2 * NSA Security-Enhanced Linux (SELinux) security module
4 * This file contains the SELinux hook function implementations.
6 * Authors: Stephen Smalley, <sds@tycho.nsa.gov>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul@paul-moore.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
20 * Copyright (C) 2016 Mellanox Technologies
22 * This program is free software; you can redistribute it and/or modify
23 * it under the terms of the GNU General Public License version 2,
24 * as published by the Free Software Foundation.
27 #include <linux/init.h>
29 #include <linux/kernel.h>
30 #include <linux/tracehook.h>
31 #include <linux/errno.h>
32 #include <linux/sched/signal.h>
33 #include <linux/sched/task.h>
34 #include <linux/lsm_hooks.h>
35 #include <linux/xattr.h>
36 #include <linux/capability.h>
37 #include <linux/unistd.h>
39 #include <linux/mman.h>
40 #include <linux/slab.h>
41 #include <linux/pagemap.h>
42 #include <linux/proc_fs.h>
43 #include <linux/swap.h>
44 #include <linux/spinlock.h>
45 #include <linux/syscalls.h>
46 #include <linux/dcache.h>
47 #include <linux/file.h>
48 #include <linux/fdtable.h>
49 #include <linux/namei.h>
50 #include <linux/mount.h>
51 #include <linux/fs_context.h>
52 #include <linux/fs_parser.h>
53 #include <linux/netfilter_ipv4.h>
54 #include <linux/netfilter_ipv6.h>
55 #include <linux/tty.h>
57 #include <net/ip.h> /* for local_port_range[] */
58 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
59 #include <net/inet_connection_sock.h>
60 #include <net/net_namespace.h>
61 #include <net/netlabel.h>
62 #include <linux/uaccess.h>
63 #include <asm/ioctls.h>
64 #include <linux/atomic.h>
65 #include <linux/bitops.h>
66 #include <linux/interrupt.h>
67 #include <linux/netdevice.h> /* for network interface checks */
68 #include <net/netlink.h>
69 #include <linux/tcp.h>
70 #include <linux/udp.h>
71 #include <linux/dccp.h>
72 #include <linux/sctp.h>
73 #include <net/sctp/structs.h>
74 #include <linux/quota.h>
75 #include <linux/un.h> /* for Unix socket types */
76 #include <net/af_unix.h> /* for Unix socket types */
77 #include <linux/parser.h>
78 #include <linux/nfs_mount.h>
80 #include <linux/hugetlb.h>
81 #include <linux/personality.h>
82 #include <linux/audit.h>
83 #include <linux/string.h>
84 #include <linux/mutex.h>
85 #include <linux/posix-timers.h>
86 #include <linux/syslog.h>
87 #include <linux/user_namespace.h>
88 #include <linux/export.h>
89 #include <linux/msg.h>
90 #include <linux/shm.h>
91 #include <linux/bpf.h>
92 #include <uapi/linux/mount.h>
101 #include "netlabel.h"
105 struct selinux_state selinux_state;
107 /* SECMARK reference count */
108 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
110 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
111 static int selinux_enforcing_boot;
113 static int __init enforcing_setup(char *str)
115 unsigned long enforcing;
116 if (!kstrtoul(str, 0, &enforcing))
117 selinux_enforcing_boot = enforcing ? 1 : 0;
120 __setup("enforcing=", enforcing_setup);
122 #define selinux_enforcing_boot 1
125 int selinux_enabled __lsm_ro_after_init = 1;
126 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
127 static int __init selinux_enabled_setup(char *str)
129 unsigned long enabled;
130 if (!kstrtoul(str, 0, &enabled))
131 selinux_enabled = enabled ? 1 : 0;
134 __setup("selinux=", selinux_enabled_setup);
137 static unsigned int selinux_checkreqprot_boot =
138 CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
140 static int __init checkreqprot_setup(char *str)
142 unsigned long checkreqprot;
144 if (!kstrtoul(str, 0, &checkreqprot))
145 selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
148 __setup("checkreqprot=", checkreqprot_setup);
151 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
154 * This function checks the SECMARK reference counter to see if any SECMARK
155 * targets are currently configured, if the reference counter is greater than
156 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
157 * enabled, false (0) if SECMARK is disabled. If the always_check_network
158 * policy capability is enabled, SECMARK is always considered enabled.
161 static int selinux_secmark_enabled(void)
163 return (selinux_policycap_alwaysnetwork() ||
164 atomic_read(&selinux_secmark_refcount));
168 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
171 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
172 * (1) if any are enabled or false (0) if neither are enabled. If the
173 * always_check_network policy capability is enabled, peer labeling
174 * is always considered enabled.
177 static int selinux_peerlbl_enabled(void)
179 return (selinux_policycap_alwaysnetwork() ||
180 netlbl_enabled() || selinux_xfrm_enabled());
183 static int selinux_netcache_avc_callback(u32 event)
185 if (event == AVC_CALLBACK_RESET) {
194 static int selinux_lsm_notifier_avc_callback(u32 event)
196 if (event == AVC_CALLBACK_RESET) {
198 call_lsm_notifier(LSM_POLICY_CHANGE, NULL);
205 * initialise the security for the init task
207 static void cred_init_security(void)
209 struct cred *cred = (struct cred *) current->real_cred;
210 struct task_security_struct *tsec;
212 tsec = selinux_cred(cred);
213 tsec->osid = tsec->sid = SECINITSID_KERNEL;
217 * get the security ID of a set of credentials
219 static inline u32 cred_sid(const struct cred *cred)
221 const struct task_security_struct *tsec;
223 tsec = selinux_cred(cred);
228 * get the objective security ID of a task
230 static inline u32 task_sid(const struct task_struct *task)
235 sid = cred_sid(__task_cred(task));
240 /* Allocate and free functions for each kind of security blob. */
242 static int inode_alloc_security(struct inode *inode)
244 struct inode_security_struct *isec = selinux_inode(inode);
245 u32 sid = current_sid();
247 spin_lock_init(&isec->lock);
248 INIT_LIST_HEAD(&isec->list);
250 isec->sid = SECINITSID_UNLABELED;
251 isec->sclass = SECCLASS_FILE;
252 isec->task_sid = sid;
253 isec->initialized = LABEL_INVALID;
258 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
261 * Try reloading inode security labels that have been marked as invalid. The
262 * @may_sleep parameter indicates when sleeping and thus reloading labels is
263 * allowed; when set to false, returns -ECHILD when the label is
264 * invalid. The @dentry parameter should be set to a dentry of the inode.
266 static int __inode_security_revalidate(struct inode *inode,
267 struct dentry *dentry,
270 struct inode_security_struct *isec = selinux_inode(inode);
272 might_sleep_if(may_sleep);
274 if (selinux_state.initialized &&
275 isec->initialized != LABEL_INITIALIZED) {
280 * Try reloading the inode security label. This will fail if
281 * @opt_dentry is NULL and no dentry for this inode can be
282 * found; in that case, continue using the old label.
284 inode_doinit_with_dentry(inode, dentry);
289 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
291 return selinux_inode(inode);
294 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
298 error = __inode_security_revalidate(inode, NULL, !rcu);
300 return ERR_PTR(error);
301 return selinux_inode(inode);
305 * Get the security label of an inode.
307 static struct inode_security_struct *inode_security(struct inode *inode)
309 __inode_security_revalidate(inode, NULL, true);
310 return selinux_inode(inode);
313 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
315 struct inode *inode = d_backing_inode(dentry);
317 return selinux_inode(inode);
321 * Get the security label of a dentry's backing inode.
323 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
325 struct inode *inode = d_backing_inode(dentry);
327 __inode_security_revalidate(inode, dentry, true);
328 return selinux_inode(inode);
331 static void inode_free_security(struct inode *inode)
333 struct inode_security_struct *isec = selinux_inode(inode);
334 struct superblock_security_struct *sbsec;
338 sbsec = inode->i_sb->s_security;
340 * As not all inode security structures are in a list, we check for
341 * empty list outside of the lock to make sure that we won't waste
342 * time taking a lock doing nothing.
344 * The list_del_init() function can be safely called more than once.
345 * It should not be possible for this function to be called with
346 * concurrent list_add(), but for better safety against future changes
347 * in the code, we use list_empty_careful() here.
349 if (!list_empty_careful(&isec->list)) {
350 spin_lock(&sbsec->isec_lock);
351 list_del_init(&isec->list);
352 spin_unlock(&sbsec->isec_lock);
356 static int file_alloc_security(struct file *file)
358 struct file_security_struct *fsec = selinux_file(file);
359 u32 sid = current_sid();
362 fsec->fown_sid = sid;
367 static int superblock_alloc_security(struct super_block *sb)
369 struct superblock_security_struct *sbsec;
371 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
375 mutex_init(&sbsec->lock);
376 INIT_LIST_HEAD(&sbsec->isec_head);
377 spin_lock_init(&sbsec->isec_lock);
379 sbsec->sid = SECINITSID_UNLABELED;
380 sbsec->def_sid = SECINITSID_FILE;
381 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
382 sb->s_security = sbsec;
387 static void superblock_free_security(struct super_block *sb)
389 struct superblock_security_struct *sbsec = sb->s_security;
390 sb->s_security = NULL;
394 struct selinux_mnt_opts {
395 const char *fscontext, *context, *rootcontext, *defcontext;
398 static void selinux_free_mnt_opts(void *mnt_opts)
400 struct selinux_mnt_opts *opts = mnt_opts;
401 kfree(opts->fscontext);
402 kfree(opts->context);
403 kfree(opts->rootcontext);
404 kfree(opts->defcontext);
408 static inline int inode_doinit(struct inode *inode)
410 return inode_doinit_with_dentry(inode, NULL);
422 #define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg}
432 A(rootcontext, true),
437 static int match_opt_prefix(char *s, int l, char **arg)
441 for (i = 0; i < ARRAY_SIZE(tokens); i++) {
442 size_t len = tokens[i].len;
443 if (len > l || memcmp(s, tokens[i].name, len))
445 if (tokens[i].has_arg) {
446 if (len == l || s[len] != '=')
451 return tokens[i].opt;
456 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
458 static int may_context_mount_sb_relabel(u32 sid,
459 struct superblock_security_struct *sbsec,
460 const struct cred *cred)
462 const struct task_security_struct *tsec = selinux_cred(cred);
465 rc = avc_has_perm(&selinux_state,
466 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
467 FILESYSTEM__RELABELFROM, NULL);
471 rc = avc_has_perm(&selinux_state,
472 tsec->sid, sid, SECCLASS_FILESYSTEM,
473 FILESYSTEM__RELABELTO, NULL);
477 static int may_context_mount_inode_relabel(u32 sid,
478 struct superblock_security_struct *sbsec,
479 const struct cred *cred)
481 const struct task_security_struct *tsec = selinux_cred(cred);
483 rc = avc_has_perm(&selinux_state,
484 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
485 FILESYSTEM__RELABELFROM, NULL);
489 rc = avc_has_perm(&selinux_state,
490 sid, sbsec->sid, SECCLASS_FILESYSTEM,
491 FILESYSTEM__ASSOCIATE, NULL);
495 static int selinux_is_genfs_special_handling(struct super_block *sb)
497 /* Special handling. Genfs but also in-core setxattr handler */
498 return !strcmp(sb->s_type->name, "sysfs") ||
499 !strcmp(sb->s_type->name, "pstore") ||
500 !strcmp(sb->s_type->name, "debugfs") ||
501 !strcmp(sb->s_type->name, "tracefs") ||
502 !strcmp(sb->s_type->name, "rootfs") ||
503 (selinux_policycap_cgroupseclabel() &&
504 (!strcmp(sb->s_type->name, "cgroup") ||
505 !strcmp(sb->s_type->name, "cgroup2")));
508 static int selinux_is_sblabel_mnt(struct super_block *sb)
510 struct superblock_security_struct *sbsec = sb->s_security;
513 * IMPORTANT: Double-check logic in this function when adding a new
514 * SECURITY_FS_USE_* definition!
