audit_size);
3161 audit_log_end(ab);
3162
Stephen Smalley12b29f32008-05-07 13:03:20 -04003163 return rc;
Eric Parisd6ea83e2012-04-04 13:45:49 -04003164 }
Stephen Smalley12b29f32008-05-07 13:03:20 -04003165 rc = security_context_to_sid_force(value, size, &newsid);
3166 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003167 if (rc)
3168 return rc;
3169
David Howells275bb412008-11-14 10:39:19 +11003170 rc = avc_has_perm(sid, newsid, isec->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003171 FILE__RELABELTO, &ad);
3172 if (rc)
3173 return rc;
3174
David Howells275bb412008-11-14 10:39:19 +11003175 rc = security_validate_transition(isec->sid, newsid, sid,
Eric Paris828dfe12008-04-17 13:17:49 -04003176 isec->sclass);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003177 if (rc)
3178 return rc;
3179
3180 return avc_has_perm(newsid,
3181 sbsec->sid,
3182 SECCLASS_FILESYSTEM,
3183 FILESYSTEM__ASSOCIATE,
3184 &ad);
3185}
3186
David Howells8f0cfa52008-04-29 00:59:41 -07003187static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
Eric Parisf5269712008-05-14 11:27:45 -04003188 const void *value, size_t size,
David Howells8f0cfa52008-04-29 00:59:41 -07003189 int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003190{
David Howellsc6f493d2015-03-17 22:26:22 +00003191 struct inode *inode = d_backing_inode(dentry);
Paul Moore20cdef82016-04-04 14:14:42 -04003192 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003193 u32 newsid;
3194 int rc;
3195
3196 if (strcmp(name, XATTR_NAME_SELINUX)) {
3197 /* Not an attribute we recognize, so nothing to do. */
3198 return;
3199 }
3200
Stephen Smalley12b29f32008-05-07 13:03:20 -04003201 rc = security_context_to_sid_force(value, size, &newsid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003202 if (rc) {
Stephen Smalley12b29f32008-05-07 13:03:20 -04003203 printk(KERN_ERR "SELinux: unable to map context to SID"
3204 "for (%s, %lu), rc=%d\n",
3205 inode->i_sb->s_id, inode->i_ino, -rc);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003206 return;
3207 }
3208
Paul Moore20cdef82016-04-04 14:14:42 -04003209 isec = backing_inode_security(dentry);
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003210 spin_lock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003211 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003212 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05003213 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003214 spin_unlock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003215
Linus Torvalds1da177e2005-04-16 15:20:36 -07003216 return;
3217}
3218
David Howells8f0cfa52008-04-29 00:59:41 -07003219static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003220{
David Howells88e67f32008-11-14 10:39:21 +11003221 const struct cred *cred = current_cred();
3222
Eric Paris2875fa02011-04-28 16:04:24 -04003223 return dentry_has_perm(cred, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003224}
3225
Eric Paris828dfe12008-04-17 13:17:49 -04003226static int selinux_inode_listxattr(struct dentry *dentry)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003227{
David Howells88e67f32008-11-14 10:39:21 +11003228 const struct cred *cred = current_cred();
3229
Eric Paris2875fa02011-04-28 16:04:24 -04003230 return dentry_has_perm(cred, dentry, FILE__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003231}
3232
David Howells8f0cfa52008-04-29 00:59:41 -07003233static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003234{
Serge E. Hallynb5376772007-10-16 23:31:36 -07003235 if (strcmp(name, XATTR_NAME_SELINUX))
3236 return selinux_inode_setotherxattr(dentry, name);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003237
3238 /* No one is allowed to remove a SELinux security label.
3239 You can change the label, but all data must be labeled. */
3240 return -EACCES;
3241}
3242
James Morrisd381d8a2005-10-30 14:59:22 -08003243/*
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003244 * Copy the inode security context value to the user.
James Morrisd381d8a2005-10-30 14:59:22 -08003245 *
3246 * Permission check is handled by selinux_inode_getxattr hook.
3247 */
Andreas Gruenbacherea861dfd2015-12-24 11:09:39 -05003248static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003249{
David P. Quigley42492592008-02-04 22:29:39 -08003250 u32 size;
3251 int error;
3252 char *context = NULL;
Paul Moore20cdef82016-04-04 14:14:42 -04003253 struct inode_security_struct *isec;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003254
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00003255 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3256 return -EOPNOTSUPP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003257
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003258 /*
3259 * If the caller has CAP_MAC_ADMIN, then get the raw context
3260 * value even if it is not defined by current policy; otherwise,
3261 * use the in-core value under current policy.
3262 * Use the non-auditing forms of the permission checks since
3263 * getxattr may be called by unprivileged processes commonly
3264 * and lack of permission just means that we fall back to the
3265 * in-core context value, not a denial.
3266 */
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07003267 error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3268 SECURITY_CAP_NOAUDIT);
3269 if (!error)
3270 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04003271 SECURITY_CAP_NOAUDIT, true);
Paul Moore20cdef82016-04-04 14:14:42 -04003272 isec = inode_security(inode);
Stephen Smalleyabc69bb2008-05-21 14:16:12 -04003273 if (!error)
3274 error = security_sid_to_context_force(isec->sid, &context,
3275 &size);
3276 else
3277 error = security_sid_to_context(isec->sid, &context, &size);
David P. Quigley42492592008-02-04 22:29:39 -08003278 if (error)
3279 return error;
3280 error = size;
3281 if (alloc) {
3282 *buffer = context;
3283 goto out_nofree;
3284 }
3285 kfree(context);
3286out_nofree:
3287 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003288}
3289
3290static int selinux_inode_setsecurity(struct inode *inode, const char *name,
Eric Paris828dfe12008-04-17 13:17:49 -04003291 const void *value, size_t size, int flags)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003292{
Paul Moore2c971652016-04-19 16:36:28 -04003293 struct inode_security_struct *isec = inode_security_novalidate(inode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003294 u32 newsid;
3295 int rc;
3296
3297 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3298 return -EOPNOTSUPP;
3299
3300 if (!value || !size)
3301 return -EACCES;
3302
Rasmus Villemoes20ba96a2015-10-21 17:44:26 -04003303 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003304 if (rc)
3305 return rc;
3306
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003307 spin_lock(&isec->lock);
David Quigleyaa9c2662013-05-22 12:50:44 -04003308 isec->sclass = inode_mode_to_security_class(inode->i_mode);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003309 isec->sid = newsid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05003310 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003311 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003312 return 0;
3313}
3314
3315static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3316{
3317 const int len = sizeof(XATTR_NAME_SELINUX);
3318 if (buffer && len <= buffer_size)
3319 memcpy(buffer, XATTR_NAME_SELINUX, len);
3320 return len;
3321}
3322
Andreas Gruenbacherd6335d72015-12-24 11:09:39 -05003323static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02003324{
Andreas Gruenbachere817c2f2016-02-18 12:04:08 +01003325 struct inode_security_struct *isec = inode_security_novalidate(inode);
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02003326 *secid = isec->sid;
3327}
3328
Vivek Goyal56909eb2016-07-13 10:44:48 -04003329static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3330{
3331 u32 sid;
3332 struct task_security_struct *tsec;
3333 struct cred *new_creds = *new;
3334
3335 if (new_creds == NULL) {
3336 new_creds = prepare_creds();
3337 if (!new_creds)
3338 return -ENOMEM;
3339 }
3340
3341 tsec = new_creds->security;
3342 /* Get label from overlay inode and set it in create_sid */
3343 selinux_inode_getsecid(d_inode(src), &sid);
3344 tsec->create_sid = sid;
3345 *new = new_creds;
3346 return 0;
3347}
3348
Vivek Goyal19472b62016-07-13 10:44:50 -04003349static int selinux_inode_copy_up_xattr(const char *name)
3350{
3351 /* The copy_up hook above sets the initial context on an inode, but we
3352 * don't then want to overwrite it by blindly copying all the lower
3353 * xattrs up. Instead, we have to filter out SELinux-related xattrs.
3354 */
3355 if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3356 return 1; /* Discard */
3357 /*
3358 * Any other attribute apart from SELINUX is not claimed, supported
3359 * by selinux.
3360 */
3361 return -EOPNOTSUPP;
3362}
3363
Linus Torvalds1da177e2005-04-16 15:20:36 -07003364/* file security operations */
3365
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003366static int selinux_revalidate_file_permission(struct file *file, int mask)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003367{
David Howells88e67f32008-11-14 10:39:21 +11003368 const struct cred *cred = current_cred();
Al Viro496ad9a2013-01-23 17:07:38 -05003369 struct inode *inode = file_inode(file);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003370
Linus Torvalds1da177e2005-04-16 15:20:36 -07003371 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3372 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3373 mask |= MAY_APPEND;
3374
Paul Moore389fb8002009-03-27 17:10:34 -04003375 return file_has_perm(cred, file,
3376 file_mask_to_av(inode->i_mode, mask));
Linus Torvalds1da177e2005-04-16 15:20:36 -07003377}
3378
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003379static int selinux_file_permission(struct file *file, int mask)
3380{
Al Viro496ad9a2013-01-23 17:07:38 -05003381 struct inode *inode = file_inode(file);
Stephen Smalley20dda182009-06-22 14:54:53 -04003382 struct file_security_struct *fsec = file->f_security;
Andreas Gruenbacherb1973672016-01-05 23:12:33 +01003383 struct inode_security_struct *isec;
Stephen Smalley20dda182009-06-22 14:54:53 -04003384 u32 sid = current_sid();
3385
Paul Moore389fb8002009-03-27 17:10:34 -04003386 if (!mask)
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003387 /* No permission to check. Existence test. */
3388 return 0;
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003389
Andreas Gruenbacherb1973672016-01-05 23:12:33 +01003390 isec = inode_security(inode);
Stephen Smalley20dda182009-06-22 14:54:53 -04003391 if (sid == fsec->sid && fsec->isid == isec->sid &&
3392 fsec->pseqno == avc_policy_seqno())
Eric Paris83d49852012-04-04 13:45:40 -04003393 /* No change since file_open check. */
Stephen Smalley20dda182009-06-22 14:54:53 -04003394 return 0;
3395
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003396 return selinux_revalidate_file_permission(file, mask);
3397}
3398
Linus Torvalds1da177e2005-04-16 15:20:36 -07003399static int selinux_file_alloc_security(struct file *file)
3400{
3401 return file_alloc_security(file);
3402}
3403
3404static void selinux_file_free_security(struct file *file)
3405{
3406 file_free_security(file);
3407}
3408
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003409/*
3410 * Check whether a task has the ioctl permission and cmd
3411 * operation to an inode.
3412 */
Geliang Tang1d2a1682015-10-21 17:44:27 -04003413static int ioctl_has_perm(const struct cred *cred, struct file *file,
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003414 u32 requested, u16 cmd)
3415{
3416 struct common_audit_data ad;
3417 struct file_security_struct *fsec = file->f_security;
3418 struct inode *inode = file_inode(file);
Paul Moore20cdef82016-04-04 14:14:42 -04003419 struct inode_security_struct *isec;
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003420 struct lsm_ioctlop_audit ioctl;
3421 u32 ssid = cred_sid(cred);
3422 int rc;
3423 u8 driver = cmd >> 8;
3424 u8 xperm = cmd & 0xff;
3425
3426 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3427 ad.u.op = &ioctl;
3428 ad.u.op->cmd = cmd;
3429 ad.u.op->path = file->f_path;
3430
3431 if (ssid != fsec->sid) {
3432 rc = avc_has_perm(ssid, fsec->sid,
3433 SECCLASS_FD,
3434 FD__USE,
3435 &ad);
3436 if (rc)
3437 goto out;
3438 }
3439
3440 if (unlikely(IS_PRIVATE(inode)))
3441 return 0;
3442
Paul Moore20cdef82016-04-04 14:14:42 -04003443 isec = inode_security(inode);
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003444 rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3445 requested, driver, xperm, &ad);
3446out:
3447 return rc;
3448}
3449
Linus Torvalds1da177e2005-04-16 15:20:36 -07003450static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3451 unsigned long arg)
3452{
David Howells88e67f32008-11-14 10:39:21 +11003453 const struct cred *cred = current_cred();
Eric Paris0b24dcb2011-02-25 15:39:20 -05003454 int error = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003455
Eric Paris0b24dcb2011-02-25 15:39:20 -05003456 switch (cmd) {
3457 case FIONREAD:
3458 /* fall through */
3459 case FIBMAP:
3460 /* fall through */
3461 case FIGETBSZ:
3462 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003463 case FS_IOC_GETFLAGS:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003464 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003465 case FS_IOC_GETVERSION:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003466 error = file_has_perm(cred, file, FILE__GETATTR);
3467 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003468
Al Viro2f99c362012-03-23 16:04:05 -04003469 case FS_IOC_SETFLAGS:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003470 /* fall through */
Al Viro2f99c362012-03-23 16:04:05 -04003471 case FS_IOC_SETVERSION:
Eric Paris0b24dcb2011-02-25 15:39:20 -05003472 error = file_has_perm(cred, file, FILE__SETATTR);
3473 break;
3474
3475 /* sys_ioctl() checks */
3476 case FIONBIO:
3477 /* fall through */
3478 case FIOASYNC:
3479 error = file_has_perm(cred, file, 0);
3480 break;
3481
3482 case KDSKBENT:
3483 case KDSKBSENT:
Eric Paris6a9de492012-01-03 12:25:14 -05003484 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
Stephen Smalley8e4ff6f2016-04-08 13:52:00 -04003485 SECURITY_CAP_AUDIT, true);
Eric Paris0b24dcb2011-02-25 15:39:20 -05003486 break;
3487
3488 /* default case assumes that the command will go
3489 * to the file's ioctl() function.
3490 */
3491 default:
Jeff Vander Stoepfa1aa142015-07-10 17:19:56 -04003492 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
Eric Paris0b24dcb2011-02-25 15:39:20 -05003493 }
3494 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003495}
3496
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003497static int default_noexec;
3498
Linus Torvalds1da177e2005-04-16 15:20:36 -07003499static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3500{
David Howells88e67f32008-11-14 10:39:21 +11003501 const struct cred *cred = current_cred();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003502 u32 sid = cred_sid(cred);
David Howellsd84f4f92008-11-14 10:39:23 +11003503 int rc = 0;
David Howells88e67f32008-11-14 10:39:21 +11003504
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003505 if (default_noexec &&
Stephen Smalley892e8ca2015-07-10 09:40:59 -04003506 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3507 (!shared && (prot & PROT_WRITE)))) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07003508 /*
3509 * We are making executable an anonymous mapping or a
3510 * private file mapping that will also be writable.
3511 * This has an additional check.
3512 */
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003513 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3514 PROCESS__EXECMEM, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003515 if (rc)
David Howellsd84f4f92008-11-14 10:39:23 +11003516 goto error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003517 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003518
3519 if (file) {
3520 /* read access is always possible with a mapping */
3521 u32 av = FILE__READ;
3522
3523 /* write access only matters if the mapping is shared */
3524 if (shared && (prot & PROT_WRITE))
3525 av |= FILE__WRITE;
3526
3527 if (prot & PROT_EXEC)
3528 av |= FILE__EXECUTE;
3529
David Howells88e67f32008-11-14 10:39:21 +11003530 return file_has_perm(cred, file, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003531 }
David Howellsd84f4f92008-11-14 10:39:23 +11003532
3533error:
3534 return rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003535}
3536
Al Viroe5467852012-05-30 13:30:51 -04003537static int selinux_mmap_addr(unsigned long addr)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003538{
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07003539 int rc = 0;
Paul Moore98883bf2014-03-19 16:46:11 -04003540
3541 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3542 u32 sid = current_sid();
3543 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3544 MEMPROTECT__MMAP_ZERO, NULL);
3545 }
3546
3547 return rc;
Al Viroe5467852012-05-30 13:30:51 -04003548}
Linus Torvalds1da177e2005-04-16 15:20:36 -07003549
Al Viroe5467852012-05-30 13:30:51 -04003550static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3551 unsigned long prot, unsigned long flags)
3552{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003553 if (selinux_checkreqprot)
3554 prot = reqprot;
3555
3556 return file_map_prot_check(file, prot,
3557 (flags & MAP_TYPE) == MAP_SHARED);
3558}
3559
3560static int selinux_file_mprotect(struct vm_area_struct *vma,
3561 unsigned long reqprot,
3562 unsigned long prot)
3563{
David Howells88e67f32008-11-14 10:39:21 +11003564 const struct cred *cred = current_cred();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003565 u32 sid = cred_sid(cred);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003566
3567 if (selinux_checkreqprot)
3568 prot = reqprot;
3569
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04003570 if (default_noexec &&
3571 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
James Morrisd541bbe2009-01-29 12:19:51 +11003572 int rc = 0;
Stephen Smalleydb4c96412006-02-01 03:05:54 -08003573 if (vma->vm_start >= vma->vm_mm->start_brk &&
3574 vma->vm_end <= vma->vm_mm->brk) {
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003575 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3576 PROCESS__EXECHEAP, NULL);
Stephen Smalleydb4c96412006-02-01 03:05:54 -08003577 } else if (!vma->vm_file &&
Stephen Smalleyc2316db2016-04-08 13:55:03 -04003578 ((vma->vm_start <= vma->vm_mm->start_stack &&
3579 vma->vm_end >= vma->vm_mm->start_stack) ||
Andy Lutomirskid17af502016-09-30 10:58:58 -07003580 vma_is_stack_for_current(vma))) {
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003581 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3582 PROCESS__EXECSTACK, NULL);
Stephen Smalleydb4c96412006-02-01 03:05:54 -08003583 } else if (vma->vm_file && vma->anon_vma) {
3584 /*
3585 * We are making executable a file mapping that has
3586 * had some COW done. Since pages might have been
3587 * written, check ability to execute the possibly
3588 * modified content. This typically should only
3589 * occur for text relocations.
