2 * NSA Security-Enhanced Linux (SELinux) security module
4 * This file contains the SELinux hook function implementations.
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul@paul-moore.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
26 #include <linux/init.h>
28 #include <linux/kernel.h>
29 #include <linux/tracehook.h>
30 #include <linux/errno.h>
31 #include <linux/ext2_fs.h>
32 #include <linux/sched.h>
33 #include <linux/security.h>
34 #include <linux/xattr.h>
35 #include <linux/capability.h>
36 #include <linux/unistd.h>
38 #include <linux/mman.h>
39 #include <linux/slab.h>
40 #include <linux/pagemap.h>
41 #include <linux/proc_fs.h>
42 #include <linux/swap.h>
43 #include <linux/spinlock.h>
44 #include <linux/syscalls.h>
45 #include <linux/dcache.h>
46 #include <linux/file.h>
47 #include <linux/fdtable.h>
48 #include <linux/namei.h>
49 #include <linux/mount.h>
50 #include <linux/netfilter_ipv4.h>
51 #include <linux/netfilter_ipv6.h>
52 #include <linux/tty.h>
54 #include <net/ip.h> /* for local_port_range[] */
55 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
56 #include <net/net_namespace.h>
57 #include <net/netlabel.h>
58 #include <linux/uaccess.h>
59 #include <asm/ioctls.h>
60 #include <linux/atomic.h>
61 #include <linux/bitops.h>
62 #include <linux/interrupt.h>
63 #include <linux/netdevice.h> /* for network interface checks */
64 #include <linux/netlink.h>
65 #include <linux/tcp.h>
66 #include <linux/udp.h>
67 #include <linux/dccp.h>
68 #include <linux/quota.h>
69 #include <linux/un.h> /* for Unix socket types */
70 #include <net/af_unix.h> /* for Unix socket types */
71 #include <linux/parser.h>
72 #include <linux/nfs_mount.h>
74 #include <linux/hugetlb.h>
75 #include <linux/personality.h>
76 #include <linux/audit.h>
77 #include <linux/string.h>
78 #include <linux/selinux.h>
79 #include <linux/mutex.h>
80 #include <linux/posix-timers.h>
81 #include <linux/syslog.h>
82 #include <linux/user_namespace.h>
93 #define NUM_SEL_MNT_OPTS 5
95 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
96 extern struct security_operations *security_ops;
98 /* SECMARK reference count */
99 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
101 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
102 int selinux_enforcing;
104 static int __init enforcing_setup(char *str)
106 unsigned long enforcing;
107 if (!strict_strtoul(str, 0, &enforcing))
108 selinux_enforcing = enforcing ? 1 : 0;
111 __setup("enforcing=", enforcing_setup);
114 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
115 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
117 static int __init selinux_enabled_setup(char *str)
119 unsigned long enabled;
120 if (!strict_strtoul(str, 0, &enabled))
121 selinux_enabled = enabled ? 1 : 0;
124 __setup("selinux=", selinux_enabled_setup);
126 int selinux_enabled = 1;
129 static struct kmem_cache *sel_inode_cache;
132 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
135 * This function checks the SECMARK reference counter to see if any SECMARK
136 * targets are currently configured, if the reference counter is greater than
137 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
138 * enabled, false (0) if SECMARK is disabled.
141 static int selinux_secmark_enabled(void)
143 return (atomic_read(&selinux_secmark_refcount) > 0);
147 * initialise the security for the init task
149 static void cred_init_security(void)
151 struct cred *cred = (struct cred *) current->real_cred;
152 struct task_security_struct *tsec;
154 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
156 panic("SELinux: Failed to initialize initial task.\n");
158 tsec->osid = tsec->sid = SECINITSID_KERNEL;
159 cred->security = tsec;
163 * get the security ID of a set of credentials
165 static inline u32 cred_sid(const struct cred *cred)
167 const struct task_security_struct *tsec;
169 tsec = cred->security;
174 * get the objective security ID of a task
176 static inline u32 task_sid(const struct task_struct *task)
181 sid = cred_sid(__task_cred(task));
187 * get the subjective security ID of the current task
189 static inline u32 current_sid(void)
191 const struct task_security_struct *tsec = current_security();
196 /* Allocate and free functions for each kind of security blob. */
198 static int inode_alloc_security(struct inode *inode)
200 struct inode_security_struct *isec;
201 u32 sid = current_sid();
203 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
207 mutex_init(&isec->lock);
208 INIT_LIST_HEAD(&isec->list);
210 isec->sid = SECINITSID_UNLABELED;
211 isec->sclass = SECCLASS_FILE;
212 isec->task_sid = sid;
213 inode->i_security = isec;
218 static void inode_free_security(struct inode *inode)
220 struct inode_security_struct *isec = inode->i_security;
221 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
223 spin_lock(&sbsec->isec_lock);
224 if (!list_empty(&isec->list))
225 list_del_init(&isec->list);
226 spin_unlock(&sbsec->isec_lock);
228 inode->i_security = NULL;
229 kmem_cache_free(sel_inode_cache, isec);
232 static int file_alloc_security(struct file *file)
234 struct file_security_struct *fsec;
235 u32 sid = current_sid();
237 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
242 fsec->fown_sid = sid;
243 file->f_security = fsec;
248 static void file_free_security(struct file *file)
250 struct file_security_struct *fsec = file->f_security;
251 file->f_security = NULL;
255 static int superblock_alloc_security(struct super_block *sb)
257 struct superblock_security_struct *sbsec;
259 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
263 mutex_init(&sbsec->lock);
264 INIT_LIST_HEAD(&sbsec->isec_head);
265 spin_lock_init(&sbsec->isec_lock);
267 sbsec->sid = SECINITSID_UNLABELED;
268 sbsec->def_sid = SECINITSID_FILE;
269 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
270 sb->s_security = sbsec;
275 static void superblock_free_security(struct super_block *sb)
277 struct superblock_security_struct *sbsec = sb->s_security;
278 sb->s_security = NULL;
282 /* The security server must be initialized before
283 any labeling or access decisions can be provided. */
284 extern int ss_initialized;
286 /* The file system's label must be initialized prior to use. */
288 static const char *labeling_behaviors[6] = {
290 "uses transition SIDs",
292 "uses genfs_contexts",
293 "not configured for labeling",
294 "uses mountpoint labeling",
297 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
299 static inline int inode_doinit(struct inode *inode)
301 return inode_doinit_with_dentry(inode, NULL);
310 Opt_labelsupport = 5,
313 static const match_table_t tokens = {
314 {Opt_context, CONTEXT_STR "%s"},
315 {Opt_fscontext, FSCONTEXT_STR "%s"},
316 {Opt_defcontext, DEFCONTEXT_STR "%s"},
317 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
318 {Opt_labelsupport, LABELSUPP_STR},
322 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
324 static int may_context_mount_sb_relabel(u32 sid,
325 struct superblock_security_struct *sbsec,
326 const struct cred *cred)
328 const struct task_security_struct *tsec = cred->security;
331 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
332 FILESYSTEM__RELABELFROM, NULL);
336 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
337 FILESYSTEM__RELABELTO, NULL);
341 static int may_context_mount_inode_relabel(u32 sid,
342 struct superblock_security_struct *sbsec,
343 const struct cred *cred)
345 const struct task_security_struct *tsec = cred->security;
347 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
348 FILESYSTEM__RELABELFROM, NULL);
352 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
353 FILESYSTEM__ASSOCIATE, NULL);
357 static int sb_finish_set_opts(struct super_block *sb)
359 struct superblock_security_struct *sbsec = sb->s_security;
360 struct dentry *root = sb->s_root;
361 struct inode *root_inode = root->d_inode;
364 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
365 /* Make sure that the xattr handler exists and that no
366 error other than -ENODATA is returned by getxattr on
367 the root directory. -ENODATA is ok, as this may be
368 the first boot of the SELinux kernel before we have
369 assigned xattr values to the filesystem. */
370 if (!root_inode->i_op->getxattr) {
371 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
372 "xattr support\n", sb->s_id, sb->s_type->name);
376 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
377 if (rc < 0 && rc != -ENODATA) {
378 if (rc == -EOPNOTSUPP)
379 printk(KERN_WARNING "SELinux: (dev %s, type "
380 "%s) has no security xattr handler\n",
381 sb->s_id, sb->s_type->name);
383 printk(KERN_WARNING "SELinux: (dev %s, type "
384 "%s) getxattr errno %d\n", sb->s_id,
385 sb->s_type->name, -rc);
390 sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
392 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
393 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
394 sb->s_id, sb->s_type->name);
396 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
397 sb->s_id, sb->s_type->name,
398 labeling_behaviors[sbsec->behavior-1]);
400 if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
401 sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
402 sbsec->behavior == SECURITY_FS_USE_NONE ||
403 sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
404 sbsec->flags &= ~SE_SBLABELSUPP;
406 /* Special handling for sysfs. Is genfs but also has setxattr handler*/
407 if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
408 sbsec->flags |= SE_SBLABELSUPP;
410 /* Initialize the root inode. */
411 rc = inode_doinit_with_dentry(root_inode, root);
413 /* Initialize any other inodes associated with the superblock, e.g.
414 inodes created prior to initial policy load or inodes created
415 during get_sb by a pseudo filesystem that directly
417 spin_lock(&sbsec->isec_lock);
419 if (!list_empty(&sbsec->isec_head)) {
420 struct inode_security_struct *isec =
421 list_entry(sbsec->isec_head.next,
422 struct inode_security_struct, list);
423 struct inode *inode = isec->inode;
424 spin_unlock(&sbsec->isec_lock);
425 inode = igrab(inode);
427 if (!IS_PRIVATE(inode))
431 spin_lock(&sbsec->isec_lock);
432 list_del_init(&isec->list);
435 spin_unlock(&sbsec->isec_lock);
441 * This function should allow an FS to ask what it's mount security
442 * options were so it can use those later for submounts, displaying
443 * mount options, or whatever.
445 static int selinux_get_mnt_opts(const struct super_block *sb,
446 struct security_mnt_opts *opts)
449 struct superblock_security_struct *sbsec = sb->s_security;
450 char *context = NULL;
454 security_init_mnt_opts(opts);
456 if (!(sbsec->flags & SE_SBINITIALIZED))
462 tmp = sbsec->flags & SE_MNTMASK;
463 /* count the number of mount options for this sb */
464 for (i = 0; i < 8; i++) {
466 opts->num_mnt_opts++;
469 /* Check if the Label support flag is set */
470 if (sbsec->flags & SE_SBLABELSUPP)
471 opts->num_mnt_opts++;
473 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
474 if (!opts->mnt_opts) {
479 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
480 if (!opts->mnt_opts_flags) {
486 if (sbsec->flags & FSCONTEXT_MNT) {
487 rc = security_sid_to_context(sbsec->sid, &context, &len);
490 opts->mnt_opts[i] = context;
491 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
493 if (sbsec->flags & CONTEXT_MNT) {
494 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
497 opts->mnt_opts[i] = context;
498 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
500 if (sbsec->flags & DEFCONTEXT_MNT) {
501 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
504 opts->mnt_opts[i] = context;
505 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
507 if (sbsec->flags & ROOTCONTEXT_MNT) {
508 struct inode *root = sbsec->sb->s_root->d_inode;
509 struct inode_security_struct *isec = root->i_security;
511 rc = security_sid_to_context(isec->sid, &context, &len);
514 opts->mnt_opts[i] = context;
515 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
517 if (sbsec->flags & SE_SBLABELSUPP) {
518 opts->mnt_opts[i] = NULL;
519 opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
522 BUG_ON(i != opts->num_mnt_opts);
527 security_free_mnt_opts(opts);
531 static int bad_option(struct superblock_security_struct *sbsec, char flag,
532 u32 old_sid, u32 new_sid)
534 char mnt_flags = sbsec->flags & SE_MNTMASK;
536 /* check if the old mount command had the same options */
537 if (sbsec->flags & SE_SBINITIALIZED)
538 if (!(sbsec->flags & flag) ||
539 (old_sid != new_sid))
542 /* check if we were passed the same options twice,
543 * aka someone passed context=a,context=b
545 if (!(sbsec->flags & SE_SBINITIALIZED))
546 if (mnt_flags & flag)
552 * Allow filesystems with binary mount data to explicitly set mount point
553 * labeling information.
555 static int selinux_set_mnt_opts(struct super_block *sb,
556 struct security_mnt_opts *opts)
558 const struct cred *cred = current_cred();
560 struct superblock_security_struct *sbsec = sb->s_security;
561 const char *name = sb->s_type->name;
562 struct inode *inode = sbsec->sb->s_root->d_inode;
563 struct inode_security_struct *root_isec = inode->i_security;
564 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
565 u32 defcontext_sid = 0;
566 char **mount_options = opts->mnt_opts;
567 int *flags = opts->mnt_opts_flags;
568 int num_opts = opts->num_mnt_opts;
570 mutex_lock(&sbsec->lock);
572 if (!ss_initialized) {
574 /* Defer initialization until selinux_complete_init,
575 after the initial policy is loaded and the security
576 server is ready to handle calls. */
580 printk(KERN_WARNING "SELinux: Unable to set superblock options "
581 "before the security server is initialized\n");
586 * Binary mount data FS will come through this function twice. Once
587 * from an explicit call and once from the generic calls from the vfs.
588 * Since the generic VFS calls will not contain any security mount data
589 * we need to skip the double mount verification.
591 * This does open a hole in which we will not notice if the first
592 * mount using this sb set explict options and a second mount using
593 * this sb does not set any security options. (The first options
594 * will be used for both mounts)
596 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
601 * parse the mount options, check if they are valid sids.
602 * also check if someone is trying to mount the same sb more
603 * than once with different security options.
605 for (i = 0; i < num_opts; i++) {
608 if (flags[i] == SE_SBLABELSUPP)
610 rc = security_context_to_sid(mount_options[i],
611 strlen(mount_options[i]), &sid);
613 printk(KERN_WARNING "SELinux: security_context_to_sid"
614 "(%s) failed for (dev %s, type %s) errno=%d\n",
615 mount_options[i], sb->s_id, name, rc);
622 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
624 goto out_double_mount;
626 sbsec->flags |= FSCONTEXT_MNT;
631 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
633 goto out_double_mount;
635 sbsec->flags |= CONTEXT_MNT;
637 case ROOTCONTEXT_MNT:
638 rootcontext_sid = sid;
640 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
642 goto out_double_mount;
644 sbsec->flags |= ROOTCONTEXT_MNT;
648 defcontext_sid = sid;
650 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
652 goto out_double_mount;
654 sbsec->flags |= DEFCONTEXT_MNT;
663 if (sbsec->flags & SE_SBINITIALIZED) {
664 /* previously mounted with options, but not on this attempt? */
665 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
666 goto out_double_mount;
671 if (strcmp(sb->s_type->name, "proc") == 0)
672 sbsec->flags |= SE_SBPROC;
674 /* Determine the labeling behavior to use for this filesystem type. */
675 rc = security_fs_use((sbsec->flags & SE_SBPROC) ? "proc" : sb->s_type->name, &sbsec->behavior, &sbsec->sid);
677 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
678 __func__, sb->s_type->name, rc);
682 /* sets the context of the superblock for the fs being mounted. */
684 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
688 sbsec->sid = fscontext_sid;
692 * Switch to using mount point labeling behavior.