516 BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
518 switch (sbsec->behavior) {
519 case SECURITY_FS_USE_XATTR:
520 case SECURITY_FS_USE_TRANS:
521 case SECURITY_FS_USE_TASK:
522 case SECURITY_FS_USE_NATIVE:
525 case SECURITY_FS_USE_GENFS:
526 return selinux_is_genfs_special_handling(sb);
528 /* Never allow relabeling on context mounts */
529 case SECURITY_FS_USE_MNTPOINT:
530 case SECURITY_FS_USE_NONE:
536 static int sb_finish_set_opts(struct super_block *sb)
538 struct superblock_security_struct *sbsec = sb->s_security;
539 struct dentry *root = sb->s_root;
540 struct inode *root_inode = d_backing_inode(root);
543 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
544 /* Make sure that the xattr handler exists and that no
545 error other than -ENODATA is returned by getxattr on
546 the root directory. -ENODATA is ok, as this may be
547 the first boot of the SELinux kernel before we have
548 assigned xattr values to the filesystem. */
549 if (!(root_inode->i_opflags & IOP_XATTR)) {
550 pr_warn("SELinux: (dev %s, type %s) has no "
551 "xattr support\n", sb->s_id, sb->s_type->name);
556 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
557 if (rc < 0 && rc != -ENODATA) {
558 if (rc == -EOPNOTSUPP)
559 pr_warn("SELinux: (dev %s, type "
560 "%s) has no security xattr handler\n",
561 sb->s_id, sb->s_type->name);
563 pr_warn("SELinux: (dev %s, type "
564 "%s) getxattr errno %d\n", sb->s_id,
565 sb->s_type->name, -rc);
570 sbsec->flags |= SE_SBINITIALIZED;
573 * Explicitly set or clear SBLABEL_MNT. It's not sufficient to simply
574 * leave the flag untouched because sb_clone_mnt_opts might be handing
575 * us a superblock that needs the flag to be cleared.
577 if (selinux_is_sblabel_mnt(sb))
578 sbsec->flags |= SBLABEL_MNT;
580 sbsec->flags &= ~SBLABEL_MNT;
582 /* Initialize the root inode. */
583 rc = inode_doinit_with_dentry(root_inode, root);
585 /* Initialize any other inodes associated with the superblock, e.g.
586 inodes created prior to initial policy load or inodes created
587 during get_sb by a pseudo filesystem that directly
589 spin_lock(&sbsec->isec_lock);
590 while (!list_empty(&sbsec->isec_head)) {
591 struct inode_security_struct *isec =
592 list_first_entry(&sbsec->isec_head,
593 struct inode_security_struct, list);
594 struct inode *inode = isec->inode;
595 list_del_init(&isec->list);
596 spin_unlock(&sbsec->isec_lock);
597 inode = igrab(inode);
599 if (!IS_PRIVATE(inode))
603 spin_lock(&sbsec->isec_lock);
605 spin_unlock(&sbsec->isec_lock);
610 static int bad_option(struct superblock_security_struct *sbsec, char flag,
611 u32 old_sid, u32 new_sid)
613 char mnt_flags = sbsec->flags & SE_MNTMASK;
615 /* check if the old mount command had the same options */
616 if (sbsec->flags & SE_SBINITIALIZED)
617 if (!(sbsec->flags & flag) ||
618 (old_sid != new_sid))
621 /* check if we were passed the same options twice,
622 * aka someone passed context=a,context=b
624 if (!(sbsec->flags & SE_SBINITIALIZED))
625 if (mnt_flags & flag)
630 static int parse_sid(struct super_block *sb, const char *s, u32 *sid)
632 int rc = security_context_str_to_sid(&selinux_state, s,
635 pr_warn("SELinux: security_context_str_to_sid"
636 "(%s) failed for (dev %s, type %s) errno=%d\n",
637 s, sb->s_id, sb->s_type->name, rc);
642 * Allow filesystems with binary mount data to explicitly set mount point
643 * labeling information.
645 static int selinux_set_mnt_opts(struct super_block *sb,
647 unsigned long kern_flags,
648 unsigned long *set_kern_flags)
650 const struct cred *cred = current_cred();
651 struct superblock_security_struct *sbsec = sb->s_security;
652 struct dentry *root = sbsec->sb->s_root;
653 struct selinux_mnt_opts *opts = mnt_opts;
654 struct inode_security_struct *root_isec;
655 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
656 u32 defcontext_sid = 0;
659 mutex_lock(&sbsec->lock);
661 if (!selinux_state.initialized) {
663 /* Defer initialization until selinux_complete_init,
664 after the initial policy is loaded and the security
665 server is ready to handle calls. */
669 pr_warn("SELinux: Unable to set superblock options "
670 "before the security server is initialized\n");
673 if (kern_flags && !set_kern_flags) {
674 /* Specifying internal flags without providing a place to
675 * place the results is not allowed */
681 * Binary mount data FS will come through this function twice. Once
682 * from an explicit call and once from the generic calls from the vfs.
683 * Since the generic VFS calls will not contain any security mount data
684 * we need to skip the double mount verification.
686 * This does open a hole in which we will not notice if the first
687 * mount using this sb set explict options and a second mount using
688 * this sb does not set any security options. (The first options
689 * will be used for both mounts)
691 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
695 root_isec = backing_inode_security_novalidate(root);
698 * parse the mount options, check if they are valid sids.
699 * also check if someone is trying to mount the same sb more
700 * than once with different security options.
703 if (opts->fscontext) {
704 rc = parse_sid(sb, opts->fscontext, &fscontext_sid);
707 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
709 goto out_double_mount;
710 sbsec->flags |= FSCONTEXT_MNT;
713 rc = parse_sid(sb, opts->context, &context_sid);
716 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
718 goto out_double_mount;
719 sbsec->flags |= CONTEXT_MNT;
721 if (opts->rootcontext) {
722 rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid);
725 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
727 goto out_double_mount;
728 sbsec->flags |= ROOTCONTEXT_MNT;
730 if (opts->defcontext) {
731 rc = parse_sid(sb, opts->defcontext, &defcontext_sid);
734 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
736 goto out_double_mount;
737 sbsec->flags |= DEFCONTEXT_MNT;
741 if (sbsec->flags & SE_SBINITIALIZED) {
742 /* previously mounted with options, but not on this attempt? */
743 if ((sbsec->flags & SE_MNTMASK) && !opts)
744 goto out_double_mount;
749 if (strcmp(sb->s_type->name, "proc") == 0)
750 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
752 if (!strcmp(sb->s_type->name, "debugfs") ||
753 !strcmp(sb->s_type->name, "tracefs") ||
754 !strcmp(sb->s_type->name, "sysfs") ||
755 !strcmp(sb->s_type->name, "pstore") ||
756 !strcmp(sb->s_type->name, "cgroup") ||
757 !strcmp(sb->s_type->name, "cgroup2"))
758 sbsec->flags |= SE_SBGENFS;
760 if (!sbsec->behavior) {
762 * Determine the labeling behavior to use for this
765 rc = security_fs_use(&selinux_state, sb);
767 pr_warn("%s: security_fs_use(%s) returned %d\n",
768 __func__, sb->s_type->name, rc);
774 * If this is a user namespace mount and the filesystem type is not
775 * explicitly whitelisted, then no contexts are allowed on the command
776 * line and security labels must be ignored.
778 if (sb->s_user_ns != &init_user_ns &&
779 strcmp(sb->s_type->name, "tmpfs") &&
780 strcmp(sb->s_type->name, "ramfs") &&
781 strcmp(sb->s_type->name, "devpts")) {
782 if (context_sid || fscontext_sid || rootcontext_sid ||
787 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
788 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
789 rc = security_transition_sid(&selinux_state,
793 &sbsec->mntpoint_sid);
800 /* sets the context of the superblock for the fs being mounted. */
802 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
806 sbsec->sid = fscontext_sid;
810 * Switch to using mount point labeling behavior.
811 * sets the label used on all file below the mountpoint, and will set
812 * the superblock context if not already set.
814 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
815 sbsec->behavior = SECURITY_FS_USE_NATIVE;
816 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
820 if (!fscontext_sid) {
821 rc = may_context_mount_sb_relabel(context_sid, sbsec,
825 sbsec->sid = context_sid;
827 rc = may_context_mount_inode_relabel(context_sid, sbsec,
832 if (!rootcontext_sid)
833 rootcontext_sid = context_sid;
835 sbsec->mntpoint_sid = context_sid;
836 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
839 if (rootcontext_sid) {
840 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
845 root_isec->sid = rootcontext_sid;
846 root_isec->initialized = LABEL_INITIALIZED;
849 if (defcontext_sid) {
850 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
851 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
853 pr_warn("SELinux: defcontext option is "
854 "invalid for this filesystem type\n");
858 if (defcontext_sid != sbsec->def_sid) {
859 rc = may_context_mount_inode_relabel(defcontext_sid,
865 sbsec->def_sid = defcontext_sid;
869 rc = sb_finish_set_opts(sb);
871 mutex_unlock(&sbsec->lock);
875 pr_warn("SELinux: mount invalid. Same superblock, different "
876 "security settings for (dev %s, type %s)\n", sb->s_id,
881 static int selinux_cmp_sb_context(const struct super_block *oldsb,
882 const struct super_block *newsb)
884 struct superblock_security_struct *old = oldsb->s_security;
885 struct superblock_security_struct *new = newsb->s_security;
886 char oldflags = old->flags & SE_MNTMASK;
887 char newflags = new->flags & SE_MNTMASK;
889 if (oldflags != newflags)
891 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
893 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
895 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
897 if (oldflags & ROOTCONTEXT_MNT) {
898 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
899 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
900 if (oldroot->sid != newroot->sid)
905 pr_warn("SELinux: mount invalid. Same superblock, "
906 "different security settings for (dev %s, "
907 "type %s)\n", newsb->s_id, newsb->s_type->name);
911 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
912 struct super_block *newsb,
913 unsigned long kern_flags,
914 unsigned long *set_kern_flags)
917 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
918 struct superblock_security_struct *newsbsec = newsb->s_security;
920 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
921 int set_context = (oldsbsec->flags & CONTEXT_MNT);
922 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
925 * if the parent was able to be mounted it clearly had no special lsm
926 * mount options. thus we can safely deal with this superblock later
928 if (!selinux_state.initialized)
932 * Specifying internal flags without providing a place to
933 * place the results is not allowed.
