2 * NSA Security-Enhanced Linux (SELinux) security module
4 * This file contains the SELinux hook function implementations.
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul.moore@hp.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
26 #include <linux/init.h>
27 #include <linux/kernel.h>
28 #include <linux/tracehook.h>
29 #include <linux/errno.h>
30 #include <linux/sched.h>
31 #include <linux/security.h>
32 #include <linux/xattr.h>
33 #include <linux/capability.h>
34 #include <linux/unistd.h>
36 #include <linux/mman.h>
37 #include <linux/slab.h>
38 #include <linux/pagemap.h>
39 #include <linux/swap.h>
40 #include <linux/spinlock.h>
41 #include <linux/syscalls.h>
42 #include <linux/file.h>
43 #include <linux/fdtable.h>
44 #include <linux/namei.h>
45 #include <linux/mount.h>
46 #include <linux/proc_fs.h>
47 #include <linux/netfilter_ipv4.h>
48 #include <linux/netfilter_ipv6.h>
49 #include <linux/tty.h>
51 #include <net/ip.h> /* for local_port_range[] */
52 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
53 #include <net/net_namespace.h>
54 #include <net/netlabel.h>
55 #include <linux/uaccess.h>
56 #include <asm/ioctls.h>
57 #include <asm/atomic.h>
58 #include <linux/bitops.h>
59 #include <linux/interrupt.h>
60 #include <linux/netdevice.h> /* for network interface checks */
61 #include <linux/netlink.h>
62 #include <linux/tcp.h>
63 #include <linux/udp.h>
64 #include <linux/dccp.h>
65 #include <linux/quota.h>
66 #include <linux/un.h> /* for Unix socket types */
67 #include <net/af_unix.h> /* for Unix socket types */
68 #include <linux/parser.h>
69 #include <linux/nfs_mount.h>
71 #include <linux/hugetlb.h>
72 #include <linux/personality.h>
73 #include <linux/sysctl.h>
74 #include <linux/audit.h>
75 #include <linux/string.h>
76 #include <linux/selinux.h>
77 #include <linux/mutex.h>
78 #include <linux/posix-timers.h>
79 #include <linux/syslog.h>
90 #define XATTR_SELINUX_SUFFIX "selinux"
91 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
93 #define NUM_SEL_MNT_OPTS 5
95 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
96 extern struct security_operations *security_ops;
98 /* SECMARK reference count */
99 atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
101 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
102 int selinux_enforcing;
104 static int __init enforcing_setup(char *str)
106 unsigned long enforcing;
107 if (!strict_strtoul(str, 0, &enforcing))
108 selinux_enforcing = enforcing ? 1 : 0;
111 __setup("enforcing=", enforcing_setup);
114 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
115 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
117 static int __init selinux_enabled_setup(char *str)
119 unsigned long enabled;
120 if (!strict_strtoul(str, 0, &enabled))
121 selinux_enabled = enabled ? 1 : 0;
124 __setup("selinux=", selinux_enabled_setup);
126 int selinux_enabled = 1;
129 static struct kmem_cache *sel_inode_cache;
132 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
135 * This function checks the SECMARK reference counter to see if any SECMARK
136 * targets are currently configured, if the reference counter is greater than
137 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
138 * enabled, false (0) if SECMARK is disabled.
141 static int selinux_secmark_enabled(void)
143 return (atomic_read(&selinux_secmark_refcount) > 0);
147 * initialise the security for the init task
149 static void cred_init_security(void)
151 struct cred *cred = (struct cred *) current->real_cred;
152 struct task_security_struct *tsec;
154 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
156 panic("SELinux: Failed to initialize initial task.\n");
158 tsec->osid = tsec->sid = SECINITSID_KERNEL;
159 cred->security = tsec;
163 * get the security ID of a set of credentials
165 static inline u32 cred_sid(const struct cred *cred)
167 const struct task_security_struct *tsec;
169 tsec = cred->security;
174 * get the objective security ID of a task
176 static inline u32 task_sid(const struct task_struct *task)
181 sid = cred_sid(__task_cred(task));
187 * get the subjective security ID of the current task
189 static inline u32 current_sid(void)
191 const struct task_security_struct *tsec = current_cred()->security;
196 /* Allocate and free functions for each kind of security blob. */
198 static int inode_alloc_security(struct inode *inode)
200 struct inode_security_struct *isec;
201 u32 sid = current_sid();
203 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
207 mutex_init(&isec->lock);
208 INIT_LIST_HEAD(&isec->list);
210 isec->sid = SECINITSID_UNLABELED;
211 isec->sclass = SECCLASS_FILE;
212 isec->task_sid = sid;
213 inode->i_security = isec;
218 static void inode_free_security(struct inode *inode)
220 struct inode_security_struct *isec = inode->i_security;
221 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
223 spin_lock(&sbsec->isec_lock);
224 if (!list_empty(&isec->list))
225 list_del_init(&isec->list);
226 spin_unlock(&sbsec->isec_lock);
228 inode->i_security = NULL;
229 kmem_cache_free(sel_inode_cache, isec);
232 static int file_alloc_security(struct file *file)
234 struct file_security_struct *fsec;
235 u32 sid = current_sid();
237 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
242 fsec->fown_sid = sid;
243 file->f_security = fsec;
248 static void file_free_security(struct file *file)
250 struct file_security_struct *fsec = file->f_security;
251 file->f_security = NULL;
255 static int superblock_alloc_security(struct super_block *sb)
257 struct superblock_security_struct *sbsec;
259 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
263 mutex_init(&sbsec->lock);
264 INIT_LIST_HEAD(&sbsec->isec_head);
265 spin_lock_init(&sbsec->isec_lock);
267 sbsec->sid = SECINITSID_UNLABELED;
268 sbsec->def_sid = SECINITSID_FILE;
269 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
270 sb->s_security = sbsec;
275 static void superblock_free_security(struct super_block *sb)
277 struct superblock_security_struct *sbsec = sb->s_security;
278 sb->s_security = NULL;
282 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
284 struct sk_security_struct *sksec;
286 sksec = kzalloc(sizeof(*sksec), priority);
290 sksec->peer_sid = SECINITSID_UNLABELED;
291 sksec->sid = SECINITSID_UNLABELED;
292 sk->sk_security = sksec;
294 selinux_netlbl_sk_security_reset(sksec);
299 static void sk_free_security(struct sock *sk)
301 struct sk_security_struct *sksec = sk->sk_security;
303 sk->sk_security = NULL;
304 selinux_netlbl_sk_security_free(sksec);
308 /* The security server must be initialized before
309 any labeling or access decisions can be provided. */
310 extern int ss_initialized;
312 /* The file system's label must be initialized prior to use. */
314 static const char *labeling_behaviors[6] = {
316 "uses transition SIDs",
318 "uses genfs_contexts",
319 "not configured for labeling",
320 "uses mountpoint labeling",
323 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
325 static inline int inode_doinit(struct inode *inode)
327 return inode_doinit_with_dentry(inode, NULL);
336 Opt_labelsupport = 5,
339 static const match_table_t tokens = {
340 {Opt_context, CONTEXT_STR "%s"},
341 {Opt_fscontext, FSCONTEXT_STR "%s"},
342 {Opt_defcontext, DEFCONTEXT_STR "%s"},
343 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
344 {Opt_labelsupport, LABELSUPP_STR},
348 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
350 static int may_context_mount_sb_relabel(u32 sid,
351 struct superblock_security_struct *sbsec,
352 const struct cred *cred)
354 const struct task_security_struct *tsec = cred->security;
357 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
358 FILESYSTEM__RELABELFROM, NULL);
362 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
363 FILESYSTEM__RELABELTO, NULL);
367 static int may_context_mount_inode_relabel(u32 sid,
368 struct superblock_security_struct *sbsec,
369 const struct cred *cred)
371 const struct task_security_struct *tsec = cred->security;
373 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
374 FILESYSTEM__RELABELFROM, NULL);
378 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
379 FILESYSTEM__ASSOCIATE, NULL);
383 static int sb_finish_set_opts(struct super_block *sb)
385 struct superblock_security_struct *sbsec = sb->s_security;
386 struct dentry *root = sb->s_root;
387 struct inode *root_inode = root->d_inode;
390 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
391 /* Make sure that the xattr handler exists and that no
392 error other than -ENODATA is returned by getxattr on
393 the root directory. -ENODATA is ok, as this may be
394 the first boot of the SELinux kernel before we have
395 assigned xattr values to the filesystem. */
396 if (!root_inode->i_op->getxattr) {
397 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
398 "xattr support\n", sb->s_id, sb->s_type->name);
402 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
403 if (rc < 0 && rc != -ENODATA) {
404 if (rc == -EOPNOTSUPP)
405 printk(KERN_WARNING "SELinux: (dev %s, type "
406 "%s) has no security xattr handler\n",
407 sb->s_id, sb->s_type->name);
409 printk(KERN_WARNING "SELinux: (dev %s, type "
410 "%s) getxattr errno %d\n", sb->s_id,
411 sb->s_type->name, -rc);
416 sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
418 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
419 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
420 sb->s_id, sb->s_type->name);
422 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
423 sb->s_id, sb->s_type->name,
424 labeling_behaviors[sbsec->behavior-1]);
426 if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
427 sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
428 sbsec->behavior == SECURITY_FS_USE_NONE ||
429 sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
430 sbsec->flags &= ~SE_SBLABELSUPP;
432 /* Special handling for sysfs. Is genfs but also has setxattr handler*/
433 if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
434 sbsec->flags |= SE_SBLABELSUPP;
436 /* Initialize the root inode. */
437 rc = inode_doinit_with_dentry(root_inode, root);
439 /* Initialize any other inodes associated with the superblock, e.g.
440 inodes created prior to initial policy load or inodes created
441 during get_sb by a pseudo filesystem that directly
443 spin_lock(&sbsec->isec_lock);
445 if (!list_empty(&sbsec->isec_head)) {
446 struct inode_security_struct *isec =
447 list_entry(sbsec->isec_head.next,
448 struct inode_security_struct, list);
449 struct inode *inode = isec->inode;
450 spin_unlock(&sbsec->isec_lock);
451 inode = igrab(inode);
453 if (!IS_PRIVATE(inode))
457 spin_lock(&sbsec->isec_lock);
458 list_del_init(&isec->list);
461 spin_unlock(&sbsec->isec_lock);
467 * This function should allow an FS to ask what it's mount security
468 * options were so it can use those later for submounts, displaying
469 * mount options, or whatever.
471 static int selinux_get_mnt_opts(const struct super_block *sb,
472 struct security_mnt_opts *opts)
475 struct superblock_security_struct *sbsec = sb->s_security;
476 char *context = NULL;
480 security_init_mnt_opts(opts);
482 if (!(sbsec->flags & SE_SBINITIALIZED))
488 tmp = sbsec->flags & SE_MNTMASK;
489 /* count the number of mount options for this sb */
490 for (i = 0; i < 8; i++) {
492 opts->num_mnt_opts++;
495 /* Check if the Label support flag is set */
496 if (sbsec->flags & SE_SBLABELSUPP)
497 opts->num_mnt_opts++;
499 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
500 if (!opts->mnt_opts) {
505 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
506 if (!opts->mnt_opts_flags) {
512 if (sbsec->flags & FSCONTEXT_MNT) {
513 rc = security_sid_to_context(sbsec->sid, &context, &len);
516 opts->mnt_opts[i] = context;
517 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
519 if (sbsec->flags & CONTEXT_MNT) {
520 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
523 opts->mnt_opts[i] = context;
524 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
526 if (sbsec->flags & DEFCONTEXT_MNT) {
527 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
530 opts->mnt_opts[i] = context;
531 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
533 if (sbsec->flags & ROOTCONTEXT_MNT) {
534 struct inode *root = sbsec->sb->s_root->d_inode;
535 struct inode_security_struct *isec = root->i_security;
537 rc = security_sid_to_context(isec->sid, &context, &len);
540 opts->mnt_opts[i] = context;
541 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
543 if (sbsec->flags & SE_SBLABELSUPP) {
544 opts->mnt_opts[i] = NULL;
545 opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
548 BUG_ON(i != opts->num_mnt_opts);
553 security_free_mnt_opts(opts);
557 static int bad_option(struct superblock_security_struct *sbsec, char flag,
558 u32 old_sid, u32 new_sid)
560 char mnt_flags = sbsec->flags & SE_MNTMASK;
562 /* check if the old mount command had the same options */
563 if (sbsec->flags & SE_SBINITIALIZED)
564 if (!(sbsec->flags & flag) ||
565 (old_sid != new_sid))
568 /* check if we were passed the same options twice,
569 * aka someone passed context=a,context=b
571 if (!(sbsec->flags & SE_SBINITIALIZED))
572 if (mnt_flags & flag)
578 * Allow filesystems with binary mount data to explicitly set mount point
579 * labeling information.
581 static int selinux_set_mnt_opts(struct super_block *sb,
582 struct security_mnt_opts *opts)
584 const struct cred *cred = current_cred();
586 struct superblock_security_struct *sbsec = sb->s_security;
587 const char *name = sb->s_type->name;
588 struct inode *inode = sbsec->sb->s_root->d_inode;
589 struct inode_security_struct *root_isec = inode->i_security;
590 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
591 u32 defcontext_sid = 0;
592 char **mount_options = opts->mnt_opts;
593 int *flags = opts->mnt_opts_flags;
594 int num_opts = opts->num_mnt_opts;
596 mutex_lock(&sbsec->lock);
598 if (!ss_initialized) {
600 /* Defer initialization until selinux_complete_init,
601 after the initial policy is loaded and the security
602 server is ready to handle calls. */
606 printk(KERN_WARNING "SELinux: Unable to set superblock options "
607 "before the security server is initialized\n");
612 * Binary mount data FS will come through this function twice. Once
613 * from an explicit call and once from the generic calls from the vfs.
614 * Since the generic VFS calls will not contain any security mount data
615 * we need to skip the double mount verification.
617 * This does open a hole in which we will not notice if the first
618 * mount using this sb set explict options and a second mount using
619 * this sb does not set any security options. (The first options
620 * will be used for both mounts)
622 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
627 * parse the mount options, check if they are valid sids.
628 * also check if someone is trying to mount the same sb more
629 * than once with different security options.