3590 */
David Howellsd84f4f92008-11-14 10:39:23 +11003591 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
Stephen Smalleydb4c96412006-02-01 03:05:54 -08003592 }
Lorenzo Hernandez García-Hierro6b992192005-06-25 14:54:34 -07003593 if (rc)
3594 return rc;
3595 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07003596
3597 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3598}
3599
3600static int selinux_file_lock(struct file *file, unsigned int cmd)
3601{
David Howells88e67f32008-11-14 10:39:21 +11003602 const struct cred *cred = current_cred();
3603
3604 return file_has_perm(cred, file, FILE__LOCK);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003605}
3606
3607static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3608 unsigned long arg)
3609{
David Howells88e67f32008-11-14 10:39:21 +11003610 const struct cred *cred = current_cred();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003611 int err = 0;
3612
3613 switch (cmd) {
Eric Paris828dfe12008-04-17 13:17:49 -04003614 case F_SETFL:
Eric Paris828dfe12008-04-17 13:17:49 -04003615 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
David Howells88e67f32008-11-14 10:39:21 +11003616 err = file_has_perm(cred, file, FILE__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003617 break;
Eric Paris828dfe12008-04-17 13:17:49 -04003618 }
3619 /* fall through */
3620 case F_SETOWN:
3621 case F_SETSIG:
3622 case F_GETFL:
3623 case F_GETOWN:
3624 case F_GETSIG:
Cyrill Gorcunov1d151c32012-07-30 14:43:00 -07003625 case F_GETOWNER_UIDS:
Eric Paris828dfe12008-04-17 13:17:49 -04003626 /* Just check FD__USE permission */
David Howells88e67f32008-11-14 10:39:21 +11003627 err = file_has_perm(cred, file, 0);
Eric Paris828dfe12008-04-17 13:17:49 -04003628 break;
3629 case F_GETLK:
3630 case F_SETLK:
3631 case F_SETLKW:
Jeff Layton0d3f7a22014-04-22 08:23:58 -04003632 case F_OFD_GETLK:
3633 case F_OFD_SETLK:
3634 case F_OFD_SETLKW:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003635#if BITS_PER_LONG == 32
Eric Paris828dfe12008-04-17 13:17:49 -04003636 case F_GETLK64:
3637 case F_SETLK64:
3638 case F_SETLKW64:
Linus Torvalds1da177e2005-04-16 15:20:36 -07003639#endif
David Howells88e67f32008-11-14 10:39:21 +11003640 err = file_has_perm(cred, file, FILE__LOCK);
Eric Paris828dfe12008-04-17 13:17:49 -04003641 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003642 }
3643
3644 return err;
3645}
3646
Jeff Laytone0b93ed2014-08-22 11:27:32 -04003647static void selinux_file_set_fowner(struct file *file)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003648{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003649 struct file_security_struct *fsec;
3650
Linus Torvalds1da177e2005-04-16 15:20:36 -07003651 fsec = file->f_security;
David Howells275bb412008-11-14 10:39:19 +11003652 fsec->fown_sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07003653}
3654
3655static int selinux_file_send_sigiotask(struct task_struct *tsk,
3656 struct fown_struct *fown, int signum)
3657{
Eric Paris828dfe12008-04-17 13:17:49 -04003658 struct file *file;
Stephen Smalley65c90bc2009-05-04 15:43:18 -04003659 u32 sid = task_sid(tsk);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003660 u32 perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003661 struct file_security_struct *fsec;
3662
3663 /* struct fown_struct is never outside the context of a struct file */
Eric Paris828dfe12008-04-17 13:17:49 -04003664 file = container_of(fown, struct file, f_owner);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003665
Linus Torvalds1da177e2005-04-16 15:20:36 -07003666 fsec = file->f_security;
3667
3668 if (!signum)
3669 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3670 else
3671 perm = signal_to_av(signum);
3672
David Howells275bb412008-11-14 10:39:19 +11003673 return avc_has_perm(fsec->fown_sid, sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07003674 SECCLASS_PROCESS, perm, NULL);
3675}
3676
3677static int selinux_file_receive(struct file *file)
3678{
David Howells88e67f32008-11-14 10:39:21 +11003679 const struct cred *cred = current_cred();
3680
3681 return file_has_perm(cred, file, file_to_av(file));
Linus Torvalds1da177e2005-04-16 15:20:36 -07003682}
3683
Eric Paris83d49852012-04-04 13:45:40 -04003684static int selinux_file_open(struct file *file, const struct cred *cred)
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003685{
3686 struct file_security_struct *fsec;
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003687 struct inode_security_struct *isec;
David Howellsd84f4f92008-11-14 10:39:23 +11003688
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003689 fsec = file->f_security;
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05003690 isec = inode_security(file_inode(file));
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003691 /*
3692 * Save inode label and policy sequence number
3693 * at open-time so that selinux_file_permission
3694 * can determine whether revalidation is necessary.
3695 * Task label is already saved in the file security
3696 * struct as its SID.
3697 */
3698 fsec->isid = isec->sid;
3699 fsec->pseqno = avc_policy_seqno();
3700 /*
3701 * Since the inode label or policy seqno may have changed
3702 * between the selinux_inode_permission check and the saving
3703 * of state above, recheck that access is still permitted.
3704 * Otherwise, access might never be revalidated against the
3705 * new inode label or new policy.
3706 * This check is not redundant - do not remove.
3707 */
David Howells13f8e982013-06-13 23:37:55 +01003708 return file_path_has_perm(cred, file, open_file_to_av(file));
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09003709}
3710
Linus Torvalds1da177e2005-04-16 15:20:36 -07003711/* task security operations */
3712
3713static int selinux_task_create(unsigned long clone_flags)
3714{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003715 u32 sid = current_sid();
3716
3717 return avc_has_perm(sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003718}
3719
David Howellsf1752ee2008-11-14 10:39:17 +11003720/*
David Howellsee18d642009-09-02 09:14:21 +01003721 * allocate the SELinux part of blank credentials
3722 */
3723static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3724{
3725 struct task_security_struct *tsec;
3726
3727 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3728 if (!tsec)
3729 return -ENOMEM;
3730
3731 cred->security = tsec;
3732 return 0;
3733}
3734
3735/*
David Howellsf1752ee2008-11-14 10:39:17 +11003736 * detach and free the LSM part of a set of credentials
3737 */
3738static void selinux_cred_free(struct cred *cred)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003739{
David Howellsf1752ee2008-11-14 10:39:17 +11003740 struct task_security_struct *tsec = cred->security;
David Howellse0e81732009-09-02 09:13:40 +01003741
Tetsuo Handa2edeaa32011-02-07 13:36:10 +00003742 /*
3743 * cred->security == NULL if security_cred_alloc_blank() or
3744 * security_prepare_creds() returned an error.
3745 */
3746 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
David Howellse0e81732009-09-02 09:13:40 +01003747 cred->security = (void *) 0x7UL;
David Howellsf1752ee2008-11-14 10:39:17 +11003748 kfree(tsec);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003749}
3750
David Howellsd84f4f92008-11-14 10:39:23 +11003751/*
3752 * prepare a new set of credentials for modification
3753 */
3754static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3755 gfp_t gfp)
3756{
3757 const struct task_security_struct *old_tsec;
3758 struct task_security_struct *tsec;
3759
3760 old_tsec = old->security;
3761
3762 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3763 if (!tsec)
3764 return -ENOMEM;
3765
3766 new->security = tsec;
3767 return 0;
3768}
3769
3770/*
David Howellsee18d642009-09-02 09:14:21 +01003771 * transfer the SELinux data to a blank set of creds
3772 */
3773static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3774{
3775 const struct task_security_struct *old_tsec = old->security;
3776 struct task_security_struct *tsec = new->security;
3777
3778 *tsec = *old_tsec;
3779}
3780
3781/*
David Howells3a3b7ce2008-11-14 10:39:28 +11003782 * set the security data for a kernel service
3783 * - all the creation contexts are set to unlabelled
3784 */
3785static int selinux_kernel_act_as(struct cred *new, u32 secid)
3786{
3787 struct task_security_struct *tsec = new->security;
3788 u32 sid = current_sid();
3789 int ret;
3790
3791 ret = avc_has_perm(sid, secid,
3792 SECCLASS_KERNEL_SERVICE,
3793 KERNEL_SERVICE__USE_AS_OVERRIDE,
3794 NULL);
3795 if (ret == 0) {
3796 tsec->sid = secid;
3797 tsec->create_sid = 0;
3798 tsec->keycreate_sid = 0;
3799 tsec->sockcreate_sid = 0;
3800 }
3801 return ret;
3802}
3803
3804/*
3805 * set the file creation context in a security record to the same as the
3806 * objective context of the specified inode
3807 */
3808static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3809{
Andreas Gruenbacher83da53c52015-12-24 11:09:39 -05003810 struct inode_security_struct *isec = inode_security(inode);
David Howells3a3b7ce2008-11-14 10:39:28 +11003811 struct task_security_struct *tsec = new->security;
3812 u32 sid = current_sid();
3813 int ret;
3814
3815 ret = avc_has_perm(sid, isec->sid,
3816 SECCLASS_KERNEL_SERVICE,
3817 KERNEL_SERVICE__CREATE_FILES_AS,
3818 NULL);
3819
3820 if (ret == 0)
3821 tsec->create_sid = isec->sid;
David Howellsef574712010-02-26 01:56:16 +00003822 return ret;
David Howells3a3b7ce2008-11-14 10:39:28 +11003823}
3824
Eric Parisdd8dbf22009-11-03 16:35:32 +11003825static int selinux_kernel_module_request(char *kmod_name)
Eric Paris25354c42009-08-13 09:45:03 -04003826{
Eric Parisdd8dbf22009-11-03 16:35:32 +11003827 struct common_audit_data ad;
3828
Eric Paris50c205f2012-04-04 15:01:43 -04003829 ad.type = LSM_AUDIT_DATA_KMOD;
Eric Parisdd8dbf22009-11-03 16:35:32 +11003830 ad.u.kmod_name = kmod_name;
3831
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003832 return avc_has_perm(current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
Eric Parisdd8dbf22009-11-03 16:35:32 +11003833 SYSTEM__MODULE_REQUEST, &ad);
Eric Paris25354c42009-08-13 09:45:03 -04003834}
3835
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003836static int selinux_kernel_module_from_file(struct file *file)
3837{
3838 struct common_audit_data ad;
3839 struct inode_security_struct *isec;
3840 struct file_security_struct *fsec;
3841 u32 sid = current_sid();
3842 int rc;
3843
3844 /* init_module */
3845 if (file == NULL)
3846 return avc_has_perm(sid, sid, SECCLASS_SYSTEM,
3847 SYSTEM__MODULE_LOAD, NULL);
3848
3849 /* finit_module */
Paul Moore20cdef82016-04-04 14:14:42 -04003850
Vivek Goyal43af5de2016-09-09 11:37:49 -04003851 ad.type = LSM_AUDIT_DATA_FILE;
3852 ad.u.file = file;
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003853
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003854 fsec = file->f_security;
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003855 if (sid != fsec->sid) {
3856 rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3857 if (rc)
3858 return rc;
3859 }
3860
Paul Moore20cdef82016-04-04 14:14:42 -04003861 isec = inode_security(file_inode(file));
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07003862 return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM,
3863 SYSTEM__MODULE_LOAD, &ad);
3864}
3865
3866static int selinux_kernel_read_file(struct file *file,
3867 enum kernel_read_file_id id)
3868{
3869 int rc = 0;
3870
3871 switch (id) {
3872 case READING_MODULE:
3873 rc = selinux_kernel_module_from_file(file);
3874 break;
3875 default:
3876 break;
3877 }
3878
3879 return rc;
3880}
3881
Linus Torvalds1da177e2005-04-16 15:20:36 -07003882static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3883{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003884 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3885 PROCESS__SETPGID, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003886}
3887
3888static int selinux_task_getpgid(struct task_struct *p)
3889{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003890 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3891 PROCESS__GETPGID, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003892}
3893
3894static int selinux_task_getsid(struct task_struct *p)
3895{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003896 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3897 PROCESS__GETSESSION, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003898}
3899
David Quigleyf9008e4c2006-06-30 01:55:46 -07003900static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3901{
David Howells275bb412008-11-14 10:39:19 +11003902 *secid = task_sid(p);
David Quigleyf9008e4c2006-06-30 01:55:46 -07003903}
3904
Linus Torvalds1da177e2005-04-16 15:20:36 -07003905static int selinux_task_setnice(struct task_struct *p, int nice)
3906{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003907 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3908 PROCESS__SETSCHED, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003909}
3910
James Morris03e68062006-06-23 02:03:58 -07003911static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3912{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003913 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3914 PROCESS__SETSCHED, NULL);
James Morris03e68062006-06-23 02:03:58 -07003915}
3916
David Quigleya1836a42006-06-30 01:55:49 -07003917static int selinux_task_getioprio(struct task_struct *p)
3918{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003919 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3920 PROCESS__GETSCHED, NULL);
David Quigleya1836a42006-06-30 01:55:49 -07003921}
3922
Jiri Slaby8fd00b42009-08-26 18:41:16 +02003923static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3924 struct rlimit *new_rlim)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003925{
Jiri Slaby8fd00b42009-08-26 18:41:16 +02003926 struct rlimit *old_rlim = p->signal->rlim + resource;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003927
3928 /* Control the ability to change the hard limit (whether
3929 lowering or raising it), so that the hard limit can
3930 later be used as a safe reset point for the soft limit
David Howellsd84f4f92008-11-14 10:39:23 +11003931 upon context transitions. See selinux_bprm_committing_creds. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07003932 if (old_rlim->rlim_max != new_rlim->rlim_max)
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003933 return avc_has_perm(current_sid(), task_sid(p),
3934 SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003935
3936 return 0;
3937}
3938
KOSAKI Motohirob0ae1982010-10-15 04:21:18 +09003939static int selinux_task_setscheduler(struct task_struct *p)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003940{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003941 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3942 PROCESS__SETSCHED, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003943}
3944
3945static int selinux_task_getscheduler(struct task_struct *p)
3946{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003947 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3948 PROCESS__GETSCHED, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003949}
3950
David Quigley35601542006-06-23 02:04:01 -07003951static int selinux_task_movememory(struct task_struct *p)
3952{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003953 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3954 PROCESS__SETSCHED, NULL);
David Quigley35601542006-06-23 02:04:01 -07003955}
3956
David Quigleyf9008e4c2006-06-30 01:55:46 -07003957static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3958 int sig, u32 secid)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003959{
3960 u32 perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07003961
Linus Torvalds1da177e2005-04-16 15:20:36 -07003962 if (!sig)
3963 perm = PROCESS__SIGNULL; /* null signal; existence test */
3964 else
3965 perm = signal_to_av(sig);
Stephen Smalleybe0554c2017-01-09 10:07:31 -05003966 if (!secid)
3967 secid = current_sid();
3968 return avc_has_perm(secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003969}
3970
Linus Torvalds1da177e2005-04-16 15:20:36 -07003971static void selinux_task_to_inode(struct task_struct *p,
3972 struct inode *inode)
3973{
Linus Torvalds1da177e2005-04-16 15:20:36 -07003974 struct inode_security_struct *isec = inode->i_security;
David Howells275bb412008-11-14 10:39:19 +11003975 u32 sid = task_sid(p);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003976
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003977 spin_lock(&isec->lock);
Andreas Gruenbacherdb978da2016-11-10 22:18:28 +01003978 isec->sclass = inode_mode_to_security_class(inode->i_mode);
David Howells275bb412008-11-14 10:39:19 +11003979 isec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05003980 isec->initialized = LABEL_INITIALIZED;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01003981 spin_unlock(&isec->lock);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003982}
3983
Linus Torvalds1da177e2005-04-16 15:20:36 -07003984/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06003985static int selinux_parse_skb_ipv4(struct sk_buff *skb,
Thomas Liu2bf49692009-07-14 12:14:09 -04003986 struct common_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07003987{
3988 int offset, ihlen, ret = -EINVAL;
3989 struct iphdr _iph, *ih;
3990
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03003991 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07003992 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3993 if (ih == NULL)
3994 goto out;
3995
3996 ihlen = ih->ihl * 4;
3997 if (ihlen < sizeof(_iph))
3998 goto out;
3999
Eric Paris48c62af2012-04-02 13:15:44 -04004000 ad->u.net->v4info.saddr = ih->saddr;
4001 ad->u.net->v4info.daddr = ih->daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004002 ret = 0;
4003
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004004 if (proto)
4005 *proto = ih->protocol;
4006
Linus Torvalds1da177e2005-04-16 15:20:36 -07004007 switch (ih->protocol) {
Eric Paris828dfe12008-04-17 13:17:49 -04004008 case IPPROTO_TCP: {
4009 struct tcphdr _tcph, *th;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004010
Eric Paris828dfe12008-04-17 13:17:49 -04004011 if (ntohs(ih->frag_off) & IP_OFFSET)
4012 break;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004013
4014 offset += ihlen;
4015 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4016 if (th == NULL)
4017 break;
4018
Eric Paris48c62af2012-04-02 13:15:44 -04004019 ad->u.net->sport = th->source;
4020 ad->u.net->dport = th->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004021 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004022 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004023
Eric Paris828dfe12008-04-17 13:17:49 -04004024 case IPPROTO_UDP: {
4025 struct udphdr _udph, *uh;
4026
4027 if (ntohs(ih->frag_off) & IP_OFFSET)
4028 break;