935 if (kern_flags && !set_kern_flags)
938 /* how can we clone if the old one wasn't set up?? */
939 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
941 /* if fs is reusing a sb, make sure that the contexts match */
942 if (newsbsec->flags & SE_SBINITIALIZED) {
943 if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
944 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
945 return selinux_cmp_sb_context(oldsb, newsb);
948 mutex_lock(&newsbsec->lock);
950 newsbsec->flags = oldsbsec->flags;
952 newsbsec->sid = oldsbsec->sid;
953 newsbsec->def_sid = oldsbsec->def_sid;
954 newsbsec->behavior = oldsbsec->behavior;
956 if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
957 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
958 rc = security_fs_use(&selinux_state, newsb);
963 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
964 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
965 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
969 u32 sid = oldsbsec->mntpoint_sid;
973 if (!set_rootcontext) {
974 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
977 newsbsec->mntpoint_sid = sid;
979 if (set_rootcontext) {
980 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
981 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
983 newisec->sid = oldisec->sid;
986 sb_finish_set_opts(newsb);
988 mutex_unlock(&newsbsec->lock);
992 static int selinux_add_opt(int token, const char *s, void **mnt_opts)
994 struct selinux_mnt_opts *opts = *mnt_opts;
996 if (token == Opt_seclabel) /* eaten and completely ignored */
1000 opts = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
1009 if (opts->context || opts->defcontext)
1014 if (opts->fscontext)
1016 opts->fscontext = s;
1018 case Opt_rootcontext:
1019 if (opts->rootcontext)
1021 opts->rootcontext = s;
1023 case Opt_defcontext:
1024 if (opts->context || opts->defcontext)
1026 opts->defcontext = s;
1031 pr_warn(SEL_MOUNT_FAIL_MSG);
1035 static int selinux_add_mnt_opt(const char *option, const char *val, int len,
1038 int token = Opt_error;
1041 for (i = 0; i < ARRAY_SIZE(tokens); i++) {
1042 if (strcmp(option, tokens[i].name) == 0) {
1043 token = tokens[i].opt;
1048 if (token == Opt_error)
1051 if (token != Opt_seclabel)
1052 val = kmemdup_nul(val, len, GFP_KERNEL);
1053 rc = selinux_add_opt(token, val, mnt_opts);
1057 selinux_free_mnt_opts(*mnt_opts);
1064 static int show_sid(struct seq_file *m, u32 sid)
1066 char *context = NULL;
1070 rc = security_sid_to_context(&selinux_state, sid,
1073 bool has_comma = context && strchr(context, ',');
1078 seq_escape(m, context, "\"\n\\");
1086 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1088 struct superblock_security_struct *sbsec = sb->s_security;
1091 if (!(sbsec->flags & SE_SBINITIALIZED))
1094 if (!selinux_state.initialized)
1097 if (sbsec->flags & FSCONTEXT_MNT) {
1099 seq_puts(m, FSCONTEXT_STR);
1100 rc = show_sid(m, sbsec->sid);
1104 if (sbsec->flags & CONTEXT_MNT) {
1106 seq_puts(m, CONTEXT_STR);
1107 rc = show_sid(m, sbsec->mntpoint_sid);
1111 if (sbsec->flags & DEFCONTEXT_MNT) {
1113 seq_puts(m, DEFCONTEXT_STR);
1114 rc = show_sid(m, sbsec->def_sid);
1118 if (sbsec->flags & ROOTCONTEXT_MNT) {
1119 struct dentry *root = sbsec->sb->s_root;
1120 struct inode_security_struct *isec = backing_inode_security(root);
1122 seq_puts(m, ROOTCONTEXT_STR);
1123 rc = show_sid(m, isec->sid);
1127 if (sbsec->flags & SBLABEL_MNT) {
1129 seq_puts(m, SECLABEL_STR);
1134 static inline u16 inode_mode_to_security_class(umode_t mode)
1136 switch (mode & S_IFMT) {
1138 return SECCLASS_SOCK_FILE;
1140 return SECCLASS_LNK_FILE;
1142 return SECCLASS_FILE;
1144 return SECCLASS_BLK_FILE;
1146 return SECCLASS_DIR;
1148 return SECCLASS_CHR_FILE;
1150 return SECCLASS_FIFO_FILE;
1154 return SECCLASS_FILE;
1157 static inline int default_protocol_stream(int protocol)
1159 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1162 static inline int default_protocol_dgram(int protocol)
1164 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1167 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1169 int extsockclass = selinux_policycap_extsockclass();
1175 case SOCK_SEQPACKET:
1176 return SECCLASS_UNIX_STREAM_SOCKET;
1179 return SECCLASS_UNIX_DGRAM_SOCKET;
1186 case SOCK_SEQPACKET:
1187 if (default_protocol_stream(protocol))
1188 return SECCLASS_TCP_SOCKET;
1189 else if (extsockclass && protocol == IPPROTO_SCTP)
1190 return SECCLASS_SCTP_SOCKET;
1192 return SECCLASS_RAWIP_SOCKET;
1194 if (default_protocol_dgram(protocol))
1195 return SECCLASS_UDP_SOCKET;
1196 else if (extsockclass && (protocol == IPPROTO_ICMP ||
1197 protocol == IPPROTO_ICMPV6))
1198 return SECCLASS_ICMP_SOCKET;
1200 return SECCLASS_RAWIP_SOCKET;
1202 return SECCLASS_DCCP_SOCKET;
1204 return SECCLASS_RAWIP_SOCKET;
1210 return SECCLASS_NETLINK_ROUTE_SOCKET;
1211 case NETLINK_SOCK_DIAG:
1212 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1214 return SECCLASS_NETLINK_NFLOG_SOCKET;
1216 return SECCLASS_NETLINK_XFRM_SOCKET;
1217 case NETLINK_SELINUX:
1218 return SECCLASS_NETLINK_SELINUX_SOCKET;
1220 return SECCLASS_NETLINK_ISCSI_SOCKET;
1222 return SECCLASS_NETLINK_AUDIT_SOCKET;
1223 case NETLINK_FIB_LOOKUP:
1224 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1225 case NETLINK_CONNECTOR:
1226 return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1227 case NETLINK_NETFILTER:
1228 return SECCLASS_NETLINK_NETFILTER_SOCKET;
1229 case NETLINK_DNRTMSG:
1230 return SECCLASS_NETLINK_DNRT_SOCKET;
1231 case NETLINK_KOBJECT_UEVENT:
1232 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1233 case NETLINK_GENERIC:
1234 return SECCLASS_NETLINK_GENERIC_SOCKET;
1235 case NETLINK_SCSITRANSPORT:
1236 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1238 return SECCLASS_NETLINK_RDMA_SOCKET;
1239 case NETLINK_CRYPTO:
1240 return SECCLASS_NETLINK_CRYPTO_SOCKET;
1242 return SECCLASS_NETLINK_SOCKET;
1245 return SECCLASS_PACKET_SOCKET;
1247 return SECCLASS_KEY_SOCKET;
1249 return SECCLASS_APPLETALK_SOCKET;
1255 return SECCLASS_AX25_SOCKET;
1257 return SECCLASS_IPX_SOCKET;
1259 return SECCLASS_NETROM_SOCKET;
1261 return SECCLASS_ATMPVC_SOCKET;
1263 return SECCLASS_X25_SOCKET;
1265 return SECCLASS_ROSE_SOCKET;
1267 return SECCLASS_DECNET_SOCKET;
1269 return SECCLASS_ATMSVC_SOCKET;
1271 return SECCLASS_RDS_SOCKET;
1273 return SECCLASS_IRDA_SOCKET;
1275 return SECCLASS_PPPOX_SOCKET;
1277 return SECCLASS_LLC_SOCKET;
1279 return SECCLASS_CAN_SOCKET;
1281 return SECCLASS_TIPC_SOCKET;
1283 return SECCLASS_BLUETOOTH_SOCKET;
1285 return SECCLASS_IUCV_SOCKET;
1287 return SECCLASS_RXRPC_SOCKET;
1289 return SECCLASS_ISDN_SOCKET;
1291 return SECCLASS_PHONET_SOCKET;
1293 return SECCLASS_IEEE802154_SOCKET;
1295 return SECCLASS_CAIF_SOCKET;
1297 return SECCLASS_ALG_SOCKET;
1299 return SECCLASS_NFC_SOCKET;
1301 return SECCLASS_VSOCK_SOCKET;
1303 return SECCLASS_KCM_SOCKET;
1305 return SECCLASS_QIPCRTR_SOCKET;
1307 return SECCLASS_SMC_SOCKET;
1309 return SECCLASS_XDP_SOCKET;
1311 #error New address family defined, please update this function.
1316 return SECCLASS_SOCKET;
1319 static int selinux_genfs_get_sid(struct dentry *dentry,
1325 struct super_block *sb = dentry->d_sb;
1326 char *buffer, *path;
1328 buffer = (char *)__get_free_page(GFP_KERNEL);
1332 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1336 if (flags & SE_SBPROC) {
1337 /* each process gets a /proc/PID/ entry. Strip off the
1338 * PID part to get a valid selinux labeling.
1339 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1340 while (path[1] >= '0' && path[1] <= '9') {
1345 rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1347 if (rc == -ENOENT) {
1348 /* No match in policy, mark as unlabeled. */
1349 *sid = SECINITSID_UNLABELED;
1353 free_page((unsigned long)buffer);
1357 /* The inode's security attributes must be initialized before first use. */
1358 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1360 struct superblock_security_struct *sbsec = NULL;
1361 struct inode_security_struct *isec = selinux_inode(inode);
1362 u32 task_sid, sid = 0;
1364 struct dentry *dentry;
1365 #define INITCONTEXTLEN 255
1366 char *context = NULL;
1370 if (isec->initialized == LABEL_INITIALIZED)
1373 spin_lock(&isec->lock);
1374 if (isec->initialized == LABEL_INITIALIZED)
1377 if (isec->sclass == SECCLASS_FILE)
1378 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1380 sbsec = inode->i_sb->s_security;
1381 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1382 /* Defer initialization until selinux_complete_init,
1383 after the initial policy is loaded and the security
1384 server is ready to handle calls. */
1385 spin_lock(&sbsec->isec_lock);
1386 if (list_empty(&isec->list))
1387 list_add(&isec->list, &sbsec->isec_head);
1388 spin_unlock(&sbsec->isec_lock);
1392 sclass = isec->sclass;
1393 task_sid = isec->task_sid;
1395 isec->initialized = LABEL_PENDING;
1396 spin_unlock(&isec->lock);
1398 switch (sbsec->behavior) {
1399 case SECURITY_FS_USE_NATIVE:
1401 case SECURITY_FS_USE_XATTR:
1402 if (!(inode->i_opflags & IOP_XATTR)) {
1403 sid = sbsec->def_sid;
1406 /* Need a dentry, since the xattr API requires one.
1407 Life would be simpler if we could just pass the inode. */
1409 /* Called from d_instantiate or d_splice_alias. */
1410 dentry = dget(opt_dentry);
1413 * Called from selinux_complete_init, try to find a dentry.
1414 * Some filesystems really want a connected one, so try
1415 * that first. We could split SECURITY_FS_USE_XATTR in
1416 * two, depending upon that...
1418 dentry = d_find_alias(inode);
1420 dentry = d_find_any_alias(inode);
1424 * this is can be hit on boot when a file is accessed
1425 * before the policy is loaded. When we load policy we
1426 * may find inodes that have no dentry on the
1427 * sbsec->isec_head list. No reason to complain as these
1428 * will get fixed up the next time we go through
1429 * inode_doinit with a dentry, before these inodes could
1430 * be used again by userspace.