631 for (i = 0; i < num_opts; i++) {
634 if (flags[i] == SE_SBLABELSUPP)
636 rc = security_context_to_sid(mount_options[i],
637 strlen(mount_options[i]), &sid);
639 printk(KERN_WARNING "SELinux: security_context_to_sid"
640 "(%s) failed for (dev %s, type %s) errno=%d\n",
641 mount_options[i], sb->s_id, name, rc);
648 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
650 goto out_double_mount;
652 sbsec->flags |= FSCONTEXT_MNT;
657 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
659 goto out_double_mount;
661 sbsec->flags |= CONTEXT_MNT;
663 case ROOTCONTEXT_MNT:
664 rootcontext_sid = sid;
666 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
668 goto out_double_mount;
670 sbsec->flags |= ROOTCONTEXT_MNT;
674 defcontext_sid = sid;
676 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
678 goto out_double_mount;
680 sbsec->flags |= DEFCONTEXT_MNT;
689 if (sbsec->flags & SE_SBINITIALIZED) {
690 /* previously mounted with options, but not on this attempt? */
691 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
692 goto out_double_mount;
697 if (strcmp(sb->s_type->name, "proc") == 0)
698 sbsec->flags |= SE_SBPROC;
700 /* Determine the labeling behavior to use for this filesystem type. */
701 rc = security_fs_use((sbsec->flags & SE_SBPROC) ? "proc" : sb->s_type->name, &sbsec->behavior, &sbsec->sid);
703 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
704 __func__, sb->s_type->name, rc);
708 /* sets the context of the superblock for the fs being mounted. */
710 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
714 sbsec->sid = fscontext_sid;
718 * Switch to using mount point labeling behavior.
719 * sets the label used on all file below the mountpoint, and will set
720 * the superblock context if not already set.
723 if (!fscontext_sid) {
724 rc = may_context_mount_sb_relabel(context_sid, sbsec,
728 sbsec->sid = context_sid;
730 rc = may_context_mount_inode_relabel(context_sid, sbsec,
735 if (!rootcontext_sid)
736 rootcontext_sid = context_sid;
738 sbsec->mntpoint_sid = context_sid;
739 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
742 if (rootcontext_sid) {
743 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
748 root_isec->sid = rootcontext_sid;
749 root_isec->initialized = 1;
752 if (defcontext_sid) {
753 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
755 printk(KERN_WARNING "SELinux: defcontext option is "
756 "invalid for this filesystem type\n");
760 if (defcontext_sid != sbsec->def_sid) {
761 rc = may_context_mount_inode_relabel(defcontext_sid,
767 sbsec->def_sid = defcontext_sid;
770 rc = sb_finish_set_opts(sb);
772 mutex_unlock(&sbsec->lock);
776 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
777 "security settings for (dev %s, type %s)\n", sb->s_id, name);
781 static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
782 struct super_block *newsb)
784 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
785 struct superblock_security_struct *newsbsec = newsb->s_security;
787 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
788 int set_context = (oldsbsec->flags & CONTEXT_MNT);
789 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
792 * if the parent was able to be mounted it clearly had no special lsm
793 * mount options. thus we can safely deal with this superblock later
798 /* how can we clone if the old one wasn't set up?? */
799 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
801 /* if fs is reusing a sb, just let its options stand... */
802 if (newsbsec->flags & SE_SBINITIALIZED)
805 mutex_lock(&newsbsec->lock);
807 newsbsec->flags = oldsbsec->flags;
809 newsbsec->sid = oldsbsec->sid;
810 newsbsec->def_sid = oldsbsec->def_sid;
811 newsbsec->behavior = oldsbsec->behavior;
814 u32 sid = oldsbsec->mntpoint_sid;
818 if (!set_rootcontext) {
819 struct inode *newinode = newsb->s_root->d_inode;
820 struct inode_security_struct *newisec = newinode->i_security;
823 newsbsec->mntpoint_sid = sid;
825 if (set_rootcontext) {
826 const struct inode *oldinode = oldsb->s_root->d_inode;
827 const struct inode_security_struct *oldisec = oldinode->i_security;
828 struct inode *newinode = newsb->s_root->d_inode;
829 struct inode_security_struct *newisec = newinode->i_security;
831 newisec->sid = oldisec->sid;
834 sb_finish_set_opts(newsb);
835 mutex_unlock(&newsbsec->lock);
838 static int selinux_parse_opts_str(char *options,
839 struct security_mnt_opts *opts)
842 char *context = NULL, *defcontext = NULL;
843 char *fscontext = NULL, *rootcontext = NULL;
844 int rc, num_mnt_opts = 0;
846 opts->num_mnt_opts = 0;
848 /* Standard string-based options. */
849 while ((p = strsep(&options, "|")) != NULL) {
851 substring_t args[MAX_OPT_ARGS];
856 token = match_token(p, tokens, args);
860 if (context || defcontext) {
862 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
865 context = match_strdup(&args[0]);
875 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
878 fscontext = match_strdup(&args[0]);
885 case Opt_rootcontext:
888 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
891 rootcontext = match_strdup(&args[0]);
899 if (context || defcontext) {
901 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
904 defcontext = match_strdup(&args[0]);
910 case Opt_labelsupport:
914 printk(KERN_WARNING "SELinux: unknown mount option\n");
921 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
925 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
926 if (!opts->mnt_opts_flags) {
927 kfree(opts->mnt_opts);
932 opts->mnt_opts[num_mnt_opts] = fscontext;
933 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
936 opts->mnt_opts[num_mnt_opts] = context;
937 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
940 opts->mnt_opts[num_mnt_opts] = rootcontext;
941 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
944 opts->mnt_opts[num_mnt_opts] = defcontext;
945 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
948 opts->num_mnt_opts = num_mnt_opts;
959 * string mount options parsing and call set the sbsec
961 static int superblock_doinit(struct super_block *sb, void *data)
964 char *options = data;
965 struct security_mnt_opts opts;
967 security_init_mnt_opts(&opts);
972 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
974 rc = selinux_parse_opts_str(options, &opts);
979 rc = selinux_set_mnt_opts(sb, &opts);
982 security_free_mnt_opts(&opts);
986 static void selinux_write_opts(struct seq_file *m,
987 struct security_mnt_opts *opts)
992 for (i = 0; i < opts->num_mnt_opts; i++) {
995 if (opts->mnt_opts[i])
996 has_comma = strchr(opts->mnt_opts[i], ',');
1000 switch (opts->mnt_opts_flags[i]) {
1002 prefix = CONTEXT_STR;
1005 prefix = FSCONTEXT_STR;
1007 case ROOTCONTEXT_MNT:
1008 prefix = ROOTCONTEXT_STR;
1010 case DEFCONTEXT_MNT:
1011 prefix = DEFCONTEXT_STR;
1013 case SE_SBLABELSUPP:
1015 seq_puts(m, LABELSUPP_STR);
1020 /* we need a comma before each option */
1022 seq_puts(m, prefix);
1025 seq_puts(m, opts->mnt_opts[i]);
1031 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1033 struct security_mnt_opts opts;
1036 rc = selinux_get_mnt_opts(sb, &opts);
1038 /* before policy load we may get EINVAL, don't show anything */
1044 selinux_write_opts(m, &opts);
1046 security_free_mnt_opts(&opts);
1051 static inline u16 inode_mode_to_security_class(umode_t mode)
1053 switch (mode & S_IFMT) {
1055 return SECCLASS_SOCK_FILE;
1057 return SECCLASS_LNK_FILE;
1059 return SECCLASS_FILE;
1061 return SECCLASS_BLK_FILE;
1063 return SECCLASS_DIR;
1065 return SECCLASS_CHR_FILE;
1067 return SECCLASS_FIFO_FILE;
1071 return SECCLASS_FILE;
1074 static inline int default_protocol_stream(int protocol)
1076 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1079 static inline int default_protocol_dgram(int protocol)
1081 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1084 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1090 case SOCK_SEQPACKET:
1091 return SECCLASS_UNIX_STREAM_SOCKET;
1093 return SECCLASS_UNIX_DGRAM_SOCKET;
1100 if (default_protocol_stream(protocol))
1101 return SECCLASS_TCP_SOCKET;
1103 return SECCLASS_RAWIP_SOCKET;
1105 if (default_protocol_dgram(protocol))
1106 return SECCLASS_UDP_SOCKET;
1108 return SECCLASS_RAWIP_SOCKET;
1110 return SECCLASS_DCCP_SOCKET;
1112 return SECCLASS_RAWIP_SOCKET;
1118 return SECCLASS_NETLINK_ROUTE_SOCKET;
1119 case NETLINK_FIREWALL:
1120 return SECCLASS_NETLINK_FIREWALL_SOCKET;
1121 case NETLINK_INET_DIAG:
1122 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1124 return SECCLASS_NETLINK_NFLOG_SOCKET;
1126 return SECCLASS_NETLINK_XFRM_SOCKET;
1127 case NETLINK_SELINUX:
1128 return SECCLASS_NETLINK_SELINUX_SOCKET;
1130 return SECCLASS_NETLINK_AUDIT_SOCKET;
1131 case NETLINK_IP6_FW:
1132 return SECCLASS_NETLINK_IP6FW_SOCKET;
1133 case NETLINK_DNRTMSG:
1134 return SECCLASS_NETLINK_DNRT_SOCKET;
1135 case NETLINK_KOBJECT_UEVENT:
1136 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1138 return SECCLASS_NETLINK_SOCKET;
1141 return SECCLASS_PACKET_SOCKET;
1143 return SECCLASS_KEY_SOCKET;
1145 return SECCLASS_APPLETALK_SOCKET;
1148 return SECCLASS_SOCKET;
1151 #ifdef CONFIG_PROC_FS
1152 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1157 char *buffer, *path, *end;
1159 buffer = (char *)__get_free_page(GFP_KERNEL);
1164 end = buffer+buflen;
1169 while (de && de != de->parent) {
1170 buflen -= de->namelen + 1;
1174 memcpy(end, de->name, de->namelen);
1179 rc = security_genfs_sid("proc", path, tclass, sid);
1180 free_page((unsigned long)buffer);
1184 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1192 /* The inode's security attributes must be initialized before first use. */
1193 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1195 struct superblock_security_struct *sbsec = NULL;
1196 struct inode_security_struct *isec = inode->i_security;
1198 struct dentry *dentry;
1199 #define INITCONTEXTLEN 255
1200 char *context = NULL;
1204 if (isec->initialized)
1207 mutex_lock(&isec->lock);
1208 if (isec->initialized)
1211 sbsec = inode->i_sb->s_security;
1212 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1213 /* Defer initialization until selinux_complete_init,
1214 after the initial policy is loaded and the security
1215 server is ready to handle calls. */
1216 spin_lock(&sbsec->isec_lock);
1217 if (list_empty(&isec->list))
1218 list_add(&isec->list, &sbsec->isec_head);
1219 spin_unlock(&sbsec->isec_lock);
1223 switch (sbsec->behavior) {
1224 case SECURITY_FS_USE_XATTR:
1225 if (!inode->i_op->getxattr) {
1226 isec->sid = sbsec->def_sid;
1230 /* Need a dentry, since the xattr API requires one.
1231 Life would be simpler if we could just pass the inode. */
1233 /* Called from d_instantiate or d_splice_alias. */
1234 dentry = dget(opt_dentry);
1236 /* Called from selinux_complete_init, try to find a dentry. */
1237 dentry = d_find_alias(inode);
1241 * this is can be hit on boot when a file is accessed
1242 * before the policy is loaded. When we load policy we
1243 * may find inodes that have no dentry on the
1244 * sbsec->isec_head list. No reason to complain as these
1245 * will get fixed up the next time we go through
1246 * inode_doinit with a dentry, before these inodes could
1247 * be used again by userspace.
1252 len = INITCONTEXTLEN;
1253 context = kmalloc(len+1, GFP_NOFS);
1259 context[len] = '\0';
1260 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1262 if (rc == -ERANGE) {
1265 /* Need a larger buffer. Query for the right size. */
1266 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1273 context = kmalloc(len+1, GFP_NOFS);
1279 context[len] = '\0';
1280 rc = inode->i_op->getxattr(dentry,
1286 if (rc != -ENODATA) {
1287 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1288 "%d for dev=%s ino=%ld\n", __func__,
1289 -rc, inode->i_sb->s_id, inode->i_ino);
1293 /* Map ENODATA to the default file SID */
1294 sid = sbsec->def_sid;
1297 rc = security_context_to_sid_default(context, rc, &sid,
1301 char *dev = inode->i_sb->s_id;
1302 unsigned long ino = inode->i_ino;
1304 if (rc == -EINVAL) {
1305 if (printk_ratelimit())
1306 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1307 "context=%s. This indicates you may need to relabel the inode or the "
1308 "filesystem in question.\n", ino, dev, context);
1310 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1311 "returned %d for dev=%s ino=%ld\n",
1312 __func__, context, -rc, dev, ino);
1315 /* Leave with the unlabeled SID */
1323 case SECURITY_FS_USE_TASK:
1324 isec->sid = isec->task_sid;
1326 case SECURITY_FS_USE_TRANS:
1327 /* Default to the fs SID. */
1328 isec->sid = sbsec->sid;
1330 /* Try to obtain a transition SID. */
1331 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1332 rc = security_transition_sid(isec->task_sid,
1340 case SECURITY_FS_USE_MNTPOINT:
1341 isec->sid = sbsec->mntpoint_sid;
1344 /* Default to the fs superblock SID. */
1345 isec->sid = sbsec->sid;
1347 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1348 struct proc_inode *proci = PROC_I(inode);
1350 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1351 rc = selinux_proc_get_sid(proci->pde,
1362 isec->initialized = 1;
1365 mutex_unlock(&isec->lock);
1367 if (isec->sclass == SECCLASS_FILE)
1368 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1372 /* Convert a Linux signal to an access vector. */
1373 static inline u32 signal_to_av(int sig)
1379 /* Commonly granted from child to parent. */
1380 perm = PROCESS__SIGCHLD;
1383 /* Cannot be caught or ignored */
1384 perm = PROCESS__SIGKILL;
1387 /* Cannot be caught or ignored */
1388 perm = PROCESS__SIGSTOP;
1391 /* All other signals. */
1392 perm = PROCESS__SIGNAL;
1400 * Check permission between a pair of credentials
1401 * fork check, ptrace check, etc.
1403 static int cred_has_perm(const struct cred *actor,
1404 const struct cred *target,
1407 u32 asid = cred_sid(actor), tsid = cred_sid(target);
1409 return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1413 * Check permission between a pair of tasks, e.g. signal checks,
1414 * fork check, ptrace check, etc.
1415 * tsk1 is the actor and tsk2 is the target
1416 * - this uses the default subjective creds of tsk1
1418 static int task_has_perm(const struct task_struct *tsk1,
1419 const struct task_struct *tsk2,
1422 const struct task_security_struct *__tsec1, *__tsec2;
1426 __tsec1 = __task_cred(tsk1)->security; sid1 = __tsec1->sid;
1427 __tsec2 = __task_cred(tsk2)->security; sid2 = __tsec2->sid;
1429 return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1433 * Check permission between current and another task, e.g. signal checks,
1434 * fork check, ptrace check, etc.
1435 * current is the actor and tsk2 is the target
1436 * - this uses current's subjective creds
1438 static int current_has_perm(const struct task_struct *tsk,
1443 sid = current_sid();
1444 tsid = task_sid(tsk);
1445 return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1448 #if CAP_LAST_CAP > 63
1449 #error Fix SELinux to handle capabilities > 63.