693 * sets the label used on all file below the mountpoint, and will set
694 * the superblock context if not already set.
697 if (!fscontext_sid) {
698 rc = may_context_mount_sb_relabel(context_sid, sbsec,
702 sbsec->sid = context_sid;
704 rc = may_context_mount_inode_relabel(context_sid, sbsec,
709 if (!rootcontext_sid)
710 rootcontext_sid = context_sid;
712 sbsec->mntpoint_sid = context_sid;
713 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
716 if (rootcontext_sid) {
717 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
722 root_isec->sid = rootcontext_sid;
723 root_isec->initialized = 1;
726 if (defcontext_sid) {
727 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
729 printk(KERN_WARNING "SELinux: defcontext option is "
730 "invalid for this filesystem type\n");
734 if (defcontext_sid != sbsec->def_sid) {
735 rc = may_context_mount_inode_relabel(defcontext_sid,
741 sbsec->def_sid = defcontext_sid;
744 rc = sb_finish_set_opts(sb);
746 mutex_unlock(&sbsec->lock);
750 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
751 "security settings for (dev %s, type %s)\n", sb->s_id, name);
755 static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
756 struct super_block *newsb)
758 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
759 struct superblock_security_struct *newsbsec = newsb->s_security;
761 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
762 int set_context = (oldsbsec->flags & CONTEXT_MNT);
763 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
766 * if the parent was able to be mounted it clearly had no special lsm
767 * mount options. thus we can safely deal with this superblock later
772 /* how can we clone if the old one wasn't set up?? */
773 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
775 /* if fs is reusing a sb, just let its options stand... */
776 if (newsbsec->flags & SE_SBINITIALIZED)
779 mutex_lock(&newsbsec->lock);
781 newsbsec->flags = oldsbsec->flags;
783 newsbsec->sid = oldsbsec->sid;
784 newsbsec->def_sid = oldsbsec->def_sid;
785 newsbsec->behavior = oldsbsec->behavior;
788 u32 sid = oldsbsec->mntpoint_sid;
792 if (!set_rootcontext) {
793 struct inode *newinode = newsb->s_root->d_inode;
794 struct inode_security_struct *newisec = newinode->i_security;
797 newsbsec->mntpoint_sid = sid;
799 if (set_rootcontext) {
800 const struct inode *oldinode = oldsb->s_root->d_inode;
801 const struct inode_security_struct *oldisec = oldinode->i_security;
802 struct inode *newinode = newsb->s_root->d_inode;
803 struct inode_security_struct *newisec = newinode->i_security;
805 newisec->sid = oldisec->sid;
808 sb_finish_set_opts(newsb);
809 mutex_unlock(&newsbsec->lock);
812 static int selinux_parse_opts_str(char *options,
813 struct security_mnt_opts *opts)
816 char *context = NULL, *defcontext = NULL;
817 char *fscontext = NULL, *rootcontext = NULL;
818 int rc, num_mnt_opts = 0;
820 opts->num_mnt_opts = 0;
822 /* Standard string-based options. */
823 while ((p = strsep(&options, "|")) != NULL) {
825 substring_t args[MAX_OPT_ARGS];
830 token = match_token(p, tokens, args);
834 if (context || defcontext) {
836 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
839 context = match_strdup(&args[0]);
849 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
852 fscontext = match_strdup(&args[0]);
859 case Opt_rootcontext:
862 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
865 rootcontext = match_strdup(&args[0]);
873 if (context || defcontext) {
875 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
878 defcontext = match_strdup(&args[0]);
884 case Opt_labelsupport:
888 printk(KERN_WARNING "SELinux: unknown mount option\n");
895 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
899 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
900 if (!opts->mnt_opts_flags) {
901 kfree(opts->mnt_opts);
906 opts->mnt_opts[num_mnt_opts] = fscontext;
907 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
910 opts->mnt_opts[num_mnt_opts] = context;
911 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
914 opts->mnt_opts[num_mnt_opts] = rootcontext;
915 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
918 opts->mnt_opts[num_mnt_opts] = defcontext;
919 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
922 opts->num_mnt_opts = num_mnt_opts;
933 * string mount options parsing and call set the sbsec
935 static int superblock_doinit(struct super_block *sb, void *data)
938 char *options = data;
939 struct security_mnt_opts opts;
941 security_init_mnt_opts(&opts);
946 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
948 rc = selinux_parse_opts_str(options, &opts);
953 rc = selinux_set_mnt_opts(sb, &opts);
956 security_free_mnt_opts(&opts);
960 static void selinux_write_opts(struct seq_file *m,
961 struct security_mnt_opts *opts)
966 for (i = 0; i < opts->num_mnt_opts; i++) {
969 if (opts->mnt_opts[i])
970 has_comma = strchr(opts->mnt_opts[i], ',');
974 switch (opts->mnt_opts_flags[i]) {
976 prefix = CONTEXT_STR;
979 prefix = FSCONTEXT_STR;
981 case ROOTCONTEXT_MNT:
982 prefix = ROOTCONTEXT_STR;
985 prefix = DEFCONTEXT_STR;
989 seq_puts(m, LABELSUPP_STR);
995 /* we need a comma before each option */
1000 seq_puts(m, opts->mnt_opts[i]);
1006 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1008 struct security_mnt_opts opts;
1011 rc = selinux_get_mnt_opts(sb, &opts);
1013 /* before policy load we may get EINVAL, don't show anything */
1019 selinux_write_opts(m, &opts);
1021 security_free_mnt_opts(&opts);
1026 static inline u16 inode_mode_to_security_class(umode_t mode)
1028 switch (mode & S_IFMT) {
1030 return SECCLASS_SOCK_FILE;
1032 return SECCLASS_LNK_FILE;
1034 return SECCLASS_FILE;
1036 return SECCLASS_BLK_FILE;
1038 return SECCLASS_DIR;
1040 return SECCLASS_CHR_FILE;
1042 return SECCLASS_FIFO_FILE;
1046 return SECCLASS_FILE;
1049 static inline int default_protocol_stream(int protocol)
1051 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1054 static inline int default_protocol_dgram(int protocol)
1056 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1059 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1065 case SOCK_SEQPACKET:
1066 return SECCLASS_UNIX_STREAM_SOCKET;
1068 return SECCLASS_UNIX_DGRAM_SOCKET;
1075 if (default_protocol_stream(protocol))
1076 return SECCLASS_TCP_SOCKET;
1078 return SECCLASS_RAWIP_SOCKET;
1080 if (default_protocol_dgram(protocol))
1081 return SECCLASS_UDP_SOCKET;
1083 return SECCLASS_RAWIP_SOCKET;
1085 return SECCLASS_DCCP_SOCKET;
1087 return SECCLASS_RAWIP_SOCKET;
1093 return SECCLASS_NETLINK_ROUTE_SOCKET;
1094 case NETLINK_FIREWALL:
1095 return SECCLASS_NETLINK_FIREWALL_SOCKET;
1096 case NETLINK_INET_DIAG:
1097 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1099 return SECCLASS_NETLINK_NFLOG_SOCKET;
1101 return SECCLASS_NETLINK_XFRM_SOCKET;
1102 case NETLINK_SELINUX:
1103 return SECCLASS_NETLINK_SELINUX_SOCKET;
1105 return SECCLASS_NETLINK_AUDIT_SOCKET;
1106 case NETLINK_IP6_FW:
1107 return SECCLASS_NETLINK_IP6FW_SOCKET;
1108 case NETLINK_DNRTMSG:
1109 return SECCLASS_NETLINK_DNRT_SOCKET;
1110 case NETLINK_KOBJECT_UEVENT:
1111 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1113 return SECCLASS_NETLINK_SOCKET;
1116 return SECCLASS_PACKET_SOCKET;
1118 return SECCLASS_KEY_SOCKET;
1120 return SECCLASS_APPLETALK_SOCKET;
1123 return SECCLASS_SOCKET;
1126 #ifdef CONFIG_PROC_FS
1127 static int selinux_proc_get_sid(struct dentry *dentry,
1132 char *buffer, *path;
1134 buffer = (char *)__get_free_page(GFP_KERNEL);
1138 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1142 /* each process gets a /proc/PID/ entry. Strip off the
1143 * PID part to get a valid selinux labeling.
1144 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1145 while (path[1] >= '0' && path[1] <= '9') {
1149 rc = security_genfs_sid("proc", path, tclass, sid);
1151 free_page((unsigned long)buffer);
1155 static int selinux_proc_get_sid(struct dentry *dentry,
1163 /* The inode's security attributes must be initialized before first use. */
1164 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1166 struct superblock_security_struct *sbsec = NULL;
1167 struct inode_security_struct *isec = inode->i_security;
1169 struct dentry *dentry;
1170 #define INITCONTEXTLEN 255
1171 char *context = NULL;
1175 if (isec->initialized)
1178 mutex_lock(&isec->lock);
1179 if (isec->initialized)
1182 sbsec = inode->i_sb->s_security;
1183 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1184 /* Defer initialization until selinux_complete_init,
1185 after the initial policy is loaded and the security
1186 server is ready to handle calls. */
1187 spin_lock(&sbsec->isec_lock);
1188 if (list_empty(&isec->list))
1189 list_add(&isec->list, &sbsec->isec_head);
1190 spin_unlock(&sbsec->isec_lock);
1194 switch (sbsec->behavior) {
1195 case SECURITY_FS_USE_XATTR:
1196 if (!inode->i_op->getxattr) {
1197 isec->sid = sbsec->def_sid;
1201 /* Need a dentry, since the xattr API requires one.
1202 Life would be simpler if we could just pass the inode. */
1204 /* Called from d_instantiate or d_splice_alias. */
1205 dentry = dget(opt_dentry);
1207 /* Called from selinux_complete_init, try to find a dentry. */
1208 dentry = d_find_alias(inode);
1212 * this is can be hit on boot when a file is accessed
1213 * before the policy is loaded. When we load policy we
1214 * may find inodes that have no dentry on the
1215 * sbsec->isec_head list. No reason to complain as these
1216 * will get fixed up the next time we go through
1217 * inode_doinit with a dentry, before these inodes could
1218 * be used again by userspace.
1223 len = INITCONTEXTLEN;
1224 context = kmalloc(len+1, GFP_NOFS);
1230 context[len] = '\0';
1231 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1233 if (rc == -ERANGE) {
1236 /* Need a larger buffer. Query for the right size. */
1237 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1244 context = kmalloc(len+1, GFP_NOFS);
1250 context[len] = '\0';
1251 rc = inode->i_op->getxattr(dentry,
1257 if (rc != -ENODATA) {
1258 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1259 "%d for dev=%s ino=%ld\n", __func__,
1260 -rc, inode->i_sb->s_id, inode->i_ino);
1264 /* Map ENODATA to the default file SID */
1265 sid = sbsec->def_sid;
1268 rc = security_context_to_sid_default(context, rc, &sid,
1272 char *dev = inode->i_sb->s_id;
1273 unsigned long ino = inode->i_ino;
1275 if (rc == -EINVAL) {
1276 if (printk_ratelimit())
1277 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1278 "context=%s. This indicates you may need to relabel the inode or the "
1279 "filesystem in question.\n", ino, dev, context);
1281 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1282 "returned %d for dev=%s ino=%ld\n",
1283 __func__, context, -rc, dev, ino);
1286 /* Leave with the unlabeled SID */
1294 case SECURITY_FS_USE_TASK:
1295 isec->sid = isec->task_sid;
1297 case SECURITY_FS_USE_TRANS:
1298 /* Default to the fs SID. */
1299 isec->sid = sbsec->sid;
1301 /* Try to obtain a transition SID. */
1302 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1303 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1304 isec->sclass, NULL, &sid);
1309 case SECURITY_FS_USE_MNTPOINT:
1310 isec->sid = sbsec->mntpoint_sid;
1313 /* Default to the fs superblock SID. */
1314 isec->sid = sbsec->sid;
1316 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1318 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1319 rc = selinux_proc_get_sid(opt_dentry,
1330 isec->initialized = 1;
1333 mutex_unlock(&isec->lock);
1335 if (isec->sclass == SECCLASS_FILE)
1336 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1340 /* Convert a Linux signal to an access vector. */
1341 static inline u32 signal_to_av(int sig)
1347 /* Commonly granted from child to parent. */
1348 perm = PROCESS__SIGCHLD;
1351 /* Cannot be caught or ignored */
1352 perm = PROCESS__SIGKILL;
1355 /* Cannot be caught or ignored */
1356 perm = PROCESS__SIGSTOP;
1359 /* All other signals. */
1360 perm = PROCESS__SIGNAL;
1368 * Check permission between a pair of credentials
1369 * fork check, ptrace check, etc.
1371 static int cred_has_perm(const struct cred *actor,
1372 const struct cred *target,
1375 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1377 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1381 * Check permission between a pair of tasks, e.g. signal checks,
1382 * fork check, ptrace check, etc.
1383 * tsk1 is the actor and tsk2 is the target
1384 * - this uses the default subjective creds of tsk1
1386 static int task_has_perm(const struct task_struct *tsk1,
1387 const struct task_struct *tsk2,
1390 const struct task_security_struct *__tsec1, *__tsec2;
1394 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1395 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1397 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1401 * Check permission between current and another task, e.g. signal checks,
1402 * fork check, ptrace check, etc.
1403 * current is the actor and tsk2 is the target
1404 * - this uses current's subjective creds
1406 static int current_has_perm(const struct task_struct *tsk,
1411 sid = current_sid();
1412 tsid = task_sid(tsk);
1413 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1416 #if CAP_LAST_CAP > 63
1417 #error Fix SELinux to handle capabilities > 63.
1420 /* Check whether a task is allowed to use a capability. */
1421 static int task_has_capability(struct task_struct *tsk,
1422 const struct cred *cred,
1425 struct common_audit_data ad;
1426 struct av_decision avd;
1428 u32 sid = cred_sid(cred);
1429 u32 av = CAP_TO_MASK(cap);
1432 COMMON_AUDIT_DATA_INIT(&ad, CAP);
1436 switch (CAP_TO_INDEX(cap)) {
1438 sclass = SECCLASS_CAPABILITY;
1441 sclass = SECCLASS_CAPABILITY2;
1445 "SELinux: out of range capability %d\n", cap);
1450 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1451 if (audit == SECURITY_CAP_AUDIT) {
1452 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1459 /* Check whether a task is allowed to use a system operation. */
1460 static int task_has_system(struct task_struct *tsk,
1463 u32 sid = task_sid(tsk);
1465 return avc_has_perm(sid, SECINITSID_KERNEL,
1466 SECCLASS_SYSTEM, perms, NULL);
1469 /* Check whether a task has a particular permission to an inode.