4029
4030 offset += ihlen;
4031 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4032 if (uh == NULL)
4033 break;
4034
Eric Paris48c62af2012-04-02 13:15:44 -04004035 ad->u.net->sport = uh->source;
4036 ad->u.net->dport = uh->dest;
Eric Paris828dfe12008-04-17 13:17:49 -04004037 break;
4038 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004039
James Morris2ee92d42006-11-13 16:09:01 -08004040 case IPPROTO_DCCP: {
4041 struct dccp_hdr _dccph, *dh;
4042
4043 if (ntohs(ih->frag_off) & IP_OFFSET)
4044 break;
4045
4046 offset += ihlen;
4047 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4048 if (dh == NULL)
4049 break;
4050
Eric Paris48c62af2012-04-02 13:15:44 -04004051 ad->u.net->sport = dh->dccph_sport;
4052 ad->u.net->dport = dh->dccph_dport;
James Morris2ee92d42006-11-13 16:09:01 -08004053 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004054 }
James Morris2ee92d42006-11-13 16:09:01 -08004055
Eric Paris828dfe12008-04-17 13:17:49 -04004056 default:
4057 break;
4058 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004059out:
4060 return ret;
4061}
4062
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04004063#if IS_ENABLED(CONFIG_IPV6)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004064
4065/* Returns error only if unable to parse addresses */
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004066static int selinux_parse_skb_ipv6(struct sk_buff *skb,
Thomas Liu2bf49692009-07-14 12:14:09 -04004067 struct common_audit_data *ad, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004068{
4069 u8 nexthdr;
4070 int ret = -EINVAL, offset;
4071 struct ipv6hdr _ipv6h, *ip6;
Jesse Gross75f28112011-11-30 17:05:51 -08004072 __be16 frag_off;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004073
Arnaldo Carvalho de Melobbe735e2007-03-10 22:16:10 -03004074 offset = skb_network_offset(skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004075 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4076 if (ip6 == NULL)
4077 goto out;
4078
Eric Paris48c62af2012-04-02 13:15:44 -04004079 ad->u.net->v6info.saddr = ip6->saddr;
4080 ad->u.net->v6info.daddr = ip6->daddr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004081 ret = 0;
4082
4083 nexthdr = ip6->nexthdr;
4084 offset += sizeof(_ipv6h);
Jesse Gross75f28112011-11-30 17:05:51 -08004085 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004086 if (offset < 0)
4087 goto out;
4088
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004089 if (proto)
4090 *proto = nexthdr;
4091
Linus Torvalds1da177e2005-04-16 15:20:36 -07004092 switch (nexthdr) {
4093 case IPPROTO_TCP: {
Eric Paris828dfe12008-04-17 13:17:49 -04004094 struct tcphdr _tcph, *th;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004095
4096 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4097 if (th == NULL)
4098 break;
4099
Eric Paris48c62af2012-04-02 13:15:44 -04004100 ad->u.net->sport = th->source;
4101 ad->u.net->dport = th->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004102 break;
4103 }
4104
4105 case IPPROTO_UDP: {
4106 struct udphdr _udph, *uh;
4107
4108 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4109 if (uh == NULL)
4110 break;
4111
Eric Paris48c62af2012-04-02 13:15:44 -04004112 ad->u.net->sport = uh->source;
4113 ad->u.net->dport = uh->dest;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004114 break;
4115 }
4116
James Morris2ee92d42006-11-13 16:09:01 -08004117 case IPPROTO_DCCP: {
4118 struct dccp_hdr _dccph, *dh;
4119
4120 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4121 if (dh == NULL)
4122 break;
4123
Eric Paris48c62af2012-04-02 13:15:44 -04004124 ad->u.net->sport = dh->dccph_sport;
4125 ad->u.net->dport = dh->dccph_dport;
James Morris2ee92d42006-11-13 16:09:01 -08004126 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004127 }
James Morris2ee92d42006-11-13 16:09:01 -08004128
Linus Torvalds1da177e2005-04-16 15:20:36 -07004129 /* includes fragments */
4130 default:
4131 break;
4132 }
4133out:
4134 return ret;
4135}
4136
4137#endif /* IPV6 */
4138
Thomas Liu2bf49692009-07-14 12:14:09 -04004139static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
David Howellscf9481e2008-07-27 21:31:07 +10004140 char **_addrp, int src, u8 *proto)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004141{
David Howellscf9481e2008-07-27 21:31:07 +10004142 char *addrp;
4143 int ret;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004144
Eric Paris48c62af2012-04-02 13:15:44 -04004145 switch (ad->u.net->family) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07004146 case PF_INET:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004147 ret = selinux_parse_skb_ipv4(skb, ad, proto);
David Howellscf9481e2008-07-27 21:31:07 +10004148 if (ret)
4149 goto parse_error;
Eric Paris48c62af2012-04-02 13:15:44 -04004150 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4151 &ad->u.net->v4info.daddr);
David Howellscf9481e2008-07-27 21:31:07 +10004152 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004153
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04004154#if IS_ENABLED(CONFIG_IPV6)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004155 case PF_INET6:
Venkat Yekkirala67f83cb2006-11-08 17:04:26 -06004156 ret = selinux_parse_skb_ipv6(skb, ad, proto);
David Howellscf9481e2008-07-27 21:31:07 +10004157 if (ret)
4158 goto parse_error;
Eric Paris48c62af2012-04-02 13:15:44 -04004159 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4160 &ad->u.net->v6info.daddr);
David Howellscf9481e2008-07-27 21:31:07 +10004161 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004162#endif /* IPV6 */
4163 default:
David Howellscf9481e2008-07-27 21:31:07 +10004164 addrp = NULL;
4165 goto okay;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004166 }
4167
David Howellscf9481e2008-07-27 21:31:07 +10004168parse_error:
4169 printk(KERN_WARNING
4170 "SELinux: failure in selinux_parse_skb(),"
4171 " unable to parse packet\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07004172 return ret;
David Howellscf9481e2008-07-27 21:31:07 +10004173
4174okay:
4175 if (_addrp)
4176 *_addrp = addrp;
4177 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004178}
4179
Paul Moore4f6a9932007-03-01 14:35:22 -05004180/**
Paul Moore220deb92008-01-29 08:38:23 -05004181 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
Paul Moore4f6a9932007-03-01 14:35:22 -05004182 * @skb: the packet
Paul Moore75e22912008-01-29 08:38:04 -05004183 * @family: protocol family
Paul Moore220deb92008-01-29 08:38:23 -05004184 * @sid: the packet's peer label SID
Paul Moore4f6a9932007-03-01 14:35:22 -05004185 *
4186 * Description:
Paul Moore220deb92008-01-29 08:38:23 -05004187 * Check the various different forms of network peer labeling and determine
4188 * the peer label/SID for the packet; most of the magic actually occurs in
4189 * the security server function security_net_peersid_cmp(). The function
4190 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4191 * or -EACCES if @sid is invalid due to inconsistencies with the different
4192 * peer labels.
Paul Moore4f6a9932007-03-01 14:35:22 -05004193 *
4194 */
Paul Moore220deb92008-01-29 08:38:23 -05004195static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
Paul Moore4f6a9932007-03-01 14:35:22 -05004196{
Paul Moore71f1cb02008-01-29 08:51:16 -05004197 int err;
Paul Moore4f6a9932007-03-01 14:35:22 -05004198 u32 xfrm_sid;
4199 u32 nlbl_sid;
Paul Moore220deb92008-01-29 08:38:23 -05004200 u32 nlbl_type;
Paul Moore4f6a9932007-03-01 14:35:22 -05004201
Paul Moore817eff72013-12-10 14:57:54 -05004202 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
Paul Moorebed4d7e2013-07-23 17:38:40 -04004203 if (unlikely(err))
4204 return -EACCES;
4205 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4206 if (unlikely(err))
4207 return -EACCES;
Paul Moore220deb92008-01-29 08:38:23 -05004208
Paul Moore71f1cb02008-01-29 08:51:16 -05004209 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
4210 if (unlikely(err)) {
4211 printk(KERN_WARNING
4212 "SELinux: failure in selinux_skb_peerlbl_sid(),"
4213 " unable to determine packet's peer label\n");
Paul Moore220deb92008-01-29 08:38:23 -05004214 return -EACCES;
Paul Moore71f1cb02008-01-29 08:51:16 -05004215 }
Paul Moore220deb92008-01-29 08:38:23 -05004216
4217 return 0;
Paul Moore4f6a9932007-03-01 14:35:22 -05004218}
4219
Paul Moore446b8022013-12-04 16:10:51 -05004220/**
4221 * selinux_conn_sid - Determine the child socket label for a connection
4222 * @sk_sid: the parent socket's SID
4223 * @skb_sid: the packet's SID
4224 * @conn_sid: the resulting connection SID
4225 *
4226 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4227 * combined with the MLS information from @skb_sid in order to create
4228 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
4229 * of @sk_sid. Returns zero on success, negative values on failure.
4230 *
4231 */
4232static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4233{
4234 int err = 0;
4235
4236 if (skb_sid != SECSID_NULL)
4237 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4238 else
4239 *conn_sid = sk_sid;
4240
4241 return err;
4242}
4243
Linus Torvalds1da177e2005-04-16 15:20:36 -07004244/* socket security operations */
Paul Moored4f2d972010-04-22 14:46:18 -04004245
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004246static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4247 u16 secclass, u32 *socksid)
Paul Moored4f2d972010-04-22 14:46:18 -04004248{
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004249 if (tsec->sockcreate_sid > SECSID_NULL) {
4250 *socksid = tsec->sockcreate_sid;
4251 return 0;
4252 }
4253
4254 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4255 socksid);
Paul Moored4f2d972010-04-22 14:46:18 -04004256}
4257
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004258static int sock_has_perm(struct sock *sk, u32 perms)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004259{
Paul Moore253bfae2010-04-22 14:46:19 -04004260 struct sk_security_struct *sksec = sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004261 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004262 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004263
Paul Moore253bfae2010-04-22 14:46:19 -04004264 if (sksec->sid == SECINITSID_KERNEL)
4265 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004266
Eric Paris50c205f2012-04-04 15:01:43 -04004267 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004268 ad.u.net = &net;
4269 ad.u.net->sk = sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004270
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004271 return avc_has_perm(current_sid(), sksec->sid, sksec->sclass, perms,
4272 &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004273}
4274
4275static int selinux_socket_create(int family, int type,
4276 int protocol, int kern)
4277{
Paul Moore5fb49872010-04-22 14:46:19 -04004278 const struct task_security_struct *tsec = current_security();
Paul Moored4f2d972010-04-22 14:46:18 -04004279 u32 newsid;
David Howells275bb412008-11-14 10:39:19 +11004280 u16 secclass;
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004281 int rc;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004282
4283 if (kern)
Paul Moored4f2d972010-04-22 14:46:18 -04004284 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004285
David Howells275bb412008-11-14 10:39:19 +11004286 secclass = socket_type_to_security_class(family, type, protocol);
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004287 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4288 if (rc)
4289 return rc;
4290
Paul Moored4f2d972010-04-22 14:46:18 -04004291 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004292}
4293
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07004294static int selinux_socket_post_create(struct socket *sock, int family,
4295 int type, int protocol, int kern)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004296{
Paul Moore5fb49872010-04-22 14:46:19 -04004297 const struct task_security_struct *tsec = current_security();
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05004298 struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004299 struct sk_security_struct *sksec;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004300 u16 sclass = socket_type_to_security_class(family, type, protocol);
4301 u32 sid = SECINITSID_KERNEL;
David Howells275bb412008-11-14 10:39:19 +11004302 int err = 0;
4303
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004304 if (!kern) {
4305 err = socket_sockcreate_sid(tsec, sclass, &sid);
Harry Ciao2ad18bd2011-03-02 13:32:34 +08004306 if (err)
4307 return err;
4308 }
David Howells275bb412008-11-14 10:39:19 +11004309
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004310 isec->sclass = sclass;
4311 isec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05004312 isec->initialized = LABEL_INITIALIZED;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004313
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004314 if (sock->sk) {
4315 sksec = sock->sk->sk_security;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004316 sksec->sclass = sclass;
4317 sksec->sid = sid;
Paul Moore389fb8002009-03-27 17:10:34 -04004318 err = selinux_netlbl_socket_post_create(sock->sk, family);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004319 }
4320
Venkat Yekkirala7420ed22006-08-04 23:17:57 -07004321 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004322}
4323
4324/* Range of port numbers used to automatically bind.
4325 Need to determine whether we should perform a name_bind
4326 permission check between the socket and the port number. */
Linus Torvalds1da177e2005-04-16 15:20:36 -07004327
4328static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4329{
Paul Moore253bfae2010-04-22 14:46:19 -04004330 struct sock *sk = sock->sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004331 u16 family;
4332 int err;
4333
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004334 err = sock_has_perm(sk, SOCKET__BIND);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004335 if (err)
4336 goto out;
4337
4338 /*
4339 * If PF_INET or PF_INET6, check name_bind permission for the port.
James Morris13402582005-09-30 14:24:34 -04004340 * Multiple address binding for SCTP is not supported yet: we just
4341 * check the first address now.
Linus Torvalds1da177e2005-04-16 15:20:36 -07004342 */
Paul Moore253bfae2010-04-22 14:46:19 -04004343 family = sk->sk_family;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004344 if (family == PF_INET || family == PF_INET6) {
4345 char *addrp;
Paul Moore253bfae2010-04-22 14:46:19 -04004346 struct sk_security_struct *sksec = sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004347 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004348 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004349 struct sockaddr_in *addr4 = NULL;
4350 struct sockaddr_in6 *addr6 = NULL;
4351 unsigned short snum;
James Morrise399f982008-06-12 01:39:58 +10004352 u32 sid, node_perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004353
Linus Torvalds1da177e2005-04-16 15:20:36 -07004354 if (family == PF_INET) {
4355 addr4 = (struct sockaddr_in *)address;
4356 snum = ntohs(addr4->sin_port);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004357 addrp = (char *)&addr4->sin_addr.s_addr;
4358 } else {
4359 addr6 = (struct sockaddr_in6 *)address;
4360 snum = ntohs(addr6->sin6_port);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004361 addrp = (char *)&addr6->sin6_addr.s6_addr;
4362 }
4363
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004364 if (snum) {
4365 int low, high;
4366
Eric W. Biederman0bbf87d2013-09-28 14:10:59 -07004367 inet_get_local_port_range(sock_net(sk), &low, &high);
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004368
Krister Johansen4548b682017-01-20 17:49:11 -08004369 if (snum < max(inet_prot_sock(sock_net(sk)), low) ||
4370 snum > high) {
Paul Moore3e1121722008-04-10 10:48:14 -04004371 err = sel_netport_sid(sk->sk_protocol,
4372 snum, &sid);
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004373 if (err)
4374 goto out;
Eric Paris50c205f2012-04-04 15:01:43 -04004375 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004376 ad.u.net = &net;
4377 ad.u.net->sport = htons(snum);
4378 ad.u.net->family = family;
Paul Moore253bfae2010-04-22 14:46:19 -04004379 err = avc_has_perm(sksec->sid, sid,
4380 sksec->sclass,
Stephen Hemminger227b60f2007-10-10 17:30:46 -07004381 SOCKET__NAME_BIND, &ad);
4382 if (err)
4383 goto out;
4384 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07004385 }
Eric Paris828dfe12008-04-17 13:17:49 -04004386
Paul Moore253bfae2010-04-22 14:46:19 -04004387 switch (sksec->sclass) {
James Morris13402582005-09-30 14:24:34 -04004388 case SECCLASS_TCP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004389 node_perm = TCP_SOCKET__NODE_BIND;
4390 break;
Eric Paris828dfe12008-04-17 13:17:49 -04004391
James Morris13402582005-09-30 14:24:34 -04004392 case SECCLASS_UDP_SOCKET:
Linus Torvalds1da177e2005-04-16 15:20:36 -07004393 node_perm = UDP_SOCKET__NODE_BIND;
4394 break;
James Morris2ee92d42006-11-13 16:09:01 -08004395
4396 case SECCLASS_DCCP_SOCKET:
4397 node_perm = DCCP_SOCKET__NODE_BIND;
4398 break;
4399
Linus Torvalds1da177e2005-04-16 15:20:36 -07004400 default:
4401 node_perm = RAWIP_SOCKET__NODE_BIND;
4402 break;
4403 }
Eric Paris828dfe12008-04-17 13:17:49 -04004404
Paul Moore224dfbd2008-01-29 08:38:13 -05004405 err = sel_netnode_sid(addrp, family, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004406 if (err)
4407 goto out;
Eric Paris828dfe12008-04-17 13:17:49 -04004408
Eric Paris50c205f2012-04-04 15:01:43 -04004409 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004410 ad.u.net = &net;
4411 ad.u.net->sport = htons(snum);
4412 ad.u.net->family = family;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004413
4414 if (family == PF_INET)
Eric Paris48c62af2012-04-02 13:15:44 -04004415 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004416 else
Eric Paris48c62af2012-04-02 13:15:44 -04004417 ad.u.net->v6info.saddr = addr6->sin6_addr;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004418
Paul Moore253bfae2010-04-22 14:46:19 -04004419 err = avc_has_perm(sksec->sid, sid,
4420 sksec->sclass, node_perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004421 if (err)
4422 goto out;
4423 }
4424out:
4425 return err;
4426}
4427
4428static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4429{
Paul Moore014ab192008-10-10 10:16:33 -04004430 struct sock *sk = sock->sk;
Paul Moore253bfae2010-04-22 14:46:19 -04004431 struct sk_security_struct *sksec = sk->sk_security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004432 int err;
4433
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004434 err = sock_has_perm(sk, SOCKET__CONNECT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004435 if (err)
4436 return err;
4437
4438 /*
James Morris2ee92d42006-11-13 16:09:01 -08004439 * If a TCP or DCCP socket, check name_connect permission for the port.