1452 /* Check whether a task is allowed to use a capability. */
1453 static int task_has_capability(struct task_struct *tsk,
1454 const struct cred *cred,
1457 struct common_audit_data ad;
1458 struct av_decision avd;
1460 u32 sid = cred_sid(cred);
1461 u32 av = CAP_TO_MASK(cap);
1464 COMMON_AUDIT_DATA_INIT(&ad, CAP);
1468 switch (CAP_TO_INDEX(cap)) {
1470 sclass = SECCLASS_CAPABILITY;
1473 sclass = SECCLASS_CAPABILITY2;
1477 "SELinux: out of range capability %d\n", cap);
1481 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1482 if (audit == SECURITY_CAP_AUDIT)
1483 avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
1487 /* Check whether a task is allowed to use a system operation. */
1488 static int task_has_system(struct task_struct *tsk,
1491 u32 sid = task_sid(tsk);
1493 return avc_has_perm(sid, SECINITSID_KERNEL,
1494 SECCLASS_SYSTEM, perms, NULL);
1497 /* Check whether a task has a particular permission to an inode.
1498 The 'adp' parameter is optional and allows other audit
1499 data to be passed (e.g. the dentry). */
1500 static int inode_has_perm(const struct cred *cred,
1501 struct inode *inode,
1503 struct common_audit_data *adp)
1505 struct inode_security_struct *isec;
1506 struct common_audit_data ad;
1509 validate_creds(cred);
1511 if (unlikely(IS_PRIVATE(inode)))
1514 sid = cred_sid(cred);
1515 isec = inode->i_security;
1519 COMMON_AUDIT_DATA_INIT(&ad, FS);
1520 ad.u.fs.inode = inode;
1523 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1526 /* Same as inode_has_perm, but pass explicit audit data containing
1527 the dentry to help the auditing code to more easily generate the
1528 pathname if needed. */
1529 static inline int dentry_has_perm(const struct cred *cred,
1530 struct vfsmount *mnt,
1531 struct dentry *dentry,
1534 struct inode *inode = dentry->d_inode;
1535 struct common_audit_data ad;
1537 COMMON_AUDIT_DATA_INIT(&ad, FS);
1538 ad.u.fs.path.mnt = mnt;
1539 ad.u.fs.path.dentry = dentry;
1540 return inode_has_perm(cred, inode, av, &ad);
1543 /* Check whether a task can use an open file descriptor to
1544 access an inode in a given way. Check access to the
1545 descriptor itself, and then use dentry_has_perm to
1546 check a particular permission to the file.
1547 Access to the descriptor is implicitly granted if it
1548 has the same SID as the process. If av is zero, then
1549 access to the file is not checked, e.g. for cases
1550 where only the descriptor is affected like seek. */
1551 static int file_has_perm(const struct cred *cred,
1555 struct file_security_struct *fsec = file->f_security;
1556 struct inode *inode = file->f_path.dentry->d_inode;
1557 struct common_audit_data ad;
1558 u32 sid = cred_sid(cred);
1561 COMMON_AUDIT_DATA_INIT(&ad, FS);
1562 ad.u.fs.path = file->f_path;
1564 if (sid != fsec->sid) {
1565 rc = avc_has_perm(sid, fsec->sid,
1573 /* av is zero if only checking access to the descriptor. */
1576 rc = inode_has_perm(cred, inode, av, &ad);
1582 /* Check whether a task can create a file. */
1583 static int may_create(struct inode *dir,
1584 struct dentry *dentry,
1587 const struct cred *cred = current_cred();
1588 const struct task_security_struct *tsec = cred->security;
1589 struct inode_security_struct *dsec;
1590 struct superblock_security_struct *sbsec;
1592 struct common_audit_data ad;
1595 dsec = dir->i_security;
1596 sbsec = dir->i_sb->s_security;
1599 newsid = tsec->create_sid;
1601 COMMON_AUDIT_DATA_INIT(&ad, FS);
1602 ad.u.fs.path.dentry = dentry;
1604 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1605 DIR__ADD_NAME | DIR__SEARCH,
1610 if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
1611 rc = security_transition_sid(sid, dsec->sid, tclass, &newsid);
1616 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1620 return avc_has_perm(newsid, sbsec->sid,
1621 SECCLASS_FILESYSTEM,
1622 FILESYSTEM__ASSOCIATE, &ad);
1625 /* Check whether a task can create a key. */
1626 static int may_create_key(u32 ksid,
1627 struct task_struct *ctx)
1629 u32 sid = task_sid(ctx);
1631 return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1635 #define MAY_UNLINK 1
1638 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1639 static int may_link(struct inode *dir,
1640 struct dentry *dentry,
1644 struct inode_security_struct *dsec, *isec;
1645 struct common_audit_data ad;
1646 u32 sid = current_sid();
1650 dsec = dir->i_security;
1651 isec = dentry->d_inode->i_security;
1653 COMMON_AUDIT_DATA_INIT(&ad, FS);
1654 ad.u.fs.path.dentry = dentry;
1657 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1658 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1673 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1678 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1682 static inline int may_rename(struct inode *old_dir,
1683 struct dentry *old_dentry,
1684 struct inode *new_dir,
1685 struct dentry *new_dentry)
1687 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1688 struct common_audit_data ad;
1689 u32 sid = current_sid();
1691 int old_is_dir, new_is_dir;
1694 old_dsec = old_dir->i_security;
1695 old_isec = old_dentry->d_inode->i_security;
1696 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1697 new_dsec = new_dir->i_security;
1699 COMMON_AUDIT_DATA_INIT(&ad, FS);
1701 ad.u.fs.path.dentry = old_dentry;
1702 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1703 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1706 rc = avc_has_perm(sid, old_isec->sid,
1707 old_isec->sclass, FILE__RENAME, &ad);
1710 if (old_is_dir && new_dir != old_dir) {
1711 rc = avc_has_perm(sid, old_isec->sid,
1712 old_isec->sclass, DIR__REPARENT, &ad);
1717 ad.u.fs.path.dentry = new_dentry;
1718 av = DIR__ADD_NAME | DIR__SEARCH;
1719 if (new_dentry->d_inode)
1720 av |= DIR__REMOVE_NAME;
1721 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1724 if (new_dentry->d_inode) {
1725 new_isec = new_dentry->d_inode->i_security;
1726 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1727 rc = avc_has_perm(sid, new_isec->sid,
1729 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1737 /* Check whether a task can perform a filesystem operation. */
1738 static int superblock_has_perm(const struct cred *cred,
1739 struct super_block *sb,
1741 struct common_audit_data *ad)
1743 struct superblock_security_struct *sbsec;
1744 u32 sid = cred_sid(cred);
1746 sbsec = sb->s_security;
1747 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1750 /* Convert a Linux mode and permission mask to an access vector. */
1751 static inline u32 file_mask_to_av(int mode, int mask)
1755 if ((mode & S_IFMT) != S_IFDIR) {
1756 if (mask & MAY_EXEC)
1757 av |= FILE__EXECUTE;
1758 if (mask & MAY_READ)
1761 if (mask & MAY_APPEND)
1763 else if (mask & MAY_WRITE)
1767 if (mask & MAY_EXEC)
1769 if (mask & MAY_WRITE)
1771 if (mask & MAY_READ)
1778 /* Convert a Linux file to an access vector. */
1779 static inline u32 file_to_av(struct file *file)
1783 if (file->f_mode & FMODE_READ)
1785 if (file->f_mode & FMODE_WRITE) {
1786 if (file->f_flags & O_APPEND)
1793 * Special file opened with flags 3 for ioctl-only use.
1802 * Convert a file to an access vector and include the correct open
1805 static inline u32 open_file_to_av(struct file *file)
1807 u32 av = file_to_av(file);
1809 if (selinux_policycap_openperm) {
1810 mode_t mode = file->f_path.dentry->d_inode->i_mode;
1812 * lnk files and socks do not really have an 'open'
1816 else if (S_ISCHR(mode))
1817 av |= CHR_FILE__OPEN;
1818 else if (S_ISBLK(mode))
1819 av |= BLK_FILE__OPEN;
1820 else if (S_ISFIFO(mode))
1821 av |= FIFO_FILE__OPEN;
1822 else if (S_ISDIR(mode))
1824 else if (S_ISSOCK(mode))
1825 av |= SOCK_FILE__OPEN;
1827 printk(KERN_ERR "SELinux: WARNING: inside %s with "
1828 "unknown mode:%o\n", __func__, mode);
1833 /* Hook functions begin here. */
1835 static int selinux_ptrace_access_check(struct task_struct *child,
1840 rc = cap_ptrace_access_check(child, mode);
1844 if (mode == PTRACE_MODE_READ) {
1845 u32 sid = current_sid();
1846 u32 csid = task_sid(child);
1847 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1850 return current_has_perm(child, PROCESS__PTRACE);
1853 static int selinux_ptrace_traceme(struct task_struct *parent)
1857 rc = cap_ptrace_traceme(parent);
1861 return task_has_perm(parent, current, PROCESS__PTRACE);
1864 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1865 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1869 error = current_has_perm(target, PROCESS__GETCAP);
1873 return cap_capget(target, effective, inheritable, permitted);
1876 static int selinux_capset(struct cred *new, const struct cred *old,
1877 const kernel_cap_t *effective,
1878 const kernel_cap_t *inheritable,
1879 const kernel_cap_t *permitted)
1883 error = cap_capset(new, old,
1884 effective, inheritable, permitted);
1888 return cred_has_perm(old, new, PROCESS__SETCAP);
1892 * (This comment used to live with the selinux_task_setuid hook,
1893 * which was removed).
1895 * Since setuid only affects the current process, and since the SELinux
1896 * controls are not based on the Linux identity attributes, SELinux does not
1897 * need to control this operation. However, SELinux does control the use of
1898 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1901 static int selinux_capable(struct task_struct *tsk, const struct cred *cred,
1906 rc = cap_capable(tsk, cred, cap, audit);
1910 return task_has_capability(tsk, cred, cap, audit);
1913 static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1916 char *buffer, *path, *end;
1919 buffer = (char *)__get_free_page(GFP_KERNEL);
1924 end = buffer+buflen;
1930 const char *name = table->procname;
1931 size_t namelen = strlen(name);
1932 buflen -= namelen + 1;
1936 memcpy(end, name, namelen);
1939 table = table->parent;
1945 memcpy(end, "/sys", 4);
1947 rc = security_genfs_sid("proc", path, tclass, sid);
1949 free_page((unsigned long)buffer);
1954 static int selinux_sysctl(ctl_table *table, int op)
1961 sid = current_sid();
1963 rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1964 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1966 /* Default to the well-defined sysctl SID. */
1967 tsid = SECINITSID_SYSCTL;
1970 /* The op values are "defined" in sysctl.c, thereby creating
1971 * a bad coupling between this module and sysctl.c */
1973 error = avc_has_perm(sid, tsid,
1974 SECCLASS_DIR, DIR__SEARCH, NULL);
1982 error = avc_has_perm(sid, tsid,
1983 SECCLASS_FILE, av, NULL);
1989 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1991 const struct cred *cred = current_cred();
2003 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2008 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2011 rc = 0; /* let the kernel handle invalid cmds */
2017 static int selinux_quota_on(struct dentry *dentry)
2019 const struct cred *cred = current_cred();
2021 return dentry_has_perm(cred, NULL, dentry, FILE__QUOTAON);
2024 static int selinux_syslog(int type, bool from_file)
2028 rc = cap_syslog(type, from_file);
2033 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2034 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2035 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2037 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2038 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2039 /* Set level of messages printed to console */
2040 case SYSLOG_ACTION_CONSOLE_LEVEL:
2041 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2043 case SYSLOG_ACTION_CLOSE: /* Close log */
2044 case SYSLOG_ACTION_OPEN: /* Open log */
2045 case SYSLOG_ACTION_READ: /* Read from log */
2046 case SYSLOG_ACTION_READ_CLEAR: /* Read/clear last kernel messages */
2047 case SYSLOG_ACTION_CLEAR: /* Clear ring buffer */
2049 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2056 * Check that a process has enough memory to allocate a new virtual
2057 * mapping. 0 means there is enough memory for the allocation to
2058 * succeed and -ENOMEM implies there is not.
2060 * Do not audit the selinux permission check, as this is applied to all
2061 * processes that allocate mappings.
2063 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2065 int rc, cap_sys_admin = 0;
2067 rc = selinux_capable(current, current_cred(), CAP_SYS_ADMIN,
2068 SECURITY_CAP_NOAUDIT);
2072 return __vm_enough_memory(mm, pages, cap_sys_admin);
2075 /* binprm security operations */
2077 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2079 const struct task_security_struct *old_tsec;
2080 struct task_security_struct *new_tsec;
2081 struct inode_security_struct *isec;
2082 struct common_audit_data ad;
2083 struct inode *inode = bprm->file->f_path.dentry->d_inode;
2086 rc = cap_bprm_set_creds(bprm);
2090 /* SELinux context only depends on initial program or script and not
2091 * the script interpreter */
2092 if (bprm->cred_prepared)
2095 old_tsec = current_security();
2096 new_tsec = bprm->cred->security;
2097 isec = inode->i_security;
2099 /* Default to the current task SID. */
2100 new_tsec->sid = old_tsec->sid;
2101 new_tsec->osid = old_tsec->sid;
2103 /* Reset fs, key, and sock SIDs on execve. */
2104 new_tsec->create_sid = 0;
2105 new_tsec->keycreate_sid = 0;
2106 new_tsec->sockcreate_sid = 0;
2108 if (old_tsec->exec_sid) {
2109 new_tsec->sid = old_tsec->exec_sid;
2110 /* Reset exec SID on execve. */
2111 new_tsec->exec_sid = 0;
2113 /* Check for a default transition on this program. */
2114 rc = security_transition_sid(old_tsec->sid, isec->sid,
2115 SECCLASS_PROCESS, &new_tsec->sid);
2120 COMMON_AUDIT_DATA_INIT(&ad, FS);
2121 ad.u.fs.path = bprm->file->f_path;
2123 if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
2124 new_tsec->sid = old_tsec->sid;
2126 if (new_tsec->sid == old_tsec->sid) {
2127 rc = avc_has_perm(old_tsec->sid, isec->sid,
2128 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2132 /* Check permissions for the transition. */
2133 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2134 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2138 rc = avc_has_perm(new_tsec->sid, isec->sid,
2139 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2143 /* Check for shared state */
2144 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2145 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2146 SECCLASS_PROCESS, PROCESS__SHARE,
2152 /* Make sure that anyone attempting to ptrace over a task that
2153 * changes its SID has the appropriate permit */
2155 (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2156 struct task_struct *tracer;
2157 struct task_security_struct *sec;
2161 tracer = tracehook_tracer_task(current);
2162 if (likely(tracer != NULL)) {
2163 sec = __task_cred(tracer)->security;
2169 rc = avc_has_perm(ptsid, new_tsec->sid,
2171 PROCESS__PTRACE, NULL);
2177 /* Clear any possibly unsafe personality bits on exec: */
2178 bprm->per_clear |= PER_CLEAR_ON_SETID;
2184 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2186 const struct cred *cred = current_cred();
2187 const struct task_security_struct *tsec = cred->security;
2195 /* Enable secure mode for SIDs transitions unless
2196 the noatsecure permission is granted between
2197 the two SIDs, i.e. ahp returns 0. */
2198 atsecure = avc_has_perm(osid, sid,
2200 PROCESS__NOATSECURE, NULL);
2203 return (atsecure || cap_bprm_secureexec(bprm));
2206 extern struct vfsmount *selinuxfs_mount;
2207 extern struct dentry *selinux_null;
2209 /* Derived from fs/exec.c:flush_old_files. */
2210 static inline void flush_unauthorized_files(const struct cred *cred,
2211 struct files_struct *files)
2213 struct common_audit_data ad;
2214 struct file *file, *devnull = NULL;
2215 struct tty_struct *tty;
2216 struct fdtable *fdt;
2220 tty = get_current_tty();
2223 if (!list_empty(&tty->tty_files)) {
2224 struct inode *inode;
2226 /* Revalidate access to controlling tty.