1435 len = INITCONTEXTLEN;
1436 context = kmalloc(len+1, GFP_NOFS);
1442 context[len] = '\0';
1443 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1444 if (rc == -ERANGE) {
1447 /* Need a larger buffer. Query for the right size. */
1448 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1454 context = kmalloc(len+1, GFP_NOFS);
1460 context[len] = '\0';
1461 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1465 if (rc != -ENODATA) {
1466 pr_warn("SELinux: %s: getxattr returned "
1467 "%d for dev=%s ino=%ld\n", __func__,
1468 -rc, inode->i_sb->s_id, inode->i_ino);
1472 /* Map ENODATA to the default file SID */
1473 sid = sbsec->def_sid;
1476 rc = security_context_to_sid_default(&selinux_state,
1481 char *dev = inode->i_sb->s_id;
1482 unsigned long ino = inode->i_ino;
1484 if (rc == -EINVAL) {
1485 if (printk_ratelimit())
1486 pr_notice("SELinux: inode=%lu on dev=%s was found to have an invalid "
1487 "context=%s. This indicates you may need to relabel the inode or the "
1488 "filesystem in question.\n", ino, dev, context);
1490 pr_warn("SELinux: %s: context_to_sid(%s) "
1491 "returned %d for dev=%s ino=%ld\n",
1492 __func__, context, -rc, dev, ino);
1495 /* Leave with the unlabeled SID */
1502 case SECURITY_FS_USE_TASK:
1505 case SECURITY_FS_USE_TRANS:
1506 /* Default to the fs SID. */
1509 /* Try to obtain a transition SID. */
1510 rc = security_transition_sid(&selinux_state, task_sid, sid,
1511 sclass, NULL, &sid);
1515 case SECURITY_FS_USE_MNTPOINT:
1516 sid = sbsec->mntpoint_sid;
1519 /* Default to the fs superblock SID. */
1522 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1523 /* We must have a dentry to determine the label on
1526 /* Called from d_instantiate or
1527 * d_splice_alias. */
1528 dentry = dget(opt_dentry);
1530 /* Called from selinux_complete_init, try to
1531 * find a dentry. Some filesystems really want
1532 * a connected one, so try that first.
1534 dentry = d_find_alias(inode);
1536 dentry = d_find_any_alias(inode);
1539 * This can be hit on boot when a file is accessed
1540 * before the policy is loaded. When we load policy we
1541 * may find inodes that have no dentry on the
1542 * sbsec->isec_head list. No reason to complain as
1543 * these will get fixed up the next time we go through
1544 * inode_doinit() with a dentry, before these inodes
1545 * could be used again by userspace.
1549 rc = selinux_genfs_get_sid(dentry, sclass,
1550 sbsec->flags, &sid);
1559 spin_lock(&isec->lock);
1560 if (isec->initialized == LABEL_PENDING) {
1562 isec->initialized = LABEL_INVALID;
1566 isec->initialized = LABEL_INITIALIZED;
1571 spin_unlock(&isec->lock);
1575 /* Convert a Linux signal to an access vector. */
1576 static inline u32 signal_to_av(int sig)
1582 /* Commonly granted from child to parent. */
1583 perm = PROCESS__SIGCHLD;
1586 /* Cannot be caught or ignored */
1587 perm = PROCESS__SIGKILL;
1590 /* Cannot be caught or ignored */
1591 perm = PROCESS__SIGSTOP;
1594 /* All other signals. */
1595 perm = PROCESS__SIGNAL;
1602 #if CAP_LAST_CAP > 63
1603 #error Fix SELinux to handle capabilities > 63.
1606 /* Check whether a task is allowed to use a capability. */
1607 static int cred_has_capability(const struct cred *cred,
1608 int cap, unsigned int opts, bool initns)
1610 struct common_audit_data ad;
1611 struct av_decision avd;
1613 u32 sid = cred_sid(cred);
1614 u32 av = CAP_TO_MASK(cap);
1617 ad.type = LSM_AUDIT_DATA_CAP;
1620 switch (CAP_TO_INDEX(cap)) {
1622 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1625 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1628 pr_err("SELinux: out of range capability %d\n", cap);
1633 rc = avc_has_perm_noaudit(&selinux_state,
1634 sid, sid, sclass, av, 0, &avd);
1635 if (!(opts & CAP_OPT_NOAUDIT)) {
1636 int rc2 = avc_audit(&selinux_state,
1637 sid, sid, sclass, av, &avd, rc, &ad, 0);
1644 /* Check whether a task has a particular permission to an inode.
1645 The 'adp' parameter is optional and allows other audit
1646 data to be passed (e.g. the dentry). */
1647 static int inode_has_perm(const struct cred *cred,
1648 struct inode *inode,
1650 struct common_audit_data *adp)
1652 struct inode_security_struct *isec;
1655 validate_creds(cred);
1657 if (unlikely(IS_PRIVATE(inode)))
1660 sid = cred_sid(cred);
1661 isec = selinux_inode(inode);
1663 return avc_has_perm(&selinux_state,
1664 sid, isec->sid, isec->sclass, perms, adp);
1667 /* Same as inode_has_perm, but pass explicit audit data containing
1668 the dentry to help the auditing code to more easily generate the
1669 pathname if needed. */
1670 static inline int dentry_has_perm(const struct cred *cred,
1671 struct dentry *dentry,
1674 struct inode *inode = d_backing_inode(dentry);
1675 struct common_audit_data ad;
1677 ad.type = LSM_AUDIT_DATA_DENTRY;
1678 ad.u.dentry = dentry;
1679 __inode_security_revalidate(inode, dentry, true);
1680 return inode_has_perm(cred, inode, av, &ad);
1683 /* Same as inode_has_perm, but pass explicit audit data containing
1684 the path to help the auditing code to more easily generate the
1685 pathname if needed. */
1686 static inline int path_has_perm(const struct cred *cred,
1687 const struct path *path,
1690 struct inode *inode = d_backing_inode(path->dentry);
1691 struct common_audit_data ad;
1693 ad.type = LSM_AUDIT_DATA_PATH;
1695 __inode_security_revalidate(inode, path->dentry, true);
1696 return inode_has_perm(cred, inode, av, &ad);
1699 /* Same as path_has_perm, but uses the inode from the file struct. */
1700 static inline int file_path_has_perm(const struct cred *cred,
1704 struct common_audit_data ad;
1706 ad.type = LSM_AUDIT_DATA_FILE;
1708 return inode_has_perm(cred, file_inode(file), av, &ad);
1711 #ifdef CONFIG_BPF_SYSCALL
1712 static int bpf_fd_pass(struct file *file, u32 sid);
1715 /* Check whether a task can use an open file descriptor to
1716 access an inode in a given way. Check access to the
1717 descriptor itself, and then use dentry_has_perm to
1718 check a particular permission to the file.
1719 Access to the descriptor is implicitly granted if it
1720 has the same SID as the process. If av is zero, then
1721 access to the file is not checked, e.g. for cases
1722 where only the descriptor is affected like seek. */
1723 static int file_has_perm(const struct cred *cred,
1727 struct file_security_struct *fsec = selinux_file(file);
1728 struct inode *inode = file_inode(file);
1729 struct common_audit_data ad;
1730 u32 sid = cred_sid(cred);
1733 ad.type = LSM_AUDIT_DATA_FILE;
1736 if (sid != fsec->sid) {
1737 rc = avc_has_perm(&selinux_state,
1746 #ifdef CONFIG_BPF_SYSCALL
1747 rc = bpf_fd_pass(file, cred_sid(cred));
1752 /* av is zero if only checking access to the descriptor. */
1755 rc = inode_has_perm(cred, inode, av, &ad);
1762 * Determine the label for an inode that might be unioned.
1765 selinux_determine_inode_label(const struct task_security_struct *tsec,
1767 const struct qstr *name, u16 tclass,
1770 const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1772 if ((sbsec->flags & SE_SBINITIALIZED) &&
1773 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1774 *_new_isid = sbsec->mntpoint_sid;
1775 } else if ((sbsec->flags & SBLABEL_MNT) &&
1777 *_new_isid = tsec->create_sid;
1779 const struct inode_security_struct *dsec = inode_security(dir);
1780 return security_transition_sid(&selinux_state, tsec->sid,
1788 /* Check whether a task can create a file. */
1789 static int may_create(struct inode *dir,
1790 struct dentry *dentry,
1793 const struct task_security_struct *tsec = selinux_cred(current_cred());
1794 struct inode_security_struct *dsec;
1795 struct superblock_security_struct *sbsec;
1797 struct common_audit_data ad;
1800 dsec = inode_security(dir);
1801 sbsec = dir->i_sb->s_security;
1805 ad.type = LSM_AUDIT_DATA_DENTRY;
1806 ad.u.dentry = dentry;
1808 rc = avc_has_perm(&selinux_state,
1809 sid, dsec->sid, SECCLASS_DIR,
1810 DIR__ADD_NAME | DIR__SEARCH,
1815 rc = selinux_determine_inode_label(selinux_cred(current_cred()), dir,
1816 &dentry->d_name, tclass, &newsid);
1820 rc = avc_has_perm(&selinux_state,
1821 sid, newsid, tclass, FILE__CREATE, &ad);
1825 return avc_has_perm(&selinux_state,
1827 SECCLASS_FILESYSTEM,
1828 FILESYSTEM__ASSOCIATE, &ad);
1832 #define MAY_UNLINK 1
1835 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1836 static int may_link(struct inode *dir,
1837 struct dentry *dentry,
1841 struct inode_security_struct *dsec, *isec;
1842 struct common_audit_data ad;
1843 u32 sid = current_sid();
1847 dsec = inode_security(dir);
1848 isec = backing_inode_security(dentry);
1850 ad.type = LSM_AUDIT_DATA_DENTRY;
1851 ad.u.dentry = dentry;
1854 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1855 rc = avc_has_perm(&selinux_state,
1856 sid, dsec->sid, SECCLASS_DIR, av, &ad);
1871 pr_warn("SELinux: %s: unrecognized kind %d\n",
1876 rc = avc_has_perm(&selinux_state,
1877 sid, isec->sid, isec->sclass, av, &ad);
1881 static inline int may_rename(struct inode *old_dir,
1882 struct dentry *old_dentry,
1883 struct inode *new_dir,
1884 struct dentry *new_dentry)
1886 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1887 struct common_audit_data ad;
1888 u32 sid = current_sid();
1890 int old_is_dir, new_is_dir;
1893 old_dsec = inode_security(old_dir);
1894 old_isec = backing_inode_security(old_dentry);
1895 old_is_dir = d_is_dir(old_dentry);
1896 new_dsec = inode_security(new_dir);
1898 ad.type = LSM_AUDIT_DATA_DENTRY;
1900 ad.u.dentry = old_dentry;
1901 rc = avc_has_perm(&selinux_state,
1902 sid, old_dsec->sid, SECCLASS_DIR,
1903 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1906 rc = avc_has_perm(&selinux_state,
1908 old_isec->sclass, FILE__RENAME, &ad);
1911 if (old_is_dir && new_dir != old_dir) {
1912 rc = avc_has_perm(&selinux_state,
1914 old_isec->sclass, DIR__REPARENT, &ad);
1919 ad.u.dentry = new_dentry;
1920 av = DIR__ADD_NAME | DIR__SEARCH;
1921 if (d_is_positive(new_dentry))
1922 av |= DIR__REMOVE_NAME;
1923 rc = avc_has_perm(&selinux_state,
1924 sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1927 if (d_is_positive(new_dentry)) {
1928 new_isec = backing_inode_security(new_dentry);
1929 new_is_dir = d_is_dir(new_dentry);
1930 rc = avc_has_perm(&selinux_state,
1933 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1941 /* Check whether a task can perform a filesystem operation. */
1942 static int superblock_has_perm(const struct cred *cred,
1943 struct super_block *sb,
1945 struct common_audit_data *ad)
1947 struct superblock_security_struct *sbsec;
1948 u32 sid = cred_sid(cred);
1950 sbsec = sb->s_security;
1951 return avc_has_perm(&selinux_state,
1952 sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1955 /* Convert a Linux mode and permission mask to an access vector. */
1956 static inline u32 file_mask_to_av(int mode, int mask)
1960 if (!S_ISDIR(mode)) {
1961 if (mask & MAY_EXEC)
1962 av |= FILE__EXECUTE;
1963 if (mask & MAY_READ)
1966 if (mask & MAY_APPEND)
1968 else if (mask & MAY_WRITE)
1972 if (mask & MAY_EXEC)
1974 if (mask & MAY_WRITE)
1976 if (mask & MAY_READ)
1983 /* Convert a Linux file to an access vector. */
1984 static inline u32 file_to_av(struct file *file)
1988 if (file->f_mode & FMODE_READ)
1990 if (file->f_mode & FMODE_WRITE) {
1991 if (file->f_flags & O_APPEND)
1998 * Special file opened with flags 3 for ioctl-only use.