Linus Torvalds1da177e2005-04-16 15:20:36 -07004440 */
Paul Moore253bfae2010-04-22 14:46:19 -04004441 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4442 sksec->sclass == SECCLASS_DCCP_SOCKET) {
Thomas Liu2bf49692009-07-14 12:14:09 -04004443 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004444 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004445 struct sockaddr_in *addr4 = NULL;
4446 struct sockaddr_in6 *addr6 = NULL;
4447 unsigned short snum;
James Morris2ee92d42006-11-13 16:09:01 -08004448 u32 sid, perm;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004449
4450 if (sk->sk_family == PF_INET) {
4451 addr4 = (struct sockaddr_in *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07004452 if (addrlen < sizeof(struct sockaddr_in))
Linus Torvalds1da177e2005-04-16 15:20:36 -07004453 return -EINVAL;
4454 snum = ntohs(addr4->sin_port);
4455 } else {
4456 addr6 = (struct sockaddr_in6 *)address;
Stephen Smalley911656f2005-07-28 21:16:21 -07004457 if (addrlen < SIN6_LEN_RFC2133)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004458 return -EINVAL;
4459 snum = ntohs(addr6->sin6_port);
4460 }
4461
Paul Moore3e1121722008-04-10 10:48:14 -04004462 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004463 if (err)
4464 goto out;
4465
Paul Moore253bfae2010-04-22 14:46:19 -04004466 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
James Morris2ee92d42006-11-13 16:09:01 -08004467 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4468
Eric Paris50c205f2012-04-04 15:01:43 -04004469 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004470 ad.u.net = &net;
4471 ad.u.net->dport = htons(snum);
4472 ad.u.net->family = sk->sk_family;
Paul Moore253bfae2010-04-22 14:46:19 -04004473 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004474 if (err)
4475 goto out;
4476 }
4477
Paul Moore014ab192008-10-10 10:16:33 -04004478 err = selinux_netlbl_socket_connect(sk, address);
4479
Linus Torvalds1da177e2005-04-16 15:20:36 -07004480out:
4481 return err;
4482}
4483
4484static int selinux_socket_listen(struct socket *sock, int backlog)
4485{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004486 return sock_has_perm(sock->sk, SOCKET__LISTEN);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004487}
4488
4489static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4490{
4491 int err;
4492 struct inode_security_struct *isec;
4493 struct inode_security_struct *newisec;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004494 u16 sclass;
4495 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004496
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004497 err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004498 if (err)
4499 return err;
4500
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05004501 isec = inode_security_novalidate(SOCK_INODE(sock));
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01004502 spin_lock(&isec->lock);
4503 sclass = isec->sclass;
4504 sid = isec->sid;
4505 spin_unlock(&isec->lock);
4506
4507 newisec = inode_security_novalidate(SOCK_INODE(newsock));
4508 newisec->sclass = sclass;
4509 newisec->sid = sid;
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05004510 newisec->initialized = LABEL_INITIALIZED;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004511
4512 return 0;
4513}
4514
4515static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
Eric Paris828dfe12008-04-17 13:17:49 -04004516 int size)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004517{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004518 return sock_has_perm(sock->sk, SOCKET__WRITE);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004519}
4520
4521static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4522 int size, int flags)
4523{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004524 return sock_has_perm(sock->sk, SOCKET__READ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004525}
4526
4527static int selinux_socket_getsockname(struct socket *sock)
4528{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004529 return sock_has_perm(sock->sk, SOCKET__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004530}
4531
4532static int selinux_socket_getpeername(struct socket *sock)
4533{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004534 return sock_has_perm(sock->sk, SOCKET__GETATTR);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004535}
4536
Eric Paris828dfe12008-04-17 13:17:49 -04004537static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004538{
Paul Mooref8687af2006-10-30 15:22:15 -08004539 int err;
4540
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004541 err = sock_has_perm(sock->sk, SOCKET__SETOPT);
Paul Mooref8687af2006-10-30 15:22:15 -08004542 if (err)
4543 return err;
4544
4545 return selinux_netlbl_socket_setsockopt(sock, level, optname);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004546}
4547
4548static int selinux_socket_getsockopt(struct socket *sock, int level,
4549 int optname)
4550{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004551 return sock_has_perm(sock->sk, SOCKET__GETOPT);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004552}
4553
4554static int selinux_socket_shutdown(struct socket *sock, int how)
4555{
Stephen Smalleybe0554c2017-01-09 10:07:31 -05004556 return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004557}
4558
David S. Miller3610cda2011-01-05 15:38:53 -08004559static int selinux_socket_unix_stream_connect(struct sock *sock,
4560 struct sock *other,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004561 struct sock *newsk)
4562{
David S. Miller3610cda2011-01-05 15:38:53 -08004563 struct sk_security_struct *sksec_sock = sock->sk_security;
4564 struct sk_security_struct *sksec_other = other->sk_security;
Paul Moore4d1e2452010-04-22 14:46:18 -04004565 struct sk_security_struct *sksec_new = newsk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004566 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004567 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004568 int err;
4569
Eric Paris50c205f2012-04-04 15:01:43 -04004570 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004571 ad.u.net = &net;
4572 ad.u.net->sk = other;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004573
Paul Moore4d1e2452010-04-22 14:46:18 -04004574 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4575 sksec_other->sclass,
Linus Torvalds1da177e2005-04-16 15:20:36 -07004576 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4577 if (err)
4578 return err;
4579
Linus Torvalds1da177e2005-04-16 15:20:36 -07004580 /* server child socket */
Paul Moore4d1e2452010-04-22 14:46:18 -04004581 sksec_new->peer_sid = sksec_sock->sid;
4582 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4583 &sksec_new->sid);
4584 if (err)
4585 return err;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004586
Paul Moore4d1e2452010-04-22 14:46:18 -04004587 /* connecting socket */
4588 sksec_sock->peer_sid = sksec_new->sid;
4589
4590 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004591}
4592
4593static int selinux_socket_unix_may_send(struct socket *sock,
4594 struct socket *other)
4595{
Paul Moore253bfae2010-04-22 14:46:19 -04004596 struct sk_security_struct *ssec = sock->sk->sk_security;
4597 struct sk_security_struct *osec = other->sk->sk_security;
Thomas Liu2bf49692009-07-14 12:14:09 -04004598 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004599 struct lsm_network_audit net = {0,};
Linus Torvalds1da177e2005-04-16 15:20:36 -07004600
Eric Paris50c205f2012-04-04 15:01:43 -04004601 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004602 ad.u.net = &net;
4603 ad.u.net->sk = other->sk;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004604
Paul Moore253bfae2010-04-22 14:46:19 -04004605 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4606 &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004607}
4608
Paul Moorecbe0d6e2014-09-10 17:09:57 -04004609static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4610 char *addrp, u16 family, u32 peer_sid,
Thomas Liu2bf49692009-07-14 12:14:09 -04004611 struct common_audit_data *ad)
Paul Mooreeffad8d2008-01-29 08:49:27 -05004612{
4613 int err;
4614 u32 if_sid;
4615 u32 node_sid;
4616
Paul Moorecbe0d6e2014-09-10 17:09:57 -04004617 err = sel_netif_sid(ns, ifindex, &if_sid);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004618 if (err)
4619 return err;
4620 err = avc_has_perm(peer_sid, if_sid,
4621 SECCLASS_NETIF, NETIF__INGRESS, ad);
4622 if (err)
4623 return err;
4624
4625 err = sel_netnode_sid(addrp, family, &node_sid);
4626 if (err)
4627 return err;
4628 return avc_has_perm(peer_sid, node_sid,
4629 SECCLASS_NODE, NODE__RECVFROM, ad);
4630}
4631
Paul Moore220deb92008-01-29 08:38:23 -05004632static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
Paul Moored8395c82008-10-10 10:16:30 -04004633 u16 family)
Paul Moore220deb92008-01-29 08:38:23 -05004634{
Paul Moore277d3422008-12-31 12:54:11 -05004635 int err = 0;
Paul Moore220deb92008-01-29 08:38:23 -05004636 struct sk_security_struct *sksec = sk->sk_security;
Paul Moore220deb92008-01-29 08:38:23 -05004637 u32 sk_sid = sksec->sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04004638 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004639 struct lsm_network_audit net = {0,};
Paul Moored8395c82008-10-10 10:16:30 -04004640 char *addrp;
4641
Eric Paris50c205f2012-04-04 15:01:43 -04004642 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004643 ad.u.net = &net;
4644 ad.u.net->netif = skb->skb_iif;
4645 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04004646 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4647 if (err)
4648 return err;
Paul Moore220deb92008-01-29 08:38:23 -05004649
Paul Moore58bfbb52009-03-27 17:10:41 -04004650 if (selinux_secmark_enabled()) {
Paul Moore220deb92008-01-29 08:38:23 -05004651 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
Paul Moored8395c82008-10-10 10:16:30 -04004652 PACKET__RECV, &ad);
Paul Moore58bfbb52009-03-27 17:10:41 -04004653 if (err)
4654 return err;
4655 }
Paul Moore220deb92008-01-29 08:38:23 -05004656
Steffen Klassertb9679a72011-02-23 12:55:21 +01004657 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4658 if (err)
4659 return err;
4660 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004661
James Morris4e5ab4c2006-06-09 00:33:33 -07004662 return err;
4663}
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004664
James Morris4e5ab4c2006-06-09 00:33:33 -07004665static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4666{
Paul Moore220deb92008-01-29 08:38:23 -05004667 int err;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004668 struct sk_security_struct *sksec = sk->sk_security;
Paul Moore220deb92008-01-29 08:38:23 -05004669 u16 family = sk->sk_family;
4670 u32 sk_sid = sksec->sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04004671 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04004672 struct lsm_network_audit net = {0,};
Paul Moore220deb92008-01-29 08:38:23 -05004673 char *addrp;
Paul Moored8395c82008-10-10 10:16:30 -04004674 u8 secmark_active;
4675 u8 peerlbl_active;
James Morris4e5ab4c2006-06-09 00:33:33 -07004676
James Morris4e5ab4c2006-06-09 00:33:33 -07004677 if (family != PF_INET && family != PF_INET6)
Paul Moore220deb92008-01-29 08:38:23 -05004678 return 0;
James Morris4e5ab4c2006-06-09 00:33:33 -07004679
4680 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
Al Viro87fcd702006-12-04 22:00:55 +00004681 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
James Morris4e5ab4c2006-06-09 00:33:33 -07004682 family = PF_INET;
4683
Paul Moored8395c82008-10-10 10:16:30 -04004684 /* If any sort of compatibility mode is enabled then handoff processing
4685 * to the selinux_sock_rcv_skb_compat() function to deal with the
4686 * special handling. We do this in an attempt to keep this function
4687 * as fast and as clean as possible. */
Paul Moore58bfbb52009-03-27 17:10:41 -04004688 if (!selinux_policycap_netpeer)
Paul Moored8395c82008-10-10 10:16:30 -04004689 return selinux_sock_rcv_skb_compat(sk, skb, family);
4690
4691 secmark_active = selinux_secmark_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04004692 peerlbl_active = selinux_peerlbl_enabled();
Paul Moored8395c82008-10-10 10:16:30 -04004693 if (!secmark_active && !peerlbl_active)
4694 return 0;
4695
Eric Paris50c205f2012-04-04 15:01:43 -04004696 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04004697 ad.u.net = &net;
4698 ad.u.net->netif = skb->skb_iif;
4699 ad.u.net->family = family;
Paul Moore224dfbd2008-01-29 08:38:13 -05004700 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
James Morris4e5ab4c2006-06-09 00:33:33 -07004701 if (err)
Paul Moore220deb92008-01-29 08:38:23 -05004702 return err;
James Morris4e5ab4c2006-06-09 00:33:33 -07004703
Paul Moored8395c82008-10-10 10:16:30 -04004704 if (peerlbl_active) {
Paul Moored621d352008-01-29 08:43:36 -05004705 u32 peer_sid;
4706
4707 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4708 if (err)
4709 return err;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04004710 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4711 addrp, family, peer_sid, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04004712 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04004713 selinux_netlbl_err(skb, family, err, 0);
Paul Mooreeffad8d2008-01-29 08:49:27 -05004714 return err;
Paul Mooredfaebe92008-10-10 10:16:31 -04004715 }
Paul Moored621d352008-01-29 08:43:36 -05004716 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4717 PEER__RECV, &ad);
Chad Hanson46d01d62013-12-23 17:45:01 -05004718 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04004719 selinux_netlbl_err(skb, family, err, 0);
Chad Hanson46d01d62013-12-23 17:45:01 -05004720 return err;
4721 }
Paul Moored621d352008-01-29 08:43:36 -05004722 }
4723
Paul Moored8395c82008-10-10 10:16:30 -04004724 if (secmark_active) {
Paul Mooreeffad8d2008-01-29 08:49:27 -05004725 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4726 PACKET__RECV, &ad);
4727 if (err)
4728 return err;
4729 }
4730
Paul Moored621d352008-01-29 08:43:36 -05004731 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004732}
4733
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004734static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4735 int __user *optlen, unsigned len)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004736{
4737 int err = 0;
4738 char *scontext;
4739 u32 scontext_len;
Paul Moore253bfae2010-04-22 14:46:19 -04004740 struct sk_security_struct *sksec = sock->sk->sk_security;
Paul Moore3de4bab2006-11-17 17:38:54 -05004741 u32 peer_sid = SECSID_NULL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004742
Paul Moore253bfae2010-04-22 14:46:19 -04004743 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4744 sksec->sclass == SECCLASS_TCP_SOCKET)
Eric Parisdd3e7832010-04-07 15:08:46 -04004745 peer_sid = sksec->peer_sid;
Paul Moore253bfae2010-04-22 14:46:19 -04004746 if (peer_sid == SECSID_NULL)
4747 return -ENOPROTOOPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004748
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004749 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004750 if (err)
Paul Moore253bfae2010-04-22 14:46:19 -04004751 return err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004752
4753 if (scontext_len > len) {
4754 err = -ERANGE;
4755 goto out_len;
4756 }
4757
4758 if (copy_to_user(optval, scontext, scontext_len))
4759 err = -EFAULT;
4760
4761out_len:
4762 if (put_user(scontext_len, optlen))
4763 err = -EFAULT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004764 kfree(scontext);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004765 return err;
4766}
4767
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07004768static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004769{
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07004770 u32 peer_secid = SECSID_NULL;
Paul Moore75e22912008-01-29 08:38:04 -05004771 u16 family;
Paul Moore899134f2016-03-28 15:19:10 -04004772 struct inode_security_struct *isec;
Catherine Zhang877ce7c2006-06-29 12:27:47 -07004773
Paul Mooreaa862902008-10-10 10:16:29 -04004774 if (skb && skb->protocol == htons(ETH_P_IP))
4775 family = PF_INET;
4776 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4777 family = PF_INET6;
4778 else if (sock)
Paul Moore75e22912008-01-29 08:38:04 -05004779 family = sock->sk->sk_family;
Paul Moore75e22912008-01-29 08:38:04 -05004780 else
4781 goto out;
4782
Paul Moore899134f2016-03-28 15:19:10 -04004783 if (sock && family == PF_UNIX) {
4784 isec = inode_security_novalidate(SOCK_INODE(sock));
4785 peer_secid = isec->sid;
4786 } else if (skb)
Paul Moore220deb92008-01-29 08:38:23 -05004787 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004788
Paul Moore75e22912008-01-29 08:38:04 -05004789out:
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07004790 *secid = peer_secid;
Paul Moore75e22912008-01-29 08:38:04 -05004791 if (peer_secid == SECSID_NULL)
4792 return -EINVAL;
4793 return 0;
Catherine Zhang2c7946a2006-03-20 22:41:23 -08004794}
4795
Al Viro7d877f32005-10-21 03:20:43 -04004796static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
Linus Torvalds1da177e2005-04-16 15:20:36 -07004797{
Paul Moore84914b72010-04-22 14:46:18 -04004798 struct sk_security_struct *sksec;
4799
4800 sksec = kzalloc(sizeof(*sksec), priority);
4801 if (!sksec)
4802 return -ENOMEM;
4803
4804 sksec->peer_sid = SECINITSID_UNLABELED;
4805 sksec->sid = SECINITSID_UNLABELED;
Stephen Smalley5dee25d2015-07-10 17:19:57 -04004806 sksec->sclass = SECCLASS_SOCKET;
Paul Moore84914b72010-04-22 14:46:18 -04004807 selinux_netlbl_sk_security_reset(sksec);
4808 sk->sk_security = sksec;
4809
4810 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07004811}
4812
4813static void selinux_sk_free_security(struct sock *sk)
4814{
Paul Moore84914b72010-04-22 14:46:18 -04004815 struct sk_security_struct *sksec = sk->sk_security;
4816
4817 sk->sk_security = NULL;
4818 selinux_netlbl_sk_security_free(sksec);
4819 kfree(sksec);
Linus Torvalds1da177e2005-04-16 15:20:36 -07004820}
4821
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004822static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4823{
Eric Parisdd3e7832010-04-07 15:08:46 -04004824 struct sk_security_struct *sksec = sk->sk_security;
4825 struct sk_security_struct *newsksec = newsk->sk_security;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004826
Eric Parisdd3e7832010-04-07 15:08:46 -04004827 newsksec->sid = sksec->sid;
4828 newsksec->peer_sid = sksec->peer_sid;
4829 newsksec->sclass = sksec->sclass;
Paul Moore99f59ed2006-08-29 17:53:48 -07004830
Eric Parisdd3e7832010-04-07 15:08:46 -04004831 selinux_netlbl_sk_security_reset(newsksec);
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004832}
4833
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07004834static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004835{
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004836 if (!sk)
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07004837 *secid = SECINITSID_ANY_SOCKET;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004838 else {
4839 struct sk_security_struct *sksec = sk->sk_security;
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004840
Venkat Yekkiralabeb8d132006-08-04 23:12:42 -07004841 *secid = sksec->sid;
Venkat Yekkirala892c1412006-08-04 23:08:56 -07004842 }
Trent Jaegerd28d1e02005-12-13 23:12:40 -08004843}
4844
Eric Paris828dfe12008-04-17 13:17:49 -04004845static void selinux_sock_graft(struct sock *sk, struct socket *parent)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004846{
Andreas Gruenbacher5d226df2015-12-24 11:09:40 -05004847 struct inode_security_struct *isec =
4848 inode_security_novalidate(SOCK_INODE(parent));
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004849 struct sk_security_struct *sksec = sk->sk_security;
4850
Paul Moore2873ead2014-07-28 10:42:48 -04004851 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4852 sk->sk_family == PF_UNIX)
David Woodhouse2148ccc2006-09-29 15:50:25 -07004853 isec->sid = sksec->sid;
Paul Moore220deb92008-01-29 08:38:23 -05004854 sksec->sclass = isec->sclass;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004855}
4856
Adrian Bunk9a673e52006-08-15 00:03:53 -07004857static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4858 struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004859{
4860 struct sk_security_struct *sksec = sk->sk_security;
4861 int err;
Paul Moore0b1f24e2013-12-03 11:39:13 -05004862 u16 family = req->rsk_ops->family;
Paul Moore446b8022013-12-04 16:10:51 -05004863 u32 connsid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004864 u32 peersid;
4865
Paul Mooreaa862902008-10-10 10:16:29 -04004866 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
Paul Moore220deb92008-01-29 08:38:23 -05004867 if (err)
4868 return err;
Paul Moore446b8022013-12-04 16:10:51 -05004869 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4870 if (err)
4871 return err;
4872 req->secid = connsid;
4873 req->peer_secid = peersid;
Venkat Yekkiralaa51c64f2006-07-27 22:01:34 -07004874
Paul Moore389fb8002009-03-27 17:10:34 -04004875 return selinux_netlbl_inet_conn_request(req, family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004876}
4877
Adrian Bunk9a673e52006-08-15 00:03:53 -07004878static void selinux_inet_csk_clone(struct sock *newsk,
4879 const struct request_sock *req)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004880{
4881 struct sk_security_struct *newsksec = newsk->sk_security;
4882
4883 newsksec->sid = req->secid;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004884 newsksec->peer_sid = req->peer_secid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004885 /* NOTE: Ideally, we should also get the isec->sid for the
4886 new socket in sync, but we don't have the isec available yet.