1470 The 'adp' parameter is optional and allows other audit
1471 data to be passed (e.g. the dentry). */
1472 static int inode_has_perm(const struct cred *cred,
1473 struct inode *inode,
1475 struct common_audit_data *adp,
1478 struct inode_security_struct *isec;
1481 validate_creds(cred);
1483 if (unlikely(IS_PRIVATE(inode)))
1486 sid = cred_sid(cred);
1487 isec = inode->i_security;
1489 return avc_has_perm_flags(sid, isec->sid, isec->sclass, perms, adp, flags);
1492 static int inode_has_perm_noadp(const struct cred *cred,
1493 struct inode *inode,
1497 struct common_audit_data ad;
1499 COMMON_AUDIT_DATA_INIT(&ad, INODE);
1501 return inode_has_perm(cred, inode, perms, &ad, flags);
1504 /* Same as inode_has_perm, but pass explicit audit data containing
1505 the dentry to help the auditing code to more easily generate the
1506 pathname if needed. */
1507 static inline int dentry_has_perm(const struct cred *cred,
1508 struct dentry *dentry,
1511 struct inode *inode = dentry->d_inode;
1512 struct common_audit_data ad;
1514 COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
1515 ad.u.dentry = dentry;
1516 return inode_has_perm(cred, inode, av, &ad, 0);
1519 /* Same as inode_has_perm, but pass explicit audit data containing
1520 the path to help the auditing code to more easily generate the
1521 pathname if needed. */
1522 static inline int path_has_perm(const struct cred *cred,
1526 struct inode *inode = path->dentry->d_inode;
1527 struct common_audit_data ad;
1529 COMMON_AUDIT_DATA_INIT(&ad, PATH);
1531 return inode_has_perm(cred, inode, av, &ad, 0);
1534 /* Check whether a task can use an open file descriptor to
1535 access an inode in a given way. Check access to the
1536 descriptor itself, and then use dentry_has_perm to
1537 check a particular permission to the file.
1538 Access to the descriptor is implicitly granted if it
1539 has the same SID as the process. If av is zero, then
1540 access to the file is not checked, e.g. for cases
1541 where only the descriptor is affected like seek. */
1542 static int file_has_perm(const struct cred *cred,
1546 struct file_security_struct *fsec = file->f_security;
1547 struct inode *inode = file->f_path.dentry->d_inode;
1548 struct common_audit_data ad;
1549 u32 sid = cred_sid(cred);
1552 COMMON_AUDIT_DATA_INIT(&ad, PATH);
1553 ad.u.path = file->f_path;
1555 if (sid != fsec->sid) {
1556 rc = avc_has_perm(sid, fsec->sid,
1564 /* av is zero if only checking access to the descriptor. */
1567 rc = inode_has_perm(cred, inode, av, &ad, 0);
1573 /* Check whether a task can create a file. */
1574 static int may_create(struct inode *dir,
1575 struct dentry *dentry,
1578 const struct task_security_struct *tsec = current_security();
1579 struct inode_security_struct *dsec;
1580 struct superblock_security_struct *sbsec;
1582 struct common_audit_data ad;
1585 dsec = dir->i_security;
1586 sbsec = dir->i_sb->s_security;
1589 newsid = tsec->create_sid;
1591 COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
1592 ad.u.dentry = dentry;
1594 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1595 DIR__ADD_NAME | DIR__SEARCH,
1600 if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
1601 rc = security_transition_sid(sid, dsec->sid, tclass,
1602 &dentry->d_name, &newsid);
1607 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1611 return avc_has_perm(newsid, sbsec->sid,
1612 SECCLASS_FILESYSTEM,
1613 FILESYSTEM__ASSOCIATE, &ad);
1616 /* Check whether a task can create a key. */
1617 static int may_create_key(u32 ksid,
1618 struct task_struct *ctx)
1620 u32 sid = task_sid(ctx);
1622 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1626 #define MAY_UNLINK 1
1629 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1630 static int may_link(struct inode *dir,
1631 struct dentry *dentry,
1635 struct inode_security_struct *dsec, *isec;
1636 struct common_audit_data ad;
1637 u32 sid = current_sid();
1641 dsec = dir->i_security;
1642 isec = dentry->d_inode->i_security;
1644 COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
1645 ad.u.dentry = dentry;
1648 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1649 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1664 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1669 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1673 static inline int may_rename(struct inode *old_dir,
1674 struct dentry *old_dentry,
1675 struct inode *new_dir,
1676 struct dentry *new_dentry)
1678 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1679 struct common_audit_data ad;
1680 u32 sid = current_sid();
1682 int old_is_dir, new_is_dir;
1685 old_dsec = old_dir->i_security;
1686 old_isec = old_dentry->d_inode->i_security;
1687 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1688 new_dsec = new_dir->i_security;
1690 COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
1692 ad.u.dentry = old_dentry;
1693 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1694 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1697 rc = avc_has_perm(sid, old_isec->sid,
1698 old_isec->sclass, FILE__RENAME, &ad);
1701 if (old_is_dir && new_dir != old_dir) {
1702 rc = avc_has_perm(sid, old_isec->sid,
1703 old_isec->sclass, DIR__REPARENT, &ad);
1708 ad.u.dentry = new_dentry;
1709 av = DIR__ADD_NAME | DIR__SEARCH;
1710 if (new_dentry->d_inode)
1711 av |= DIR__REMOVE_NAME;
1712 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1715 if (new_dentry->d_inode) {
1716 new_isec = new_dentry->d_inode->i_security;
1717 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1718 rc = avc_has_perm(sid, new_isec->sid,
1720 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1728 /* Check whether a task can perform a filesystem operation. */
1729 static int superblock_has_perm(const struct cred *cred,
1730 struct super_block *sb,
1732 struct common_audit_data *ad)
1734 struct superblock_security_struct *sbsec;
1735 u32 sid = cred_sid(cred);
1737 sbsec = sb->s_security;
1738 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1741 /* Convert a Linux mode and permission mask to an access vector. */
1742 static inline u32 file_mask_to_av(int mode, int mask)
1746 if ((mode & S_IFMT) != S_IFDIR) {
1747 if (mask & MAY_EXEC)
1748 av |= FILE__EXECUTE;
1749 if (mask & MAY_READ)
1752 if (mask & MAY_APPEND)
1754 else if (mask & MAY_WRITE)
1758 if (mask & MAY_EXEC)
1760 if (mask & MAY_WRITE)
1762 if (mask & MAY_READ)
1769 /* Convert a Linux file to an access vector. */
1770 static inline u32 file_to_av(struct file *file)
1774 if (file->f_mode & FMODE_READ)
1776 if (file->f_mode & FMODE_WRITE) {
1777 if (file->f_flags & O_APPEND)
1784 * Special file opened with flags 3 for ioctl-only use.
1793 * Convert a file to an access vector and include the correct open
1796 static inline u32 open_file_to_av(struct file *file)
1798 u32 av = file_to_av(file);
1800 if (selinux_policycap_openperm)
1806 /* Hook functions begin here. */
1808 static int selinux_ptrace_access_check(struct task_struct *child,
1813 rc = cap_ptrace_access_check(child, mode);
1817 if (mode == PTRACE_MODE_READ) {
1818 u32 sid = current_sid();
1819 u32 csid = task_sid(child);
1820 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1823 return current_has_perm(child, PROCESS__PTRACE);
1826 static int selinux_ptrace_traceme(struct task_struct *parent)
1830 rc = cap_ptrace_traceme(parent);
1834 return task_has_perm(parent, current, PROCESS__PTRACE);
1837 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1838 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1842 error = current_has_perm(target, PROCESS__GETCAP);
1846 return cap_capget(target, effective, inheritable, permitted);
1849 static int selinux_capset(struct cred *new, const struct cred *old,
1850 const kernel_cap_t *effective,
1851 const kernel_cap_t *inheritable,
1852 const kernel_cap_t *permitted)
1856 error = cap_capset(new, old,
1857 effective, inheritable, permitted);
1861 return cred_has_perm(old, new, PROCESS__SETCAP);
1865 * (This comment used to live with the selinux_task_setuid hook,
1866 * which was removed).
1868 * Since setuid only affects the current process, and since the SELinux
1869 * controls are not based on the Linux identity attributes, SELinux does not
1870 * need to control this operation. However, SELinux does control the use of
1871 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1874 static int selinux_capable(struct task_struct *tsk, const struct cred *cred,
1875 struct user_namespace *ns, int cap, int audit)
1879 rc = cap_capable(tsk, cred, ns, cap, audit);
1883 return task_has_capability(tsk, cred, cap, audit);
1886 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1888 const struct cred *cred = current_cred();
1900 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
1905 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
1908 rc = 0; /* let the kernel handle invalid cmds */
1914 static int selinux_quota_on(struct dentry *dentry)
1916 const struct cred *cred = current_cred();
1918 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
1921 static int selinux_syslog(int type)
1926 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
1927 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
1928 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1930 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
1931 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
1932 /* Set level of messages printed to console */
1933 case SYSLOG_ACTION_CONSOLE_LEVEL:
1934 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1936 case SYSLOG_ACTION_CLOSE: /* Close log */
1937 case SYSLOG_ACTION_OPEN: /* Open log */
1938 case SYSLOG_ACTION_READ: /* Read from log */
1939 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
1940 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
1942 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1949 * Check that a process has enough memory to allocate a new virtual
1950 * mapping. 0 means there is enough memory for the allocation to
1951 * succeed and -ENOMEM implies there is not.
1953 * Do not audit the selinux permission check, as this is applied to all
1954 * processes that allocate mappings.
1956 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1958 int rc, cap_sys_admin = 0;
1960 rc = selinux_capable(current, current_cred(),
1961 &init_user_ns, CAP_SYS_ADMIN,
1962 SECURITY_CAP_NOAUDIT);
1966 return __vm_enough_memory(mm, pages, cap_sys_admin);
1969 /* binprm security operations */
1971 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
1973 const struct task_security_struct *old_tsec;
1974 struct task_security_struct *new_tsec;
1975 struct inode_security_struct *isec;
1976 struct common_audit_data ad;
1977 struct inode *inode = bprm->file->f_path.dentry->d_inode;
1980 rc = cap_bprm_set_creds(bprm);
1984 /* SELinux context only depends on initial program or script and not
1985 * the script interpreter */
1986 if (bprm->cred_prepared)
1989 old_tsec = current_security();
1990 new_tsec = bprm->cred->security;
1991 isec = inode->i_security;
1993 /* Default to the current task SID. */
1994 new_tsec->sid = old_tsec->sid;
1995 new_tsec->osid = old_tsec->sid;
1997 /* Reset fs, key, and sock SIDs on execve. */
1998 new_tsec->create_sid = 0;
1999 new_tsec->keycreate_sid = 0;
2000 new_tsec->sockcreate_sid = 0;
2002 if (old_tsec->exec_sid) {
2003 new_tsec->sid = old_tsec->exec_sid;
2004 /* Reset exec SID on execve. */
2005 new_tsec->exec_sid = 0;
2007 /* Check for a default transition on this program. */
2008 rc = security_transition_sid(old_tsec->sid, isec->sid,
2009 SECCLASS_PROCESS, NULL,
2015 COMMON_AUDIT_DATA_INIT(&ad, PATH);
2016 ad.u.path = bprm->file->f_path;
2018 if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
2019 new_tsec->sid = old_tsec->sid;
2021 if (new_tsec->sid == old_tsec->sid) {
2022 rc = avc_has_perm(old_tsec->sid, isec->sid,
2023 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2027 /* Check permissions for the transition. */
2028 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2029 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2033 rc = avc_has_perm(new_tsec->sid, isec->sid,
2034 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2038 /* Check for shared state */
2039 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2040 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2041 SECCLASS_PROCESS, PROCESS__SHARE,
2047 /* Make sure that anyone attempting to ptrace over a task that
2048 * changes its SID has the appropriate permit */
2050 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2051 struct task_struct *tracer;
2052 struct task_security_struct *sec;
2056 tracer = ptrace_parent(current);
2057 if (likely(tracer != NULL)) {
2058 sec = __task_cred(tracer)->security;
2064 rc = avc_has_perm(ptsid, new_tsec->sid,
2066 PROCESS__PTRACE, NULL);
2072 /* Clear any possibly unsafe personality bits on exec: */
2073 bprm->per_clear |= PER_CLEAR_ON_SETID;
2079 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2081 const struct task_security_struct *tsec = current_security();
2089 /* Enable secure mode for SIDs transitions unless
2090 the noatsecure permission is granted between
2091 the two SIDs, i.e. ahp returns 0. */
2092 atsecure = avc_has_perm(osid, sid,
2094 PROCESS__NOATSECURE, NULL);
2097 return (atsecure || cap_bprm_secureexec(bprm));
2100 /* Derived from fs/exec.c:flush_old_files. */
2101 static inline void flush_unauthorized_files(const struct cred *cred,
2102 struct files_struct *files)
2104 struct common_audit_data ad;
2105 struct file *file, *devnull = NULL;
2106 struct tty_struct *tty;
2107 struct fdtable *fdt;
2111 tty = get_current_tty();
2113 spin_lock(&tty_files_lock);
2114 if (!list_empty(&tty->tty_files)) {
2115 struct tty_file_private *file_priv;
2116 struct inode *inode;
2118 /* Revalidate access to controlling tty.
2119 Use inode_has_perm on the tty inode directly rather
2120 than using file_has_perm, as this particular open
2121 file may belong to another process and we are only
2122 interested in the inode-based check here. */
2123 file_priv = list_first_entry(&tty->tty_files,
2124 struct tty_file_private, list);
2125 file = file_priv->file;
2126 inode = file->f_path.dentry->d_inode;
2127 if (inode_has_perm_noadp(cred, inode,
2128 FILE__READ | FILE__WRITE, 0)) {
2132 spin_unlock(&tty_files_lock);
2135 /* Reset controlling tty. */
2139 /* Revalidate access to inherited open files. */
2141 COMMON_AUDIT_DATA_INIT(&ad, INODE);
2143 spin_lock(&files->file_lock);
2145 unsigned long set, i;
2150 fdt = files_fdtable(files);
2151 if (i >= fdt->max_fds)
2153 set = fdt->open_fds->fds_bits[j];
2156 spin_unlock(&files->file_lock);
2157 for ( ; set ; i++, set >>= 1) {
2162 if (file_has_perm(cred,
2164 file_to_av(file))) {
2166 fd = get_unused_fd();
2176 devnull = dentry_open(
2178 mntget(selinuxfs_mount),
2180 if (IS_ERR(devnull)) {
2187 fd_install(fd, devnull);
2192 spin_lock(&files->file_lock);
2195 spin_unlock(&files->file_lock);
2199 * Prepare a process for imminent new credential changes due to exec
2201 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2203 struct task_security_struct *new_tsec;
2204 struct rlimit *rlim, *initrlim;
2207 new_tsec = bprm->cred->security;
2208 if (new_tsec->sid == new_tsec->osid)
2211 /* Close files for which the new task SID is not authorized. */
2212 flush_unauthorized_files(bprm->cred, current->files);
2214 /* Always clear parent death signal on SID transitions. */
2215 current->pdeath_signal = 0;
2217 /* Check whether the new SID can inherit resource limits from the old
2218 * SID. If not, reset all soft limits to the lower of the current
2219 * task's hard limit and the init task's soft limit.