2227 Use inode_has_perm on the tty inode directly rather
2228 than using file_has_perm, as this particular open
2229 file may belong to another process and we are only
2230 interested in the inode-based check here. */
2231 file = list_first_entry(&tty->tty_files, struct file, f_u.fu_list);
2232 inode = file->f_path.dentry->d_inode;
2233 if (inode_has_perm(cred, inode,
2234 FILE__READ | FILE__WRITE, NULL)) {
2241 /* Reset controlling tty. */
2245 /* Revalidate access to inherited open files. */
2247 COMMON_AUDIT_DATA_INIT(&ad, FS);
2249 spin_lock(&files->file_lock);
2251 unsigned long set, i;
2256 fdt = files_fdtable(files);
2257 if (i >= fdt->max_fds)
2259 set = fdt->open_fds->fds_bits[j];
2262 spin_unlock(&files->file_lock);
2263 for ( ; set ; i++, set >>= 1) {
2268 if (file_has_perm(cred,
2270 file_to_av(file))) {
2272 fd = get_unused_fd();
2282 devnull = dentry_open(
2284 mntget(selinuxfs_mount),
2286 if (IS_ERR(devnull)) {
2293 fd_install(fd, devnull);
2298 spin_lock(&files->file_lock);
2301 spin_unlock(&files->file_lock);
2305 * Prepare a process for imminent new credential changes due to exec
2307 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2309 struct task_security_struct *new_tsec;
2310 struct rlimit *rlim, *initrlim;
2313 new_tsec = bprm->cred->security;
2314 if (new_tsec->sid == new_tsec->osid)
2317 /* Close files for which the new task SID is not authorized. */
2318 flush_unauthorized_files(bprm->cred, current->files);
2320 /* Always clear parent death signal on SID transitions. */
2321 current->pdeath_signal = 0;
2323 /* Check whether the new SID can inherit resource limits from the old
2324 * SID. If not, reset all soft limits to the lower of the current
2325 * task's hard limit and the init task's soft limit.
2327 * Note that the setting of hard limits (even to lower them) can be
2328 * controlled by the setrlimit check. The inclusion of the init task's
2329 * soft limit into the computation is to avoid resetting soft limits
2330 * higher than the default soft limit for cases where the default is
2331 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2333 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2334 PROCESS__RLIMITINH, NULL);
2336 for (i = 0; i < RLIM_NLIMITS; i++) {
2337 rlim = current->signal->rlim + i;
2338 initrlim = init_task.signal->rlim + i;
2339 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2341 update_rlimit_cpu(current,
2342 current->signal->rlim[RLIMIT_CPU].rlim_cur);
2347 * Clean up the process immediately after the installation of new credentials
2350 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2352 const struct task_security_struct *tsec = current_security();
2353 struct itimerval itimer;
2363 /* Check whether the new SID can inherit signal state from the old SID.
2364 * If not, clear itimers to avoid subsequent signal generation and
2365 * flush and unblock signals.
2367 * This must occur _after_ the task SID has been updated so that any
2368 * kill done after the flush will be checked against the new SID.
2370 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2372 memset(&itimer, 0, sizeof itimer);
2373 for (i = 0; i < 3; i++)
2374 do_setitimer(i, &itimer, NULL);
2375 spin_lock_irq(¤t->sighand->siglock);
2376 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2377 __flush_signals(current);
2378 flush_signal_handlers(current, 1);
2379 sigemptyset(¤t->blocked);
2381 spin_unlock_irq(¤t->sighand->siglock);
2384 /* Wake up the parent if it is waiting so that it can recheck
2385 * wait permission to the new task SID. */
2386 read_lock(&tasklist_lock);
2387 __wake_up_parent(current, current->real_parent);
2388 read_unlock(&tasklist_lock);
2391 /* superblock security operations */
2393 static int selinux_sb_alloc_security(struct super_block *sb)
2395 return superblock_alloc_security(sb);
2398 static void selinux_sb_free_security(struct super_block *sb)
2400 superblock_free_security(sb);
2403 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2408 return !memcmp(prefix, option, plen);
2411 static inline int selinux_option(char *option, int len)
2413 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2414 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2415 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2416 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2417 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2420 static inline void take_option(char **to, char *from, int *first, int len)
2427 memcpy(*to, from, len);
2431 static inline void take_selinux_option(char **to, char *from, int *first,
2434 int current_size = 0;
2442 while (current_size < len) {
2452 static int selinux_sb_copy_data(char *orig, char *copy)
2454 int fnosec, fsec, rc = 0;
2455 char *in_save, *in_curr, *in_end;
2456 char *sec_curr, *nosec_save, *nosec;
2462 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2470 in_save = in_end = orig;
2474 open_quote = !open_quote;
2475 if ((*in_end == ',' && open_quote == 0) ||
2477 int len = in_end - in_curr;
2479 if (selinux_option(in_curr, len))
2480 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2482 take_option(&nosec, in_curr, &fnosec, len);
2484 in_curr = in_end + 1;
2486 } while (*in_end++);
2488 strcpy(in_save, nosec_save);
2489 free_page((unsigned long)nosec_save);
2494 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2496 const struct cred *cred = current_cred();
2497 struct common_audit_data ad;
2500 rc = superblock_doinit(sb, data);
2504 /* Allow all mounts performed by the kernel */
2505 if (flags & MS_KERNMOUNT)
2508 COMMON_AUDIT_DATA_INIT(&ad, FS);
2509 ad.u.fs.path.dentry = sb->s_root;
2510 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2513 static int selinux_sb_statfs(struct dentry *dentry)
2515 const struct cred *cred = current_cred();
2516 struct common_audit_data ad;
2518 COMMON_AUDIT_DATA_INIT(&ad, FS);
2519 ad.u.fs.path.dentry = dentry->d_sb->s_root;
2520 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2523 static int selinux_mount(char *dev_name,
2526 unsigned long flags,
2529 const struct cred *cred = current_cred();
2531 if (flags & MS_REMOUNT)
2532 return superblock_has_perm(cred, path->mnt->mnt_sb,
2533 FILESYSTEM__REMOUNT, NULL);
2535 return dentry_has_perm(cred, path->mnt, path->dentry,
2539 static int selinux_umount(struct vfsmount *mnt, int flags)
2541 const struct cred *cred = current_cred();
2543 return superblock_has_perm(cred, mnt->mnt_sb,
2544 FILESYSTEM__UNMOUNT, NULL);
2547 /* inode security operations */
2549 static int selinux_inode_alloc_security(struct inode *inode)
2551 return inode_alloc_security(inode);
2554 static void selinux_inode_free_security(struct inode *inode)
2556 inode_free_security(inode);
2559 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2560 char **name, void **value,
2563 const struct cred *cred = current_cred();
2564 const struct task_security_struct *tsec = cred->security;
2565 struct inode_security_struct *dsec;
2566 struct superblock_security_struct *sbsec;
2567 u32 sid, newsid, clen;
2569 char *namep = NULL, *context;
2571 dsec = dir->i_security;
2572 sbsec = dir->i_sb->s_security;
2575 newsid = tsec->create_sid;
2577 if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
2578 rc = security_transition_sid(sid, dsec->sid,
2579 inode_mode_to_security_class(inode->i_mode),
2582 printk(KERN_WARNING "%s: "
2583 "security_transition_sid failed, rc=%d (dev=%s "
2586 -rc, inode->i_sb->s_id, inode->i_ino);
2591 /* Possibly defer initialization to selinux_complete_init. */
2592 if (sbsec->flags & SE_SBINITIALIZED) {
2593 struct inode_security_struct *isec = inode->i_security;
2594 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2596 isec->initialized = 1;
2599 if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
2603 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2610 rc = security_sid_to_context_force(newsid, &context, &clen);
2622 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2624 return may_create(dir, dentry, SECCLASS_FILE);
2627 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2629 return may_link(dir, old_dentry, MAY_LINK);
2632 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2634 return may_link(dir, dentry, MAY_UNLINK);
2637 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2639 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2642 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2644 return may_create(dir, dentry, SECCLASS_DIR);
2647 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2649 return may_link(dir, dentry, MAY_RMDIR);
2652 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2654 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2657 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2658 struct inode *new_inode, struct dentry *new_dentry)
2660 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2663 static int selinux_inode_readlink(struct dentry *dentry)
2665 const struct cred *cred = current_cred();
2667 return dentry_has_perm(cred, NULL, dentry, FILE__READ);
2670 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2672 const struct cred *cred = current_cred();
2674 return dentry_has_perm(cred, NULL, dentry, FILE__READ);
2677 static int selinux_inode_permission(struct inode *inode, int mask)
2679 const struct cred *cred = current_cred();
2682 /* No permission to check. Existence test. */
2686 return inode_has_perm(cred, inode,
2687 file_mask_to_av(inode->i_mode, mask), NULL);
2690 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2692 const struct cred *cred = current_cred();
2693 unsigned int ia_valid = iattr->ia_valid;
2695 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2696 if (ia_valid & ATTR_FORCE) {
2697 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2703 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2704 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2705 return dentry_has_perm(cred, NULL, dentry, FILE__SETATTR);
2707 return dentry_has_perm(cred, NULL, dentry, FILE__WRITE);
2710 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2712 const struct cred *cred = current_cred();
2714 return dentry_has_perm(cred, mnt, dentry, FILE__GETATTR);
2717 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2719 const struct cred *cred = current_cred();
2721 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2722 sizeof XATTR_SECURITY_PREFIX - 1)) {
2723 if (!strcmp(name, XATTR_NAME_CAPS)) {
2724 if (!capable(CAP_SETFCAP))
2726 } else if (!capable(CAP_SYS_ADMIN)) {
2727 /* A different attribute in the security namespace.
2728 Restrict to administrator. */
2733 /* Not an attribute we recognize, so just check the
2734 ordinary setattr permission. */
2735 return dentry_has_perm(cred, NULL, dentry, FILE__SETATTR);
2738 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2739 const void *value, size_t size, int flags)
2741 struct inode *inode = dentry->d_inode;
2742 struct inode_security_struct *isec = inode->i_security;
2743 struct superblock_security_struct *sbsec;
2744 struct common_audit_data ad;
2745 u32 newsid, sid = current_sid();
2748 if (strcmp(name, XATTR_NAME_SELINUX))
2749 return selinux_inode_setotherxattr(dentry, name);
2751 sbsec = inode->i_sb->s_security;
2752 if (!(sbsec->flags & SE_SBLABELSUPP))
2755 if (!is_owner_or_cap(inode))
2758 COMMON_AUDIT_DATA_INIT(&ad, FS);
2759 ad.u.fs.path.dentry = dentry;
2761 rc = avc_has_perm(sid, isec->sid, isec->sclass,
2762 FILE__RELABELFROM, &ad);
2766 rc = security_context_to_sid(value, size, &newsid);
2767 if (rc == -EINVAL) {
2768 if (!capable(CAP_MAC_ADMIN))
2770 rc = security_context_to_sid_force(value, size, &newsid);
2775 rc = avc_has_perm(sid, newsid, isec->sclass,
2776 FILE__RELABELTO, &ad);
2780 rc = security_validate_transition(isec->sid, newsid, sid,
2785 return avc_has_perm(newsid,
2787 SECCLASS_FILESYSTEM,
2788 FILESYSTEM__ASSOCIATE,
2792 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2793 const void *value, size_t size,
2796 struct inode *inode = dentry->d_inode;
2797 struct inode_security_struct *isec = inode->i_security;
2801 if (strcmp(name, XATTR_NAME_SELINUX)) {
2802 /* Not an attribute we recognize, so nothing to do. */
2806 rc = security_context_to_sid_force(value, size, &newsid);
2808 printk(KERN_ERR "SELinux: unable to map context to SID"
2809 "for (%s, %lu), rc=%d\n",
2810 inode->i_sb->s_id, inode->i_ino, -rc);
2818 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2820 const struct cred *cred = current_cred();
2822 return dentry_has_perm(cred, NULL, dentry, FILE__GETATTR);
2825 static int selinux_inode_listxattr(struct dentry *dentry)
2827 const struct cred *cred = current_cred();
2829 return dentry_has_perm(cred, NULL, dentry, FILE__GETATTR);
2832 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2834 if (strcmp(name, XATTR_NAME_SELINUX))
2835 return selinux_inode_setotherxattr(dentry, name);
2837 /* No one is allowed to remove a SELinux security label.
2838 You can change the label, but all data must be labeled. */
2843 * Copy the inode security context value to the user.
2845 * Permission check is handled by selinux_inode_getxattr hook.
2847 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2851 char *context = NULL;
2852 struct inode_security_struct *isec = inode->i_security;
2854 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2858 * If the caller has CAP_MAC_ADMIN, then get the raw context
2859 * value even if it is not defined by current policy; otherwise,
2860 * use the in-core value under current policy.
2861 * Use the non-auditing forms of the permission checks since
2862 * getxattr may be called by unprivileged processes commonly
2863 * and lack of permission just means that we fall back to the
2864 * in-core context value, not a denial.