4887 So we will wait until sock_graft to do it, by which
4888 time it will have been created and available. */
Paul Moore99f59ed2006-08-29 17:53:48 -07004889
Paul Moore9f2ad662006-11-17 17:38:53 -05004890 /* We don't need to take any sort of lock here as we are the only
4891 * thread with access to newsksec */
Paul Moore389fb8002009-03-27 17:10:34 -04004892 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004893}
4894
Paul Moore014ab192008-10-10 10:16:33 -04004895static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004896{
Paul Mooreaa862902008-10-10 10:16:29 -04004897 u16 family = sk->sk_family;
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004898 struct sk_security_struct *sksec = sk->sk_security;
4899
Paul Mooreaa862902008-10-10 10:16:29 -04004900 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4901 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4902 family = PF_INET;
4903
4904 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
Venkat Yekkirala6b877692006-11-08 17:04:09 -06004905}
4906
Eric Paris2606fd12010-10-13 16:24:41 -04004907static int selinux_secmark_relabel_packet(u32 sid)
4908{
4909 const struct task_security_struct *__tsec;
4910 u32 tsid;
4911
4912 __tsec = current_security();
4913 tsid = __tsec->sid;
4914
4915 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4916}
4917
4918static void selinux_secmark_refcount_inc(void)
4919{
4920 atomic_inc(&selinux_secmark_refcount);
4921}
4922
4923static void selinux_secmark_refcount_dec(void)
4924{
4925 atomic_dec(&selinux_secmark_refcount);
4926}
4927
Adrian Bunk9a673e52006-08-15 00:03:53 -07004928static void selinux_req_classify_flow(const struct request_sock *req,
4929 struct flowi *fl)
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004930{
David S. Miller1d28f422011-03-12 00:29:39 -05004931 fl->flowi_secid = req->secid;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07004932}
4933
Paul Moore5dbbaf22013-01-14 07:12:19 +00004934static int selinux_tun_dev_alloc_security(void **security)
4935{
4936 struct tun_security_struct *tunsec;
4937
4938 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4939 if (!tunsec)
4940 return -ENOMEM;
4941 tunsec->sid = current_sid();
4942
4943 *security = tunsec;
4944 return 0;
4945}
4946
4947static void selinux_tun_dev_free_security(void *security)
4948{
4949 kfree(security);
4950}
4951
Paul Mooreed6d76e2009-08-28 18:12:49 -04004952static int selinux_tun_dev_create(void)
4953{
4954 u32 sid = current_sid();
4955
4956 /* we aren't taking into account the "sockcreate" SID since the socket
4957 * that is being created here is not a socket in the traditional sense,
4958 * instead it is a private sock, accessible only to the kernel, and
4959 * representing a wide range of network traffic spanning multiple
4960 * connections unlike traditional sockets - check the TUN driver to
4961 * get a better understanding of why this socket is special */
4962
4963 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4964 NULL);
4965}
4966
Paul Moore5dbbaf22013-01-14 07:12:19 +00004967static int selinux_tun_dev_attach_queue(void *security)
Paul Mooreed6d76e2009-08-28 18:12:49 -04004968{
Paul Moore5dbbaf22013-01-14 07:12:19 +00004969 struct tun_security_struct *tunsec = security;
4970
4971 return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4972 TUN_SOCKET__ATTACH_QUEUE, NULL);
4973}
4974
4975static int selinux_tun_dev_attach(struct sock *sk, void *security)
4976{
4977 struct tun_security_struct *tunsec = security;
Paul Mooreed6d76e2009-08-28 18:12:49 -04004978 struct sk_security_struct *sksec = sk->sk_security;
4979
4980 /* we don't currently perform any NetLabel based labeling here and it
4981 * isn't clear that we would want to do so anyway; while we could apply
4982 * labeling without the support of the TUN user the resulting labeled
4983 * traffic from the other end of the connection would almost certainly
4984 * cause confusion to the TUN user that had no idea network labeling
4985 * protocols were being used */
4986
Paul Moore5dbbaf22013-01-14 07:12:19 +00004987 sksec->sid = tunsec->sid;
Paul Mooreed6d76e2009-08-28 18:12:49 -04004988 sksec->sclass = SECCLASS_TUN_SOCKET;
Paul Moore5dbbaf22013-01-14 07:12:19 +00004989
4990 return 0;
Paul Mooreed6d76e2009-08-28 18:12:49 -04004991}
4992
Paul Moore5dbbaf22013-01-14 07:12:19 +00004993static int selinux_tun_dev_open(void *security)
Paul Mooreed6d76e2009-08-28 18:12:49 -04004994{
Paul Moore5dbbaf22013-01-14 07:12:19 +00004995 struct tun_security_struct *tunsec = security;
Paul Mooreed6d76e2009-08-28 18:12:49 -04004996 u32 sid = current_sid();
4997 int err;
4998
Paul Moore5dbbaf22013-01-14 07:12:19 +00004999 err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
Paul Mooreed6d76e2009-08-28 18:12:49 -04005000 TUN_SOCKET__RELABELFROM, NULL);
5001 if (err)
5002 return err;
5003 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
5004 TUN_SOCKET__RELABELTO, NULL);
5005 if (err)
5006 return err;
Paul Moore5dbbaf22013-01-14 07:12:19 +00005007 tunsec->sid = sid;
Paul Mooreed6d76e2009-08-28 18:12:49 -04005008
5009 return 0;
5010}
5011
Linus Torvalds1da177e2005-04-16 15:20:36 -07005012static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5013{
5014 int err = 0;
5015 u32 perm;
5016 struct nlmsghdr *nlh;
Paul Moore253bfae2010-04-22 14:46:19 -04005017 struct sk_security_struct *sksec = sk->sk_security;
Eric Paris828dfe12008-04-17 13:17:49 -04005018
Hong zhi guo77954982013-03-27 06:49:35 +00005019 if (skb->len < NLMSG_HDRLEN) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005020 err = -EINVAL;
5021 goto out;
5022 }
Arnaldo Carvalho de Melob529ccf2007-04-25 19:08:35 -07005023 nlh = nlmsg_hdr(skb);
Eric Paris828dfe12008-04-17 13:17:49 -04005024
Paul Moore253bfae2010-04-22 14:46:19 -04005025 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005026 if (err) {
5027 if (err == -EINVAL) {
Vladis Dronov76319942015-12-24 11:09:41 -05005028 pr_warn_ratelimited("SELinux: unrecognized netlink"
5029 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5030 " pig=%d comm=%s\n",
Marek Milkoviccded3ff2015-06-04 16:22:16 -04005031 sk->sk_protocol, nlh->nlmsg_type,
Vladis Dronov76319942015-12-24 11:09:41 -05005032 secclass_map[sksec->sclass - 1].name,
5033 task_pid_nr(current), current->comm);
Eric Paris39c9aed2008-11-05 09:34:42 -05005034 if (!selinux_enforcing || security_get_allow_unknown())
Linus Torvalds1da177e2005-04-16 15:20:36 -07005035 err = 0;
5036 }
5037
5038 /* Ignore */
5039 if (err == -ENOENT)
5040 err = 0;
5041 goto out;
5042 }
5043
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005044 err = sock_has_perm(sk, perm);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005045out:
5046 return err;
5047}
5048
5049#ifdef CONFIG_NETFILTER
5050
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005051static unsigned int selinux_ip_forward(struct sk_buff *skb,
5052 const struct net_device *indev,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005053 u16 family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005054{
Paul Mooredfaebe92008-10-10 10:16:31 -04005055 int err;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005056 char *addrp;
5057 u32 peer_sid;
Thomas Liu2bf49692009-07-14 12:14:09 -04005058 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005059 struct lsm_network_audit net = {0,};
Paul Mooreeffad8d2008-01-29 08:49:27 -05005060 u8 secmark_active;
Paul Moore948bf852008-10-10 10:16:32 -04005061 u8 netlbl_active;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005062 u8 peerlbl_active;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005063
Paul Mooreeffad8d2008-01-29 08:49:27 -05005064 if (!selinux_policycap_netpeer)
5065 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005066
Paul Mooreeffad8d2008-01-29 08:49:27 -05005067 secmark_active = selinux_secmark_enabled();
Paul Moore948bf852008-10-10 10:16:32 -04005068 netlbl_active = netlbl_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04005069 peerlbl_active = selinux_peerlbl_enabled();
Paul Mooreeffad8d2008-01-29 08:49:27 -05005070 if (!secmark_active && !peerlbl_active)
5071 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005072
Paul Moored8395c82008-10-10 10:16:30 -04005073 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5074 return NF_DROP;
5075
Eric Paris50c205f2012-04-04 15:01:43 -04005076 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005077 ad.u.net = &net;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005078 ad.u.net->netif = indev->ifindex;
Eric Paris48c62af2012-04-02 13:15:44 -04005079 ad.u.net->family = family;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005080 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5081 return NF_DROP;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005082
Paul Mooredfaebe92008-10-10 10:16:31 -04005083 if (peerlbl_active) {
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005084 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5085 addrp, family, peer_sid, &ad);
Paul Mooredfaebe92008-10-10 10:16:31 -04005086 if (err) {
Huw Daviesa04e71f2016-06-27 15:06:16 -04005087 selinux_netlbl_err(skb, family, err, 1);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005088 return NF_DROP;
Paul Mooredfaebe92008-10-10 10:16:31 -04005089 }
5090 }
Paul Mooreeffad8d2008-01-29 08:49:27 -05005091
5092 if (secmark_active)
5093 if (avc_has_perm(peer_sid, skb->secmark,
5094 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5095 return NF_DROP;
5096
Paul Moore948bf852008-10-10 10:16:32 -04005097 if (netlbl_active)
5098 /* we do this in the FORWARD path and not the POST_ROUTING
5099 * path because we want to make sure we apply the necessary
5100 * labeling before IPsec is applied so we can leverage AH
5101 * protection */
5102 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5103 return NF_DROP;
5104
Paul Mooreeffad8d2008-01-29 08:49:27 -05005105 return NF_ACCEPT;
5106}
5107
Eric W. Biederman06198b32015-09-18 14:33:06 -05005108static unsigned int selinux_ipv4_forward(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005109 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005110 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005111{
David S. Miller238e54c2015-04-03 20:32:56 -04005112 return selinux_ip_forward(skb, state->in, PF_INET);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005113}
5114
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005115#if IS_ENABLED(CONFIG_IPV6)
Eric W. Biederman06198b32015-09-18 14:33:06 -05005116static unsigned int selinux_ipv6_forward(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005117 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005118 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005119{
David S. Miller238e54c2015-04-03 20:32:56 -04005120 return selinux_ip_forward(skb, state->in, PF_INET6);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005121}
5122#endif /* IPV6 */
5123
Paul Moore948bf852008-10-10 10:16:32 -04005124static unsigned int selinux_ip_output(struct sk_buff *skb,
5125 u16 family)
5126{
Paul Moore47180062013-12-04 16:10:45 -05005127 struct sock *sk;
Paul Moore948bf852008-10-10 10:16:32 -04005128 u32 sid;
5129
5130 if (!netlbl_enabled())
5131 return NF_ACCEPT;
5132
5133 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5134 * because we want to make sure we apply the necessary labeling
5135 * before IPsec is applied so we can leverage AH protection */
Paul Moore47180062013-12-04 16:10:45 -05005136 sk = skb->sk;
5137 if (sk) {
5138 struct sk_security_struct *sksec;
5139
Eric Dumazete446f9d2015-10-08 05:01:55 -07005140 if (sk_listener(sk))
Paul Moore47180062013-12-04 16:10:45 -05005141 /* if the socket is the listening state then this
5142 * packet is a SYN-ACK packet which means it needs to
5143 * be labeled based on the connection/request_sock and
5144 * not the parent socket. unfortunately, we can't
5145 * lookup the request_sock yet as it isn't queued on
5146 * the parent socket until after the SYN-ACK is sent.
5147 * the "solution" is to simply pass the packet as-is
5148 * as any IP option based labeling should be copied
5149 * from the initial connection request (in the IP
5150 * layer). it is far from ideal, but until we get a
5151 * security label in the packet itself this is the
5152 * best we can do. */
5153 return NF_ACCEPT;
5154
5155 /* standard practice, label using the parent socket */
5156 sksec = sk->sk_security;
Paul Moore948bf852008-10-10 10:16:32 -04005157 sid = sksec->sid;
5158 } else
5159 sid = SECINITSID_KERNEL;
5160 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5161 return NF_DROP;
5162
5163 return NF_ACCEPT;
5164}
5165
Eric W. Biederman06198b32015-09-18 14:33:06 -05005166static unsigned int selinux_ipv4_output(void *priv,
Paul Moore948bf852008-10-10 10:16:32 -04005167 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005168 const struct nf_hook_state *state)
Paul Moore948bf852008-10-10 10:16:32 -04005169{
5170 return selinux_ip_output(skb, PF_INET);
5171}
5172
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005173#if IS_ENABLED(CONFIG_IPV6)
Huw Davies2917f572016-06-27 15:06:15 -04005174static unsigned int selinux_ipv6_output(void *priv,
5175 struct sk_buff *skb,
5176 const struct nf_hook_state *state)
5177{
5178 return selinux_ip_output(skb, PF_INET6);
5179}
5180#endif /* IPV6 */
5181
Paul Mooreeffad8d2008-01-29 08:49:27 -05005182static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5183 int ifindex,
Paul Moored8395c82008-10-10 10:16:30 -04005184 u16 family)
James Morris4e5ab4c2006-06-09 00:33:33 -07005185{
Eric Dumazet54abc682015-11-08 10:54:07 -08005186 struct sock *sk = skb_to_full_sk(skb);
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005187 struct sk_security_struct *sksec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005188 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005189 struct lsm_network_audit net = {0,};
Paul Moored8395c82008-10-10 10:16:30 -04005190 char *addrp;
5191 u8 proto;
James Morris4e5ab4c2006-06-09 00:33:33 -07005192
Paul Mooreeffad8d2008-01-29 08:49:27 -05005193 if (sk == NULL)
5194 return NF_ACCEPT;
Venkat Yekkirala4237c752006-07-24 23:32:50 -07005195 sksec = sk->sk_security;
James Morris4e5ab4c2006-06-09 00:33:33 -07005196
Eric Paris50c205f2012-04-04 15:01:43 -04005197 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005198 ad.u.net = &net;
5199 ad.u.net->netif = ifindex;
5200 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04005201 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5202 return NF_DROP;
5203
Paul Moore58bfbb52009-03-27 17:10:41 -04005204 if (selinux_secmark_enabled())
Paul Mooreeffad8d2008-01-29 08:49:27 -05005205 if (avc_has_perm(sksec->sid, skb->secmark,
Paul Moored8395c82008-10-10 10:16:30 -04005206 SECCLASS_PACKET, PACKET__SEND, &ad))
Eric Paris2fe66ec2010-11-23 06:28:08 +00005207 return NF_DROP_ERR(-ECONNREFUSED);
James Morris4e5ab4c2006-06-09 00:33:33 -07005208
Steffen Klassertb9679a72011-02-23 12:55:21 +01005209 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5210 return NF_DROP_ERR(-ECONNREFUSED);
James Morris4e5ab4c2006-06-09 00:33:33 -07005211
Paul Mooreeffad8d2008-01-29 08:49:27 -05005212 return NF_ACCEPT;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005213}
5214
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005215static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5216 const struct net_device *outdev,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005217 u16 family)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005218{
Paul Mooreeffad8d2008-01-29 08:49:27 -05005219 u32 secmark_perm;
5220 u32 peer_sid;
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005221 int ifindex = outdev->ifindex;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005222 struct sock *sk;
Thomas Liu2bf49692009-07-14 12:14:09 -04005223 struct common_audit_data ad;
Eric Paris48c62af2012-04-02 13:15:44 -04005224 struct lsm_network_audit net = {0,};
Paul Mooreeffad8d2008-01-29 08:49:27 -05005225 char *addrp;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005226 u8 secmark_active;
5227 u8 peerlbl_active;
5228
Paul Mooreeffad8d2008-01-29 08:49:27 -05005229 /* If any sort of compatibility mode is enabled then handoff processing
5230 * to the selinux_ip_postroute_compat() function to deal with the
5231 * special handling. We do this in an attempt to keep this function
5232 * as fast and as clean as possible. */
Paul Moore58bfbb52009-03-27 17:10:41 -04005233 if (!selinux_policycap_netpeer)
Paul Moored8395c82008-10-10 10:16:30 -04005234 return selinux_ip_postroute_compat(skb, ifindex, family);
Paul Moorec0828e52013-12-10 14:58:01 -05005235
Paul Mooreeffad8d2008-01-29 08:49:27 -05005236 secmark_active = selinux_secmark_enabled();
Chris PeBenito2be4d742013-05-03 09:05:39 -04005237 peerlbl_active = selinux_peerlbl_enabled();
Paul Mooreeffad8d2008-01-29 08:49:27 -05005238 if (!secmark_active && !peerlbl_active)
5239 return NF_ACCEPT;
5240
Eric Dumazet54abc682015-11-08 10:54:07 -08005241 sk = skb_to_full_sk(skb);
Paul Moorec0828e52013-12-10 14:58:01 -05005242
Paul Mooreeffad8d2008-01-29 08:49:27 -05005243#ifdef CONFIG_XFRM
5244 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5245 * packet transformation so allow the packet to pass without any checks
5246 * since we'll have another chance to perform access control checks
5247 * when the packet is on it's final way out.