2221 * Note that the setting of hard limits (even to lower them) can be
2222 * controlled by the setrlimit check. The inclusion of the init task's
2223 * soft limit into the computation is to avoid resetting soft limits
2224 * higher than the default soft limit for cases where the default is
2225 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2227 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2228 PROCESS__RLIMITINH, NULL);
2230 /* protect against do_prlimit() */
2232 for (i = 0; i < RLIM_NLIMITS; i++) {
2233 rlim = current->signal->rlim + i;
2234 initrlim = init_task.signal->rlim + i;
2235 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2237 task_unlock(current);
2238 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2243 * Clean up the process immediately after the installation of new credentials
2246 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2248 const struct task_security_struct *tsec = current_security();
2249 struct itimerval itimer;
2259 /* Check whether the new SID can inherit signal state from the old SID.
2260 * If not, clear itimers to avoid subsequent signal generation and
2261 * flush and unblock signals.
2263 * This must occur _after_ the task SID has been updated so that any
2264 * kill done after the flush will be checked against the new SID.
2266 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2268 memset(&itimer, 0, sizeof itimer);
2269 for (i = 0; i < 3; i++)
2270 do_setitimer(i, &itimer, NULL);
2271 spin_lock_irq(¤t->sighand->siglock);
2272 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2273 __flush_signals(current);
2274 flush_signal_handlers(current, 1);
2275 sigemptyset(¤t->blocked);
2277 spin_unlock_irq(¤t->sighand->siglock);
2280 /* Wake up the parent if it is waiting so that it can recheck
2281 * wait permission to the new task SID. */
2282 read_lock(&tasklist_lock);
2283 __wake_up_parent(current, current->real_parent);
2284 read_unlock(&tasklist_lock);
2287 /* superblock security operations */
2289 static int selinux_sb_alloc_security(struct super_block *sb)
2291 return superblock_alloc_security(sb);
2294 static void selinux_sb_free_security(struct super_block *sb)
2296 superblock_free_security(sb);
2299 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2304 return !memcmp(prefix, option, plen);
2307 static inline int selinux_option(char *option, int len)
2309 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2310 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2311 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2312 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2313 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2316 static inline void take_option(char **to, char *from, int *first, int len)
2323 memcpy(*to, from, len);
2327 static inline void take_selinux_option(char **to, char *from, int *first,
2330 int current_size = 0;
2338 while (current_size < len) {
2348 static int selinux_sb_copy_data(char *orig, char *copy)
2350 int fnosec, fsec, rc = 0;
2351 char *in_save, *in_curr, *in_end;
2352 char *sec_curr, *nosec_save, *nosec;
2358 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2366 in_save = in_end = orig;
2370 open_quote = !open_quote;
2371 if ((*in_end == ',' && open_quote == 0) ||
2373 int len = in_end - in_curr;
2375 if (selinux_option(in_curr, len))
2376 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2378 take_option(&nosec, in_curr, &fnosec, len);
2380 in_curr = in_end + 1;
2382 } while (*in_end++);
2384 strcpy(in_save, nosec_save);
2385 free_page((unsigned long)nosec_save);
2390 static int selinux_sb_remount(struct super_block *sb, void *data)
2393 struct security_mnt_opts opts;
2394 char *secdata, **mount_options;
2395 struct superblock_security_struct *sbsec = sb->s_security;
2397 if (!(sbsec->flags & SE_SBINITIALIZED))
2403 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2406 security_init_mnt_opts(&opts);
2407 secdata = alloc_secdata();
2410 rc = selinux_sb_copy_data(data, secdata);
2412 goto out_free_secdata;
2414 rc = selinux_parse_opts_str(secdata, &opts);
2416 goto out_free_secdata;
2418 mount_options = opts.mnt_opts;
2419 flags = opts.mnt_opts_flags;
2421 for (i = 0; i < opts.num_mnt_opts; i++) {
2425 if (flags[i] == SE_SBLABELSUPP)
2427 len = strlen(mount_options[i]);
2428 rc = security_context_to_sid(mount_options[i], len, &sid);
2430 printk(KERN_WARNING "SELinux: security_context_to_sid"
2431 "(%s) failed for (dev %s, type %s) errno=%d\n",
2432 mount_options[i], sb->s_id, sb->s_type->name, rc);
2438 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2439 goto out_bad_option;
2442 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2443 goto out_bad_option;
2445 case ROOTCONTEXT_MNT: {
2446 struct inode_security_struct *root_isec;
2447 root_isec = sb->s_root->d_inode->i_security;
2449 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2450 goto out_bad_option;
2453 case DEFCONTEXT_MNT:
2454 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2455 goto out_bad_option;
2464 security_free_mnt_opts(&opts);
2466 free_secdata(secdata);
2469 printk(KERN_WARNING "SELinux: unable to change security options "
2470 "during remount (dev %s, type=%s)\n", sb->s_id,
2475 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2477 const struct cred *cred = current_cred();
2478 struct common_audit_data ad;
2481 rc = superblock_doinit(sb, data);
2485 /* Allow all mounts performed by the kernel */
2486 if (flags & MS_KERNMOUNT)
2489 COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
2490 ad.u.dentry = sb->s_root;
2491 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2494 static int selinux_sb_statfs(struct dentry *dentry)
2496 const struct cred *cred = current_cred();
2497 struct common_audit_data ad;
2499 COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
2500 ad.u.dentry = dentry->d_sb->s_root;
2501 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2504 static int selinux_mount(char *dev_name,
2507 unsigned long flags,
2510 const struct cred *cred = current_cred();
2512 if (flags & MS_REMOUNT)
2513 return superblock_has_perm(cred, path->mnt->mnt_sb,
2514 FILESYSTEM__REMOUNT, NULL);
2516 return path_has_perm(cred, path, FILE__MOUNTON);
2519 static int selinux_umount(struct vfsmount *mnt, int flags)
2521 const struct cred *cred = current_cred();
2523 return superblock_has_perm(cred, mnt->mnt_sb,
2524 FILESYSTEM__UNMOUNT, NULL);
2527 /* inode security operations */
2529 static int selinux_inode_alloc_security(struct inode *inode)
2531 return inode_alloc_security(inode);
2534 static void selinux_inode_free_security(struct inode *inode)
2536 inode_free_security(inode);
2539 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2540 const struct qstr *qstr, char **name,
2541 void **value, size_t *len)
2543 const struct task_security_struct *tsec = current_security();
2544 struct inode_security_struct *dsec;
2545 struct superblock_security_struct *sbsec;
2546 u32 sid, newsid, clen;
2548 char *namep = NULL, *context;
2550 dsec = dir->i_security;
2551 sbsec = dir->i_sb->s_security;
2554 newsid = tsec->create_sid;
2556 if ((sbsec->flags & SE_SBINITIALIZED) &&
2557 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2558 newsid = sbsec->mntpoint_sid;
2559 else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
2560 rc = security_transition_sid(sid, dsec->sid,
2561 inode_mode_to_security_class(inode->i_mode),
2564 printk(KERN_WARNING "%s: "
2565 "security_transition_sid failed, rc=%d (dev=%s "
2568 -rc, inode->i_sb->s_id, inode->i_ino);
2573 /* Possibly defer initialization to selinux_complete_init. */
2574 if (sbsec->flags & SE_SBINITIALIZED) {
2575 struct inode_security_struct *isec = inode->i_security;
2576 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2578 isec->initialized = 1;
2581 if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
2585 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2592 rc = security_sid_to_context_force(newsid, &context, &clen);
2604 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2606 return may_create(dir, dentry, SECCLASS_FILE);
2609 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2611 return may_link(dir, old_dentry, MAY_LINK);
2614 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2616 return may_link(dir, dentry, MAY_UNLINK);
2619 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2621 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2624 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2626 return may_create(dir, dentry, SECCLASS_DIR);
2629 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2631 return may_link(dir, dentry, MAY_RMDIR);
2634 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2636 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2639 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2640 struct inode *new_inode, struct dentry *new_dentry)
2642 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2645 static int selinux_inode_readlink(struct dentry *dentry)
2647 const struct cred *cred = current_cred();
2649 return dentry_has_perm(cred, dentry, FILE__READ);
2652 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2654 const struct cred *cred = current_cred();
2656 return dentry_has_perm(cred, dentry, FILE__READ);
2659 static int selinux_inode_permission(struct inode *inode, int mask)
2661 const struct cred *cred = current_cred();
2662 struct common_audit_data ad;
2665 unsigned flags = mask & MAY_NOT_BLOCK;
2667 from_access = mask & MAY_ACCESS;
2668 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2670 /* No permission to check. Existence test. */
2674 COMMON_AUDIT_DATA_INIT(&ad, INODE);
2678 ad.selinux_audit_data.auditdeny |= FILE__AUDIT_ACCESS;
2680 perms = file_mask_to_av(inode->i_mode, mask);
2682 return inode_has_perm(cred, inode, perms, &ad, flags);
2685 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2687 const struct cred *cred = current_cred();
2688 unsigned int ia_valid = iattr->ia_valid;
2690 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2691 if (ia_valid & ATTR_FORCE) {
2692 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2698 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2699 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2700 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2702 return dentry_has_perm(cred, dentry, FILE__WRITE);
2705 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2707 const struct cred *cred = current_cred();
2710 path.dentry = dentry;
2713 return path_has_perm(cred, &path, FILE__GETATTR);
2716 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2718 const struct cred *cred = current_cred();
2720 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2721 sizeof XATTR_SECURITY_PREFIX - 1)) {
2722 if (!strcmp(name, XATTR_NAME_CAPS)) {
2723 if (!capable(CAP_SETFCAP))
2725 } else if (!capable(CAP_SYS_ADMIN)) {
2726 /* A different attribute in the security namespace.
2727 Restrict to administrator. */
2732 /* Not an attribute we recognize, so just check the
2733 ordinary setattr permission. */
2734 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2737 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2738 const void *value, size_t size, int flags)
2740 struct inode *inode = dentry->d_inode;
2741 struct inode_security_struct *isec = inode->i_security;
2742 struct superblock_security_struct *sbsec;
2743 struct common_audit_data ad;
2744 u32 newsid, sid = current_sid();
2747 if (strcmp(name, XATTR_NAME_SELINUX))
2748 return selinux_inode_setotherxattr(dentry, name);
2750 sbsec = inode->i_sb->s_security;
2751 if (!(sbsec->flags & SE_SBLABELSUPP))
2754 if (!inode_owner_or_capable(inode))
2757 COMMON_AUDIT_DATA_INIT(&ad, DENTRY);
2758 ad.u.dentry = dentry;
2760 rc = avc_has_perm(sid, isec->sid, isec->sclass,
2761 FILE__RELABELFROM, &ad);
2765 rc = security_context_to_sid(value, size, &newsid);
2766 if (rc == -EINVAL) {
2767 if (!capable(CAP_MAC_ADMIN))
2769 rc = security_context_to_sid_force(value, size, &newsid);
2774 rc = avc_has_perm(sid, newsid, isec->sclass,
2775 FILE__RELABELTO, &ad);
2779 rc = security_validate_transition(isec->sid, newsid, sid,
2784 return avc_has_perm(newsid,
2786 SECCLASS_FILESYSTEM,
2787 FILESYSTEM__ASSOCIATE,
2791 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2792 const void *value, size_t size,
2795 struct inode *inode = dentry->d_inode;
2796 struct inode_security_struct *isec = inode->i_security;
2800 if (strcmp(name, XATTR_NAME_SELINUX)) {
2801 /* Not an attribute we recognize, so nothing to do. */
2805 rc = security_context_to_sid_force(value, size, &newsid);
2807 printk(KERN_ERR "SELinux: unable to map context to SID"
2808 "for (%s, %lu), rc=%d\n",
2809 inode->i_sb->s_id, inode->i_ino, -rc);
2817 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2819 const struct cred *cred = current_cred();
2821 return dentry_has_perm(cred, dentry, FILE__GETATTR);
2824 static int selinux_inode_listxattr(struct dentry *dentry)
2826 const struct cred *cred = current_cred();
2828 return dentry_has_perm(cred, dentry, FILE__GETATTR);
2831 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2833 if (strcmp(name, XATTR_NAME_SELINUX))
2834 return selinux_inode_setotherxattr(dentry, name);
2836 /* No one is allowed to remove a SELinux security label.
2837 You can change the label, but all data must be labeled. */
2842 * Copy the inode security context value to the user.
2844 * Permission check is handled by selinux_inode_getxattr hook.
2846 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2850 char *context = NULL;
2851 struct inode_security_struct *isec = inode->i_security;
2853 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2857 * If the caller has CAP_MAC_ADMIN, then get the raw context
2858 * value even if it is not defined by current policy; otherwise,
2859 * use the in-core value under current policy.
2860 * Use the non-auditing forms of the permission checks since
2861 * getxattr may be called by unprivileged processes commonly
2862 * and lack of permission just means that we fall back to the
2863 * in-core context value, not a denial.
2865 error = selinux_capable(current, current_cred(),
2866 &init_user_ns, CAP_MAC_ADMIN,
2867 SECURITY_CAP_NOAUDIT);
2869 error = security_sid_to_context_force(isec->sid, &context,
2872 error = security_sid_to_context(isec->sid, &context, &size);
2885 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2886 const void *value, size_t size, int flags)
2888 struct inode_security_struct *isec = inode->i_security;
2892 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2895 if (!value || !size)
2898 rc = security_context_to_sid((void *)value, size, &newsid);
2903 isec->initialized = 1;
2907 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2909 const int len = sizeof(XATTR_NAME_SELINUX);
2910 if (buffer && len <= buffer_size)
2911 memcpy(buffer, XATTR_NAME_SELINUX, len);
2915 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2917 struct inode_security_struct *isec = inode->i_security;
2921 /* file security operations */
2923 static int selinux_revalidate_file_permission(struct file *file, int mask)
2925 const struct cred *cred = current_cred();
2926 struct inode *inode = file->f_path.dentry->d_inode;
2928 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2929 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2932 return file_has_perm(cred, file,
2933 file_mask_to_av(inode->i_mode, mask));
2936 static int selinux_file_permission(struct file *file, int mask)
2938 struct inode *inode = file->f_path.dentry->d_inode;
2939 struct file_security_struct *fsec = file->f_security;
2940 struct inode_security_struct *isec = inode->i_security;
2941 u32 sid = current_sid();
2944 /* No permission to check. Existence test. */
2947 if (sid == fsec->sid && fsec->isid == isec->sid &&
2948 fsec->pseqno == avc_policy_seqno())
2949 /* No change since dentry_open check. */
2952 return selinux_revalidate_file_permission(file, mask);
2955 static int selinux_file_alloc_security(struct file *file)
2957 return file_alloc_security(file);
2960 static void selinux_file_free_security(struct file *file)
2962 file_free_security(file);
2965 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2968 const struct cred *cred = current_cred();
2978 case EXT2_IOC_GETFLAGS:
2980 case EXT2_IOC_GETVERSION:
2981 error = file_has_perm(cred, file, FILE__GETATTR);
2984 case EXT2_IOC_SETFLAGS:
2986 case EXT2_IOC_SETVERSION:
2987 error = file_has_perm(cred, file, FILE__SETATTR);
2990 /* sys_ioctl() checks */
2994 error = file_has_perm(cred, file, 0);
2999 error = task_has_capability(current, cred, CAP_SYS_TTY_CONFIG,
3000 SECURITY_CAP_AUDIT);
3003 /* default case assumes that the command will go
3004 * to the file's ioctl() function.