2007 * Convert a file to an access vector and include the correct open
2010 static inline u32 open_file_to_av(struct file *file)
2012 u32 av = file_to_av(file);
2013 struct inode *inode = file_inode(file);
2015 if (selinux_policycap_openperm() &&
2016 inode->i_sb->s_magic != SOCKFS_MAGIC)
2022 /* Hook functions begin here. */
2024 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2026 u32 mysid = current_sid();
2027 u32 mgrsid = task_sid(mgr);
2029 return avc_has_perm(&selinux_state,
2030 mysid, mgrsid, SECCLASS_BINDER,
2031 BINDER__SET_CONTEXT_MGR, NULL);
2034 static int selinux_binder_transaction(struct task_struct *from,
2035 struct task_struct *to)
2037 u32 mysid = current_sid();
2038 u32 fromsid = task_sid(from);
2039 u32 tosid = task_sid(to);
2042 if (mysid != fromsid) {
2043 rc = avc_has_perm(&selinux_state,
2044 mysid, fromsid, SECCLASS_BINDER,
2045 BINDER__IMPERSONATE, NULL);
2050 return avc_has_perm(&selinux_state,
2051 fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2055 static int selinux_binder_transfer_binder(struct task_struct *from,
2056 struct task_struct *to)
2058 u32 fromsid = task_sid(from);
2059 u32 tosid = task_sid(to);
2061 return avc_has_perm(&selinux_state,
2062 fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2066 static int selinux_binder_transfer_file(struct task_struct *from,
2067 struct task_struct *to,
2070 u32 sid = task_sid(to);
2071 struct file_security_struct *fsec = selinux_file(file);
2072 struct dentry *dentry = file->f_path.dentry;
2073 struct inode_security_struct *isec;
2074 struct common_audit_data ad;
2077 ad.type = LSM_AUDIT_DATA_PATH;
2078 ad.u.path = file->f_path;
2080 if (sid != fsec->sid) {
2081 rc = avc_has_perm(&selinux_state,
2090 #ifdef CONFIG_BPF_SYSCALL
2091 rc = bpf_fd_pass(file, sid);
2096 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2099 isec = backing_inode_security(dentry);
2100 return avc_has_perm(&selinux_state,
2101 sid, isec->sid, isec->sclass, file_to_av(file),
2105 static int selinux_ptrace_access_check(struct task_struct *child,
2108 u32 sid = current_sid();
2109 u32 csid = task_sid(child);
2111 if (mode & PTRACE_MODE_READ)
2112 return avc_has_perm(&selinux_state,
2113 sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2115 return avc_has_perm(&selinux_state,
2116 sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2119 static int selinux_ptrace_traceme(struct task_struct *parent)
2121 return avc_has_perm(&selinux_state,
2122 task_sid(parent), current_sid(), SECCLASS_PROCESS,
2123 PROCESS__PTRACE, NULL);
2126 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2127 kernel_cap_t *inheritable, kernel_cap_t *permitted)
2129 return avc_has_perm(&selinux_state,
2130 current_sid(), task_sid(target), SECCLASS_PROCESS,
2131 PROCESS__GETCAP, NULL);
2134 static int selinux_capset(struct cred *new, const struct cred *old,
2135 const kernel_cap_t *effective,
2136 const kernel_cap_t *inheritable,
2137 const kernel_cap_t *permitted)
2139 return avc_has_perm(&selinux_state,
2140 cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2141 PROCESS__SETCAP, NULL);
2145 * (This comment used to live with the selinux_task_setuid hook,
2146 * which was removed).
2148 * Since setuid only affects the current process, and since the SELinux
2149 * controls are not based on the Linux identity attributes, SELinux does not
2150 * need to control this operation. However, SELinux does control the use of
2151 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2154 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2155 int cap, unsigned int opts)
2157 return cred_has_capability(cred, cap, opts, ns == &init_user_ns);
2160 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2162 const struct cred *cred = current_cred();
2174 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2179 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2182 rc = 0; /* let the kernel handle invalid cmds */
2188 static int selinux_quota_on(struct dentry *dentry)
2190 const struct cred *cred = current_cred();
2192 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2195 static int selinux_syslog(int type)
2198 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2199 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2200 return avc_has_perm(&selinux_state,
2201 current_sid(), SECINITSID_KERNEL,
2202 SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2203 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2204 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2205 /* Set level of messages printed to console */
2206 case SYSLOG_ACTION_CONSOLE_LEVEL:
2207 return avc_has_perm(&selinux_state,
2208 current_sid(), SECINITSID_KERNEL,
2209 SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2212 /* All other syslog types */
2213 return avc_has_perm(&selinux_state,
2214 current_sid(), SECINITSID_KERNEL,
2215 SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2219 * Check that a process has enough memory to allocate a new virtual
2220 * mapping. 0 means there is enough memory for the allocation to
2221 * succeed and -ENOMEM implies there is not.
2223 * Do not audit the selinux permission check, as this is applied to all
2224 * processes that allocate mappings.
2226 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2228 int rc, cap_sys_admin = 0;
2230 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2231 CAP_OPT_NOAUDIT, true);
2235 return cap_sys_admin;
2238 /* binprm security operations */
2240 static u32 ptrace_parent_sid(void)
2243 struct task_struct *tracer;
2246 tracer = ptrace_parent(current);
2248 sid = task_sid(tracer);
2254 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2255 const struct task_security_struct *old_tsec,
2256 const struct task_security_struct *new_tsec)
2258 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2259 int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2263 if (!nnp && !nosuid)
2264 return 0; /* neither NNP nor nosuid */
2266 if (new_tsec->sid == old_tsec->sid)
2267 return 0; /* No change in credentials */
2270 * If the policy enables the nnp_nosuid_transition policy capability,
2271 * then we permit transitions under NNP or nosuid if the
2272 * policy allows the corresponding permission between
2273 * the old and new contexts.
2275 if (selinux_policycap_nnp_nosuid_transition()) {
2278 av |= PROCESS2__NNP_TRANSITION;
2280 av |= PROCESS2__NOSUID_TRANSITION;
2281 rc = avc_has_perm(&selinux_state,
2282 old_tsec->sid, new_tsec->sid,
2283 SECCLASS_PROCESS2, av, NULL);
2289 * We also permit NNP or nosuid transitions to bounded SIDs,
2290 * i.e. SIDs that are guaranteed to only be allowed a subset
2291 * of the permissions of the current SID.
2293 rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2299 * On failure, preserve the errno values for NNP vs nosuid.
2300 * NNP: Operation not permitted for caller.
2301 * nosuid: Permission denied to file.
2308 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2310 const struct task_security_struct *old_tsec;
2311 struct task_security_struct *new_tsec;
2312 struct inode_security_struct *isec;
2313 struct common_audit_data ad;
2314 struct inode *inode = file_inode(bprm->file);
2317 /* SELinux context only depends on initial program or script and not
2318 * the script interpreter */
2319 if (bprm->called_set_creds)
2322 old_tsec = selinux_cred(current_cred());
2323 new_tsec = selinux_cred(bprm->cred);
2324 isec = inode_security(inode);
2326 /* Default to the current task SID. */
2327 new_tsec->sid = old_tsec->sid;
2328 new_tsec->osid = old_tsec->sid;
2330 /* Reset fs, key, and sock SIDs on execve. */
2331 new_tsec->create_sid = 0;
2332 new_tsec->keycreate_sid = 0;
2333 new_tsec->sockcreate_sid = 0;
2335 if (old_tsec->exec_sid) {
2336 new_tsec->sid = old_tsec->exec_sid;
2337 /* Reset exec SID on execve. */
2338 new_tsec->exec_sid = 0;
2340 /* Fail on NNP or nosuid if not an allowed transition. */
2341 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2345 /* Check for a default transition on this program. */
2346 rc = security_transition_sid(&selinux_state, old_tsec->sid,
2347 isec->sid, SECCLASS_PROCESS, NULL,
2353 * Fallback to old SID on NNP or nosuid if not an allowed
2356 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2358 new_tsec->sid = old_tsec->sid;
2361 ad.type = LSM_AUDIT_DATA_FILE;
2362 ad.u.file = bprm->file;
2364 if (new_tsec->sid == old_tsec->sid) {
2365 rc = avc_has_perm(&selinux_state,
2366 old_tsec->sid, isec->sid,
2367 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2371 /* Check permissions for the transition. */
2372 rc = avc_has_perm(&selinux_state,
2373 old_tsec->sid, new_tsec->sid,
2374 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2378 rc = avc_has_perm(&selinux_state,
2379 new_tsec->sid, isec->sid,
2380 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2384 /* Check for shared state */
2385 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2386 rc = avc_has_perm(&selinux_state,
2387 old_tsec->sid, new_tsec->sid,
2388 SECCLASS_PROCESS, PROCESS__SHARE,
2394 /* Make sure that anyone attempting to ptrace over a task that
2395 * changes its SID has the appropriate permit */
2396 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2397 u32 ptsid = ptrace_parent_sid();
2399 rc = avc_has_perm(&selinux_state,
2400 ptsid, new_tsec->sid,
2402 PROCESS__PTRACE, NULL);
2408 /* Clear any possibly unsafe personality bits on exec: */
2409 bprm->per_clear |= PER_CLEAR_ON_SETID;
2411 /* Enable secure mode for SIDs transitions unless
2412 the noatsecure permission is granted between
2413 the two SIDs, i.e. ahp returns 0. */
2414 rc = avc_has_perm(&selinux_state,
2415 old_tsec->sid, new_tsec->sid,
2416 SECCLASS_PROCESS, PROCESS__NOATSECURE,
2418 bprm->secureexec |= !!rc;
2424 static int match_file(const void *p, struct file *file, unsigned fd)
2426 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2429 /* Derived from fs/exec.c:flush_old_files. */
2430 static inline void flush_unauthorized_files(const struct cred *cred,
2431 struct files_struct *files)
2433 struct file *file, *devnull = NULL;
2434 struct tty_struct *tty;
2438 tty = get_current_tty();
2440 spin_lock(&tty->files_lock);
2441 if (!list_empty(&tty->tty_files)) {
2442 struct tty_file_private *file_priv;
2444 /* Revalidate access to controlling tty.