5248 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
Paul Moorec0828e52013-12-10 14:58:01 -05005249 * is NULL, in this case go ahead and apply access control.
5250 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5251 * TCP listening state we cannot wait until the XFRM processing
5252 * is done as we will miss out on the SA label if we do;
5253 * unfortunately, this means more work, but it is only once per
5254 * connection. */
5255 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
Eric Dumazete446f9d2015-10-08 05:01:55 -07005256 !(sk && sk_listener(sk)))
Paul Mooreeffad8d2008-01-29 08:49:27 -05005257 return NF_ACCEPT;
5258#endif
Paul Mooreeffad8d2008-01-29 08:49:27 -05005259
Paul Moored8395c82008-10-10 10:16:30 -04005260 if (sk == NULL) {
Paul Moore446b8022013-12-04 16:10:51 -05005261 /* Without an associated socket the packet is either coming
5262 * from the kernel or it is being forwarded; check the packet
5263 * to determine which and if the packet is being forwarded
5264 * query the packet directly to determine the security label. */
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005265 if (skb->skb_iif) {
5266 secmark_perm = PACKET__FORWARD_OUT;
Paul Moored8395c82008-10-10 10:16:30 -04005267 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005268 return NF_DROP;
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005269 } else {
5270 secmark_perm = PACKET__SEND;
Paul Moored8395c82008-10-10 10:16:30 -04005271 peer_sid = SECINITSID_KERNEL;
Steffen Klassert4a7ab3d2011-02-23 12:56:23 +01005272 }
Eric Dumazete446f9d2015-10-08 05:01:55 -07005273 } else if (sk_listener(sk)) {
Paul Moore446b8022013-12-04 16:10:51 -05005274 /* Locally generated packet but the associated socket is in the
5275 * listening state which means this is a SYN-ACK packet. In
5276 * this particular case the correct security label is assigned
5277 * to the connection/request_sock but unfortunately we can't
5278 * query the request_sock as it isn't queued on the parent
5279 * socket until after the SYN-ACK packet is sent; the only
5280 * viable choice is to regenerate the label like we do in
5281 * selinux_inet_conn_request(). See also selinux_ip_output()
5282 * for similar problems. */
5283 u32 skb_sid;
Eric Dumazete446f9d2015-10-08 05:01:55 -07005284 struct sk_security_struct *sksec;
5285
Eric Dumazete446f9d2015-10-08 05:01:55 -07005286 sksec = sk->sk_security;
Paul Moore446b8022013-12-04 16:10:51 -05005287 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5288 return NF_DROP;
Paul Moorec0828e52013-12-10 14:58:01 -05005289 /* At this point, if the returned skb peerlbl is SECSID_NULL
5290 * and the packet has been through at least one XFRM
5291 * transformation then we must be dealing with the "final"
5292 * form of labeled IPsec packet; since we've already applied
5293 * all of our access controls on this packet we can safely
5294 * pass the packet. */
5295 if (skb_sid == SECSID_NULL) {
5296 switch (family) {
5297 case PF_INET:
5298 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5299 return NF_ACCEPT;
5300 break;
5301 case PF_INET6:
5302 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5303 return NF_ACCEPT;
Paul Moorea7a91a12014-09-03 10:51:59 -04005304 break;
Paul Moorec0828e52013-12-10 14:58:01 -05005305 default:
5306 return NF_DROP_ERR(-ECONNREFUSED);
5307 }
5308 }
Paul Moore446b8022013-12-04 16:10:51 -05005309 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5310 return NF_DROP;
5311 secmark_perm = PACKET__SEND;
Paul Moored8395c82008-10-10 10:16:30 -04005312 } else {
Paul Moore446b8022013-12-04 16:10:51 -05005313 /* Locally generated packet, fetch the security label from the
5314 * associated socket. */
Paul Mooreeffad8d2008-01-29 08:49:27 -05005315 struct sk_security_struct *sksec = sk->sk_security;
5316 peer_sid = sksec->sid;
5317 secmark_perm = PACKET__SEND;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005318 }
5319
Eric Paris50c205f2012-04-04 15:01:43 -04005320 ad.type = LSM_AUDIT_DATA_NET;
Eric Paris48c62af2012-04-02 13:15:44 -04005321 ad.u.net = &net;
5322 ad.u.net->netif = ifindex;
5323 ad.u.net->family = family;
Paul Moored8395c82008-10-10 10:16:30 -04005324 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
Eric Paris04f6d702010-11-23 06:28:02 +00005325 return NF_DROP;
Paul Moored8395c82008-10-10 10:16:30 -04005326
Paul Mooreeffad8d2008-01-29 08:49:27 -05005327 if (secmark_active)
5328 if (avc_has_perm(peer_sid, skb->secmark,
5329 SECCLASS_PACKET, secmark_perm, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005330 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005331
5332 if (peerlbl_active) {
5333 u32 if_sid;
5334 u32 node_sid;
5335
Paul Moorecbe0d6e2014-09-10 17:09:57 -04005336 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005337 return NF_DROP;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005338 if (avc_has_perm(peer_sid, if_sid,
5339 SECCLASS_NETIF, NETIF__EGRESS, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005340 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005341
5342 if (sel_netnode_sid(addrp, family, &node_sid))
Eric Paris04f6d702010-11-23 06:28:02 +00005343 return NF_DROP;
Paul Mooreeffad8d2008-01-29 08:49:27 -05005344 if (avc_has_perm(peer_sid, node_sid,
5345 SECCLASS_NODE, NODE__SENDTO, &ad))
Eric Paris1f1aaf82010-11-16 11:52:57 +00005346 return NF_DROP_ERR(-ECONNREFUSED);
Paul Mooreeffad8d2008-01-29 08:49:27 -05005347 }
5348
5349 return NF_ACCEPT;
5350}
5351
Eric W. Biederman06198b32015-09-18 14:33:06 -05005352static unsigned int selinux_ipv4_postroute(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005353 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005354 const struct nf_hook_state *state)
Paul Mooreeffad8d2008-01-29 08:49:27 -05005355{
David S. Miller238e54c2015-04-03 20:32:56 -04005356 return selinux_ip_postroute(skb, state->out, PF_INET);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005357}
5358
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04005359#if IS_ENABLED(CONFIG_IPV6)
Eric W. Biederman06198b32015-09-18 14:33:06 -05005360static unsigned int selinux_ipv6_postroute(void *priv,
Paul Mooreeffad8d2008-01-29 08:49:27 -05005361 struct sk_buff *skb,
David S. Miller238e54c2015-04-03 20:32:56 -04005362 const struct nf_hook_state *state)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005363{
David S. Miller238e54c2015-04-03 20:32:56 -04005364 return selinux_ip_postroute(skb, state->out, PF_INET6);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005365}
Linus Torvalds1da177e2005-04-16 15:20:36 -07005366#endif /* IPV6 */
5367
5368#endif /* CONFIG_NETFILTER */
5369
Linus Torvalds1da177e2005-04-16 15:20:36 -07005370static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5371{
Stephen Smalley941fc5b2009-10-01 14:48:23 -04005372 return selinux_nlmsg_perm(sk, skb);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005373}
5374
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005375static int ipc_alloc_security(struct kern_ipc_perm *perm,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005376 u16 sclass)
5377{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005378 struct ipc_security_struct *isec;
5379
James Morris89d155e2005-10-30 14:59:21 -08005380 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005381 if (!isec)
5382 return -ENOMEM;
5383
Linus Torvalds1da177e2005-04-16 15:20:36 -07005384 isec->sclass = sclass;
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005385 isec->sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005386 perm->security = isec;
5387
5388 return 0;
5389}
5390
5391static void ipc_free_security(struct kern_ipc_perm *perm)
5392{
5393 struct ipc_security_struct *isec = perm->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005394 perm->security = NULL;
5395 kfree(isec);
5396}
5397
5398static int msg_msg_alloc_security(struct msg_msg *msg)
5399{
5400 struct msg_security_struct *msec;
5401
James Morris89d155e2005-10-30 14:59:21 -08005402 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005403 if (!msec)
5404 return -ENOMEM;
5405
Linus Torvalds1da177e2005-04-16 15:20:36 -07005406 msec->sid = SECINITSID_UNLABELED;
5407 msg->security = msec;
5408
5409 return 0;
5410}
5411
5412static void msg_msg_free_security(struct msg_msg *msg)
5413{
5414 struct msg_security_struct *msec = msg->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005415
5416 msg->security = NULL;
5417 kfree(msec);
5418}
5419
5420static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
Stephen Smalley6af963f2005-05-01 08:58:39 -07005421 u32 perms)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005422{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005423 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005424 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005425 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005426
Linus Torvalds1da177e2005-04-16 15:20:36 -07005427 isec = ipc_perms->security;
5428
Eric Paris50c205f2012-04-04 15:01:43 -04005429 ad.type = LSM_AUDIT_DATA_IPC;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005430 ad.u.ipc_id = ipc_perms->key;
5431
David Howells275bb412008-11-14 10:39:19 +11005432 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005433}
5434
5435static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5436{
5437 return msg_msg_alloc_security(msg);
5438}
5439
5440static void selinux_msg_msg_free_security(struct msg_msg *msg)
5441{
5442 msg_msg_free_security(msg);
5443}
5444
5445/* message queue security operations */
5446static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5447{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005448 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005449 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005450 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005451 int rc;
5452
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005453 rc = ipc_alloc_security(&msq->q_perm, SECCLASS_MSGQ);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005454 if (rc)
5455 return rc;
5456
Linus Torvalds1da177e2005-04-16 15:20:36 -07005457 isec = msq->q_perm.security;
5458
Eric Paris50c205f2012-04-04 15:01:43 -04005459 ad.type = LSM_AUDIT_DATA_IPC;
Eric Paris828dfe12008-04-17 13:17:49 -04005460 ad.u.ipc_id = msq->q_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005461
David Howells275bb412008-11-14 10:39:19 +11005462 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005463 MSGQ__CREATE, &ad);
5464 if (rc) {
5465 ipc_free_security(&msq->q_perm);
5466 return rc;
5467 }
5468 return 0;
5469}
5470
5471static void selinux_msg_queue_free_security(struct msg_queue *msq)
5472{
5473 ipc_free_security(&msq->q_perm);
5474}
5475
5476static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5477{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005478 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005479 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005480 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005481
Linus Torvalds1da177e2005-04-16 15:20:36 -07005482 isec = msq->q_perm.security;
5483
Eric Paris50c205f2012-04-04 15:01:43 -04005484 ad.type = LSM_AUDIT_DATA_IPC;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005485 ad.u.ipc_id = msq->q_perm.key;
5486
David Howells275bb412008-11-14 10:39:19 +11005487 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005488 MSGQ__ASSOCIATE, &ad);
5489}
5490
5491static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5492{
5493 int err;
5494 int perms;
5495
Eric Paris828dfe12008-04-17 13:17:49 -04005496 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005497 case IPC_INFO:
5498 case MSG_INFO:
5499 /* No specific object, just general system-wide information. */
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005500 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5501 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005502 case IPC_STAT:
5503 case MSG_STAT:
5504 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5505 break;
5506 case IPC_SET:
5507 perms = MSGQ__SETATTR;
5508 break;
5509 case IPC_RMID:
5510 perms = MSGQ__DESTROY;
5511 break;
5512 default:
5513 return 0;
5514 }
5515
Stephen Smalley6af963f2005-05-01 08:58:39 -07005516 err = ipc_has_perm(&msq->q_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005517 return err;
5518}
5519
5520static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5521{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005522 struct ipc_security_struct *isec;
5523 struct msg_security_struct *msec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005524 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005525 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005526 int rc;
5527
Linus Torvalds1da177e2005-04-16 15:20:36 -07005528 isec = msq->q_perm.security;
5529 msec = msg->security;
5530
5531 /*
5532 * First time through, need to assign label to the message
5533 */
5534 if (msec->sid == SECINITSID_UNLABELED) {
5535 /*
5536 * Compute new sid based on current process and
5537 * message queue this message will be stored in
5538 */
David Howells275bb412008-11-14 10:39:19 +11005539 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
Eric Paris652bb9b2011-02-01 11:05:40 -05005540 NULL, &msec->sid);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005541 if (rc)
5542 return rc;
5543 }
5544
Eric Paris50c205f2012-04-04 15:01:43 -04005545 ad.type = LSM_AUDIT_DATA_IPC;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005546 ad.u.ipc_id = msq->q_perm.key;
5547
5548 /* Can this process write to the queue? */
David Howells275bb412008-11-14 10:39:19 +11005549 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005550 MSGQ__WRITE, &ad);
5551 if (!rc)
5552 /* Can this process send the message */
David Howells275bb412008-11-14 10:39:19 +11005553 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5554 MSG__SEND, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005555 if (!rc)
5556 /* Can the message be put in the queue? */
David Howells275bb412008-11-14 10:39:19 +11005557 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5558 MSGQ__ENQUEUE, &ad);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005559
5560 return rc;
5561}
5562
5563static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5564 struct task_struct *target,
5565 long type, int mode)
5566{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005567 struct ipc_security_struct *isec;
5568 struct msg_security_struct *msec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005569 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005570 u32 sid = task_sid(target);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005571 int rc;
5572
Linus Torvalds1da177e2005-04-16 15:20:36 -07005573 isec = msq->q_perm.security;
5574 msec = msg->security;
5575
Eric Paris50c205f2012-04-04 15:01:43 -04005576 ad.type = LSM_AUDIT_DATA_IPC;
Eric Paris828dfe12008-04-17 13:17:49 -04005577 ad.u.ipc_id = msq->q_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005578
David Howells275bb412008-11-14 10:39:19 +11005579 rc = avc_has_perm(sid, isec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005580 SECCLASS_MSGQ, MSGQ__READ, &ad);
5581 if (!rc)
David Howells275bb412008-11-14 10:39:19 +11005582 rc = avc_has_perm(sid, msec->sid,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005583 SECCLASS_MSG, MSG__RECEIVE, &ad);
5584 return rc;
5585}
5586
5587/* Shared Memory security operations */
5588static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5589{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005590 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005591 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005592 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005593 int rc;
5594
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005595 rc = ipc_alloc_security(&shp->shm_perm, SECCLASS_SHM);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005596 if (rc)
5597 return rc;
5598
Linus Torvalds1da177e2005-04-16 15:20:36 -07005599 isec = shp->shm_perm.security;