3007 error = file_has_perm(cred, file, FILE__IOCTL);
3012 static int default_noexec;
3014 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3016 const struct cred *cred = current_cred();
3019 if (default_noexec &&
3020 (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3022 * We are making executable an anonymous mapping or a
3023 * private file mapping that will also be writable.
3024 * This has an additional check.
3026 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3032 /* read access is always possible with a mapping */
3033 u32 av = FILE__READ;
3035 /* write access only matters if the mapping is shared */
3036 if (shared && (prot & PROT_WRITE))
3039 if (prot & PROT_EXEC)
3040 av |= FILE__EXECUTE;
3042 return file_has_perm(cred, file, av);
3049 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
3050 unsigned long prot, unsigned long flags,
3051 unsigned long addr, unsigned long addr_only)
3054 u32 sid = current_sid();
3057 * notice that we are intentionally putting the SELinux check before
3058 * the secondary cap_file_mmap check. This is such a likely attempt
3059 * at bad behaviour/exploit that we always want to get the AVC, even
3060 * if DAC would have also denied the operation.
3062 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3063 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3064 MEMPROTECT__MMAP_ZERO, NULL);
3069 /* do DAC check on address space usage */
3070 rc = cap_file_mmap(file, reqprot, prot, flags, addr, addr_only);
3071 if (rc || addr_only)
3074 if (selinux_checkreqprot)
3077 return file_map_prot_check(file, prot,
3078 (flags & MAP_TYPE) == MAP_SHARED);
3081 static int selinux_file_mprotect(struct vm_area_struct *vma,
3082 unsigned long reqprot,
3085 const struct cred *cred = current_cred();
3087 if (selinux_checkreqprot)
3090 if (default_noexec &&
3091 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3093 if (vma->vm_start >= vma->vm_mm->start_brk &&
3094 vma->vm_end <= vma->vm_mm->brk) {
3095 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3096 } else if (!vma->vm_file &&
3097 vma->vm_start <= vma->vm_mm->start_stack &&
3098 vma->vm_end >= vma->vm_mm->start_stack) {
3099 rc = current_has_perm(current, PROCESS__EXECSTACK);
3100 } else if (vma->vm_file && vma->anon_vma) {
3102 * We are making executable a file mapping that has
3103 * had some COW done. Since pages might have been
3104 * written, check ability to execute the possibly
3105 * modified content. This typically should only
3106 * occur for text relocations.
3108 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3114 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3117 static int selinux_file_lock(struct file *file, unsigned int cmd)
3119 const struct cred *cred = current_cred();
3121 return file_has_perm(cred, file, FILE__LOCK);
3124 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3127 const struct cred *cred = current_cred();
3132 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3137 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3138 err = file_has_perm(cred, file, FILE__WRITE);
3147 /* Just check FD__USE permission */
3148 err = file_has_perm(cred, file, 0);
3153 #if BITS_PER_LONG == 32
3158 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3162 err = file_has_perm(cred, file, FILE__LOCK);
3169 static int selinux_file_set_fowner(struct file *file)
3171 struct file_security_struct *fsec;
3173 fsec = file->f_security;
3174 fsec->fown_sid = current_sid();
3179 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3180 struct fown_struct *fown, int signum)
3183 u32 sid = task_sid(tsk);
3185 struct file_security_struct *fsec;
3187 /* struct fown_struct is never outside the context of a struct file */
3188 file = container_of(fown, struct file, f_owner);
3190 fsec = file->f_security;
3193 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3195 perm = signal_to_av(signum);
3197 return avc_has_perm(fsec->fown_sid, sid,
3198 SECCLASS_PROCESS, perm, NULL);
3201 static int selinux_file_receive(struct file *file)
3203 const struct cred *cred = current_cred();
3205 return file_has_perm(cred, file, file_to_av(file));
3208 static int selinux_dentry_open(struct file *file, const struct cred *cred)
3210 struct file_security_struct *fsec;
3211 struct inode *inode;
3212 struct inode_security_struct *isec;
3214 inode = file->f_path.dentry->d_inode;
3215 fsec = file->f_security;
3216 isec = inode->i_security;
3218 * Save inode label and policy sequence number
3219 * at open-time so that selinux_file_permission
3220 * can determine whether revalidation is necessary.
3221 * Task label is already saved in the file security
3222 * struct as its SID.
3224 fsec->isid = isec->sid;
3225 fsec->pseqno = avc_policy_seqno();
3227 * Since the inode label or policy seqno may have changed
3228 * between the selinux_inode_permission check and the saving
3229 * of state above, recheck that access is still permitted.
3230 * Otherwise, access might never be revalidated against the
3231 * new inode label or new policy.
3232 * This check is not redundant - do not remove.
3234 return inode_has_perm_noadp(cred, inode, open_file_to_av(file), 0);
3237 /* task security operations */
3239 static int selinux_task_create(unsigned long clone_flags)
3241 return current_has_perm(current, PROCESS__FORK);
3245 * allocate the SELinux part of blank credentials
3247 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3249 struct task_security_struct *tsec;
3251 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3255 cred->security = tsec;
3260 * detach and free the LSM part of a set of credentials
3262 static void selinux_cred_free(struct cred *cred)
3264 struct task_security_struct *tsec = cred->security;
3267 * cred->security == NULL if security_cred_alloc_blank() or
3268 * security_prepare_creds() returned an error.
3270 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3271 cred->security = (void *) 0x7UL;
3276 * prepare a new set of credentials for modification
3278 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3281 const struct task_security_struct *old_tsec;
3282 struct task_security_struct *tsec;
3284 old_tsec = old->security;
3286 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3290 new->security = tsec;
3295 * transfer the SELinux data to a blank set of creds
3297 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3299 const struct task_security_struct *old_tsec = old->security;
3300 struct task_security_struct *tsec = new->security;
3306 * set the security data for a kernel service
3307 * - all the creation contexts are set to unlabelled
3309 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3311 struct task_security_struct *tsec = new->security;
3312 u32 sid = current_sid();
3315 ret = avc_has_perm(sid, secid,
3316 SECCLASS_KERNEL_SERVICE,
3317 KERNEL_SERVICE__USE_AS_OVERRIDE,
3321 tsec->create_sid = 0;
3322 tsec->keycreate_sid = 0;
3323 tsec->sockcreate_sid = 0;
3329 * set the file creation context in a security record to the same as the
3330 * objective context of the specified inode
3332 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3334 struct inode_security_struct *isec = inode->i_security;
3335 struct task_security_struct *tsec = new->security;
3336 u32 sid = current_sid();
3339 ret = avc_has_perm(sid, isec->sid,
3340 SECCLASS_KERNEL_SERVICE,
3341 KERNEL_SERVICE__CREATE_FILES_AS,
3345 tsec->create_sid = isec->sid;
3349 static int selinux_kernel_module_request(char *kmod_name)
3352 struct common_audit_data ad;
3354 sid = task_sid(current);
3356 COMMON_AUDIT_DATA_INIT(&ad, KMOD);
3357 ad.u.kmod_name = kmod_name;
3359 return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3360 SYSTEM__MODULE_REQUEST, &ad);
3363 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3365 return current_has_perm(p, PROCESS__SETPGID);
3368 static int selinux_task_getpgid(struct task_struct *p)
3370 return current_has_perm(p, PROCESS__GETPGID);
3373 static int selinux_task_getsid(struct task_struct *p)
3375 return current_has_perm(p, PROCESS__GETSESSION);
3378 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3380 *secid = task_sid(p);
3383 static int selinux_task_setnice(struct task_struct *p, int nice)
3387 rc = cap_task_setnice(p, nice);
3391 return current_has_perm(p, PROCESS__SETSCHED);
3394 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3398 rc = cap_task_setioprio(p, ioprio);
3402 return current_has_perm(p, PROCESS__SETSCHED);
3405 static int selinux_task_getioprio(struct task_struct *p)
3407 return current_has_perm(p, PROCESS__GETSCHED);
3410 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3411 struct rlimit *new_rlim)
3413 struct rlimit *old_rlim = p->signal->rlim + resource;
3415 /* Control the ability to change the hard limit (whether
3416 lowering or raising it), so that the hard limit can
3417 later be used as a safe reset point for the soft limit
3418 upon context transitions. See selinux_bprm_committing_creds. */
3419 if (old_rlim->rlim_max != new_rlim->rlim_max)
3420 return current_has_perm(p, PROCESS__SETRLIMIT);
3425 static int selinux_task_setscheduler(struct task_struct *p)
3429 rc = cap_task_setscheduler(p);
3433 return current_has_perm(p, PROCESS__SETSCHED);
3436 static int selinux_task_getscheduler(struct task_struct *p)
3438 return current_has_perm(p, PROCESS__GETSCHED);
3441 static int selinux_task_movememory(struct task_struct *p)
3443 return current_has_perm(p, PROCESS__SETSCHED);
3446 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3453 perm = PROCESS__SIGNULL; /* null signal; existence test */
3455 perm = signal_to_av(sig);
3457 rc = avc_has_perm(secid, task_sid(p),
3458 SECCLASS_PROCESS, perm, NULL);
3460 rc = current_has_perm(p, perm);
3464 static int selinux_task_wait(struct task_struct *p)
3466 return task_has_perm(p, current, PROCESS__SIGCHLD);
3469 static void selinux_task_to_inode(struct task_struct *p,
3470 struct inode *inode)
3472 struct inode_security_struct *isec = inode->i_security;
3473 u32 sid = task_sid(p);
3476 isec->initialized = 1;
3479 /* Returns error only if unable to parse addresses */
3480 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3481 struct common_audit_data *ad, u8 *proto)
3483 int offset, ihlen, ret = -EINVAL;
3484 struct iphdr _iph, *ih;
3486 offset = skb_network_offset(skb);
3487 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3491 ihlen = ih->ihl * 4;
3492 if (ihlen < sizeof(_iph))
3495 ad->u.net.v4info.saddr = ih->saddr;
3496 ad->u.net.v4info.daddr = ih->daddr;
3500 *proto = ih->protocol;
3502 switch (ih->protocol) {
3504 struct tcphdr _tcph, *th;
3506 if (ntohs(ih->frag_off) & IP_OFFSET)
3510 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3514 ad->u.net.sport = th->source;
3515 ad->u.net.dport = th->dest;
3520 struct udphdr _udph, *uh;
3522 if (ntohs(ih->frag_off) & IP_OFFSET)
3526 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3530 ad->u.net.sport = uh->source;
3531 ad->u.net.dport = uh->dest;
3535 case IPPROTO_DCCP: {
3536 struct dccp_hdr _dccph, *dh;
3538 if (ntohs(ih->frag_off) & IP_OFFSET)
3542 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3546 ad->u.net.sport = dh->dccph_sport;
3547 ad->u.net.dport = dh->dccph_dport;
3558 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3560 /* Returns error only if unable to parse addresses */
3561 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3562 struct common_audit_data *ad, u8 *proto)
3565 int ret = -EINVAL, offset;
3566 struct ipv6hdr _ipv6h, *ip6;
3568 offset = skb_network_offset(skb);
3569 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3573 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3574 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3577 nexthdr = ip6->nexthdr;
3578 offset += sizeof(_ipv6h);
3579 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
3588 struct tcphdr _tcph, *th;
3590 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3594 ad->u.net.sport = th->source;
3595 ad->u.net.dport = th->dest;
3600 struct udphdr _udph, *uh;
3602 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3606 ad->u.net.sport = uh->source;
3607 ad->u.net.dport = uh->dest;
3611 case IPPROTO_DCCP: {
3612 struct dccp_hdr _dccph, *dh;
3614 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3618 ad->u.net.sport = dh->dccph_sport;
3619 ad->u.net.dport = dh->dccph_dport;
3623 /* includes fragments */
3633 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3634 char **_addrp, int src, u8 *proto)
3639 switch (ad->u.net.family) {
3641 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3644 addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3645 &ad->u.net.v4info.daddr);
3648 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3650 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3653 addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3654 &ad->u.net.v6info.daddr);
3664 "SELinux: failure in selinux_parse_skb(),"
3665 " unable to parse packet\n");
3675 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3677 * @family: protocol family
3678 * @sid: the packet's peer label SID
3681 * Check the various different forms of network peer labeling and determine
3682 * the peer label/SID for the packet; most of the magic actually occurs in
3683 * the security server function security_net_peersid_cmp(). The function
3684 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3685 * or -EACCES if @sid is invalid due to inconsistencies with the different
3689 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3696 selinux_skb_xfrm_sid(skb, &xfrm_sid);
3697 selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3699 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3700 if (unlikely(err)) {
3702 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3703 " unable to determine packet's peer label\n");
3710 /* socket security operations */
3712 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3713 u16 secclass, u32 *socksid)
3715 if (tsec->sockcreate_sid > SECSID_NULL) {
3716 *socksid = tsec->sockcreate_sid;
3720 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3724 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3726 struct sk_security_struct *sksec = sk->sk_security;
3727 struct common_audit_data ad;
3728 u32 tsid = task_sid(task);
3730 if (sksec->sid == SECINITSID_KERNEL)
3733 COMMON_AUDIT_DATA_INIT(&ad, NET);
3736 return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3739 static int selinux_socket_create(int family, int type,
3740 int protocol, int kern)
3742 const struct task_security_struct *tsec = current_security();
3750 secclass = socket_type_to_security_class(family, type, protocol);
3751 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3755 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3758 static int selinux_socket_post_create(struct socket *sock, int family,
3759 int type, int protocol, int kern)
3761 const struct task_security_struct *tsec = current_security();
3762 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3763 struct sk_security_struct *sksec;
3766 isec->sclass = socket_type_to_security_class(family, type, protocol);
3769 isec->sid = SECINITSID_KERNEL;
3771 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3776 isec->initialized = 1;
3779 sksec = sock->sk->sk_security;
3780 sksec->sid = isec->sid;
3781 sksec->sclass = isec->sclass;
3782 err = selinux_netlbl_socket_post_create(sock->sk, family);
3788 /* Range of port numbers used to automatically bind.