2866 error = selinux_capable(current, current_cred(), CAP_MAC_ADMIN,
2867 SECURITY_CAP_NOAUDIT);
2869 error = security_sid_to_context_force(isec->sid, &context,
2872 error = security_sid_to_context(isec->sid, &context, &size);
2885 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2886 const void *value, size_t size, int flags)
2888 struct inode_security_struct *isec = inode->i_security;
2892 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2895 if (!value || !size)
2898 rc = security_context_to_sid((void *)value, size, &newsid);
2903 isec->initialized = 1;
2907 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2909 const int len = sizeof(XATTR_NAME_SELINUX);
2910 if (buffer && len <= buffer_size)
2911 memcpy(buffer, XATTR_NAME_SELINUX, len);
2915 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2917 struct inode_security_struct *isec = inode->i_security;
2921 /* file security operations */
2923 static int selinux_revalidate_file_permission(struct file *file, int mask)
2925 const struct cred *cred = current_cred();
2926 struct inode *inode = file->f_path.dentry->d_inode;
2928 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2929 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2932 return file_has_perm(cred, file,
2933 file_mask_to_av(inode->i_mode, mask));
2936 static int selinux_file_permission(struct file *file, int mask)
2938 struct inode *inode = file->f_path.dentry->d_inode;
2939 struct file_security_struct *fsec = file->f_security;
2940 struct inode_security_struct *isec = inode->i_security;
2941 u32 sid = current_sid();
2944 /* No permission to check. Existence test. */
2947 if (sid == fsec->sid && fsec->isid == isec->sid &&
2948 fsec->pseqno == avc_policy_seqno())
2949 /* No change since dentry_open check. */
2952 return selinux_revalidate_file_permission(file, mask);
2955 static int selinux_file_alloc_security(struct file *file)
2957 return file_alloc_security(file);
2960 static void selinux_file_free_security(struct file *file)
2962 file_free_security(file);
2965 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2968 const struct cred *cred = current_cred();
2971 if (_IOC_DIR(cmd) & _IOC_WRITE)
2973 if (_IOC_DIR(cmd) & _IOC_READ)
2978 return file_has_perm(cred, file, av);
2981 static int default_noexec;
2983 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2985 const struct cred *cred = current_cred();
2988 if (default_noexec &&
2989 (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2991 * We are making executable an anonymous mapping or a
2992 * private file mapping that will also be writable.
2993 * This has an additional check.
2995 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3001 /* read access is always possible with a mapping */
3002 u32 av = FILE__READ;
3004 /* write access only matters if the mapping is shared */
3005 if (shared && (prot & PROT_WRITE))
3008 if (prot & PROT_EXEC)
3009 av |= FILE__EXECUTE;
3011 return file_has_perm(cred, file, av);
3018 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
3019 unsigned long prot, unsigned long flags,
3020 unsigned long addr, unsigned long addr_only)
3023 u32 sid = current_sid();
3026 * notice that we are intentionally putting the SELinux check before
3027 * the secondary cap_file_mmap check. This is such a likely attempt
3028 * at bad behaviour/exploit that we always want to get the AVC, even
3029 * if DAC would have also denied the operation.
3031 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3032 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3033 MEMPROTECT__MMAP_ZERO, NULL);
3038 /* do DAC check on address space usage */
3039 rc = cap_file_mmap(file, reqprot, prot, flags, addr, addr_only);
3040 if (rc || addr_only)
3043 if (selinux_checkreqprot)
3046 return file_map_prot_check(file, prot,
3047 (flags & MAP_TYPE) == MAP_SHARED);
3050 static int selinux_file_mprotect(struct vm_area_struct *vma,
3051 unsigned long reqprot,
3054 const struct cred *cred = current_cred();
3056 if (selinux_checkreqprot)
3059 if (default_noexec &&
3060 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3062 if (vma->vm_start >= vma->vm_mm->start_brk &&
3063 vma->vm_end <= vma->vm_mm->brk) {
3064 rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3065 } else if (!vma->vm_file &&
3066 vma->vm_start <= vma->vm_mm->start_stack &&
3067 vma->vm_end >= vma->vm_mm->start_stack) {
3068 rc = current_has_perm(current, PROCESS__EXECSTACK);
3069 } else if (vma->vm_file && vma->anon_vma) {
3071 * We are making executable a file mapping that has
3072 * had some COW done. Since pages might have been
3073 * written, check ability to execute the possibly
3074 * modified content. This typically should only
3075 * occur for text relocations.
3077 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3083 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3086 static int selinux_file_lock(struct file *file, unsigned int cmd)
3088 const struct cred *cred = current_cred();
3090 return file_has_perm(cred, file, FILE__LOCK);
3093 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3096 const struct cred *cred = current_cred();
3101 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3106 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3107 err = file_has_perm(cred, file, FILE__WRITE);
3116 /* Just check FD__USE permission */
3117 err = file_has_perm(cred, file, 0);
3122 #if BITS_PER_LONG == 32
3127 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3131 err = file_has_perm(cred, file, FILE__LOCK);
3138 static int selinux_file_set_fowner(struct file *file)
3140 struct file_security_struct *fsec;
3142 fsec = file->f_security;
3143 fsec->fown_sid = current_sid();
3148 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3149 struct fown_struct *fown, int signum)
3152 u32 sid = task_sid(tsk);
3154 struct file_security_struct *fsec;
3156 /* struct fown_struct is never outside the context of a struct file */
3157 file = container_of(fown, struct file, f_owner);
3159 fsec = file->f_security;
3162 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3164 perm = signal_to_av(signum);
3166 return avc_has_perm(fsec->fown_sid, sid,
3167 SECCLASS_PROCESS, perm, NULL);
3170 static int selinux_file_receive(struct file *file)
3172 const struct cred *cred = current_cred();
3174 return file_has_perm(cred, file, file_to_av(file));
3177 static int selinux_dentry_open(struct file *file, const struct cred *cred)
3179 struct file_security_struct *fsec;
3180 struct inode *inode;
3181 struct inode_security_struct *isec;
3183 inode = file->f_path.dentry->d_inode;
3184 fsec = file->f_security;
3185 isec = inode->i_security;
3187 * Save inode label and policy sequence number
3188 * at open-time so that selinux_file_permission
3189 * can determine whether revalidation is necessary.
3190 * Task label is already saved in the file security
3191 * struct as its SID.
3193 fsec->isid = isec->sid;
3194 fsec->pseqno = avc_policy_seqno();
3196 * Since the inode label or policy seqno may have changed
3197 * between the selinux_inode_permission check and the saving
3198 * of state above, recheck that access is still permitted.
3199 * Otherwise, access might never be revalidated against the
3200 * new inode label or new policy.
3201 * This check is not redundant - do not remove.
3203 return inode_has_perm(cred, inode, open_file_to_av(file), NULL);
3206 /* task security operations */
3208 static int selinux_task_create(unsigned long clone_flags)
3210 return current_has_perm(current, PROCESS__FORK);
3214 * allocate the SELinux part of blank credentials
3216 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3218 struct task_security_struct *tsec;
3220 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3224 cred->security = tsec;
3229 * detach and free the LSM part of a set of credentials
3231 static void selinux_cred_free(struct cred *cred)
3233 struct task_security_struct *tsec = cred->security;
3235 BUG_ON((unsigned long) cred->security < PAGE_SIZE);
3236 cred->security = (void *) 0x7UL;
3241 * prepare a new set of credentials for modification
3243 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3246 const struct task_security_struct *old_tsec;
3247 struct task_security_struct *tsec;
3249 old_tsec = old->security;
3251 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3255 new->security = tsec;
3260 * transfer the SELinux data to a blank set of creds
3262 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3264 const struct task_security_struct *old_tsec = old->security;
3265 struct task_security_struct *tsec = new->security;
3271 * set the security data for a kernel service
3272 * - all the creation contexts are set to unlabelled
3274 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3276 struct task_security_struct *tsec = new->security;
3277 u32 sid = current_sid();
3280 ret = avc_has_perm(sid, secid,
3281 SECCLASS_KERNEL_SERVICE,
3282 KERNEL_SERVICE__USE_AS_OVERRIDE,
3286 tsec->create_sid = 0;
3287 tsec->keycreate_sid = 0;
3288 tsec->sockcreate_sid = 0;
3294 * set the file creation context in a security record to the same as the
3295 * objective context of the specified inode
3297 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3299 struct inode_security_struct *isec = inode->i_security;
3300 struct task_security_struct *tsec = new->security;
3301 u32 sid = current_sid();
3304 ret = avc_has_perm(sid, isec->sid,
3305 SECCLASS_KERNEL_SERVICE,
3306 KERNEL_SERVICE__CREATE_FILES_AS,
3310 tsec->create_sid = isec->sid;
3314 static int selinux_kernel_module_request(char *kmod_name)
3317 struct common_audit_data ad;
3319 sid = task_sid(current);
3321 COMMON_AUDIT_DATA_INIT(&ad, KMOD);
3322 ad.u.kmod_name = kmod_name;
3324 return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3325 SYSTEM__MODULE_REQUEST, &ad);
3328 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3330 return current_has_perm(p, PROCESS__SETPGID);
3333 static int selinux_task_getpgid(struct task_struct *p)
3335 return current_has_perm(p, PROCESS__GETPGID);
3338 static int selinux_task_getsid(struct task_struct *p)
3340 return current_has_perm(p, PROCESS__GETSESSION);
3343 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3345 *secid = task_sid(p);
3348 static int selinux_task_setnice(struct task_struct *p, int nice)
3352 rc = cap_task_setnice(p, nice);
3356 return current_has_perm(p, PROCESS__SETSCHED);
3359 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3363 rc = cap_task_setioprio(p, ioprio);
3367 return current_has_perm(p, PROCESS__SETSCHED);
3370 static int selinux_task_getioprio(struct task_struct *p)
3372 return current_has_perm(p, PROCESS__GETSCHED);
3375 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3376 struct rlimit *new_rlim)
3378 struct rlimit *old_rlim = p->signal->rlim + resource;
3380 /* Control the ability to change the hard limit (whether
3381 lowering or raising it), so that the hard limit can
3382 later be used as a safe reset point for the soft limit
3383 upon context transitions. See selinux_bprm_committing_creds. */
3384 if (old_rlim->rlim_max != new_rlim->rlim_max)
3385 return current_has_perm(p, PROCESS__SETRLIMIT);
3390 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
3394 rc = cap_task_setscheduler(p, policy, lp);
3398 return current_has_perm(p, PROCESS__SETSCHED);
3401 static int selinux_task_getscheduler(struct task_struct *p)
3403 return current_has_perm(p, PROCESS__GETSCHED);
3406 static int selinux_task_movememory(struct task_struct *p)
3408 return current_has_perm(p, PROCESS__SETSCHED);
3411 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3418 perm = PROCESS__SIGNULL; /* null signal; existence test */
3420 perm = signal_to_av(sig);
3422 rc = avc_has_perm(secid, task_sid(p),
3423 SECCLASS_PROCESS, perm, NULL);
3425 rc = current_has_perm(p, perm);
3429 static int selinux_task_wait(struct task_struct *p)
3431 return task_has_perm(p, current, PROCESS__SIGCHLD);
3434 static void selinux_task_to_inode(struct task_struct *p,
3435 struct inode *inode)
3437 struct inode_security_struct *isec = inode->i_security;
3438 u32 sid = task_sid(p);
3441 isec->initialized = 1;
3444 /* Returns error only if unable to parse addresses */
3445 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3446 struct common_audit_data *ad, u8 *proto)
3448 int offset, ihlen, ret = -EINVAL;
3449 struct iphdr _iph, *ih;
3451 offset = skb_network_offset(skb);
3452 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3456 ihlen = ih->ihl * 4;
3457 if (ihlen < sizeof(_iph))
3460 ad->u.net.v4info.saddr = ih->saddr;
3461 ad->u.net.v4info.daddr = ih->daddr;
3465 *proto = ih->protocol;
3467 switch (ih->protocol) {
3469 struct tcphdr _tcph, *th;
3471 if (ntohs(ih->frag_off) & IP_OFFSET)
3475 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3479 ad->u.net.sport = th->source;
3480 ad->u.net.dport = th->dest;
3485 struct udphdr _udph, *uh;
3487 if (ntohs(ih->frag_off) & IP_OFFSET)
3491 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3495 ad->u.net.sport = uh->source;
3496 ad->u.net.dport = uh->dest;
3500 case IPPROTO_DCCP: {
3501 struct dccp_hdr _dccph, *dh;
3503 if (ntohs(ih->frag_off) & IP_OFFSET)
3507 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3511 ad->u.net.sport = dh->dccph_sport;
3512 ad->u.net.dport = dh->dccph_dport;
3523 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3525 /* Returns error only if unable to parse addresses */
3526 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3527 struct common_audit_data *ad, u8 *proto)
3530 int ret = -EINVAL, offset;
3531 struct ipv6hdr _ipv6h, *ip6;
3533 offset = skb_network_offset(skb);
3534 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3538 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3539 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3542 nexthdr = ip6->nexthdr;
3543 offset += sizeof(_ipv6h);
3544 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
3553 struct tcphdr _tcph, *th;
3555 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3559 ad->u.net.sport = th->source;
3560 ad->u.net.dport = th->dest;
3565 struct udphdr _udph, *uh;
3567 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3571 ad->u.net.sport = uh->source;
3572 ad->u.net.dport = uh->dest;
3576 case IPPROTO_DCCP: {
3577 struct dccp_hdr _dccph, *dh;
3579 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3583 ad->u.net.sport = dh->dccph_sport;
3584 ad->u.net.dport = dh->dccph_dport;
3588 /* includes fragments */
3598 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3599 char **_addrp, int src, u8 *proto)
3604 switch (ad->u.net.family) {
3606 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3609 addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3610 &ad->u.net.v4info.daddr);
3613 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3615 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3618 addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3619 &ad->u.net.v6info.daddr);
3629 "SELinux: failure in selinux_parse_skb(),"
3630 " unable to parse packet\n");
3640 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3642 * @family: protocol family
3643 * @sid: the packet's peer label SID
3646 * Check the various different forms of network peer labeling and determine
3647 * the peer label/SID for the packet; most of the magic actually occurs in
3648 * the security server function security_net_peersid_cmp(). The function
3649 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3650 * or -EACCES if @sid is invalid due to inconsistencies with the different
3654 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3661 selinux_skb_xfrm_sid(skb, &xfrm_sid);
3662 selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3664 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3665 if (unlikely(err)) {
3667 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3668 " unable to determine packet's peer label\n");
3675 /* socket security operations */
3676 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3679 struct inode_security_struct *isec;
3680 struct common_audit_data ad;
3684 isec = SOCK_INODE(sock)->i_security;
3686 if (isec->sid == SECINITSID_KERNEL)
3688 sid = task_sid(task);
3690 COMMON_AUDIT_DATA_INIT(&ad, NET);
3691 ad.u.net.sk = sock->sk;
3692 err = avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
3698 static int selinux_socket_create(int family, int type,
3699 int protocol, int kern)
3701 const struct cred *cred = current_cred();
3702 const struct task_security_struct *tsec = cred->security;
3711 newsid = tsec->sockcreate_sid ?: sid;
3713 secclass = socket_type_to_security_class(family, type, protocol);
3714 err = avc_has_perm(sid, newsid, secclass, SOCKET__CREATE, NULL);
3720 static int selinux_socket_post_create(struct socket *sock, int family,
3721 int type, int protocol, int kern)
3723 const struct cred *cred = current_cred();
3724 const struct task_security_struct *tsec = cred->security;
3725 struct inode_security_struct *isec;
3726 struct sk_security_struct *sksec;
3731 newsid = tsec->sockcreate_sid;
3733 isec = SOCK_INODE(sock)->i_security;
3736 isec->sid = SECINITSID_KERNEL;
3742 isec->sclass = socket_type_to_security_class(family, type, protocol);
3743 isec->initialized = 1;
3746 sksec = sock->sk->sk_security;
3747 sksec->sid = isec->sid;
3748 sksec->sclass = isec->sclass;
3749 err = selinux_netlbl_socket_post_create(sock->sk, family);
3755 /* Range of port numbers used to automatically bind.