5600
Eric Paris50c205f2012-04-04 15:01:43 -04005601 ad.type = LSM_AUDIT_DATA_IPC;
Eric Paris828dfe12008-04-17 13:17:49 -04005602 ad.u.ipc_id = shp->shm_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005603
David Howells275bb412008-11-14 10:39:19 +11005604 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005605 SHM__CREATE, &ad);
5606 if (rc) {
5607 ipc_free_security(&shp->shm_perm);
5608 return rc;
5609 }
5610 return 0;
5611}
5612
5613static void selinux_shm_free_security(struct shmid_kernel *shp)
5614{
5615 ipc_free_security(&shp->shm_perm);
5616}
5617
5618static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5619{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005620 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005621 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005622 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005623
Linus Torvalds1da177e2005-04-16 15:20:36 -07005624 isec = shp->shm_perm.security;
5625
Eric Paris50c205f2012-04-04 15:01:43 -04005626 ad.type = LSM_AUDIT_DATA_IPC;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005627 ad.u.ipc_id = shp->shm_perm.key;
5628
David Howells275bb412008-11-14 10:39:19 +11005629 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005630 SHM__ASSOCIATE, &ad);
5631}
5632
5633/* Note, at this point, shp is locked down */
5634static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5635{
5636 int perms;
5637 int err;
5638
Eric Paris828dfe12008-04-17 13:17:49 -04005639 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005640 case IPC_INFO:
5641 case SHM_INFO:
5642 /* No specific object, just general system-wide information. */
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005643 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5644 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005645 case IPC_STAT:
5646 case SHM_STAT:
5647 perms = SHM__GETATTR | SHM__ASSOCIATE;
5648 break;
5649 case IPC_SET:
5650 perms = SHM__SETATTR;
5651 break;
5652 case SHM_LOCK:
5653 case SHM_UNLOCK:
5654 perms = SHM__LOCK;
5655 break;
5656 case IPC_RMID:
5657 perms = SHM__DESTROY;
5658 break;
5659 default:
5660 return 0;
5661 }
5662
Stephen Smalley6af963f2005-05-01 08:58:39 -07005663 err = ipc_has_perm(&shp->shm_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005664 return err;
5665}
5666
5667static int selinux_shm_shmat(struct shmid_kernel *shp,
5668 char __user *shmaddr, int shmflg)
5669{
5670 u32 perms;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005671
5672 if (shmflg & SHM_RDONLY)
5673 perms = SHM__READ;
5674 else
5675 perms = SHM__READ | SHM__WRITE;
5676
Stephen Smalley6af963f2005-05-01 08:58:39 -07005677 return ipc_has_perm(&shp->shm_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005678}
5679
5680/* Semaphore security operations */
5681static int selinux_sem_alloc_security(struct sem_array *sma)
5682{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005683 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005684 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005685 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005686 int rc;
5687
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005688 rc = ipc_alloc_security(&sma->sem_perm, SECCLASS_SEM);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005689 if (rc)
5690 return rc;
5691
Linus Torvalds1da177e2005-04-16 15:20:36 -07005692 isec = sma->sem_perm.security;
5693
Eric Paris50c205f2012-04-04 15:01:43 -04005694 ad.type = LSM_AUDIT_DATA_IPC;
Eric Paris828dfe12008-04-17 13:17:49 -04005695 ad.u.ipc_id = sma->sem_perm.key;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005696
David Howells275bb412008-11-14 10:39:19 +11005697 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005698 SEM__CREATE, &ad);
5699 if (rc) {
5700 ipc_free_security(&sma->sem_perm);
5701 return rc;
5702 }
5703 return 0;
5704}
5705
5706static void selinux_sem_free_security(struct sem_array *sma)
5707{
5708 ipc_free_security(&sma->sem_perm);
5709}
5710
5711static int selinux_sem_associate(struct sem_array *sma, int semflg)
5712{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005713 struct ipc_security_struct *isec;
Thomas Liu2bf49692009-07-14 12:14:09 -04005714 struct common_audit_data ad;
David Howells275bb412008-11-14 10:39:19 +11005715 u32 sid = current_sid();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005716
Linus Torvalds1da177e2005-04-16 15:20:36 -07005717 isec = sma->sem_perm.security;
5718
Eric Paris50c205f2012-04-04 15:01:43 -04005719 ad.type = LSM_AUDIT_DATA_IPC;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005720 ad.u.ipc_id = sma->sem_perm.key;
5721
David Howells275bb412008-11-14 10:39:19 +11005722 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
Linus Torvalds1da177e2005-04-16 15:20:36 -07005723 SEM__ASSOCIATE, &ad);
5724}
5725
5726/* Note, at this point, sma is locked down */
5727static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5728{
5729 int err;
5730 u32 perms;
5731
Eric Paris828dfe12008-04-17 13:17:49 -04005732 switch (cmd) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005733 case IPC_INFO:
5734 case SEM_INFO:
5735 /* No specific object, just general system-wide information. */
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005736 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5737 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005738 case GETPID:
5739 case GETNCNT:
5740 case GETZCNT:
5741 perms = SEM__GETATTR;
5742 break;
5743 case GETVAL:
5744 case GETALL:
5745 perms = SEM__READ;
5746 break;
5747 case SETVAL:
5748 case SETALL:
5749 perms = SEM__WRITE;
5750 break;
5751 case IPC_RMID:
5752 perms = SEM__DESTROY;
5753 break;
5754 case IPC_SET:
5755 perms = SEM__SETATTR;
5756 break;
5757 case IPC_STAT:
5758 case SEM_STAT:
5759 perms = SEM__GETATTR | SEM__ASSOCIATE;
5760 break;
5761 default:
5762 return 0;
5763 }
5764
Stephen Smalley6af963f2005-05-01 08:58:39 -07005765 err = ipc_has_perm(&sma->sem_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005766 return err;
5767}
5768
5769static int selinux_sem_semop(struct sem_array *sma,
5770 struct sembuf *sops, unsigned nsops, int alter)
5771{
5772 u32 perms;
5773
5774 if (alter)
5775 perms = SEM__READ | SEM__WRITE;
5776 else
5777 perms = SEM__READ;
5778
Stephen Smalley6af963f2005-05-01 08:58:39 -07005779 return ipc_has_perm(&sma->sem_perm, perms);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005780}
5781
5782static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5783{
Linus Torvalds1da177e2005-04-16 15:20:36 -07005784 u32 av = 0;
5785
Linus Torvalds1da177e2005-04-16 15:20:36 -07005786 av = 0;
5787 if (flag & S_IRUGO)
5788 av |= IPC__UNIX_READ;
5789 if (flag & S_IWUGO)
5790 av |= IPC__UNIX_WRITE;
5791
5792 if (av == 0)
5793 return 0;
5794
Stephen Smalley6af963f2005-05-01 08:58:39 -07005795 return ipc_has_perm(ipcp, av);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005796}
5797
Ahmed S. Darwish713a04ae2008-03-01 21:52:30 +02005798static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5799{
5800 struct ipc_security_struct *isec = ipcp->security;
5801 *secid = isec->sid;
5802}
5803
Eric Paris828dfe12008-04-17 13:17:49 -04005804static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005805{
5806 if (inode)
5807 inode_doinit_with_dentry(inode, dentry);
5808}
5809
5810static int selinux_getprocattr(struct task_struct *p,
Al Viro04ff9702007-03-12 16:17:58 +00005811 char *name, char **value)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005812{
David Howells275bb412008-11-14 10:39:19 +11005813 const struct task_security_struct *__tsec;
Dustin Kirkland8c8570f2005-11-03 17:15:16 +00005814 u32 sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005815 int error;
Al Viro04ff9702007-03-12 16:17:58 +00005816 unsigned len;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005817
David Howells275bb412008-11-14 10:39:19 +11005818 rcu_read_lock();
5819 __tsec = __task_cred(p)->security;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005820
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005821 if (current != p) {
5822 error = avc_has_perm(current_sid(), __tsec->sid,
5823 SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
5824 if (error)
5825 goto bad;
5826 }
5827
Linus Torvalds1da177e2005-04-16 15:20:36 -07005828 if (!strcmp(name, "current"))
David Howells275bb412008-11-14 10:39:19 +11005829 sid = __tsec->sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005830 else if (!strcmp(name, "prev"))
David Howells275bb412008-11-14 10:39:19 +11005831 sid = __tsec->osid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005832 else if (!strcmp(name, "exec"))
David Howells275bb412008-11-14 10:39:19 +11005833 sid = __tsec->exec_sid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005834 else if (!strcmp(name, "fscreate"))
David Howells275bb412008-11-14 10:39:19 +11005835 sid = __tsec->create_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07005836 else if (!strcmp(name, "keycreate"))
David Howells275bb412008-11-14 10:39:19 +11005837 sid = __tsec->keycreate_sid;
Eric Paris42c3e032006-06-26 00:26:03 -07005838 else if (!strcmp(name, "sockcreate"))
David Howells275bb412008-11-14 10:39:19 +11005839 sid = __tsec->sockcreate_sid;
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005840 else {
5841 error = -EINVAL;
5842 goto bad;
5843 }
David Howells275bb412008-11-14 10:39:19 +11005844 rcu_read_unlock();
Linus Torvalds1da177e2005-04-16 15:20:36 -07005845
5846 if (!sid)
5847 return 0;
5848
Al Viro04ff9702007-03-12 16:17:58 +00005849 error = security_sid_to_context(sid, value, &len);
5850 if (error)
5851 return error;
5852 return len;
David Howells275bb412008-11-14 10:39:19 +11005853
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005854bad:
David Howells275bb412008-11-14 10:39:19 +11005855 rcu_read_unlock();
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005856 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005857}
5858
Stephen Smalleyb21507e2017-01-09 10:07:31 -05005859static int selinux_setprocattr(const char *name, void *value, size_t size)
Linus Torvalds1da177e2005-04-16 15:20:36 -07005860{
5861 struct task_security_struct *tsec;
David Howellsd84f4f92008-11-14 10:39:23 +11005862 struct cred *new;
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005863 u32 mysid = current_sid(), sid = 0, ptsid;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005864 int error;
5865 char *str = value;
5866
Linus Torvalds1da177e2005-04-16 15:20:36 -07005867 /*
5868 * Basic control over ability to set these attributes at all.
Linus Torvalds1da177e2005-04-16 15:20:36 -07005869 */
5870 if (!strcmp(name, "exec"))
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005871 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5872 PROCESS__SETEXEC, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005873 else if (!strcmp(name, "fscreate"))
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005874 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5875 PROCESS__SETFSCREATE, NULL);
Michael LeMay4eb582c2006-06-26 00:24:57 -07005876 else if (!strcmp(name, "keycreate"))
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005877 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5878 PROCESS__SETKEYCREATE, NULL);
Eric Paris42c3e032006-06-26 00:26:03 -07005879 else if (!strcmp(name, "sockcreate"))
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005880 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5881 PROCESS__SETSOCKCREATE, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005882 else if (!strcmp(name, "current"))
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005883 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5884 PROCESS__SETCURRENT, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005885 else
5886 error = -EINVAL;
5887 if (error)
5888 return error;
5889
5890 /* Obtain a SID for the context, if one was specified. */
Stephen Smalleya050a572017-01-31 11:54:04 -05005891 if (size && str[0] && str[0] != '\n') {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005892 if (str[size-1] == '\n') {
5893 str[size-1] = 0;
5894 size--;
5895 }
Nikolay Aleksandrov52a4c642014-03-07 12:44:19 +01005896 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
Stephen Smalley12b29f32008-05-07 13:03:20 -04005897 if (error == -EINVAL && !strcmp(name, "fscreate")) {
Eric Parisd6ea83e2012-04-04 13:45:49 -04005898 if (!capable(CAP_MAC_ADMIN)) {
5899 struct audit_buffer *ab;
5900 size_t audit_size;
5901
5902 /* We strip a nul only if it is at the end, otherwise the
5903 * context contains a nul and we should audit that */
5904 if (str[size - 1] == '\0')
5905 audit_size = size - 1;
5906 else
5907 audit_size = size;
5908 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5909 audit_log_format(ab, "op=fscreate invalid_context=");
5910 audit_log_n_untrustedstring(ab, value, audit_size);
5911 audit_log_end(ab);
5912
Stephen Smalley12b29f32008-05-07 13:03:20 -04005913 return error;
Eric Parisd6ea83e2012-04-04 13:45:49 -04005914 }
Stephen Smalley12b29f32008-05-07 13:03:20 -04005915 error = security_context_to_sid_force(value, size,
5916 &sid);
5917 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07005918 if (error)
5919 return error;
5920 }
5921
David Howellsd84f4f92008-11-14 10:39:23 +11005922 new = prepare_creds();
5923 if (!new)
5924 return -ENOMEM;
5925
Linus Torvalds1da177e2005-04-16 15:20:36 -07005926 /* Permission checking based on the specified context is
5927 performed during the actual operation (execve,
5928 open/mkdir/...), when we know the full context of the
David Howellsd84f4f92008-11-14 10:39:23 +11005929 operation. See selinux_bprm_set_creds for the execve
Linus Torvalds1da177e2005-04-16 15:20:36 -07005930 checks and may_create for the file creation checks. The
5931 operation will then fail if the context is not permitted. */
David Howellsd84f4f92008-11-14 10:39:23 +11005932 tsec = new->security;
5933 if (!strcmp(name, "exec")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005934 tsec->exec_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11005935 } else if (!strcmp(name, "fscreate")) {
Linus Torvalds1da177e2005-04-16 15:20:36 -07005936 tsec->create_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11005937 } else if (!strcmp(name, "keycreate")) {
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005938 error = avc_has_perm(mysid, sid, SECCLASS_KEY, KEY__CREATE,
5939 NULL);
Michael LeMay4eb582c2006-06-26 00:24:57 -07005940 if (error)
David Howellsd84f4f92008-11-14 10:39:23 +11005941 goto abort_change;
Michael LeMay4eb582c2006-06-26 00:24:57 -07005942 tsec->keycreate_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11005943 } else if (!strcmp(name, "sockcreate")) {
Eric Paris42c3e032006-06-26 00:26:03 -07005944 tsec->sockcreate_sid = sid;
David Howellsd84f4f92008-11-14 10:39:23 +11005945 } else if (!strcmp(name, "current")) {
5946 error = -EINVAL;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005947 if (sid == 0)
David Howellsd84f4f92008-11-14 10:39:23 +11005948 goto abort_change;
KaiGai Koheid9250de2008-08-28 16:35:57 +09005949
David Howellsd84f4f92008-11-14 10:39:23 +11005950 /* Only allow single threaded processes to change context */
5951 error = -EPERM;
Oleg Nesterov5bb459b2009-07-10 03:48:23 +02005952 if (!current_is_single_threaded()) {
David Howellsd84f4f92008-11-14 10:39:23 +11005953 error = security_bounded_transition(tsec->sid, sid);
5954 if (error)
5955 goto abort_change;
Eric Paris828dfe12008-04-17 13:17:49 -04005956 }
Linus Torvalds1da177e2005-04-16 15:20:36 -07005957
5958 /* Check permissions for the transition. */
5959 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
Eric Paris828dfe12008-04-17 13:17:49 -04005960 PROCESS__DYNTRANSITION, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005961 if (error)
David Howellsd84f4f92008-11-14 10:39:23 +11005962 goto abort_change;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005963
5964 /* Check for ptracing, and update the task SID if ok.