3789 Need to determine whether we should perform a name_bind
3790 permission check between the socket and the port number. */
3792 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3794 struct sock *sk = sock->sk;
3798 err = sock_has_perm(current, sk, SOCKET__BIND);
3803 * If PF_INET or PF_INET6, check name_bind permission for the port.
3804 * Multiple address binding for SCTP is not supported yet: we just
3805 * check the first address now.
3807 family = sk->sk_family;
3808 if (family == PF_INET || family == PF_INET6) {
3810 struct sk_security_struct *sksec = sk->sk_security;
3811 struct common_audit_data ad;
3812 struct sockaddr_in *addr4 = NULL;
3813 struct sockaddr_in6 *addr6 = NULL;
3814 unsigned short snum;
3817 if (family == PF_INET) {
3818 addr4 = (struct sockaddr_in *)address;
3819 snum = ntohs(addr4->sin_port);
3820 addrp = (char *)&addr4->sin_addr.s_addr;
3822 addr6 = (struct sockaddr_in6 *)address;
3823 snum = ntohs(addr6->sin6_port);
3824 addrp = (char *)&addr6->sin6_addr.s6_addr;
3830 inet_get_local_port_range(&low, &high);
3832 if (snum < max(PROT_SOCK, low) || snum > high) {
3833 err = sel_netport_sid(sk->sk_protocol,
3837 COMMON_AUDIT_DATA_INIT(&ad, NET);
3838 ad.u.net.sport = htons(snum);
3839 ad.u.net.family = family;
3840 err = avc_has_perm(sksec->sid, sid,
3842 SOCKET__NAME_BIND, &ad);
3848 switch (sksec->sclass) {
3849 case SECCLASS_TCP_SOCKET:
3850 node_perm = TCP_SOCKET__NODE_BIND;
3853 case SECCLASS_UDP_SOCKET:
3854 node_perm = UDP_SOCKET__NODE_BIND;
3857 case SECCLASS_DCCP_SOCKET:
3858 node_perm = DCCP_SOCKET__NODE_BIND;
3862 node_perm = RAWIP_SOCKET__NODE_BIND;
3866 err = sel_netnode_sid(addrp, family, &sid);
3870 COMMON_AUDIT_DATA_INIT(&ad, NET);
3871 ad.u.net.sport = htons(snum);
3872 ad.u.net.family = family;
3874 if (family == PF_INET)
3875 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3877 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3879 err = avc_has_perm(sksec->sid, sid,
3880 sksec->sclass, node_perm, &ad);
3888 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3890 struct sock *sk = sock->sk;
3891 struct sk_security_struct *sksec = sk->sk_security;
3894 err = sock_has_perm(current, sk, SOCKET__CONNECT);
3899 * If a TCP or DCCP socket, check name_connect permission for the port.
3901 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
3902 sksec->sclass == SECCLASS_DCCP_SOCKET) {
3903 struct common_audit_data ad;
3904 struct sockaddr_in *addr4 = NULL;
3905 struct sockaddr_in6 *addr6 = NULL;
3906 unsigned short snum;
3909 if (sk->sk_family == PF_INET) {
3910 addr4 = (struct sockaddr_in *)address;
3911 if (addrlen < sizeof(struct sockaddr_in))
3913 snum = ntohs(addr4->sin_port);
3915 addr6 = (struct sockaddr_in6 *)address;
3916 if (addrlen < SIN6_LEN_RFC2133)
3918 snum = ntohs(addr6->sin6_port);
3921 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
3925 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
3926 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3928 COMMON_AUDIT_DATA_INIT(&ad, NET);
3929 ad.u.net.dport = htons(snum);
3930 ad.u.net.family = sk->sk_family;
3931 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
3936 err = selinux_netlbl_socket_connect(sk, address);
3942 static int selinux_socket_listen(struct socket *sock, int backlog)
3944 return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
3947 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3950 struct inode_security_struct *isec;
3951 struct inode_security_struct *newisec;
3953 err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
3957 newisec = SOCK_INODE(newsock)->i_security;
3959 isec = SOCK_INODE(sock)->i_security;
3960 newisec->sclass = isec->sclass;
3961 newisec->sid = isec->sid;
3962 newisec->initialized = 1;
3967 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3970 return sock_has_perm(current, sock->sk, SOCKET__WRITE);
3973 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3974 int size, int flags)
3976 return sock_has_perm(current, sock->sk, SOCKET__READ);
3979 static int selinux_socket_getsockname(struct socket *sock)
3981 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
3984 static int selinux_socket_getpeername(struct socket *sock)
3986 return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
3989 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
3993 err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
3997 return selinux_netlbl_socket_setsockopt(sock, level, optname);
4000 static int selinux_socket_getsockopt(struct socket *sock, int level,
4003 return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4006 static int selinux_socket_shutdown(struct socket *sock, int how)
4008 return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4011 static int selinux_socket_unix_stream_connect(struct sock *sock,
4015 struct sk_security_struct *sksec_sock = sock->sk_security;
4016 struct sk_security_struct *sksec_other = other->sk_security;
4017 struct sk_security_struct *sksec_new = newsk->sk_security;
4018 struct common_audit_data ad;
4021 COMMON_AUDIT_DATA_INIT(&ad, NET);
4022 ad.u.net.sk = other;
4024 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4025 sksec_other->sclass,
4026 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4030 /* server child socket */
4031 sksec_new->peer_sid = sksec_sock->sid;
4032 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4037 /* connecting socket */
4038 sksec_sock->peer_sid = sksec_new->sid;
4043 static int selinux_socket_unix_may_send(struct socket *sock,
4044 struct socket *other)
4046 struct sk_security_struct *ssec = sock->sk->sk_security;
4047 struct sk_security_struct *osec = other->sk->sk_security;
4048 struct common_audit_data ad;
4050 COMMON_AUDIT_DATA_INIT(&ad, NET);
4051 ad.u.net.sk = other->sk;
4053 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4057 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4059 struct common_audit_data *ad)
4065 err = sel_netif_sid(ifindex, &if_sid);
4068 err = avc_has_perm(peer_sid, if_sid,
4069 SECCLASS_NETIF, NETIF__INGRESS, ad);
4073 err = sel_netnode_sid(addrp, family, &node_sid);
4076 return avc_has_perm(peer_sid, node_sid,
4077 SECCLASS_NODE, NODE__RECVFROM, ad);
4080 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4084 struct sk_security_struct *sksec = sk->sk_security;
4085 u32 sk_sid = sksec->sid;
4086 struct common_audit_data ad;
4089 COMMON_AUDIT_DATA_INIT(&ad, NET);
4090 ad.u.net.netif = skb->skb_iif;
4091 ad.u.net.family = family;
4092 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4096 if (selinux_secmark_enabled()) {
4097 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4103 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4106 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4111 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4114 struct sk_security_struct *sksec = sk->sk_security;
4115 u16 family = sk->sk_family;
4116 u32 sk_sid = sksec->sid;
4117 struct common_audit_data ad;
4122 if (family != PF_INET && family != PF_INET6)
4125 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4126 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4129 /* If any sort of compatibility mode is enabled then handoff processing
4130 * to the selinux_sock_rcv_skb_compat() function to deal with the
4131 * special handling. We do this in an attempt to keep this function
4132 * as fast and as clean as possible. */
4133 if (!selinux_policycap_netpeer)
4134 return selinux_sock_rcv_skb_compat(sk, skb, family);
4136 secmark_active = selinux_secmark_enabled();
4137 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4138 if (!secmark_active && !peerlbl_active)
4141 COMMON_AUDIT_DATA_INIT(&ad, NET);
4142 ad.u.net.netif = skb->skb_iif;
4143 ad.u.net.family = family;
4144 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4148 if (peerlbl_active) {
4151 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4154 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4157 selinux_netlbl_err(skb, err, 0);
4160 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4163 selinux_netlbl_err(skb, err, 0);
4166 if (secmark_active) {
4167 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4176 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4177 int __user *optlen, unsigned len)
4182 struct sk_security_struct *sksec = sock->sk->sk_security;
4183 u32 peer_sid = SECSID_NULL;
4185 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4186 sksec->sclass == SECCLASS_TCP_SOCKET)
4187 peer_sid = sksec->peer_sid;
4188 if (peer_sid == SECSID_NULL)
4189 return -ENOPROTOOPT;
4191 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4195 if (scontext_len > len) {
4200 if (copy_to_user(optval, scontext, scontext_len))
4204 if (put_user(scontext_len, optlen))
4210 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4212 u32 peer_secid = SECSID_NULL;
4215 if (skb && skb->protocol == htons(ETH_P_IP))
4217 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4220 family = sock->sk->sk_family;
4224 if (sock && family == PF_UNIX)
4225 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4227 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4230 *secid = peer_secid;
4231 if (peer_secid == SECSID_NULL)
4236 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4238 struct sk_security_struct *sksec;
4240 sksec = kzalloc(sizeof(*sksec), priority);
4244 sksec->peer_sid = SECINITSID_UNLABELED;
4245 sksec->sid = SECINITSID_UNLABELED;
4246 selinux_netlbl_sk_security_reset(sksec);
4247 sk->sk_security = sksec;
4252 static void selinux_sk_free_security(struct sock *sk)
4254 struct sk_security_struct *sksec = sk->sk_security;
4256 sk->sk_security = NULL;
4257 selinux_netlbl_sk_security_free(sksec);
4261 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4263 struct sk_security_struct *sksec = sk->sk_security;
4264 struct sk_security_struct *newsksec = newsk->sk_security;
4266 newsksec->sid = sksec->sid;
4267 newsksec->peer_sid = sksec->peer_sid;
4268 newsksec->sclass = sksec->sclass;
4270 selinux_netlbl_sk_security_reset(newsksec);
4273 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4276 *secid = SECINITSID_ANY_SOCKET;
4278 struct sk_security_struct *sksec = sk->sk_security;
4280 *secid = sksec->sid;
4284 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4286 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4287 struct sk_security_struct *sksec = sk->sk_security;
4289 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4290 sk->sk_family == PF_UNIX)
4291 isec->sid = sksec->sid;
4292 sksec->sclass = isec->sclass;
4295 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4296 struct request_sock *req)
4298 struct sk_security_struct *sksec = sk->sk_security;
4300 u16 family = sk->sk_family;
4304 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4305 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4308 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4311 if (peersid == SECSID_NULL) {
4312 req->secid = sksec->sid;
4313 req->peer_secid = SECSID_NULL;
4315 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4318 req->secid = newsid;
4319 req->peer_secid = peersid;
4322 return selinux_netlbl_inet_conn_request(req, family);
4325 static void selinux_inet_csk_clone(struct sock *newsk,
4326 const struct request_sock *req)
4328 struct sk_security_struct *newsksec = newsk->sk_security;
4330 newsksec->sid = req->secid;
4331 newsksec->peer_sid = req->peer_secid;
4332 /* NOTE: Ideally, we should also get the isec->sid for the
4333 new socket in sync, but we don't have the isec available yet.
4334 So we will wait until sock_graft to do it, by which
4335 time it will have been created and available. */
4337 /* We don't need to take any sort of lock here as we are the only
4338 * thread with access to newsksec */
4339 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4342 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4344 u16 family = sk->sk_family;
4345 struct sk_security_struct *sksec = sk->sk_security;
4347 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4348 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4351 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4354 static int selinux_secmark_relabel_packet(u32 sid)
4356 const struct task_security_struct *__tsec;
4359 __tsec = current_security();
4362 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4365 static void selinux_secmark_refcount_inc(void)
4367 atomic_inc(&selinux_secmark_refcount);
4370 static void selinux_secmark_refcount_dec(void)
4372 atomic_dec(&selinux_secmark_refcount);
4375 static void selinux_req_classify_flow(const struct request_sock *req,
4378 fl->flowi_secid = req->secid;
4381 static int selinux_tun_dev_create(void)
4383 u32 sid = current_sid();
4385 /* we aren't taking into account the "sockcreate" SID since the socket
4386 * that is being created here is not a socket in the traditional sense,
4387 * instead it is a private sock, accessible only to the kernel, and
4388 * representing a wide range of network traffic spanning multiple
4389 * connections unlike traditional sockets - check the TUN driver to
4390 * get a better understanding of why this socket is special */
4392 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4396 static void selinux_tun_dev_post_create(struct sock *sk)
4398 struct sk_security_struct *sksec = sk->sk_security;
4400 /* we don't currently perform any NetLabel based labeling here and it
4401 * isn't clear that we would want to do so anyway; while we could apply
4402 * labeling without the support of the TUN user the resulting labeled
4403 * traffic from the other end of the connection would almost certainly
4404 * cause confusion to the TUN user that had no idea network labeling
4405 * protocols were being used */
4407 /* see the comments in selinux_tun_dev_create() about why we don't use
4408 * the sockcreate SID here */
4410 sksec->sid = current_sid();
4411 sksec->sclass = SECCLASS_TUN_SOCKET;
4414 static int selinux_tun_dev_attach(struct sock *sk)
4416 struct sk_security_struct *sksec = sk->sk_security;
4417 u32 sid = current_sid();
4420 err = avc_has_perm(sid, sksec->sid, SECCLASS_TUN_SOCKET,
4421 TUN_SOCKET__RELABELFROM, NULL);
4424 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4425 TUN_SOCKET__RELABELTO, NULL);
4434 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4438 struct nlmsghdr *nlh;
4439 struct sk_security_struct *sksec = sk->sk_security;
4441 if (skb->len < NLMSG_SPACE(0)) {
4445 nlh = nlmsg_hdr(skb);
4447 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4449 if (err == -EINVAL) {
4450 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4451 "SELinux: unrecognized netlink message"
4452 " type=%hu for sclass=%hu\n",
4453 nlh->nlmsg_type, sksec->sclass);
4454 if (!selinux_enforcing || security_get_allow_unknown())
4464 err = sock_has_perm(current, sk, perm);
4469 #ifdef CONFIG_NETFILTER
4471 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4477 struct common_audit_data ad;
4482 if (!selinux_policycap_netpeer)
4485 secmark_active = selinux_secmark_enabled();
4486 netlbl_active = netlbl_enabled();
4487 peerlbl_active = netlbl_active || selinux_xfrm_enabled();
4488 if (!secmark_active && !peerlbl_active)
4491 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4494 COMMON_AUDIT_DATA_INIT(&ad, NET);
4495 ad.u.net.netif = ifindex;
4496 ad.u.net.family = family;
4497 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4500 if (peerlbl_active) {
4501 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4504 selinux_netlbl_err(skb, err, 1);
4510 if (avc_has_perm(peer_sid, skb->secmark,
4511 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4515 /* we do this in the FORWARD path and not the POST_ROUTING
4516 * path because we want to make sure we apply the necessary
4517 * labeling before IPsec is applied so we can leverage AH
4519 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4525 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4526 struct sk_buff *skb,
4527 const struct net_device *in,
4528 const struct net_device *out,
4529 int (*okfn)(struct sk_buff *))
4531 return selinux_ip_forward(skb, in->ifindex, PF_INET);
4534 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4535 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4536 struct sk_buff *skb,
4537 const struct net_device *in,
4538 const struct net_device *out,
4539 int (*okfn)(struct sk_buff *))
4541 return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4545 static unsigned int selinux_ip_output(struct sk_buff *skb,
4550 if (!netlbl_enabled())
4553 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4554 * because we want to make sure we apply the necessary labeling
4555 * before IPsec is applied so we can leverage AH protection */
4557 struct sk_security_struct *sksec = skb->sk->sk_security;
4560 sid = SECINITSID_KERNEL;
4561 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4567 static unsigned int selinux_ipv4_output(unsigned int hooknum,
4568 struct sk_buff *skb,
4569 const struct net_device *in,
4570 const struct net_device *out,
4571 int (*okfn)(struct sk_buff *))
4573 return selinux_ip_output(skb, PF_INET);
4576 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4580 struct sock *sk = skb->sk;
4581 struct sk_security_struct *sksec;
4582 struct common_audit_data ad;
4588 sksec = sk->sk_security;
4590 COMMON_AUDIT_DATA_INIT(&ad, NET);
4591 ad.u.net.netif = ifindex;
4592 ad.u.net.family = family;
4593 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4596 if (selinux_secmark_enabled())
4597 if (avc_has_perm(sksec->sid, skb->secmark,
4598 SECCLASS_PACKET, PACKET__SEND, &ad))
4599 return NF_DROP_ERR(-ECONNREFUSED);
4601 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4602 return NF_DROP_ERR(-ECONNREFUSED);
4607 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4613 struct common_audit_data ad;
4618 /* If any sort of compatibility mode is enabled then handoff processing
4619 * to the selinux_ip_postroute_compat() function to deal with the
4620 * special handling. We do this in an attempt to keep this function
4621 * as fast and as clean as possible. */
4622 if (!selinux_policycap_netpeer)
4623 return selinux_ip_postroute_compat(skb, ifindex, family);
4625 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4626 * packet transformation so allow the packet to pass without any checks
4627 * since we'll have another chance to perform access control checks
4628 * when the packet is on it's final way out.