3756 Need to determine whether we should perform a name_bind
3757 permission check between the socket and the port number. */
3759 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3764 err = socket_has_perm(current, sock, SOCKET__BIND);
3769 * If PF_INET or PF_INET6, check name_bind permission for the port.
3770 * Multiple address binding for SCTP is not supported yet: we just
3771 * check the first address now.
3773 family = sock->sk->sk_family;
3774 if (family == PF_INET || family == PF_INET6) {
3776 struct inode_security_struct *isec;
3777 struct common_audit_data ad;
3778 struct sockaddr_in *addr4 = NULL;
3779 struct sockaddr_in6 *addr6 = NULL;
3780 unsigned short snum;
3781 struct sock *sk = sock->sk;
3784 isec = SOCK_INODE(sock)->i_security;
3786 if (family == PF_INET) {
3787 addr4 = (struct sockaddr_in *)address;
3788 snum = ntohs(addr4->sin_port);
3789 addrp = (char *)&addr4->sin_addr.s_addr;
3791 addr6 = (struct sockaddr_in6 *)address;
3792 snum = ntohs(addr6->sin6_port);
3793 addrp = (char *)&addr6->sin6_addr.s6_addr;
3799 inet_get_local_port_range(&low, &high);
3801 if (snum < max(PROT_SOCK, low) || snum > high) {
3802 err = sel_netport_sid(sk->sk_protocol,
3806 COMMON_AUDIT_DATA_INIT(&ad, NET);
3807 ad.u.net.sport = htons(snum);
3808 ad.u.net.family = family;
3809 err = avc_has_perm(isec->sid, sid,
3811 SOCKET__NAME_BIND, &ad);
3817 switch (isec->sclass) {
3818 case SECCLASS_TCP_SOCKET:
3819 node_perm = TCP_SOCKET__NODE_BIND;
3822 case SECCLASS_UDP_SOCKET:
3823 node_perm = UDP_SOCKET__NODE_BIND;
3826 case SECCLASS_DCCP_SOCKET:
3827 node_perm = DCCP_SOCKET__NODE_BIND;
3831 node_perm = RAWIP_SOCKET__NODE_BIND;
3835 err = sel_netnode_sid(addrp, family, &sid);
3839 COMMON_AUDIT_DATA_INIT(&ad, NET);
3840 ad.u.net.sport = htons(snum);
3841 ad.u.net.family = family;
3843 if (family == PF_INET)
3844 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3846 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3848 err = avc_has_perm(isec->sid, sid,
3849 isec->sclass, node_perm, &ad);
3857 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3859 struct sock *sk = sock->sk;
3860 struct inode_security_struct *isec;
3863 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3868 * If a TCP or DCCP socket, check name_connect permission for the port.
3870 isec = SOCK_INODE(sock)->i_security;
3871 if (isec->sclass == SECCLASS_TCP_SOCKET ||
3872 isec->sclass == SECCLASS_DCCP_SOCKET) {
3873 struct common_audit_data ad;
3874 struct sockaddr_in *addr4 = NULL;
3875 struct sockaddr_in6 *addr6 = NULL;
3876 unsigned short snum;
3879 if (sk->sk_family == PF_INET) {
3880 addr4 = (struct sockaddr_in *)address;
3881 if (addrlen < sizeof(struct sockaddr_in))
3883 snum = ntohs(addr4->sin_port);
3885 addr6 = (struct sockaddr_in6 *)address;
3886 if (addrlen < SIN6_LEN_RFC2133)
3888 snum = ntohs(addr6->sin6_port);
3891 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
3895 perm = (isec->sclass == SECCLASS_TCP_SOCKET) ?
3896 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3898 COMMON_AUDIT_DATA_INIT(&ad, NET);
3899 ad.u.net.dport = htons(snum);
3900 ad.u.net.family = sk->sk_family;
3901 err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad);
3906 err = selinux_netlbl_socket_connect(sk, address);
3912 static int selinux_socket_listen(struct socket *sock, int backlog)
3914 return socket_has_perm(current, sock, SOCKET__LISTEN);
3917 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3920 struct inode_security_struct *isec;
3921 struct inode_security_struct *newisec;
3923 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3927 newisec = SOCK_INODE(newsock)->i_security;
3929 isec = SOCK_INODE(sock)->i_security;
3930 newisec->sclass = isec->sclass;
3931 newisec->sid = isec->sid;
3932 newisec->initialized = 1;
3937 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3940 return socket_has_perm(current, sock, SOCKET__WRITE);
3943 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3944 int size, int flags)
3946 return socket_has_perm(current, sock, SOCKET__READ);
3949 static int selinux_socket_getsockname(struct socket *sock)
3951 return socket_has_perm(current, sock, SOCKET__GETATTR);
3954 static int selinux_socket_getpeername(struct socket *sock)
3956 return socket_has_perm(current, sock, SOCKET__GETATTR);
3959 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
3963 err = socket_has_perm(current, sock, SOCKET__SETOPT);
3967 return selinux_netlbl_socket_setsockopt(sock, level, optname);
3970 static int selinux_socket_getsockopt(struct socket *sock, int level,
3973 return socket_has_perm(current, sock, SOCKET__GETOPT);
3976 static int selinux_socket_shutdown(struct socket *sock, int how)
3978 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3981 static int selinux_socket_unix_stream_connect(struct socket *sock,
3982 struct socket *other,
3985 struct sk_security_struct *sksec;
3986 struct inode_security_struct *isec;
3987 struct inode_security_struct *other_isec;
3988 struct common_audit_data ad;
3991 isec = SOCK_INODE(sock)->i_security;
3992 other_isec = SOCK_INODE(other)->i_security;
3994 COMMON_AUDIT_DATA_INIT(&ad, NET);
3995 ad.u.net.sk = other->sk;
3997 err = avc_has_perm(isec->sid, other_isec->sid,
3999 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4003 /* connecting socket */
4004 sksec = sock->sk->sk_security;
4005 sksec->peer_sid = other_isec->sid;
4007 /* server child socket */
4008 sksec = newsk->sk_security;
4009 sksec->peer_sid = isec->sid;
4010 err = security_sid_mls_copy(other_isec->sid, sksec->peer_sid, &sksec->sid);
4015 static int selinux_socket_unix_may_send(struct socket *sock,
4016 struct socket *other)
4018 struct inode_security_struct *isec;
4019 struct inode_security_struct *other_isec;
4020 struct common_audit_data ad;
4023 isec = SOCK_INODE(sock)->i_security;
4024 other_isec = SOCK_INODE(other)->i_security;
4026 COMMON_AUDIT_DATA_INIT(&ad, NET);
4027 ad.u.net.sk = other->sk;
4029 err = avc_has_perm(isec->sid, other_isec->sid,
4030 isec->sclass, SOCKET__SENDTO, &ad);
4037 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4039 struct common_audit_data *ad)
4045 err = sel_netif_sid(ifindex, &if_sid);
4048 err = avc_has_perm(peer_sid, if_sid,
4049 SECCLASS_NETIF, NETIF__INGRESS, ad);
4053 err = sel_netnode_sid(addrp, family, &node_sid);
4056 return avc_has_perm(peer_sid, node_sid,
4057 SECCLASS_NODE, NODE__RECVFROM, ad);
4060 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4064 struct sk_security_struct *sksec = sk->sk_security;
4066 u32 sk_sid = sksec->sid;
4067 struct common_audit_data ad;
4070 COMMON_AUDIT_DATA_INIT(&ad, NET);
4071 ad.u.net.netif = skb->skb_iif;
4072 ad.u.net.family = family;
4073 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4077 if (selinux_secmark_enabled()) {
4078 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4084 if (selinux_policycap_netpeer) {
4085 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4088 err = avc_has_perm(sk_sid, peer_sid,
4089 SECCLASS_PEER, PEER__RECV, &ad);
4091 selinux_netlbl_err(skb, err, 0);
4093 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4096 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4102 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4105 struct sk_security_struct *sksec = sk->sk_security;
4106 u16 family = sk->sk_family;
4107 u32 sk_sid = sksec->sid;
4108 struct common_audit_data ad;
4113 if (family != PF_INET && family != PF_INET6)
4116 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4117 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4120 /* If any sort of compatibility mode is enabled then handoff processing
4121 * to the selinux_sock_rcv_skb_compat() function to deal with the
4122 * special handling. We do this in an attempt to keep this function
4123 * as fast and as clean as possible. */
4124 if (!selinux_policycap_netpeer)
4125 return selinux_sock_rcv_skb_compat(sk, skb, family);
4127 secmark_active = selinux_secmark_enabled();
4128 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4129 if (!secmark_active && !peerlbl_active)
4132 COMMON_AUDIT_DATA_INIT(&ad, NET);
4133 ad.u.net.netif = skb->skb_iif;
4134 ad.u.net.family = family;
4135 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4139 if (peerlbl_active) {
4142 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4145 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4148 selinux_netlbl_err(skb, err, 0);
4151 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4154 selinux_netlbl_err(skb, err, 0);
4157 if (secmark_active) {
4158 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4167 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4168 int __user *optlen, unsigned len)
4173 struct sk_security_struct *sksec;
4174 struct inode_security_struct *isec;
4175 u32 peer_sid = SECSID_NULL;
4177 isec = SOCK_INODE(sock)->i_security;
4179 if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4180 isec->sclass == SECCLASS_TCP_SOCKET) {
4181 sksec = sock->sk->sk_security;
4182 peer_sid = sksec->peer_sid;
4184 if (peer_sid == SECSID_NULL) {
4189 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4194 if (scontext_len > len) {
4199 if (copy_to_user(optval, scontext, scontext_len))
4203 if (put_user(scontext_len, optlen))
4211 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4213 u32 peer_secid = SECSID_NULL;
4216 if (skb && skb->protocol == htons(ETH_P_IP))
4218 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4221 family = sock->sk->sk_family;
4225 if (sock && family == PF_UNIX)
4226 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4228 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4231 *secid = peer_secid;
4232 if (peer_secid == SECSID_NULL)
4237 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4239 return sk_alloc_security(sk, family, priority);
4242 static void selinux_sk_free_security(struct sock *sk)
4244 sk_free_security(sk);
4247 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4249 struct sk_security_struct *sksec = sk->sk_security;
4250 struct sk_security_struct *newsksec = newsk->sk_security;
4252 newsksec->sid = sksec->sid;
4253 newsksec->peer_sid = sksec->peer_sid;
4254 newsksec->sclass = sksec->sclass;
4256 selinux_netlbl_sk_security_reset(newsksec);
4259 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4262 *secid = SECINITSID_ANY_SOCKET;
4264 struct sk_security_struct *sksec = sk->sk_security;
4266 *secid = sksec->sid;
4270 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4272 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4273 struct sk_security_struct *sksec = sk->sk_security;
4275 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4276 sk->sk_family == PF_UNIX)
4277 isec->sid = sksec->sid;
4278 sksec->sclass = isec->sclass;
4281 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4282 struct request_sock *req)
4284 struct sk_security_struct *sksec = sk->sk_security;
4286 u16 family = sk->sk_family;
4290 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4291 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4294 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4297 if (peersid == SECSID_NULL) {
4298 req->secid = sksec->sid;
4299 req->peer_secid = SECSID_NULL;
4301 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4304 req->secid = newsid;
4305 req->peer_secid = peersid;
4308 return selinux_netlbl_inet_conn_request(req, family);
4311 static void selinux_inet_csk_clone(struct sock *newsk,
4312 const struct request_sock *req)
4314 struct sk_security_struct *newsksec = newsk->sk_security;
4316 newsksec->sid = req->secid;
4317 newsksec->peer_sid = req->peer_secid;
4318 /* NOTE: Ideally, we should also get the isec->sid for the
4319 new socket in sync, but we don't have the isec available yet.
4320 So we will wait until sock_graft to do it, by which
4321 time it will have been created and available. */
4323 /* We don't need to take any sort of lock here as we are the only
4324 * thread with access to newsksec */
4325 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4328 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4330 u16 family = sk->sk_family;
4331 struct sk_security_struct *sksec = sk->sk_security;
4333 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4334 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4337 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4340 static void selinux_req_classify_flow(const struct request_sock *req,
4343 fl->secid = req->secid;
4346 static int selinux_tun_dev_create(void)
4348 u32 sid = current_sid();
4350 /* we aren't taking into account the "sockcreate" SID since the socket
4351 * that is being created here is not a socket in the traditional sense,
4352 * instead it is a private sock, accessible only to the kernel, and
4353 * representing a wide range of network traffic spanning multiple
4354 * connections unlike traditional sockets - check the TUN driver to
4355 * get a better understanding of why this socket is special */
4357 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4361 static void selinux_tun_dev_post_create(struct sock *sk)
4363 struct sk_security_struct *sksec = sk->sk_security;
4365 /* we don't currently perform any NetLabel based labeling here and it
4366 * isn't clear that we would want to do so anyway; while we could apply
4367 * labeling without the support of the TUN user the resulting labeled
4368 * traffic from the other end of the connection would almost certainly
4369 * cause confusion to the TUN user that had no idea network labeling
4370 * protocols were being used */
4372 /* see the comments in selinux_tun_dev_create() about why we don't use
4373 * the sockcreate SID here */
4375 sksec->sid = current_sid();
4376 sksec->sclass = SECCLASS_TUN_SOCKET;
4379 static int selinux_tun_dev_attach(struct sock *sk)
4381 struct sk_security_struct *sksec = sk->sk_security;
4382 u32 sid = current_sid();
4385 err = avc_has_perm(sid, sksec->sid, SECCLASS_TUN_SOCKET,
4386 TUN_SOCKET__RELABELFROM, NULL);
4389 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4390 TUN_SOCKET__RELABELTO, NULL);
4399 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4403 struct nlmsghdr *nlh;
4404 struct socket *sock = sk->sk_socket;
4405 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4407 if (skb->len < NLMSG_SPACE(0)) {
4411 nlh = nlmsg_hdr(skb);
4413 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
4415 if (err == -EINVAL) {
4416 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4417 "SELinux: unrecognized netlink message"
4418 " type=%hu for sclass=%hu\n",
4419 nlh->nlmsg_type, isec->sclass);
4420 if (!selinux_enforcing || security_get_allow_unknown())
4430 err = socket_has_perm(current, sock, perm);
4435 #ifdef CONFIG_NETFILTER
4437 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4443 struct common_audit_data ad;
4448 if (!selinux_policycap_netpeer)
4451 secmark_active = selinux_secmark_enabled();
4452 netlbl_active = netlbl_enabled();
4453 peerlbl_active = netlbl_active || selinux_xfrm_enabled();
4454 if (!secmark_active && !peerlbl_active)
4457 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4460 COMMON_AUDIT_DATA_INIT(&ad, NET);
4461 ad.u.net.netif = ifindex;
4462 ad.u.net.family = family;
4463 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4466 if (peerlbl_active) {
4467 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4470 selinux_netlbl_err(skb, err, 1);
4476 if (avc_has_perm(peer_sid, skb->secmark,
4477 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4481 /* we do this in the FORWARD path and not the POST_ROUTING
4482 * path because we want to make sure we apply the necessary
4483 * labeling before IPsec is applied so we can leverage AH
4485 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4491 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4492 struct sk_buff *skb,
4493 const struct net_device *in,
4494 const struct net_device *out,
4495 int (*okfn)(struct sk_buff *))
4497 return selinux_ip_forward(skb, in->ifindex, PF_INET);
4500 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4501 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4502 struct sk_buff *skb,
4503 const struct net_device *in,
4504 const struct net_device *out,
4505 int (*okfn)(struct sk_buff *))
4507 return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4511 static unsigned int selinux_ip_output(struct sk_buff *skb,
4516 if (!netlbl_enabled())
4519 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4520 * because we want to make sure we apply the necessary labeling
4521 * before IPsec is applied so we can leverage AH protection */
4523 struct sk_security_struct *sksec = skb->sk->sk_security;
4526 sid = SECINITSID_KERNEL;
4527 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4533 static unsigned int selinux_ipv4_output(unsigned int hooknum,
4534 struct sk_buff *skb,
4535 const struct net_device *in,
4536 const struct net_device *out,
4537 int (*okfn)(struct sk_buff *))
4539 return selinux_ip_output(skb, PF_INET);
4542 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4546 struct sock *sk = skb->sk;
4547 struct sk_security_struct *sksec;
4548 struct common_audit_data ad;
4554 sksec = sk->sk_security;
4556 COMMON_AUDIT_DATA_INIT(&ad, NET);
4557 ad.u.net.netif = ifindex;
4558 ad.u.net.family = family;
4559 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4562 if (selinux_secmark_enabled())
4563 if (avc_has_perm(sksec->sid, skb->secmark,
4564 SECCLASS_PACKET, PACKET__SEND, &ad))
4567 if (selinux_policycap_netpeer)
4568 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4574 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4580 struct common_audit_data ad;
4585 /* If any sort of compatibility mode is enabled then handoff processing
4586 * to the selinux_ip_postroute_compat() function to deal with the
4587 * special handling. We do this in an attempt to keep this function
4588 * as fast and as clean as possible. */
4589 if (!selinux_policycap_netpeer)
4590 return selinux_ip_postroute_compat(skb, ifindex, family);
4592 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4593 * packet transformation so allow the packet to pass without any checks
4594 * since we'll have another chance to perform access control checks
4595 * when the packet is on it's final way out.