5965 Otherwise, leave SID unchanged and fail. */
Stephen Smalleybe0554c2017-01-09 10:07:31 -05005966 ptsid = ptrace_parent_sid();
Paul Moore0c6181c2016-03-30 21:41:21 -04005967 if (ptsid != 0) {
David Howellsd84f4f92008-11-14 10:39:23 +11005968 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5969 PROCESS__PTRACE, NULL);
5970 if (error)
5971 goto abort_change;
5972 }
5973
5974 tsec->sid = sid;
5975 } else {
5976 error = -EINVAL;
5977 goto abort_change;
5978 }
5979
5980 commit_creds(new);
Linus Torvalds1da177e2005-04-16 15:20:36 -07005981 return size;
David Howellsd84f4f92008-11-14 10:39:23 +11005982
5983abort_change:
5984 abort_creds(new);
5985 return error;
Linus Torvalds1da177e2005-04-16 15:20:36 -07005986}
5987
David Quigley746df9b2013-05-22 12:50:35 -04005988static int selinux_ismaclabel(const char *name)
5989{
5990 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5991}
5992
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07005993static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5994{
5995 return security_sid_to_context(secid, secdata, seclen);
5996}
5997
David Howells7bf570d2008-04-29 20:52:51 +01005998static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
David Howells63cb3442008-01-15 23:47:35 +00005999{
Nikolay Aleksandrov52a4c642014-03-07 12:44:19 +01006000 return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
David Howells63cb3442008-01-15 23:47:35 +00006001}
6002
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006003static void selinux_release_secctx(char *secdata, u32 seclen)
6004{
Paul Moore088999e2007-08-01 11:12:58 -04006005 kfree(secdata);
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006006}
6007
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006008static void selinux_inode_invalidate_secctx(struct inode *inode)
6009{
6010 struct inode_security_struct *isec = inode->i_security;
6011
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01006012 spin_lock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006013 isec->initialized = LABEL_INVALID;
Andreas Gruenbacher9287aed2016-11-15 11:06:40 +01006014 spin_unlock(&isec->lock);
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006015}
6016
David P. Quigley1ee65e32009-09-03 14:25:57 -04006017/*
6018 * called with inode->i_mutex locked
6019 */
6020static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6021{
6022 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
6023}
6024
6025/*
6026 * called with inode->i_mutex locked
6027 */
6028static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6029{
6030 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6031}
6032
6033static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6034{
6035 int len = 0;
6036 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6037 ctx, true);
6038 if (len < 0)
6039 return len;
6040 *ctxlen = len;
6041 return 0;
6042}
Michael LeMayd7200242006-06-22 14:47:17 -07006043#ifdef CONFIG_KEYS
6044
David Howellsd84f4f92008-11-14 10:39:23 +11006045static int selinux_key_alloc(struct key *k, const struct cred *cred,
David Howells7e047ef2006-06-26 00:24:50 -07006046 unsigned long flags)
Michael LeMayd7200242006-06-22 14:47:17 -07006047{
David Howellsd84f4f92008-11-14 10:39:23 +11006048 const struct task_security_struct *tsec;
Michael LeMayd7200242006-06-22 14:47:17 -07006049 struct key_security_struct *ksec;
6050
6051 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6052 if (!ksec)
6053 return -ENOMEM;
6054
David Howellsd84f4f92008-11-14 10:39:23 +11006055 tsec = cred->security;
6056 if (tsec->keycreate_sid)
6057 ksec->sid = tsec->keycreate_sid;
Michael LeMay4eb582c2006-06-26 00:24:57 -07006058 else
David Howellsd84f4f92008-11-14 10:39:23 +11006059 ksec->sid = tsec->sid;
Michael LeMayd7200242006-06-22 14:47:17 -07006060
David Howells275bb412008-11-14 10:39:19 +11006061 k->security = ksec;
Michael LeMayd7200242006-06-22 14:47:17 -07006062 return 0;
6063}
6064
6065static void selinux_key_free(struct key *k)
6066{
6067 struct key_security_struct *ksec = k->security;
6068
6069 k->security = NULL;
6070 kfree(ksec);
6071}
6072
6073static int selinux_key_permission(key_ref_t key_ref,
David Howellsd84f4f92008-11-14 10:39:23 +11006074 const struct cred *cred,
David Howellsf5895942014-03-14 17:44:49 +00006075 unsigned perm)
Michael LeMayd7200242006-06-22 14:47:17 -07006076{
6077 struct key *key;
Michael LeMayd7200242006-06-22 14:47:17 -07006078 struct key_security_struct *ksec;
David Howells275bb412008-11-14 10:39:19 +11006079 u32 sid;
Michael LeMayd7200242006-06-22 14:47:17 -07006080
6081 /* if no specific permissions are requested, we skip the
6082 permission check. No serious, additional covert channels
6083 appear to be created. */
6084 if (perm == 0)
6085 return 0;
6086
David Howellsd84f4f92008-11-14 10:39:23 +11006087 sid = cred_sid(cred);
David Howells275bb412008-11-14 10:39:19 +11006088
6089 key = key_ref_to_ptr(key_ref);
6090 ksec = key->security;
6091
6092 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
Michael LeMayd7200242006-06-22 14:47:17 -07006093}
6094
David Howells70a5bb72008-04-29 01:01:26 -07006095static int selinux_key_getsecurity(struct key *key, char **_buffer)
6096{
6097 struct key_security_struct *ksec = key->security;
6098 char *context = NULL;
6099 unsigned len;
6100 int rc;
6101
6102 rc = security_sid_to_context(ksec->sid, &context, &len);
6103 if (!rc)
6104 rc = len;
6105 *_buffer = context;
6106 return rc;
6107}
6108
Michael LeMayd7200242006-06-22 14:47:17 -07006109#endif
6110
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07006111static struct security_hook_list selinux_hooks[] = {
Casey Schauflere20b0432015-05-02 15:11:36 -07006112 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6113 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6114 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6115 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02006116
Casey Schauflere20b0432015-05-02 15:11:36 -07006117 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6118 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6119 LSM_HOOK_INIT(capget, selinux_capget),
6120 LSM_HOOK_INIT(capset, selinux_capset),
6121 LSM_HOOK_INIT(capable, selinux_capable),
6122 LSM_HOOK_INIT(quotactl, selinux_quotactl),
6123 LSM_HOOK_INIT(quota_on, selinux_quota_on),
6124 LSM_HOOK_INIT(syslog, selinux_syslog),
6125 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
Stephen Smalley79af73072015-01-21 10:54:10 -05006126
Casey Schauflere20b0432015-05-02 15:11:36 -07006127 LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006128
Casey Schauflere20b0432015-05-02 15:11:36 -07006129 LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6130 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6131 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6132 LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006133
Casey Schauflere20b0432015-05-02 15:11:36 -07006134 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6135 LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6136 LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
6137 LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6138 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6139 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6140 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6141 LSM_HOOK_INIT(sb_mount, selinux_mount),
6142 LSM_HOOK_INIT(sb_umount, selinux_umount),
6143 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6144 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6145 LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006146
Casey Schauflere20b0432015-05-02 15:11:36 -07006147 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
Vivek Goyala518b0a2016-07-13 10:44:53 -04006148 LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
Eric Parise0007522008-03-05 10:31:54 -05006149
Casey Schauflere20b0432015-05-02 15:11:36 -07006150 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6151 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6152 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6153 LSM_HOOK_INIT(inode_create, selinux_inode_create),
6154 LSM_HOOK_INIT(inode_link, selinux_inode_link),
6155 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6156 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6157 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6158 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6159 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6160 LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6161 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6162 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6163 LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6164 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6165 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6166 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6167 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6168 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6169 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6170 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6171 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6172 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6173 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6174 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
Vivek Goyal56909eb2016-07-13 10:44:48 -04006175 LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
Vivek Goyal19472b62016-07-13 10:44:50 -04006176 LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006177
Casey Schauflere20b0432015-05-02 15:11:36 -07006178 LSM_HOOK_INIT(file_permission, selinux_file_permission),
6179 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6180 LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
6181 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6182 LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6183 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6184 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6185 LSM_HOOK_INIT(file_lock, selinux_file_lock),
6186 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6187 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6188 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6189 LSM_HOOK_INIT(file_receive, selinux_file_receive),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006190
Casey Schauflere20b0432015-05-02 15:11:36 -07006191 LSM_HOOK_INIT(file_open, selinux_file_open),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006192
Casey Schauflere20b0432015-05-02 15:11:36 -07006193 LSM_HOOK_INIT(task_create, selinux_task_create),
6194 LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
6195 LSM_HOOK_INIT(cred_free, selinux_cred_free),
6196 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6197 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6198 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6199 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6200 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
Jeff Vander Stoep61d612ea2016-04-05 13:06:27 -07006201 LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
Casey Schauflere20b0432015-05-02 15:11:36 -07006202 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6203 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6204 LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6205 LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6206 LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6207 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6208 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
6209 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6210 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6211 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6212 LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6213 LSM_HOOK_INIT(task_kill, selinux_task_kill),
Casey Schauflere20b0432015-05-02 15:11:36 -07006214 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
Yuichi Nakamura788e7dd2007-09-14 09:27:07 +09006215
Casey Schauflere20b0432015-05-02 15:11:36 -07006216 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6217 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006218
Casey Schauflere20b0432015-05-02 15:11:36 -07006219 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6220 LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006221
Casey Schauflere20b0432015-05-02 15:11:36 -07006222 LSM_HOOK_INIT(msg_queue_alloc_security,
6223 selinux_msg_queue_alloc_security),
6224 LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6225 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6226 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6227 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6228 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006229
Casey Schauflere20b0432015-05-02 15:11:36 -07006230 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6231 LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6232 LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6233 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6234 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006235
Casey Schauflere20b0432015-05-02 15:11:36 -07006236 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6237 LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6238 LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6239 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6240 LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006241
Casey Schauflere20b0432015-05-02 15:11:36 -07006242 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006243
Casey Schauflere20b0432015-05-02 15:11:36 -07006244 LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6245 LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006246
Casey Schauflere20b0432015-05-02 15:11:36 -07006247 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6248 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6249 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6250 LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
Andreas Gruenbacher6f3be9f2015-12-24 11:09:40 -05006251 LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
Casey Schauflere20b0432015-05-02 15:11:36 -07006252 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6253 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6254 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006255
Casey Schauflere20b0432015-05-02 15:11:36 -07006256 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6257 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
Catherine Zhangdc49c1f2006-08-02 14:12:06 -07006258
Casey Schauflere20b0432015-05-02 15:11:36 -07006259 LSM_HOOK_INIT(socket_create, selinux_socket_create),
6260 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6261 LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6262 LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6263 LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6264 LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6265 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6266 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6267 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6268 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6269 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6270 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6271 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6272 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6273 LSM_HOOK_INIT(socket_getpeersec_stream,
6274 selinux_socket_getpeersec_stream),
6275 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6276 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6277 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6278 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6279 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6280 LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6281 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6282 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6283 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6284 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6285 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6286 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6287 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6288 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6289 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6290 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6291 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6292 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6293 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
Trent Jaegerd28d1e02005-12-13 23:12:40 -08006294
6295#ifdef CONFIG_SECURITY_NETWORK_XFRM
Casey Schauflere20b0432015-05-02 15:11:36 -07006296 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6297 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6298 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6299 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6300 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6301 LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6302 selinux_xfrm_state_alloc_acquire),
6303 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6304 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6305 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6306 LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6307 selinux_xfrm_state_pol_flow_match),
6308 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
Linus Torvalds1da177e2005-04-16 15:20:36 -07006309#endif
Michael LeMayd7200242006-06-22 14:47:17 -07006310
6311#ifdef CONFIG_KEYS
Casey Schauflere20b0432015-05-02 15:11:36 -07006312 LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6313 LSM_HOOK_INIT(key_free, selinux_key_free),
6314 LSM_HOOK_INIT(key_permission, selinux_key_permission),
6315 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
Michael LeMayd7200242006-06-22 14:47:17 -07006316#endif
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +02006317
6318#ifdef CONFIG_AUDIT
Casey Schauflere20b0432015-05-02 15:11:36 -07006319 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6320 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6321 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6322 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
Ahmed S. Darwish9d57a7f2008-03-01 22:03:14 +02006323#endif
Linus Torvalds1da177e2005-04-16 15:20:36 -07006324};
6325
6326static __init int selinux_init(void)
6327{
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07006328 if (!security_module_enable("selinux")) {
Ahmed S. Darwish076c54c2008-03-06 18:09:10 +02006329 selinux_enabled = 0;
6330 return 0;
6331 }
6332
Linus Torvalds1da177e2005-04-16 15:20:36 -07006333 if (!selinux_enabled) {
6334 printk(KERN_INFO "SELinux: Disabled at boot.\n");
6335 return 0;
6336 }
6337
6338 printk(KERN_INFO "SELinux: Initializing.\n");
6339
6340 /* Set the security state for the initial task. */
David Howellsd84f4f92008-11-14 10:39:23 +11006341 cred_init_security();
Linus Torvalds1da177e2005-04-16 15:20:36 -07006342
Stephen Smalleyfcaaade2010-04-28 15:57:57 -04006343 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6344
James Morris7cae7e22006-03-22 00:09:22 -08006345 sel_inode_cache = kmem_cache_create("selinux_inode_security",
6346 sizeof(struct inode_security_struct),
Paul Mundt20c2df82007-07-20 10:11:58 +09006347 0, SLAB_PANIC, NULL);
Sangwoo63205652015-10-21 17:44:30 -04006348 file_security_cache = kmem_cache_create("selinux_file_security",
6349 sizeof(struct file_security_struct),
6350 0, SLAB_PANIC, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006351 avc_init();
6352
Casey Schauflerd69dece52017-01-18 17:09:05 -08006353 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
Linus Torvalds1da177e2005-04-16 15:20:36 -07006354
Paul Moore615e51f2014-06-26 14:33:56 -04006355 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6356 panic("SELinux: Unable to register AVC netcache callback\n");
6357
Eric Paris828dfe12008-04-17 13:17:49 -04006358 if (selinux_enforcing)
Eric Parisfadcdb42007-02-22 18:11:31 -05006359 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
Eric Paris828dfe12008-04-17 13:17:49 -04006360 else
Eric Parisfadcdb42007-02-22 18:11:31 -05006361 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
Michael LeMayd7200242006-06-22 14:47:17 -07006362
Linus Torvalds1da177e2005-04-16 15:20:36 -07006363 return 0;
6364}
6365
Al Viroe8c26252010-03-23 06:36:54 -04006366static void delayed_superblock_init(struct super_block *sb, void *unused)
6367{
6368 superblock_doinit(sb, NULL);
6369}
6370
Linus Torvalds1da177e2005-04-16 15:20:36 -07006371void selinux_complete_init(void)
6372{
Eric Parisfadcdb42007-02-22 18:11:31 -05006373 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07006374
6375 /* Set up any superblocks initialized prior to the policy load. */
Eric Parisfadcdb42007-02-22 18:11:31 -05006376 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
Al Viroe8c26252010-03-23 06:36:54 -04006377 iterate_supers(delayed_superblock_init, NULL);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006378}
6379
6380/* SELinux requires early initialization in order to label
6381 all processes and objects when they are created. */
6382security_initcall(selinux_init);
6383
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08006384#if defined(CONFIG_NETFILTER)
Linus Torvalds1da177e2005-04-16 15:20:36 -07006385
Jiri Pirko25db6be2014-09-03 17:42:13 +02006386static struct nf_hook_ops selinux_nf_ops[] = {
Paul Mooreeffad8d2008-01-29 08:49:27 -05006387 {
6388 .hook = selinux_ipv4_postroute,
Alban Crequy2597a832012-05-14 03:56:39 +00006389 .pf = NFPROTO_IPV4,
Paul Mooreeffad8d2008-01-29 08:49:27 -05006390 .hooknum = NF_INET_POST_ROUTING,
6391 .priority = NF_IP_PRI_SELINUX_LAST,
6392 },
6393 {
6394 .hook = selinux_ipv4_forward,
Alban Crequy2597a832012-05-14 03:56:39 +00006395 .pf = NFPROTO_IPV4,
Paul Mooreeffad8d2008-01-29 08:49:27 -05006396 .hooknum = NF_INET_FORWARD,
6397 .priority = NF_IP_PRI_SELINUX_FIRST,
Paul Moore948bf852008-10-10 10:16:32 -04006398 },
6399 {
6400 .hook = selinux_ipv4_output,
Alban Crequy2597a832012-05-14 03:56:39 +00006401 .pf = NFPROTO_IPV4,
Paul Moore948bf852008-10-10 10:16:32 -04006402 .hooknum = NF_INET_LOCAL_OUT,
6403 .priority = NF_IP_PRI_SELINUX_FIRST,
Jiri Pirko25db6be2014-09-03 17:42:13 +02006404 },
Javier Martinez Canillas1a93a6e2016-08-08 13:08:25 -04006405#if IS_ENABLED(CONFIG_IPV6)
Paul Mooreeffad8d2008-01-29 08:49:27 -05006406 {
6407 .hook = selinux_ipv6_postroute,
Alban Crequy2597a832012-05-14 03:56:39 +00006408 .pf = NFPROTO_IPV6,
Paul Mooreeffad8d2008-01-29 08:49:27 -05006409 .hooknum = NF_INET_POST_ROUTING,
6410 .priority = NF_IP6_PRI_SELINUX_LAST,
6411 },
6412 {
6413 .hook = selinux_ipv6_forward,
Alban Crequy2597a832012-05-14 03:56:39 +00006414 .pf = NFPROTO_IPV6,
Paul Mooreeffad8d2008-01-29 08:49:27 -05006415 .hooknum = NF_INET_FORWARD,
6416 .priority = NF_IP6_PRI_SELINUX_FIRST,
Jiri Pirko25db6be2014-09-03 17:42:13 +02006417 },
Huw Davies2917f572016-06-27 15:06:15 -04006418 {
6419 .hook = selinux_ipv6_output,
6420 .pf = NFPROTO_IPV6,
6421 .hooknum = NF_INET_LOCAL_OUT,
6422 .priority = NF_IP6_PRI_SELINUX_FIRST,
6423 },
Linus Torvalds1da177e2005-04-16 15:20:36 -07006424#endif /* IPV6 */
Jiri Pirko25db6be2014-09-03 17:42:13 +02006425};
Linus Torvalds1da177e2005-04-16 15:20:36 -07006426
6427static int __init selinux_nf_ip_init(void)
6428{
Jiri Pirko25db6be2014-09-03 17:42:13 +02006429 int err;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006430
6431 if (!selinux_enabled)
Jiri Pirko25db6be2014-09-03 17:42:13 +02006432 return 0;
Eric Parisfadcdb42007-02-22 18:11:31 -05006433
6434 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
6435
Jiri Pirko25db6be2014-09-03 17:42:13 +02006436 err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
Alexey Dobriyan6c5a9d22008-07-26 17:48:15 -07006437 if (err)
Jiri Pirko25db6be2014-09-03 17:42:13 +02006438 panic("SELinux: nf_register_hooks: error %d\n", err);
Linus Torvalds1da177e2005-04-16 15:20:36 -07006439
Jiri Pirko25db6be2014-09-03 17:42:13 +02006440 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006441}
6442
6443__initcall(selinux_nf_ip_init);
6444
6445#ifdef CONFIG_SECURITY_SELINUX_DISABLE
6446static void selinux_nf_ip_exit(void)
6447{
Eric Parisfadcdb42007-02-22 18:11:31 -05006448 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
Linus Torvalds1da177e2005-04-16 15:20:36 -07006449
Jiri Pirko25db6be2014-09-03 17:42:13 +02006450 nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
Linus Torvalds1da177e2005-04-16 15:20:36 -07006451}
6452#endif
6453
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08006454#else /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07006455
6456#ifdef CONFIG_SECURITY_SELINUX_DISABLE
6457#define selinux_nf_ip_exit()
6458#endif
6459
Stephen Smalleyc2b507f2006-02-04 23:27:50 -08006460#endif /* CONFIG_NETFILTER */
Linus Torvalds1da177e2005-04-16 15:20:36 -07006461
6462#ifdef CONFIG_SECURITY_SELINUX_DISABLE
Eric Paris828dfe12008-04-17 13:17:49 -04006463static int selinux_disabled;
6464
Linus Torvalds1da177e2005-04-16 15:20:36 -07006465int selinux_disable(void)
6466{
Linus Torvalds1da177e2005-04-16 15:20:36 -07006467 if (ss_initialized) {
6468 /* Not permitted after initial policy load. */
6469 return -EINVAL;
6470 }
6471
6472 if (selinux_disabled) {
6473 /* Only do this once. */
6474 return -EINVAL;
6475 }
6476
6477 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
6478
6479 selinux_disabled = 1;
Stephen Smalley30d55282006-05-03 10:52:36 -04006480 selinux_enabled = 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -07006481
Casey Schauflerb1d9e6b2015-05-02 15:11:42 -07006482 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
Linus Torvalds1da177e2005-04-16 15:20:36 -07006483
Eric Parisaf8ff042009-09-20 21:23:01 -04006484 /* Try to destroy the avc node cache */
6485 avc_disable();
6486
Linus Torvalds1da177e2005-04-16 15:20:36 -07006487 /* Unregister netfilter hooks. */
6488 selinux_nf_ip_exit();
6489
6490 /* Unregister selinuxfs. */
6491 exit_sel_fs();
6492
6493 return 0;
6494}
6495#endif