4629 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4630 * is NULL, in this case go ahead and apply access control. */
4631 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
4634 secmark_active = selinux_secmark_enabled();
4635 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4636 if (!secmark_active && !peerlbl_active)
4639 /* if the packet is being forwarded then get the peer label from the
4640 * packet itself; otherwise check to see if it is from a local
4641 * application or the kernel, if from an application get the peer label
4642 * from the sending socket, otherwise use the kernel's sid */
4646 secmark_perm = PACKET__FORWARD_OUT;
4647 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4650 secmark_perm = PACKET__SEND;
4651 peer_sid = SECINITSID_KERNEL;
4654 struct sk_security_struct *sksec = sk->sk_security;
4655 peer_sid = sksec->sid;
4656 secmark_perm = PACKET__SEND;
4659 COMMON_AUDIT_DATA_INIT(&ad, NET);
4660 ad.u.net.netif = ifindex;
4661 ad.u.net.family = family;
4662 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4666 if (avc_has_perm(peer_sid, skb->secmark,
4667 SECCLASS_PACKET, secmark_perm, &ad))
4668 return NF_DROP_ERR(-ECONNREFUSED);
4670 if (peerlbl_active) {
4674 if (sel_netif_sid(ifindex, &if_sid))
4676 if (avc_has_perm(peer_sid, if_sid,
4677 SECCLASS_NETIF, NETIF__EGRESS, &ad))
4678 return NF_DROP_ERR(-ECONNREFUSED);
4680 if (sel_netnode_sid(addrp, family, &node_sid))
4682 if (avc_has_perm(peer_sid, node_sid,
4683 SECCLASS_NODE, NODE__SENDTO, &ad))
4684 return NF_DROP_ERR(-ECONNREFUSED);
4690 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4691 struct sk_buff *skb,
4692 const struct net_device *in,
4693 const struct net_device *out,
4694 int (*okfn)(struct sk_buff *))
4696 return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4699 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4700 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4701 struct sk_buff *skb,
4702 const struct net_device *in,
4703 const struct net_device *out,
4704 int (*okfn)(struct sk_buff *))
4706 return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4710 #endif /* CONFIG_NETFILTER */
4712 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4716 err = cap_netlink_send(sk, skb);
4720 return selinux_nlmsg_perm(sk, skb);
4723 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
4726 struct common_audit_data ad;
4729 err = cap_netlink_recv(skb, capability);
4733 COMMON_AUDIT_DATA_INIT(&ad, CAP);
4734 ad.u.cap = capability;
4736 security_task_getsecid(current, &sid);
4737 return avc_has_perm(sid, sid, SECCLASS_CAPABILITY,
4738 CAP_TO_MASK(capability), &ad);
4741 static int ipc_alloc_security(struct task_struct *task,
4742 struct kern_ipc_perm *perm,
4745 struct ipc_security_struct *isec;
4748 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4752 sid = task_sid(task);
4753 isec->sclass = sclass;
4755 perm->security = isec;
4760 static void ipc_free_security(struct kern_ipc_perm *perm)
4762 struct ipc_security_struct *isec = perm->security;
4763 perm->security = NULL;
4767 static int msg_msg_alloc_security(struct msg_msg *msg)
4769 struct msg_security_struct *msec;
4771 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4775 msec->sid = SECINITSID_UNLABELED;
4776 msg->security = msec;
4781 static void msg_msg_free_security(struct msg_msg *msg)
4783 struct msg_security_struct *msec = msg->security;
4785 msg->security = NULL;
4789 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4792 struct ipc_security_struct *isec;
4793 struct common_audit_data ad;
4794 u32 sid = current_sid();
4796 isec = ipc_perms->security;
4798 COMMON_AUDIT_DATA_INIT(&ad, IPC);
4799 ad.u.ipc_id = ipc_perms->key;
4801 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
4804 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4806 return msg_msg_alloc_security(msg);
4809 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4811 msg_msg_free_security(msg);
4814 /* message queue security operations */
4815 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4817 struct ipc_security_struct *isec;
4818 struct common_audit_data ad;
4819 u32 sid = current_sid();
4822 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4826 isec = msq->q_perm.security;
4828 COMMON_AUDIT_DATA_INIT(&ad, IPC);
4829 ad.u.ipc_id = msq->q_perm.key;
4831 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4834 ipc_free_security(&msq->q_perm);
4840 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4842 ipc_free_security(&msq->q_perm);
4845 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4847 struct ipc_security_struct *isec;
4848 struct common_audit_data ad;
4849 u32 sid = current_sid();
4851 isec = msq->q_perm.security;
4853 COMMON_AUDIT_DATA_INIT(&ad, IPC);
4854 ad.u.ipc_id = msq->q_perm.key;
4856 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4857 MSGQ__ASSOCIATE, &ad);
4860 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4868 /* No specific object, just general system-wide information. */
4869 return task_has_system(current, SYSTEM__IPC_INFO);
4872 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4875 perms = MSGQ__SETATTR;
4878 perms = MSGQ__DESTROY;
4884 err = ipc_has_perm(&msq->q_perm, perms);
4888 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4890 struct ipc_security_struct *isec;
4891 struct msg_security_struct *msec;
4892 struct common_audit_data ad;
4893 u32 sid = current_sid();
4896 isec = msq->q_perm.security;
4897 msec = msg->security;
4900 * First time through, need to assign label to the message
4902 if (msec->sid == SECINITSID_UNLABELED) {
4904 * Compute new sid based on current process and
4905 * message queue this message will be stored in
4907 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
4913 COMMON_AUDIT_DATA_INIT(&ad, IPC);
4914 ad.u.ipc_id = msq->q_perm.key;
4916 /* Can this process write to the queue? */
4917 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4920 /* Can this process send the message */
4921 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
4924 /* Can the message be put in the queue? */
4925 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
4926 MSGQ__ENQUEUE, &ad);
4931 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4932 struct task_struct *target,
4933 long type, int mode)
4935 struct ipc_security_struct *isec;
4936 struct msg_security_struct *msec;
4937 struct common_audit_data ad;
4938 u32 sid = task_sid(target);
4941 isec = msq->q_perm.security;
4942 msec = msg->security;
4944 COMMON_AUDIT_DATA_INIT(&ad, IPC);
4945 ad.u.ipc_id = msq->q_perm.key;
4947 rc = avc_has_perm(sid, isec->sid,
4948 SECCLASS_MSGQ, MSGQ__READ, &ad);
4950 rc = avc_has_perm(sid, msec->sid,
4951 SECCLASS_MSG, MSG__RECEIVE, &ad);
4955 /* Shared Memory security operations */
4956 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4958 struct ipc_security_struct *isec;
4959 struct common_audit_data ad;
4960 u32 sid = current_sid();
4963 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4967 isec = shp->shm_perm.security;
4969 COMMON_AUDIT_DATA_INIT(&ad, IPC);
4970 ad.u.ipc_id = shp->shm_perm.key;
4972 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
4975 ipc_free_security(&shp->shm_perm);
4981 static void selinux_shm_free_security(struct shmid_kernel *shp)
4983 ipc_free_security(&shp->shm_perm);
4986 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4988 struct ipc_security_struct *isec;
4989 struct common_audit_data ad;
4990 u32 sid = current_sid();
4992 isec = shp->shm_perm.security;
4994 COMMON_AUDIT_DATA_INIT(&ad, IPC);
4995 ad.u.ipc_id = shp->shm_perm.key;
4997 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
4998 SHM__ASSOCIATE, &ad);
5001 /* Note, at this point, shp is locked down */
5002 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5010 /* No specific object, just general system-wide information. */
5011 return task_has_system(current, SYSTEM__IPC_INFO);
5014 perms = SHM__GETATTR | SHM__ASSOCIATE;
5017 perms = SHM__SETATTR;
5024 perms = SHM__DESTROY;
5030 err = ipc_has_perm(&shp->shm_perm, perms);
5034 static int selinux_shm_shmat(struct shmid_kernel *shp,
5035 char __user *shmaddr, int shmflg)
5039 if (shmflg & SHM_RDONLY)
5042 perms = SHM__READ | SHM__WRITE;
5044 return ipc_has_perm(&shp->shm_perm, perms);
5047 /* Semaphore security operations */
5048 static int selinux_sem_alloc_security(struct sem_array *sma)
5050 struct ipc_security_struct *isec;
5051 struct common_audit_data ad;
5052 u32 sid = current_sid();
5055 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5059 isec = sma->sem_perm.security;
5061 COMMON_AUDIT_DATA_INIT(&ad, IPC);
5062 ad.u.ipc_id = sma->sem_perm.key;
5064 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5067 ipc_free_security(&sma->sem_perm);
5073 static void selinux_sem_free_security(struct sem_array *sma)
5075 ipc_free_security(&sma->sem_perm);
5078 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5080 struct ipc_security_struct *isec;
5081 struct common_audit_data ad;
5082 u32 sid = current_sid();
5084 isec = sma->sem_perm.security;
5086 COMMON_AUDIT_DATA_INIT(&ad, IPC);
5087 ad.u.ipc_id = sma->sem_perm.key;
5089 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5090 SEM__ASSOCIATE, &ad);
5093 /* Note, at this point, sma is locked down */
5094 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5102 /* No specific object, just general system-wide information. */
5103 return task_has_system(current, SYSTEM__IPC_INFO);
5107 perms = SEM__GETATTR;
5118 perms = SEM__DESTROY;
5121 perms = SEM__SETATTR;
5125 perms = SEM__GETATTR | SEM__ASSOCIATE;
5131 err = ipc_has_perm(&sma->sem_perm, perms);
5135 static int selinux_sem_semop(struct sem_array *sma,
5136 struct sembuf *sops, unsigned nsops, int alter)
5141 perms = SEM__READ | SEM__WRITE;
5145 return ipc_has_perm(&sma->sem_perm, perms);
5148 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5154 av |= IPC__UNIX_READ;
5156 av |= IPC__UNIX_WRITE;
5161 return ipc_has_perm(ipcp, av);
5164 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5166 struct ipc_security_struct *isec = ipcp->security;
5170 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5173 inode_doinit_with_dentry(inode, dentry);
5176 static int selinux_getprocattr(struct task_struct *p,
5177 char *name, char **value)
5179 const struct task_security_struct *__tsec;
5185 error = current_has_perm(p, PROCESS__GETATTR);
5191 __tsec = __task_cred(p)->security;
5193 if (!strcmp(name, "current"))
5195 else if (!strcmp(name, "prev"))
5197 else if (!strcmp(name, "exec"))
5198 sid = __tsec->exec_sid;
5199 else if (!strcmp(name, "fscreate"))
5200 sid = __tsec->create_sid;
5201 else if (!strcmp(name, "keycreate"))
5202 sid = __tsec->keycreate_sid;
5203 else if (!strcmp(name, "sockcreate"))
5204 sid = __tsec->sockcreate_sid;
5212 error = security_sid_to_context(sid, value, &len);
5222 static int selinux_setprocattr(struct task_struct *p,
5223 char *name, void *value, size_t size)
5225 struct task_security_struct *tsec;
5226 struct task_struct *tracer;
5233 /* SELinux only allows a process to change its own
5234 security attributes. */
5239 * Basic control over ability to set these attributes at all.
5240 * current == p, but we'll pass them separately in case the
5241 * above restriction is ever removed.
5243 if (!strcmp(name, "exec"))
5244 error = current_has_perm(p, PROCESS__SETEXEC);
5245 else if (!strcmp(name, "fscreate"))
5246 error = current_has_perm(p, PROCESS__SETFSCREATE);
5247 else if (!strcmp(name, "keycreate"))
5248 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5249 else if (!strcmp(name, "sockcreate"))
5250 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5251 else if (!strcmp(name, "current"))
5252 error = current_has_perm(p, PROCESS__SETCURRENT);
5258 /* Obtain a SID for the context, if one was specified. */
5259 if (size && str[1] && str[1] != '\n') {
5260 if (str[size-1] == '\n') {
5264 error = security_context_to_sid(value, size, &sid);
5265 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5266 if (!capable(CAP_MAC_ADMIN))
5268 error = security_context_to_sid_force(value, size,
5275 new = prepare_creds();
5279 /* Permission checking based on the specified context is
5280 performed during the actual operation (execve,
5281 open/mkdir/...), when we know the full context of the
5282 operation. See selinux_bprm_set_creds for the execve
5283 checks and may_create for the file creation checks. The
5284 operation will then fail if the context is not permitted. */
5285 tsec = new->security;
5286 if (!strcmp(name, "exec")) {
5287 tsec->exec_sid = sid;
5288 } else if (!strcmp(name, "fscreate")) {
5289 tsec->create_sid = sid;
5290 } else if (!strcmp(name, "keycreate")) {
5291 error = may_create_key(sid, p);
5294 tsec->keycreate_sid = sid;
5295 } else if (!strcmp(name, "sockcreate")) {
5296 tsec->sockcreate_sid = sid;
5297 } else if (!strcmp(name, "current")) {
5302 /* Only allow single threaded processes to change context */
5304 if (!current_is_single_threaded()) {
5305 error = security_bounded_transition(tsec->sid, sid);
5310 /* Check permissions for the transition. */
5311 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5312 PROCESS__DYNTRANSITION, NULL);
5316 /* Check for ptracing, and update the task SID if ok.