2445 Use file_path_has_perm on the tty path directly
2446 rather than using file_has_perm, as this particular
2447 open file may belong to another process and we are
2448 only interested in the inode-based check here. */
2449 file_priv = list_first_entry(&tty->tty_files,
2450 struct tty_file_private, list);
2451 file = file_priv->file;
2452 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2455 spin_unlock(&tty->files_lock);
2458 /* Reset controlling tty. */
2462 /* Revalidate access to inherited open files. */
2463 n = iterate_fd(files, 0, match_file, cred);
2464 if (!n) /* none found? */
2467 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2468 if (IS_ERR(devnull))
2470 /* replace all the matching ones with this */
2472 replace_fd(n - 1, devnull, 0);
2473 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2479 * Prepare a process for imminent new credential changes due to exec
2481 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2483 struct task_security_struct *new_tsec;
2484 struct rlimit *rlim, *initrlim;
2487 new_tsec = selinux_cred(bprm->cred);
2488 if (new_tsec->sid == new_tsec->osid)
2491 /* Close files for which the new task SID is not authorized. */
2492 flush_unauthorized_files(bprm->cred, current->files);
2494 /* Always clear parent death signal on SID transitions. */
2495 current->pdeath_signal = 0;
2497 /* Check whether the new SID can inherit resource limits from the old
2498 * SID. If not, reset all soft limits to the lower of the current
2499 * task's hard limit and the init task's soft limit.
2501 * Note that the setting of hard limits (even to lower them) can be
2502 * controlled by the setrlimit check. The inclusion of the init task's
2503 * soft limit into the computation is to avoid resetting soft limits
2504 * higher than the default soft limit for cases where the default is
2505 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2507 rc = avc_has_perm(&selinux_state,
2508 new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2509 PROCESS__RLIMITINH, NULL);
2511 /* protect against do_prlimit() */
2513 for (i = 0; i < RLIM_NLIMITS; i++) {
2514 rlim = current->signal->rlim + i;
2515 initrlim = init_task.signal->rlim + i;
2516 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2518 task_unlock(current);
2519 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2520 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2525 * Clean up the process immediately after the installation of new credentials
2528 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2530 const struct task_security_struct *tsec = selinux_cred(current_cred());
2531 struct itimerval itimer;
2541 /* Check whether the new SID can inherit signal state from the old SID.
2542 * If not, clear itimers to avoid subsequent signal generation and
2543 * flush and unblock signals.
2545 * This must occur _after_ the task SID has been updated so that any
2546 * kill done after the flush will be checked against the new SID.
2548 rc = avc_has_perm(&selinux_state,
2549 osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2551 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) {
2552 memset(&itimer, 0, sizeof itimer);
2553 for (i = 0; i < 3; i++)
2554 do_setitimer(i, &itimer, NULL);
2556 spin_lock_irq(¤t->sighand->siglock);
2557 if (!fatal_signal_pending(current)) {
2558 flush_sigqueue(¤t->pending);
2559 flush_sigqueue(¤t->signal->shared_pending);
2560 flush_signal_handlers(current, 1);
2561 sigemptyset(¤t->blocked);
2562 recalc_sigpending();
2564 spin_unlock_irq(¤t->sighand->siglock);
2567 /* Wake up the parent if it is waiting so that it can recheck
2568 * wait permission to the new task SID. */
2569 read_lock(&tasklist_lock);
2570 __wake_up_parent(current, current->real_parent);
2571 read_unlock(&tasklist_lock);
2574 /* superblock security operations */
2576 static int selinux_sb_alloc_security(struct super_block *sb)
2578 return superblock_alloc_security(sb);
2581 static void selinux_sb_free_security(struct super_block *sb)
2583 superblock_free_security(sb);
2586 static inline int opt_len(const char *s)
2588 bool open_quote = false;
2592 for (len = 0; (c = s[len]) != '\0'; len++) {
2594 open_quote = !open_quote;
2595 if (c == ',' && !open_quote)
2601 static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
2603 char *from = options;
2608 int len = opt_len(from);
2612 token = match_opt_prefix(from, len, &arg);
2614 if (token != Opt_error) {
2619 for (p = q = arg; p < from + len; p++) {
2624 arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);
2626 rc = selinux_add_opt(token, arg, mnt_opts);
2630 selinux_free_mnt_opts(*mnt_opts);
2636 if (!first) { // copy with preceding comma
2641 memmove(to, from, len);
2653 static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
2655 struct selinux_mnt_opts *opts = mnt_opts;
2656 struct superblock_security_struct *sbsec = sb->s_security;
2660 if (!(sbsec->flags & SE_SBINITIALIZED))
2666 if (opts->fscontext) {
2667 rc = parse_sid(sb, opts->fscontext, &sid);
2670 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2671 goto out_bad_option;
2673 if (opts->context) {
2674 rc = parse_sid(sb, opts->context, &sid);
2677 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2678 goto out_bad_option;
2680 if (opts->rootcontext) {
2681 struct inode_security_struct *root_isec;
2682 root_isec = backing_inode_security(sb->s_root);
2683 rc = parse_sid(sb, opts->rootcontext, &sid);
2686 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2687 goto out_bad_option;
2689 if (opts->defcontext) {
2690 rc = parse_sid(sb, opts->defcontext, &sid);
2693 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2694 goto out_bad_option;
2699 pr_warn("SELinux: unable to change security options "
2700 "during remount (dev %s, type=%s)\n", sb->s_id,
2705 static int selinux_sb_kern_mount(struct super_block *sb)
2707 const struct cred *cred = current_cred();
2708 struct common_audit_data ad;
2710 ad.type = LSM_AUDIT_DATA_DENTRY;
2711 ad.u.dentry = sb->s_root;
2712 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2715 static int selinux_sb_statfs(struct dentry *dentry)
2717 const struct cred *cred = current_cred();
2718 struct common_audit_data ad;
2720 ad.type = LSM_AUDIT_DATA_DENTRY;
2721 ad.u.dentry = dentry->d_sb->s_root;
2722 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2725 static int selinux_mount(const char *dev_name,
2726 const struct path *path,
2728 unsigned long flags,
2731 const struct cred *cred = current_cred();
2733 if (flags & MS_REMOUNT)
2734 return superblock_has_perm(cred, path->dentry->d_sb,
2735 FILESYSTEM__REMOUNT, NULL);
2737 return path_has_perm(cred, path, FILE__MOUNTON);
2740 static int selinux_umount(struct vfsmount *mnt, int flags)
2742 const struct cred *cred = current_cred();
2744 return superblock_has_perm(cred, mnt->mnt_sb,
2745 FILESYSTEM__UNMOUNT, NULL);
2748 static int selinux_fs_context_dup(struct fs_context *fc,
2749 struct fs_context *src_fc)
2751 const struct selinux_mnt_opts *src = src_fc->security;
2752 struct selinux_mnt_opts *opts;
2757 fc->security = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
2761 opts = fc->security;
2763 if (src->fscontext) {
2764 opts->fscontext = kstrdup(src->fscontext, GFP_KERNEL);
2765 if (!opts->fscontext)
2769 opts->context = kstrdup(src->context, GFP_KERNEL);
2773 if (src->rootcontext) {
2774 opts->rootcontext = kstrdup(src->rootcontext, GFP_KERNEL);
2775 if (!opts->rootcontext)
2778 if (src->defcontext) {
2779 opts->defcontext = kstrdup(src->defcontext, GFP_KERNEL);
2780 if (!opts->defcontext)
2786 static const struct fs_parameter_spec selinux_param_specs[] = {
2787 fsparam_string(CONTEXT_STR, Opt_context),
2788 fsparam_string(DEFCONTEXT_STR, Opt_defcontext),
2789 fsparam_string(FSCONTEXT_STR, Opt_fscontext),
2790 fsparam_string(ROOTCONTEXT_STR, Opt_rootcontext),
2791 fsparam_flag (SECLABEL_STR, Opt_seclabel),
2795 static const struct fs_parameter_description selinux_fs_parameters = {
2797 .specs = selinux_param_specs,
2800 static int selinux_fs_context_parse_param(struct fs_context *fc,
2801 struct fs_parameter *param)
2803 struct fs_parse_result result;
2806 opt = fs_parse(fc, &selinux_fs_parameters, param, &result);
2810 rc = selinux_add_opt(opt, param->string, &fc->security);
2812 param->string = NULL;
2818 /* inode security operations */
2820 static int selinux_inode_alloc_security(struct inode *inode)
2822 return inode_alloc_security(inode);
2825 static void selinux_inode_free_security(struct inode *inode)
2827 inode_free_security(inode);
2830 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2831 const struct qstr *name, void **ctx,
2837 rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2838 d_inode(dentry->d_parent), name,
2839 inode_mode_to_security_class(mode),
2844 return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
2848 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2850 const struct cred *old,
2855 struct task_security_struct *tsec;
2857 rc = selinux_determine_inode_label(selinux_cred(old),
2858 d_inode(dentry->d_parent), name,
2859 inode_mode_to_security_class(mode),
2864 tsec = selinux_cred(new);
2865 tsec->create_sid = newsid;
2869 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2870 const struct qstr *qstr,
2872 void **value, size_t *len)
2874 const struct task_security_struct *tsec = selinux_cred(current_cred());
2875 struct superblock_security_struct *sbsec;
2880 sbsec = dir->i_sb->s_security;
2882 newsid = tsec->create_sid;
2884 rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2886 inode_mode_to_security_class(inode->i_mode),
2891 /* Possibly defer initialization to selinux_complete_init. */
2892 if (sbsec->flags & SE_SBINITIALIZED) {
2893 struct inode_security_struct *isec = selinux_inode(inode);
2894 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2896 isec->initialized = LABEL_INITIALIZED;
2899 if (!selinux_state.initialized || !(sbsec->flags & SBLABEL_MNT))
2903 *name = XATTR_SELINUX_SUFFIX;
2906 rc = security_sid_to_context_force(&selinux_state, newsid,
2917 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2919 return may_create(dir, dentry, SECCLASS_FILE);
2922 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2924 return may_link(dir, old_dentry, MAY_LINK);
2927 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2929 return may_link(dir, dentry, MAY_UNLINK);
2932 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2934 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2937 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2939 return may_create(dir, dentry, SECCLASS_DIR);
2942 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2944 return may_link(dir, dentry, MAY_RMDIR);
2947 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2949 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2952 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2953 struct inode *new_inode, struct dentry *new_dentry)
2955 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2958 static int selinux_inode_readlink(struct dentry *dentry)
2960 const struct cred *cred = current_cred();
2962 return dentry_has_perm(cred, dentry, FILE__READ);
2965 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2968 const struct cred *cred = current_cred();
2969 struct common_audit_data ad;
2970 struct inode_security_struct *isec;
2973 validate_creds(cred);
2975 ad.type = LSM_AUDIT_DATA_DENTRY;
2976 ad.u.dentry = dentry;
2977 sid = cred_sid(cred);
2978 isec = inode_security_rcu(inode, rcu);
2980 return PTR_ERR(isec);