4596 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4597 * is NULL, in this case go ahead and apply access control. */
4598 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
4601 secmark_active = selinux_secmark_enabled();
4602 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4603 if (!secmark_active && !peerlbl_active)
4606 /* if the packet is being forwarded then get the peer label from the
4607 * packet itself; otherwise check to see if it is from a local
4608 * application or the kernel, if from an application get the peer label
4609 * from the sending socket, otherwise use the kernel's sid */
4614 if (IPCB(skb)->flags & IPSKB_FORWARDED)
4615 secmark_perm = PACKET__FORWARD_OUT;
4617 secmark_perm = PACKET__SEND;
4620 if (IP6CB(skb)->flags & IP6SKB_FORWARDED)
4621 secmark_perm = PACKET__FORWARD_OUT;
4623 secmark_perm = PACKET__SEND;
4628 if (secmark_perm == PACKET__FORWARD_OUT) {
4629 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4632 peer_sid = SECINITSID_KERNEL;
4634 struct sk_security_struct *sksec = sk->sk_security;
4635 peer_sid = sksec->sid;
4636 secmark_perm = PACKET__SEND;
4639 COMMON_AUDIT_DATA_INIT(&ad, NET);
4640 ad.u.net.netif = ifindex;
4641 ad.u.net.family = family;
4642 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4646 if (avc_has_perm(peer_sid, skb->secmark,
4647 SECCLASS_PACKET, secmark_perm, &ad))
4650 if (peerlbl_active) {
4654 if (sel_netif_sid(ifindex, &if_sid))
4656 if (avc_has_perm(peer_sid, if_sid,
4657 SECCLASS_NETIF, NETIF__EGRESS, &ad))
4660 if (sel_netnode_sid(addrp, family, &node_sid))
4662 if (avc_has_perm(peer_sid, node_sid,
4663 SECCLASS_NODE, NODE__SENDTO, &ad))
4670 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4671 struct sk_buff *skb,
4672 const struct net_device *in,
4673 const struct net_device *out,
4674 int (*okfn)(struct sk_buff *))
4676 return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4679 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4680 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4681 struct sk_buff *skb,
4682 const struct net_device *in,
4683 const struct net_device *out,
4684 int (*okfn)(struct sk_buff *))
4686 return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4690 #endif /* CONFIG_NETFILTER */
4692 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4696 err = cap_netlink_send(sk, skb);
4700 return selinux_nlmsg_perm(sk, skb);
4703 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
4706 struct common_audit_data ad;
4708 err = cap_netlink_recv(skb, capability);
4712 COMMON_AUDIT_DATA_INIT(&ad, CAP);
4713 ad.u.cap = capability;
4715 return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
4716 SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
4719 static int ipc_alloc_security(struct task_struct *task,
4720 struct kern_ipc_perm *perm,
4723 struct ipc_security_struct *isec;
4726 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4730 sid = task_sid(task);
4731 isec->sclass = sclass;
4733 perm->security = isec;
4738 static void ipc_free_security(struct kern_ipc_perm *perm)
4740 struct ipc_security_struct *isec = perm->security;
4741 perm->security = NULL;
4745 static int msg_msg_alloc_security(struct msg_msg *msg)
4747 struct msg_security_struct *msec;
4749 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4753 msec->sid = SECINITSID_UNLABELED;
4754 msg->security = msec;
4759 static void msg_msg_free_security(struct msg_msg *msg)
4761 struct msg_security_struct *msec = msg->security;
4763 msg->security = NULL;
4767 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4770 struct ipc_security_struct *isec;
4771 struct common_audit_data ad;
4772 u32 sid = current_sid();
4774 isec = ipc_perms->security;
4776 COMMON_AUDIT_DATA_INIT(&ad, IPC);
4777 ad.u.ipc_id = ipc_perms->key;
4779 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
4782 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4784 return msg_msg_alloc_security(msg);
4787 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4789 msg_msg_free_security(msg);
4792 /* message queue security operations */
4793 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4795 struct ipc_security_struct *isec;
4796 struct common_audit_data ad;
4797 u32 sid = current_sid();
4800 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4804 isec = msq->q_perm.security;
4806 COMMON_AUDIT_DATA_INIT(&ad, IPC);
4807 ad.u.ipc_id = msq->q_perm.key;
4809 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4812 ipc_free_security(&msq->q_perm);
4818 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4820 ipc_free_security(&msq->q_perm);
4823 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4825 struct ipc_security_struct *isec;
4826 struct common_audit_data ad;
4827 u32 sid = current_sid();
4829 isec = msq->q_perm.security;
4831 COMMON_AUDIT_DATA_INIT(&ad, IPC);
4832 ad.u.ipc_id = msq->q_perm.key;
4834 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4835 MSGQ__ASSOCIATE, &ad);
4838 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4846 /* No specific object, just general system-wide information. */
4847 return task_has_system(current, SYSTEM__IPC_INFO);
4850 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4853 perms = MSGQ__SETATTR;
4856 perms = MSGQ__DESTROY;
4862 err = ipc_has_perm(&msq->q_perm, perms);
4866 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4868 struct ipc_security_struct *isec;
4869 struct msg_security_struct *msec;
4870 struct common_audit_data ad;
4871 u32 sid = current_sid();
4874 isec = msq->q_perm.security;
4875 msec = msg->security;
4878 * First time through, need to assign label to the message
4880 if (msec->sid == SECINITSID_UNLABELED) {
4882 * Compute new sid based on current process and
4883 * message queue this message will be stored in
4885 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
4891 COMMON_AUDIT_DATA_INIT(&ad, IPC);
4892 ad.u.ipc_id = msq->q_perm.key;
4894 /* Can this process write to the queue? */
4895 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4898 /* Can this process send the message */
4899 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
4902 /* Can the message be put in the queue? */
4903 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
4904 MSGQ__ENQUEUE, &ad);
4909 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4910 struct task_struct *target,
4911 long type, int mode)
4913 struct ipc_security_struct *isec;
4914 struct msg_security_struct *msec;
4915 struct common_audit_data ad;
4916 u32 sid = task_sid(target);
4919 isec = msq->q_perm.security;
4920 msec = msg->security;
4922 COMMON_AUDIT_DATA_INIT(&ad, IPC);
4923 ad.u.ipc_id = msq->q_perm.key;
4925 rc = avc_has_perm(sid, isec->sid,
4926 SECCLASS_MSGQ, MSGQ__READ, &ad);
4928 rc = avc_has_perm(sid, msec->sid,
4929 SECCLASS_MSG, MSG__RECEIVE, &ad);
4933 /* Shared Memory security operations */
4934 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4936 struct ipc_security_struct *isec;
4937 struct common_audit_data ad;
4938 u32 sid = current_sid();
4941 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4945 isec = shp->shm_perm.security;
4947 COMMON_AUDIT_DATA_INIT(&ad, IPC);
4948 ad.u.ipc_id = shp->shm_perm.key;
4950 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
4953 ipc_free_security(&shp->shm_perm);
4959 static void selinux_shm_free_security(struct shmid_kernel *shp)
4961 ipc_free_security(&shp->shm_perm);
4964 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4966 struct ipc_security_struct *isec;
4967 struct common_audit_data ad;
4968 u32 sid = current_sid();
4970 isec = shp->shm_perm.security;
4972 COMMON_AUDIT_DATA_INIT(&ad, IPC);
4973 ad.u.ipc_id = shp->shm_perm.key;
4975 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
4976 SHM__ASSOCIATE, &ad);
4979 /* Note, at this point, shp is locked down */
4980 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4988 /* No specific object, just general system-wide information. */
4989 return task_has_system(current, SYSTEM__IPC_INFO);
4992 perms = SHM__GETATTR | SHM__ASSOCIATE;
4995 perms = SHM__SETATTR;
5002 perms = SHM__DESTROY;
5008 err = ipc_has_perm(&shp->shm_perm, perms);
5012 static int selinux_shm_shmat(struct shmid_kernel *shp,
5013 char __user *shmaddr, int shmflg)
5017 if (shmflg & SHM_RDONLY)
5020 perms = SHM__READ | SHM__WRITE;
5022 return ipc_has_perm(&shp->shm_perm, perms);
5025 /* Semaphore security operations */
5026 static int selinux_sem_alloc_security(struct sem_array *sma)
5028 struct ipc_security_struct *isec;
5029 struct common_audit_data ad;
5030 u32 sid = current_sid();
5033 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5037 isec = sma->sem_perm.security;
5039 COMMON_AUDIT_DATA_INIT(&ad, IPC);
5040 ad.u.ipc_id = sma->sem_perm.key;
5042 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5045 ipc_free_security(&sma->sem_perm);
5051 static void selinux_sem_free_security(struct sem_array *sma)
5053 ipc_free_security(&sma->sem_perm);
5056 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5058 struct ipc_security_struct *isec;
5059 struct common_audit_data ad;
5060 u32 sid = current_sid();
5062 isec = sma->sem_perm.security;
5064 COMMON_AUDIT_DATA_INIT(&ad, IPC);
5065 ad.u.ipc_id = sma->sem_perm.key;
5067 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5068 SEM__ASSOCIATE, &ad);
5071 /* Note, at this point, sma is locked down */
5072 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5080 /* No specific object, just general system-wide information. */
5081 return task_has_system(current, SYSTEM__IPC_INFO);
5085 perms = SEM__GETATTR;
5096 perms = SEM__DESTROY;
5099 perms = SEM__SETATTR;
5103 perms = SEM__GETATTR | SEM__ASSOCIATE;
5109 err = ipc_has_perm(&sma->sem_perm, perms);
5113 static int selinux_sem_semop(struct sem_array *sma,
5114 struct sembuf *sops, unsigned nsops, int alter)
5119 perms = SEM__READ | SEM__WRITE;
5123 return ipc_has_perm(&sma->sem_perm, perms);
5126 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5132 av |= IPC__UNIX_READ;
5134 av |= IPC__UNIX_WRITE;
5139 return ipc_has_perm(ipcp, av);
5142 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5144 struct ipc_security_struct *isec = ipcp->security;
5148 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5151 inode_doinit_with_dentry(inode, dentry);
5154 static int selinux_getprocattr(struct task_struct *p,
5155 char *name, char **value)
5157 const struct task_security_struct *__tsec;
5163 error = current_has_perm(p, PROCESS__GETATTR);
5169 __tsec = __task_cred(p)->security;
5171 if (!strcmp(name, "current"))
5173 else if (!strcmp(name, "prev"))
5175 else if (!strcmp(name, "exec"))
5176 sid = __tsec->exec_sid;
5177 else if (!strcmp(name, "fscreate"))
5178 sid = __tsec->create_sid;
5179 else if (!strcmp(name, "keycreate"))
5180 sid = __tsec->keycreate_sid;
5181 else if (!strcmp(name, "sockcreate"))
5182 sid = __tsec->sockcreate_sid;
5190 error = security_sid_to_context(sid, value, &len);
5200 static int selinux_setprocattr(struct task_struct *p,
5201 char *name, void *value, size_t size)
5203 struct task_security_struct *tsec;
5204 struct task_struct *tracer;
5211 /* SELinux only allows a process to change its own
5212 security attributes. */
5217 * Basic control over ability to set these attributes at all.
5218 * current == p, but we'll pass them separately in case the
5219 * above restriction is ever removed.
5221 if (!strcmp(name, "exec"))
5222 error = current_has_perm(p, PROCESS__SETEXEC);
5223 else if (!strcmp(name, "fscreate"))
5224 error = current_has_perm(p, PROCESS__SETFSCREATE);
5225 else if (!strcmp(name, "keycreate"))
5226 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5227 else if (!strcmp(name, "sockcreate"))
5228 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5229 else if (!strcmp(name, "current"))
5230 error = current_has_perm(p, PROCESS__SETCURRENT);
5236 /* Obtain a SID for the context, if one was specified. */
5237 if (size && str[1] && str[1] != '\n') {
5238 if (str[size-1] == '\n') {
5242 error = security_context_to_sid(value, size, &sid);
5243 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5244 if (!capable(CAP_MAC_ADMIN))
5246 error = security_context_to_sid_force(value, size,
5253 new = prepare_creds();
5257 /* Permission checking based on the specified context is
5258 performed during the actual operation (execve,
5259 open/mkdir/...), when we know the full context of the
5260 operation. See selinux_bprm_set_creds for the execve
5261 checks and may_create for the file creation checks. The
5262 operation will then fail if the context is not permitted. */
5263 tsec = new->security;
5264 if (!strcmp(name, "exec")) {
5265 tsec->exec_sid = sid;
5266 } else if (!strcmp(name, "fscreate")) {
5267 tsec->create_sid = sid;
5268 } else if (!strcmp(name, "keycreate")) {
5269 error = may_create_key(sid, p);
5272 tsec->keycreate_sid = sid;
5273 } else if (!strcmp(name, "sockcreate")) {
5274 tsec->sockcreate_sid = sid;
5275 } else if (!strcmp(name, "current")) {
5280 /* Only allow single threaded processes to change context */
5282 if (!current_is_single_threaded()) {
5283 error = security_bounded_transition(tsec->sid, sid);
5288 /* Check permissions for the transition. */
5289 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5290 PROCESS__DYNTRANSITION, NULL);
5294 /* Check for ptracing, and update the task SID if ok.