5317 Otherwise, leave SID unchanged and fail. */
5320 tracer = ptrace_parent(p);
5322 ptsid = task_sid(tracer);
5326 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5327 PROCESS__PTRACE, NULL);
5346 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5348 return security_sid_to_context(secid, secdata, seclen);
5351 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5353 return security_context_to_sid(secdata, seclen, secid);
5356 static void selinux_release_secctx(char *secdata, u32 seclen)
5362 * called with inode->i_mutex locked
5364 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5366 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5370 * called with inode->i_mutex locked
5372 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5374 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5377 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5380 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5389 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5390 unsigned long flags)
5392 const struct task_security_struct *tsec;
5393 struct key_security_struct *ksec;
5395 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5399 tsec = cred->security;
5400 if (tsec->keycreate_sid)
5401 ksec->sid = tsec->keycreate_sid;
5403 ksec->sid = tsec->sid;
5409 static void selinux_key_free(struct key *k)
5411 struct key_security_struct *ksec = k->security;
5417 static int selinux_key_permission(key_ref_t key_ref,
5418 const struct cred *cred,
5422 struct key_security_struct *ksec;
5425 /* if no specific permissions are requested, we skip the
5426 permission check. No serious, additional covert channels
5427 appear to be created. */
5431 sid = cred_sid(cred);
5433 key = key_ref_to_ptr(key_ref);
5434 ksec = key->security;
5436 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5439 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5441 struct key_security_struct *ksec = key->security;
5442 char *context = NULL;
5446 rc = security_sid_to_context(ksec->sid, &context, &len);
5455 static struct security_operations selinux_ops = {
5458 .ptrace_access_check = selinux_ptrace_access_check,
5459 .ptrace_traceme = selinux_ptrace_traceme,
5460 .capget = selinux_capget,
5461 .capset = selinux_capset,
5462 .capable = selinux_capable,
5463 .quotactl = selinux_quotactl,
5464 .quota_on = selinux_quota_on,
5465 .syslog = selinux_syslog,
5466 .vm_enough_memory = selinux_vm_enough_memory,
5468 .netlink_send = selinux_netlink_send,
5469 .netlink_recv = selinux_netlink_recv,
5471 .bprm_set_creds = selinux_bprm_set_creds,
5472 .bprm_committing_creds = selinux_bprm_committing_creds,
5473 .bprm_committed_creds = selinux_bprm_committed_creds,
5474 .bprm_secureexec = selinux_bprm_secureexec,
5476 .sb_alloc_security = selinux_sb_alloc_security,
5477 .sb_free_security = selinux_sb_free_security,
5478 .sb_copy_data = selinux_sb_copy_data,
5479 .sb_remount = selinux_sb_remount,
5480 .sb_kern_mount = selinux_sb_kern_mount,
5481 .sb_show_options = selinux_sb_show_options,
5482 .sb_statfs = selinux_sb_statfs,
5483 .sb_mount = selinux_mount,
5484 .sb_umount = selinux_umount,
5485 .sb_set_mnt_opts = selinux_set_mnt_opts,
5486 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
5487 .sb_parse_opts_str = selinux_parse_opts_str,
5490 .inode_alloc_security = selinux_inode_alloc_security,
5491 .inode_free_security = selinux_inode_free_security,
5492 .inode_init_security = selinux_inode_init_security,
5493 .inode_create = selinux_inode_create,
5494 .inode_link = selinux_inode_link,
5495 .inode_unlink = selinux_inode_unlink,
5496 .inode_symlink = selinux_inode_symlink,
5497 .inode_mkdir = selinux_inode_mkdir,
5498 .inode_rmdir = selinux_inode_rmdir,
5499 .inode_mknod = selinux_inode_mknod,
5500 .inode_rename = selinux_inode_rename,
5501 .inode_readlink = selinux_inode_readlink,
5502 .inode_follow_link = selinux_inode_follow_link,
5503 .inode_permission = selinux_inode_permission,
5504 .inode_setattr = selinux_inode_setattr,
5505 .inode_getattr = selinux_inode_getattr,
5506 .inode_setxattr = selinux_inode_setxattr,
5507 .inode_post_setxattr = selinux_inode_post_setxattr,
5508 .inode_getxattr = selinux_inode_getxattr,
5509 .inode_listxattr = selinux_inode_listxattr,
5510 .inode_removexattr = selinux_inode_removexattr,
5511 .inode_getsecurity = selinux_inode_getsecurity,
5512 .inode_setsecurity = selinux_inode_setsecurity,
5513 .inode_listsecurity = selinux_inode_listsecurity,
5514 .inode_getsecid = selinux_inode_getsecid,
5516 .file_permission = selinux_file_permission,
5517 .file_alloc_security = selinux_file_alloc_security,
5518 .file_free_security = selinux_file_free_security,
5519 .file_ioctl = selinux_file_ioctl,
5520 .file_mmap = selinux_file_mmap,
5521 .file_mprotect = selinux_file_mprotect,
5522 .file_lock = selinux_file_lock,
5523 .file_fcntl = selinux_file_fcntl,
5524 .file_set_fowner = selinux_file_set_fowner,
5525 .file_send_sigiotask = selinux_file_send_sigiotask,
5526 .file_receive = selinux_file_receive,
5528 .dentry_open = selinux_dentry_open,
5530 .task_create = selinux_task_create,
5531 .cred_alloc_blank = selinux_cred_alloc_blank,
5532 .cred_free = selinux_cred_free,
5533 .cred_prepare = selinux_cred_prepare,
5534 .cred_transfer = selinux_cred_transfer,
5535 .kernel_act_as = selinux_kernel_act_as,
5536 .kernel_create_files_as = selinux_kernel_create_files_as,
5537 .kernel_module_request = selinux_kernel_module_request,
5538 .task_setpgid = selinux_task_setpgid,
5539 .task_getpgid = selinux_task_getpgid,
5540 .task_getsid = selinux_task_getsid,
5541 .task_getsecid = selinux_task_getsecid,
5542 .task_setnice = selinux_task_setnice,
5543 .task_setioprio = selinux_task_setioprio,
5544 .task_getioprio = selinux_task_getioprio,
5545 .task_setrlimit = selinux_task_setrlimit,
5546 .task_setscheduler = selinux_task_setscheduler,
5547 .task_getscheduler = selinux_task_getscheduler,
5548 .task_movememory = selinux_task_movememory,
5549 .task_kill = selinux_task_kill,
5550 .task_wait = selinux_task_wait,
5551 .task_to_inode = selinux_task_to_inode,
5553 .ipc_permission = selinux_ipc_permission,
5554 .ipc_getsecid = selinux_ipc_getsecid,
5556 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5557 .msg_msg_free_security = selinux_msg_msg_free_security,
5559 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5560 .msg_queue_free_security = selinux_msg_queue_free_security,
5561 .msg_queue_associate = selinux_msg_queue_associate,
5562 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5563 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5564 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5566 .shm_alloc_security = selinux_shm_alloc_security,
5567 .shm_free_security = selinux_shm_free_security,
5568 .shm_associate = selinux_shm_associate,
5569 .shm_shmctl = selinux_shm_shmctl,
5570 .shm_shmat = selinux_shm_shmat,
5572 .sem_alloc_security = selinux_sem_alloc_security,
5573 .sem_free_security = selinux_sem_free_security,
5574 .sem_associate = selinux_sem_associate,
5575 .sem_semctl = selinux_sem_semctl,
5576 .sem_semop = selinux_sem_semop,
5578 .d_instantiate = selinux_d_instantiate,
5580 .getprocattr = selinux_getprocattr,
5581 .setprocattr = selinux_setprocattr,
5583 .secid_to_secctx = selinux_secid_to_secctx,
5584 .secctx_to_secid = selinux_secctx_to_secid,
5585 .release_secctx = selinux_release_secctx,
5586 .inode_notifysecctx = selinux_inode_notifysecctx,
5587 .inode_setsecctx = selinux_inode_setsecctx,
5588 .inode_getsecctx = selinux_inode_getsecctx,
5590 .unix_stream_connect = selinux_socket_unix_stream_connect,
5591 .unix_may_send = selinux_socket_unix_may_send,
5593 .socket_create = selinux_socket_create,
5594 .socket_post_create = selinux_socket_post_create,
5595 .socket_bind = selinux_socket_bind,
5596 .socket_connect = selinux_socket_connect,
5597 .socket_listen = selinux_socket_listen,
5598 .socket_accept = selinux_socket_accept,
5599 .socket_sendmsg = selinux_socket_sendmsg,
5600 .socket_recvmsg = selinux_socket_recvmsg,
5601 .socket_getsockname = selinux_socket_getsockname,
5602 .socket_getpeername = selinux_socket_getpeername,
5603 .socket_getsockopt = selinux_socket_getsockopt,
5604 .socket_setsockopt = selinux_socket_setsockopt,
5605 .socket_shutdown = selinux_socket_shutdown,
5606 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
5607 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
5608 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
5609 .sk_alloc_security = selinux_sk_alloc_security,
5610 .sk_free_security = selinux_sk_free_security,
5611 .sk_clone_security = selinux_sk_clone_security,
5612 .sk_getsecid = selinux_sk_getsecid,
5613 .sock_graft = selinux_sock_graft,
5614 .inet_conn_request = selinux_inet_conn_request,
5615 .inet_csk_clone = selinux_inet_csk_clone,
5616 .inet_conn_established = selinux_inet_conn_established,
5617 .secmark_relabel_packet = selinux_secmark_relabel_packet,
5618 .secmark_refcount_inc = selinux_secmark_refcount_inc,
5619 .secmark_refcount_dec = selinux_secmark_refcount_dec,
5620 .req_classify_flow = selinux_req_classify_flow,
5621 .tun_dev_create = selinux_tun_dev_create,
5622 .tun_dev_post_create = selinux_tun_dev_post_create,
5623 .tun_dev_attach = selinux_tun_dev_attach,
5625 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5626 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
5627 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
5628 .xfrm_policy_free_security = selinux_xfrm_policy_free,
5629 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
5630 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
5631 .xfrm_state_free_security = selinux_xfrm_state_free,
5632 .xfrm_state_delete_security = selinux_xfrm_state_delete,
5633 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
5634 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
5635 .xfrm_decode_session = selinux_xfrm_decode_session,
5639 .key_alloc = selinux_key_alloc,
5640 .key_free = selinux_key_free,
5641 .key_permission = selinux_key_permission,
5642 .key_getsecurity = selinux_key_getsecurity,
5646 .audit_rule_init = selinux_audit_rule_init,
5647 .audit_rule_known = selinux_audit_rule_known,
5648 .audit_rule_match = selinux_audit_rule_match,
5649 .audit_rule_free = selinux_audit_rule_free,
5653 static __init int selinux_init(void)
5655 if (!security_module_enable(&selinux_ops)) {
5656 selinux_enabled = 0;
5660 if (!selinux_enabled) {
5661 printk(KERN_INFO "SELinux: Disabled at boot.\n");
5665 printk(KERN_INFO "SELinux: Initializing.\n");
5667 /* Set the security state for the initial task. */
5668 cred_init_security();
5670 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5672 sel_inode_cache = kmem_cache_create("selinux_inode_security",
5673 sizeof(struct inode_security_struct),
5674 0, SLAB_PANIC, NULL);
5677 if (register_security(&selinux_ops))
5678 panic("SELinux: Unable to register with kernel.\n");
5680 if (selinux_enforcing)
5681 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
5683 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
5688 static void delayed_superblock_init(struct super_block *sb, void *unused)
5690 superblock_doinit(sb, NULL);
5693 void selinux_complete_init(void)
5695 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
5697 /* Set up any superblocks initialized prior to the policy load. */
5698 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
5699 iterate_supers(delayed_superblock_init, NULL);
5702 /* SELinux requires early initialization in order to label
5703 all processes and objects when they are created. */
5704 security_initcall(selinux_init);
5706 #if defined(CONFIG_NETFILTER)
5708 static struct nf_hook_ops selinux_ipv4_ops[] = {
5710 .hook = selinux_ipv4_postroute,
5711 .owner = THIS_MODULE,
5713 .hooknum = NF_INET_POST_ROUTING,
5714 .priority = NF_IP_PRI_SELINUX_LAST,
5717 .hook = selinux_ipv4_forward,
5718 .owner = THIS_MODULE,
5720 .hooknum = NF_INET_FORWARD,
5721 .priority = NF_IP_PRI_SELINUX_FIRST,
5724 .hook = selinux_ipv4_output,
5725 .owner = THIS_MODULE,
5727 .hooknum = NF_INET_LOCAL_OUT,
5728 .priority = NF_IP_PRI_SELINUX_FIRST,
5732 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5734 static struct nf_hook_ops selinux_ipv6_ops[] = {
5736 .hook = selinux_ipv6_postroute,
5737 .owner = THIS_MODULE,
5739 .hooknum = NF_INET_POST_ROUTING,
5740 .priority = NF_IP6_PRI_SELINUX_LAST,
5743 .hook = selinux_ipv6_forward,
5744 .owner = THIS_MODULE,
5746 .hooknum = NF_INET_FORWARD,
5747 .priority = NF_IP6_PRI_SELINUX_FIRST,
5753 static int __init selinux_nf_ip_init(void)
5757 if (!selinux_enabled)
5760 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
5762 err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5764 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
5766 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5767 err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5769 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5776 __initcall(selinux_nf_ip_init);
5778 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5779 static void selinux_nf_ip_exit(void)
5781 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
5783 nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5784 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5785 nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5790 #else /* CONFIG_NETFILTER */
5792 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5793 #define selinux_nf_ip_exit()
5796 #endif /* CONFIG_NETFILTER */
5798 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5799 static int selinux_disabled;
5801 int selinux_disable(void)
5803 if (ss_initialized) {
5804 /* Not permitted after initial policy load. */
5808 if (selinux_disabled) {
5809 /* Only do this once. */
5813 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
5815 selinux_disabled = 1;
5816 selinux_enabled = 0;
5818 reset_security_ops();
5820 /* Try to destroy the avc node cache */
5823 /* Unregister netfilter hooks. */
5824 selinux_nf_ip_exit();
5826 /* Unregister selinuxfs. */