2982 return avc_has_perm(&selinux_state,
2983 sid, isec->sid, isec->sclass, FILE__READ, &ad);
2986 static noinline int audit_inode_permission(struct inode *inode,
2987 u32 perms, u32 audited, u32 denied,
2991 struct common_audit_data ad;
2992 struct inode_security_struct *isec = selinux_inode(inode);
2995 ad.type = LSM_AUDIT_DATA_INODE;
2998 rc = slow_avc_audit(&selinux_state,
2999 current_sid(), isec->sid, isec->sclass, perms,
3000 audited, denied, result, &ad, flags);
3006 static int selinux_inode_permission(struct inode *inode, int mask)
3008 const struct cred *cred = current_cred();
3011 unsigned flags = mask & MAY_NOT_BLOCK;
3012 struct inode_security_struct *isec;
3014 struct av_decision avd;
3016 u32 audited, denied;
3018 from_access = mask & MAY_ACCESS;
3019 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3021 /* No permission to check. Existence test. */
3025 validate_creds(cred);
3027 if (unlikely(IS_PRIVATE(inode)))
3030 perms = file_mask_to_av(inode->i_mode, mask);
3032 sid = cred_sid(cred);
3033 isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3035 return PTR_ERR(isec);
3037 rc = avc_has_perm_noaudit(&selinux_state,
3038 sid, isec->sid, isec->sclass, perms,
3039 (flags & MAY_NOT_BLOCK) ? AVC_NONBLOCKING : 0,
3041 audited = avc_audit_required(perms, &avd, rc,
3042 from_access ? FILE__AUDIT_ACCESS : 0,
3044 if (likely(!audited))
3047 rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
3053 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3055 const struct cred *cred = current_cred();
3056 struct inode *inode = d_backing_inode(dentry);
3057 unsigned int ia_valid = iattr->ia_valid;
3058 __u32 av = FILE__WRITE;
3060 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3061 if (ia_valid & ATTR_FORCE) {
3062 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3068 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3069 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3070 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3072 if (selinux_policycap_openperm() &&
3073 inode->i_sb->s_magic != SOCKFS_MAGIC &&
3074 (ia_valid & ATTR_SIZE) &&
3075 !(ia_valid & ATTR_FILE))
3078 return dentry_has_perm(cred, dentry, av);
3081 static int selinux_inode_getattr(const struct path *path)
3083 return path_has_perm(current_cred(), path, FILE__GETATTR);
3086 static bool has_cap_mac_admin(bool audit)
3088 const struct cred *cred = current_cred();
3089 unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT;
3091 if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, opts))
3093 if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, true))
3098 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3099 const void *value, size_t size, int flags)
3101 struct inode *inode = d_backing_inode(dentry);
3102 struct inode_security_struct *isec;
3103 struct superblock_security_struct *sbsec;
3104 struct common_audit_data ad;
3105 u32 newsid, sid = current_sid();
3108 if (strcmp(name, XATTR_NAME_SELINUX)) {
3109 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3113 /* Not an attribute we recognize, so just check the
3114 ordinary setattr permission. */
3115 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3118 sbsec = inode->i_sb->s_security;
3119 if (!(sbsec->flags & SBLABEL_MNT))
3122 if (!inode_owner_or_capable(inode))
3125 ad.type = LSM_AUDIT_DATA_DENTRY;
3126 ad.u.dentry = dentry;
3128 isec = backing_inode_security(dentry);
3129 rc = avc_has_perm(&selinux_state,
3130 sid, isec->sid, isec->sclass,
3131 FILE__RELABELFROM, &ad);
3135 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3137 if (rc == -EINVAL) {
3138 if (!has_cap_mac_admin(true)) {
3139 struct audit_buffer *ab;
3142 /* We strip a nul only if it is at the end, otherwise the
3143 * context contains a nul and we should audit that */
3145 const char *str = value;
3147 if (str[size - 1] == '\0')
3148 audit_size = size - 1;
3154 ab = audit_log_start(audit_context(),
3155 GFP_ATOMIC, AUDIT_SELINUX_ERR);
3156 audit_log_format(ab, "op=setxattr invalid_context=");
3157 audit_log_n_untrustedstring(ab, value, audit_size);
3162 rc = security_context_to_sid_force(&selinux_state, value,
3168 rc = avc_has_perm(&selinux_state,
3169 sid, newsid, isec->sclass,
3170 FILE__RELABELTO, &ad);
3174 rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3179 return avc_has_perm(&selinux_state,
3182 SECCLASS_FILESYSTEM,
3183 FILESYSTEM__ASSOCIATE,
3187 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3188 const void *value, size_t size,
3191 struct inode *inode = d_backing_inode(dentry);
3192 struct inode_security_struct *isec;
3196 if (strcmp(name, XATTR_NAME_SELINUX)) {
3197 /* Not an attribute we recognize, so nothing to do. */
3201 rc = security_context_to_sid_force(&selinux_state, value, size,
3204 pr_err("SELinux: unable to map context to SID"
3205 "for (%s, %lu), rc=%d\n",
3206 inode->i_sb->s_id, inode->i_ino, -rc);
3210 isec = backing_inode_security(dentry);
3211 spin_lock(&isec->lock);
3212 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3214 isec->initialized = LABEL_INITIALIZED;
3215 spin_unlock(&isec->lock);
3220 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3222 const struct cred *cred = current_cred();
3224 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3227 static int selinux_inode_listxattr(struct dentry *dentry)
3229 const struct cred *cred = current_cred();
3231 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3234 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3236 if (strcmp(name, XATTR_NAME_SELINUX)) {
3237 int rc = cap_inode_removexattr(dentry, name);
3241 /* Not an attribute we recognize, so just check the
3242 ordinary setattr permission. */
3243 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3246 /* No one is allowed to remove a SELinux security label.
3247 You can change the label, but all data must be labeled. */
3252 * Copy the inode security context value to the user.
3254 * Permission check is handled by selinux_inode_getxattr hook.
3256 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3260 char *context = NULL;
3261 struct inode_security_struct *isec;
3263 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3267 * If the caller has CAP_MAC_ADMIN, then get the raw context
3268 * value even if it is not defined by current policy; otherwise,
3269 * use the in-core value under current policy.
3270 * Use the non-auditing forms of the permission checks since
3271 * getxattr may be called by unprivileged processes commonly
3272 * and lack of permission just means that we fall back to the
3273 * in-core context value, not a denial.
3275 isec = inode_security(inode);
3276 if (has_cap_mac_admin(false))
3277 error = security_sid_to_context_force(&selinux_state,
3278 isec->sid, &context,
3281 error = security_sid_to_context(&selinux_state, isec->sid,
3295 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3296 const void *value, size_t size, int flags)
3298 struct inode_security_struct *isec = inode_security_novalidate(inode);
3299 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
3303 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3306 if (!(sbsec->flags & SBLABEL_MNT))
3309 if (!value || !size)
3312 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3317 spin_lock(&isec->lock);
3318 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3320 isec->initialized = LABEL_INITIALIZED;
3321 spin_unlock(&isec->lock);
3325 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3327 const int len = sizeof(XATTR_NAME_SELINUX);
3328 if (buffer && len <= buffer_size)
3329 memcpy(buffer, XATTR_NAME_SELINUX, len);
3333 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3335 struct inode_security_struct *isec = inode_security_novalidate(inode);
3339 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3342 struct task_security_struct *tsec;
3343 struct cred *new_creds = *new;
3345 if (new_creds == NULL) {
3346 new_creds = prepare_creds();
3351 tsec = selinux_cred(new_creds);
3352 /* Get label from overlay inode and set it in create_sid */
3353 selinux_inode_getsecid(d_inode(src), &sid);
3354 tsec->create_sid = sid;
3359 static int selinux_inode_copy_up_xattr(const char *name)
3361 /* The copy_up hook above sets the initial context on an inode, but we
3362 * don't then want to overwrite it by blindly copying all the lower
3363 * xattrs up. Instead, we have to filter out SELinux-related xattrs.
3365 if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3366 return 1; /* Discard */
3368 * Any other attribute apart from SELINUX is not claimed, supported
3374 /* file security operations */
3376 static int selinux_revalidate_file_permission(struct file *file, int mask)
3378 const struct cred *cred = current_cred();
3379 struct inode *inode = file_inode(file);
3381 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3382 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3385 return file_has_perm(cred, file,
3386 file_mask_to_av(inode->i_mode, mask));
3389 static int selinux_file_permission(struct file *file, int mask)
3391 struct inode *inode = file_inode(file);
3392 struct file_security_struct *fsec = selinux_file(file);
3393 struct inode_security_struct *isec;
3394 u32 sid = current_sid();
3397 /* No permission to check. Existence test. */
3400 isec = inode_security(inode);
3401 if (sid == fsec->sid && fsec->isid == isec->sid &&
3402 fsec->pseqno == avc_policy_seqno(&selinux_state))
3403 /* No change since file_open check. */
3406 return selinux_revalidate_file_permission(file, mask);
3409 static int selinux_file_alloc_security(struct file *file)
3411 return file_alloc_security(file);
3415 * Check whether a task has the ioctl permission and cmd
3416 * operation to an inode.
3418 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3419 u32 requested, u16 cmd)
3421 struct common_audit_data ad;
3422 struct file_security_struct *fsec = selinux_file(file);
3423 struct inode *inode = file_inode(file);
3424 struct inode_security_struct *isec;
3425 struct lsm_ioctlop_audit ioctl;
3426 u32 ssid = cred_sid(cred);
3428 u8 driver = cmd >> 8;
3429 u8 xperm = cmd & 0xff;
3431 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3434 ad.u.op->path = file->f_path;
3436 if (ssid != fsec->sid) {
3437 rc = avc_has_perm(&selinux_state,
3446 if (unlikely(IS_PRIVATE(inode)))
3449 isec = inode_security(inode);
3450 rc = avc_has_extended_perms(&selinux_state,
3451 ssid, isec->sid, isec->sclass,
3452 requested, driver, xperm, &ad);
3457 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3460 const struct cred *cred = current_cred();
3470 case FS_IOC_GETFLAGS:
3472 case FS_IOC_GETVERSION:
3473 error = file_has_perm(cred, file, FILE__GETATTR);
3476 case FS_IOC_SETFLAGS:
3478 case FS_IOC_SETVERSION:
3479 error = file_has_perm(cred, file, FILE__SETATTR);
3482 /* sys_ioctl() checks */
3486 error = file_has_perm(cred, file, 0);
3491 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3492 CAP_OPT_NONE, true);
3495 /* default case assumes that the command will go
3496 * to the file's ioctl() function.
3499 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3504 static int default_noexec;
3506 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3508 const struct cred *cred = current_cred();
3509 u32 sid = cred_sid(cred);
3512 if (default_noexec &&
3513 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3514 (!shared && (prot & PROT_WRITE)))) {
3516 * We are making executable an anonymous mapping or a
3517 * private file mapping that will also be writable.
3518 * This has an additional check.