5295 Otherwise, leave SID unchanged and fail. */
5298 tracer = tracehook_tracer_task(p);
5300 ptsid = task_sid(tracer);
5304 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5305 PROCESS__PTRACE, NULL);
5324 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5326 return security_sid_to_context(secid, secdata, seclen);
5329 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5331 return security_context_to_sid(secdata, seclen, secid);
5334 static void selinux_release_secctx(char *secdata, u32 seclen)
5340 * called with inode->i_mutex locked
5342 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5344 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5348 * called with inode->i_mutex locked
5350 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5352 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5355 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5358 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5367 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5368 unsigned long flags)
5370 const struct task_security_struct *tsec;
5371 struct key_security_struct *ksec;
5373 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5377 tsec = cred->security;
5378 if (tsec->keycreate_sid)
5379 ksec->sid = tsec->keycreate_sid;
5381 ksec->sid = tsec->sid;
5387 static void selinux_key_free(struct key *k)
5389 struct key_security_struct *ksec = k->security;
5395 static int selinux_key_permission(key_ref_t key_ref,
5396 const struct cred *cred,
5400 struct key_security_struct *ksec;
5403 /* if no specific permissions are requested, we skip the
5404 permission check. No serious, additional covert channels
5405 appear to be created. */
5409 sid = cred_sid(cred);
5411 key = key_ref_to_ptr(key_ref);
5412 ksec = key->security;
5414 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5417 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5419 struct key_security_struct *ksec = key->security;
5420 char *context = NULL;
5424 rc = security_sid_to_context(ksec->sid, &context, &len);
5433 static struct security_operations selinux_ops = {
5436 .ptrace_access_check = selinux_ptrace_access_check,
5437 .ptrace_traceme = selinux_ptrace_traceme,
5438 .capget = selinux_capget,
5439 .capset = selinux_capset,
5440 .sysctl = selinux_sysctl,
5441 .capable = selinux_capable,
5442 .quotactl = selinux_quotactl,
5443 .quota_on = selinux_quota_on,
5444 .syslog = selinux_syslog,
5445 .vm_enough_memory = selinux_vm_enough_memory,
5447 .netlink_send = selinux_netlink_send,
5448 .netlink_recv = selinux_netlink_recv,
5450 .bprm_set_creds = selinux_bprm_set_creds,
5451 .bprm_committing_creds = selinux_bprm_committing_creds,
5452 .bprm_committed_creds = selinux_bprm_committed_creds,
5453 .bprm_secureexec = selinux_bprm_secureexec,
5455 .sb_alloc_security = selinux_sb_alloc_security,
5456 .sb_free_security = selinux_sb_free_security,
5457 .sb_copy_data = selinux_sb_copy_data,
5458 .sb_kern_mount = selinux_sb_kern_mount,
5459 .sb_show_options = selinux_sb_show_options,
5460 .sb_statfs = selinux_sb_statfs,
5461 .sb_mount = selinux_mount,
5462 .sb_umount = selinux_umount,
5463 .sb_set_mnt_opts = selinux_set_mnt_opts,
5464 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
5465 .sb_parse_opts_str = selinux_parse_opts_str,
5468 .inode_alloc_security = selinux_inode_alloc_security,
5469 .inode_free_security = selinux_inode_free_security,
5470 .inode_init_security = selinux_inode_init_security,
5471 .inode_create = selinux_inode_create,
5472 .inode_link = selinux_inode_link,
5473 .inode_unlink = selinux_inode_unlink,
5474 .inode_symlink = selinux_inode_symlink,
5475 .inode_mkdir = selinux_inode_mkdir,
5476 .inode_rmdir = selinux_inode_rmdir,
5477 .inode_mknod = selinux_inode_mknod,
5478 .inode_rename = selinux_inode_rename,
5479 .inode_readlink = selinux_inode_readlink,
5480 .inode_follow_link = selinux_inode_follow_link,
5481 .inode_permission = selinux_inode_permission,
5482 .inode_setattr = selinux_inode_setattr,
5483 .inode_getattr = selinux_inode_getattr,
5484 .inode_setxattr = selinux_inode_setxattr,
5485 .inode_post_setxattr = selinux_inode_post_setxattr,
5486 .inode_getxattr = selinux_inode_getxattr,
5487 .inode_listxattr = selinux_inode_listxattr,
5488 .inode_removexattr = selinux_inode_removexattr,
5489 .inode_getsecurity = selinux_inode_getsecurity,
5490 .inode_setsecurity = selinux_inode_setsecurity,
5491 .inode_listsecurity = selinux_inode_listsecurity,
5492 .inode_getsecid = selinux_inode_getsecid,
5494 .file_permission = selinux_file_permission,
5495 .file_alloc_security = selinux_file_alloc_security,
5496 .file_free_security = selinux_file_free_security,
5497 .file_ioctl = selinux_file_ioctl,
5498 .file_mmap = selinux_file_mmap,
5499 .file_mprotect = selinux_file_mprotect,
5500 .file_lock = selinux_file_lock,
5501 .file_fcntl = selinux_file_fcntl,
5502 .file_set_fowner = selinux_file_set_fowner,
5503 .file_send_sigiotask = selinux_file_send_sigiotask,
5504 .file_receive = selinux_file_receive,
5506 .dentry_open = selinux_dentry_open,
5508 .task_create = selinux_task_create,
5509 .cred_alloc_blank = selinux_cred_alloc_blank,
5510 .cred_free = selinux_cred_free,
5511 .cred_prepare = selinux_cred_prepare,
5512 .cred_transfer = selinux_cred_transfer,
5513 .kernel_act_as = selinux_kernel_act_as,
5514 .kernel_create_files_as = selinux_kernel_create_files_as,
5515 .kernel_module_request = selinux_kernel_module_request,
5516 .task_setpgid = selinux_task_setpgid,
5517 .task_getpgid = selinux_task_getpgid,
5518 .task_getsid = selinux_task_getsid,
5519 .task_getsecid = selinux_task_getsecid,
5520 .task_setnice = selinux_task_setnice,
5521 .task_setioprio = selinux_task_setioprio,
5522 .task_getioprio = selinux_task_getioprio,
5523 .task_setrlimit = selinux_task_setrlimit,
5524 .task_setscheduler = selinux_task_setscheduler,
5525 .task_getscheduler = selinux_task_getscheduler,
5526 .task_movememory = selinux_task_movememory,
5527 .task_kill = selinux_task_kill,
5528 .task_wait = selinux_task_wait,
5529 .task_to_inode = selinux_task_to_inode,
5531 .ipc_permission = selinux_ipc_permission,
5532 .ipc_getsecid = selinux_ipc_getsecid,
5534 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5535 .msg_msg_free_security = selinux_msg_msg_free_security,
5537 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5538 .msg_queue_free_security = selinux_msg_queue_free_security,
5539 .msg_queue_associate = selinux_msg_queue_associate,
5540 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5541 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5542 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5544 .shm_alloc_security = selinux_shm_alloc_security,
5545 .shm_free_security = selinux_shm_free_security,
5546 .shm_associate = selinux_shm_associate,
5547 .shm_shmctl = selinux_shm_shmctl,
5548 .shm_shmat = selinux_shm_shmat,
5550 .sem_alloc_security = selinux_sem_alloc_security,
5551 .sem_free_security = selinux_sem_free_security,
5552 .sem_associate = selinux_sem_associate,
5553 .sem_semctl = selinux_sem_semctl,
5554 .sem_semop = selinux_sem_semop,
5556 .d_instantiate = selinux_d_instantiate,
5558 .getprocattr = selinux_getprocattr,
5559 .setprocattr = selinux_setprocattr,
5561 .secid_to_secctx = selinux_secid_to_secctx,
5562 .secctx_to_secid = selinux_secctx_to_secid,
5563 .release_secctx = selinux_release_secctx,
5564 .inode_notifysecctx = selinux_inode_notifysecctx,
5565 .inode_setsecctx = selinux_inode_setsecctx,
5566 .inode_getsecctx = selinux_inode_getsecctx,
5568 .unix_stream_connect = selinux_socket_unix_stream_connect,
5569 .unix_may_send = selinux_socket_unix_may_send,
5571 .socket_create = selinux_socket_create,
5572 .socket_post_create = selinux_socket_post_create,
5573 .socket_bind = selinux_socket_bind,
5574 .socket_connect = selinux_socket_connect,
5575 .socket_listen = selinux_socket_listen,
5576 .socket_accept = selinux_socket_accept,
5577 .socket_sendmsg = selinux_socket_sendmsg,
5578 .socket_recvmsg = selinux_socket_recvmsg,
5579 .socket_getsockname = selinux_socket_getsockname,
5580 .socket_getpeername = selinux_socket_getpeername,
5581 .socket_getsockopt = selinux_socket_getsockopt,
5582 .socket_setsockopt = selinux_socket_setsockopt,
5583 .socket_shutdown = selinux_socket_shutdown,
5584 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
5585 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
5586 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
5587 .sk_alloc_security = selinux_sk_alloc_security,
5588 .sk_free_security = selinux_sk_free_security,
5589 .sk_clone_security = selinux_sk_clone_security,
5590 .sk_getsecid = selinux_sk_getsecid,
5591 .sock_graft = selinux_sock_graft,
5592 .inet_conn_request = selinux_inet_conn_request,
5593 .inet_csk_clone = selinux_inet_csk_clone,
5594 .inet_conn_established = selinux_inet_conn_established,
5595 .req_classify_flow = selinux_req_classify_flow,
5596 .tun_dev_create = selinux_tun_dev_create,
5597 .tun_dev_post_create = selinux_tun_dev_post_create,
5598 .tun_dev_attach = selinux_tun_dev_attach,
5600 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5601 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
5602 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
5603 .xfrm_policy_free_security = selinux_xfrm_policy_free,
5604 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
5605 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
5606 .xfrm_state_free_security = selinux_xfrm_state_free,
5607 .xfrm_state_delete_security = selinux_xfrm_state_delete,
5608 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
5609 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
5610 .xfrm_decode_session = selinux_xfrm_decode_session,
5614 .key_alloc = selinux_key_alloc,
5615 .key_free = selinux_key_free,
5616 .key_permission = selinux_key_permission,
5617 .key_getsecurity = selinux_key_getsecurity,
5621 .audit_rule_init = selinux_audit_rule_init,
5622 .audit_rule_known = selinux_audit_rule_known,
5623 .audit_rule_match = selinux_audit_rule_match,
5624 .audit_rule_free = selinux_audit_rule_free,
5628 static __init int selinux_init(void)
5630 if (!security_module_enable(&selinux_ops)) {
5631 selinux_enabled = 0;
5635 if (!selinux_enabled) {
5636 printk(KERN_INFO "SELinux: Disabled at boot.\n");
5640 printk(KERN_INFO "SELinux: Initializing.\n");
5642 /* Set the security state for the initial task. */
5643 cred_init_security();
5645 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5647 sel_inode_cache = kmem_cache_create("selinux_inode_security",
5648 sizeof(struct inode_security_struct),
5649 0, SLAB_PANIC, NULL);
5652 if (register_security(&selinux_ops))
5653 panic("SELinux: Unable to register with kernel.\n");
5655 if (selinux_enforcing)
5656 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
5658 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
5663 static void delayed_superblock_init(struct super_block *sb, void *unused)
5665 superblock_doinit(sb, NULL);
5668 void selinux_complete_init(void)
5670 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
5672 /* Set up any superblocks initialized prior to the policy load. */
5673 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
5674 iterate_supers(delayed_superblock_init, NULL);
5677 /* SELinux requires early initialization in order to label
5678 all processes and objects when they are created. */
5679 security_initcall(selinux_init);
5681 #if defined(CONFIG_NETFILTER)
5683 static struct nf_hook_ops selinux_ipv4_ops[] = {
5685 .hook = selinux_ipv4_postroute,
5686 .owner = THIS_MODULE,
5688 .hooknum = NF_INET_POST_ROUTING,
5689 .priority = NF_IP_PRI_SELINUX_LAST,
5692 .hook = selinux_ipv4_forward,
5693 .owner = THIS_MODULE,
5695 .hooknum = NF_INET_FORWARD,
5696 .priority = NF_IP_PRI_SELINUX_FIRST,
5699 .hook = selinux_ipv4_output,
5700 .owner = THIS_MODULE,
5702 .hooknum = NF_INET_LOCAL_OUT,
5703 .priority = NF_IP_PRI_SELINUX_FIRST,
5707 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5709 static struct nf_hook_ops selinux_ipv6_ops[] = {
5711 .hook = selinux_ipv6_postroute,
5712 .owner = THIS_MODULE,
5714 .hooknum = NF_INET_POST_ROUTING,
5715 .priority = NF_IP6_PRI_SELINUX_LAST,
5718 .hook = selinux_ipv6_forward,
5719 .owner = THIS_MODULE,
5721 .hooknum = NF_INET_FORWARD,
5722 .priority = NF_IP6_PRI_SELINUX_FIRST,
5728 static int __init selinux_nf_ip_init(void)
5732 if (!selinux_enabled)
5735 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
5737 err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5739 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
5741 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5742 err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5744 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5751 __initcall(selinux_nf_ip_init);
5753 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5754 static void selinux_nf_ip_exit(void)
5756 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
5758 nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5759 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5760 nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5765 #else /* CONFIG_NETFILTER */
5767 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5768 #define selinux_nf_ip_exit()
5771 #endif /* CONFIG_NETFILTER */
5773 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5774 static int selinux_disabled;
5776 int selinux_disable(void)
5778 extern void exit_sel_fs(void);
5780 if (ss_initialized) {
5781 /* Not permitted after initial policy load. */
5785 if (selinux_disabled) {
5786 /* Only do this once. */
5790 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
5792 selinux_disabled = 1;
5793 selinux_enabled = 0;
5795 reset_security_ops();
5797 /* Try to destroy the avc node cache */
5800 /* Unregister netfilter hooks. */
5801 selinux_nf_ip_exit();
5803 /* Unregister selinuxfs. */