3520 rc = avc_has_perm(&selinux_state,
3521 sid, sid, SECCLASS_PROCESS,
3522 PROCESS__EXECMEM, NULL);
3528 /* read access is always possible with a mapping */
3529 u32 av = FILE__READ;
3531 /* write access only matters if the mapping is shared */
3532 if (shared && (prot & PROT_WRITE))
3535 if (prot & PROT_EXEC)
3536 av |= FILE__EXECUTE;
3538 return file_has_perm(cred, file, av);
3545 static int selinux_mmap_addr(unsigned long addr)
3549 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3550 u32 sid = current_sid();
3551 rc = avc_has_perm(&selinux_state,
3552 sid, sid, SECCLASS_MEMPROTECT,
3553 MEMPROTECT__MMAP_ZERO, NULL);
3559 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3560 unsigned long prot, unsigned long flags)
3562 struct common_audit_data ad;
3566 ad.type = LSM_AUDIT_DATA_FILE;
3568 rc = inode_has_perm(current_cred(), file_inode(file),
3574 if (selinux_state.checkreqprot)
3577 return file_map_prot_check(file, prot,
3578 (flags & MAP_TYPE) == MAP_SHARED);
3581 static int selinux_file_mprotect(struct vm_area_struct *vma,
3582 unsigned long reqprot,
3585 const struct cred *cred = current_cred();
3586 u32 sid = cred_sid(cred);
3588 if (selinux_state.checkreqprot)
3591 if (default_noexec &&
3592 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3594 if (vma->vm_start >= vma->vm_mm->start_brk &&
3595 vma->vm_end <= vma->vm_mm->brk) {
3596 rc = avc_has_perm(&selinux_state,
3597 sid, sid, SECCLASS_PROCESS,
3598 PROCESS__EXECHEAP, NULL);
3599 } else if (!vma->vm_file &&
3600 ((vma->vm_start <= vma->vm_mm->start_stack &&
3601 vma->vm_end >= vma->vm_mm->start_stack) ||
3602 vma_is_stack_for_current(vma))) {
3603 rc = avc_has_perm(&selinux_state,
3604 sid, sid, SECCLASS_PROCESS,
3605 PROCESS__EXECSTACK, NULL);
3606 } else if (vma->vm_file && vma->anon_vma) {
3608 * We are making executable a file mapping that has
3609 * had some COW done. Since pages might have been
3610 * written, check ability to execute the possibly
3611 * modified content. This typically should only
3612 * occur for text relocations.
3614 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3620 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3623 static int selinux_file_lock(struct file *file, unsigned int cmd)
3625 const struct cred *cred = current_cred();
3627 return file_has_perm(cred, file, FILE__LOCK);
3630 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3633 const struct cred *cred = current_cred();
3638 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3639 err = file_has_perm(cred, file, FILE__WRITE);
3648 case F_GETOWNER_UIDS:
3649 /* Just check FD__USE permission */
3650 err = file_has_perm(cred, file, 0);
3658 #if BITS_PER_LONG == 32
3663 err = file_has_perm(cred, file, FILE__LOCK);
3670 static void selinux_file_set_fowner(struct file *file)
3672 struct file_security_struct *fsec;
3674 fsec = selinux_file(file);
3675 fsec->fown_sid = current_sid();
3678 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3679 struct fown_struct *fown, int signum)
3682 u32 sid = task_sid(tsk);
3684 struct file_security_struct *fsec;
3686 /* struct fown_struct is never outside the context of a struct file */
3687 file = container_of(fown, struct file, f_owner);
3689 fsec = selinux_file(file);
3692 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3694 perm = signal_to_av(signum);
3696 return avc_has_perm(&selinux_state,
3697 fsec->fown_sid, sid,
3698 SECCLASS_PROCESS, perm, NULL);
3701 static int selinux_file_receive(struct file *file)
3703 const struct cred *cred = current_cred();
3705 return file_has_perm(cred, file, file_to_av(file));
3708 static int selinux_file_open(struct file *file)
3710 struct file_security_struct *fsec;
3711 struct inode_security_struct *isec;
3713 fsec = selinux_file(file);
3714 isec = inode_security(file_inode(file));
3716 * Save inode label and policy sequence number
3717 * at open-time so that selinux_file_permission
3718 * can determine whether revalidation is necessary.
3719 * Task label is already saved in the file security
3720 * struct as its SID.
3722 fsec->isid = isec->sid;
3723 fsec->pseqno = avc_policy_seqno(&selinux_state);
3725 * Since the inode label or policy seqno may have changed
3726 * between the selinux_inode_permission check and the saving
3727 * of state above, recheck that access is still permitted.
3728 * Otherwise, access might never be revalidated against the
3729 * new inode label or new policy.
3730 * This check is not redundant - do not remove.
3732 return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
3735 /* task security operations */
3737 static int selinux_task_alloc(struct task_struct *task,
3738 unsigned long clone_flags)
3740 u32 sid = current_sid();
3742 return avc_has_perm(&selinux_state,
3743 sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
3747 * prepare a new set of credentials for modification
3749 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3752 const struct task_security_struct *old_tsec = selinux_cred(old);
3753 struct task_security_struct *tsec = selinux_cred(new);
3760 * transfer the SELinux data to a blank set of creds
3762 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3764 const struct task_security_struct *old_tsec = selinux_cred(old);
3765 struct task_security_struct *tsec = selinux_cred(new);
3770 static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
3772 *secid = cred_sid(c);
3776 * set the security data for a kernel service
3777 * - all the creation contexts are set to unlabelled
3779 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3781 struct task_security_struct *tsec = selinux_cred(new);
3782 u32 sid = current_sid();
3785 ret = avc_has_perm(&selinux_state,
3787 SECCLASS_KERNEL_SERVICE,
3788 KERNEL_SERVICE__USE_AS_OVERRIDE,
3792 tsec->create_sid = 0;
3793 tsec->keycreate_sid = 0;
3794 tsec->sockcreate_sid = 0;
3800 * set the file creation context in a security record to the same as the
3801 * objective context of the specified inode
3803 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3805 struct inode_security_struct *isec = inode_security(inode);
3806 struct task_security_struct *tsec = selinux_cred(new);
3807 u32 sid = current_sid();
3810 ret = avc_has_perm(&selinux_state,
3812 SECCLASS_KERNEL_SERVICE,
3813 KERNEL_SERVICE__CREATE_FILES_AS,
3817 tsec->create_sid = isec->sid;
3821 static int selinux_kernel_module_request(char *kmod_name)
3823 struct common_audit_data ad;
3825 ad.type = LSM_AUDIT_DATA_KMOD;
3826 ad.u.kmod_name = kmod_name;
3828 return avc_has_perm(&selinux_state,
3829 current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
3830 SYSTEM__MODULE_REQUEST, &ad);
3833 static int selinux_kernel_module_from_file(struct file *file)
3835 struct common_audit_data ad;
3836 struct inode_security_struct *isec;
3837 struct file_security_struct *fsec;
3838 u32 sid = current_sid();
3843 return avc_has_perm(&selinux_state,
3844 sid, sid, SECCLASS_SYSTEM,
3845 SYSTEM__MODULE_LOAD, NULL);
3849 ad.type = LSM_AUDIT_DATA_FILE;
3852 fsec = selinux_file(file);
3853 if (sid != fsec->sid) {
3854 rc = avc_has_perm(&selinux_state,
3855 sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3860 isec = inode_security(file_inode(file));
3861 return avc_has_perm(&selinux_state,
3862 sid, isec->sid, SECCLASS_SYSTEM,
3863 SYSTEM__MODULE_LOAD, &ad);
3866 static int selinux_kernel_read_file(struct file *file,
3867 enum kernel_read_file_id id)
3872 case READING_MODULE:
3873 rc = selinux_kernel_module_from_file(file);
3882 static int selinux_kernel_load_data(enum kernel_load_data_id id)
3887 case LOADING_MODULE:
3888 rc = selinux_kernel_module_from_file(NULL);
3896 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3898 return avc_has_perm(&selinux_state,
3899 current_sid(), task_sid(p), SECCLASS_PROCESS,
3900 PROCESS__SETPGID, NULL);
3903 static int selinux_task_getpgid(struct task_struct *p)
3905 return avc_has_perm(&selinux_state,
3906 current_sid(), task_sid(p), SECCLASS_PROCESS,
3907 PROCESS__GETPGID, NULL);
3910 static int selinux_task_getsid(struct task_struct *p)
3912 return avc_has_perm(&selinux_state,
3913 current_sid(), task_sid(p), SECCLASS_PROCESS,
3914 PROCESS__GETSESSION, NULL);
3917 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3919 *secid = task_sid(p);
3922 static int selinux_task_setnice(struct task_struct *p, int nice)
3924 return avc_has_perm(&selinux_state,
3925 current_sid(), task_sid(p), SECCLASS_PROCESS,
3926 PROCESS__SETSCHED, NULL);
3929 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3931 return avc_has_perm(&selinux_state,
3932 current_sid(), task_sid(p), SECCLASS_PROCESS,
3933 PROCESS__SETSCHED, NULL);
3936 static int selinux_task_getioprio(struct task_struct *p)
3938 return avc_has_perm(&selinux_state,
3939 current_sid(), task_sid(p), SECCLASS_PROCESS,
3940 PROCESS__GETSCHED, NULL);
3943 static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
3950 if (flags & LSM_PRLIMIT_WRITE)
3951 av |= PROCESS__SETRLIMIT;
3952 if (flags & LSM_PRLIMIT_READ)
3953 av |= PROCESS__GETRLIMIT;
3954 return avc_has_perm(&selinux_state,
3955 cred_sid(cred), cred_sid(tcred),
3956 SECCLASS_PROCESS, av, NULL);
3959 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3960 struct rlimit *new_rlim)
3962 struct rlimit *old_rlim = p->signal->rlim + resource;
3964 /* Control the ability to change the hard limit (whether
3965 lowering or raising it), so that the hard limit can
3966 later be used as a safe reset point for the soft limit
3967 upon context transitions. See selinux_bprm_committing_creds. */
3968 if (old_rlim->rlim_max != new_rlim->rlim_max)
3969 return avc_has_perm(&selinux_state,
3970 current_sid(), task_sid(p),
3971 SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
3976 static int selinux_task_setscheduler(struct task_struct *p)
3978 return avc_has_perm(&selinux_state,
3979 current_sid(), task_sid(p), SECCLASS_PROCESS,
3980 PROCESS__SETSCHED, NULL);
3983 static int selinux_task_getscheduler(struct task_struct *p)
3985 return avc_has_perm(&selinux_state,
3986 current_sid(), task_sid(p), SECCLASS_PROCESS,
3987 PROCESS__GETSCHED, NULL);
3990 static int selinux_task_movememory(struct task_struct *p)
3992 return avc_has_perm(&selinux_state,
3993 current_sid(), task_sid(p), SECCLASS_PROCESS,
3994 PROCESS__SETSCHED, NULL);
3997 static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
3998 int sig, const struct cred *cred)
4004 perm = PROCESS__SIGNULL; /* null signal; existence test */
4006 perm = signal_to_av(sig);
4008 secid = current_sid();
4010 secid = cred_sid(cred);
4011 return avc_has_perm(&selinux_state,
4012 secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
4015 static void selinux_task_to_inode(struct task_struct *p,
4016 struct inode *inode)
4018 struct inode_security_struct *isec = selinux_inode(inode);
4019 u32 sid = task_sid(p);
4021 spin_lock(&isec->lock);
4022 isec->sclass = inode_mode_to_security_class(inode->i_mode);
4024 isec->initialized = LABEL_INITIALIZED;
4025 spin_unlock(&isec->lock);
4028 /* Returns error only if unable to parse addresses */
4029 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4030 struct common_audit_data *ad, u8 *proto)
4032 int offset, ihlen, ret = -EINVAL;
4033 struct iphdr _iph, *ih;
4035 offset = skb_network_offset(skb);
4036 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4040 ihlen = ih->ihl * 4;
4041 if (ihlen < sizeof(_iph))
4044 ad->u.net->v4info.saddr = ih->saddr;
4045 ad->u.net->v4info.daddr = ih->daddr;
4049 *proto = ih->protocol;
4051 switch (ih->protocol) {
4053 struct tcphdr _tcph, *th;
4055 if (ntohs(ih->frag_off) & IP_OFFSET)
4059 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4063 ad->u.net->sport = th->source;
4064 ad->u.net->dport = th->dest;
4069 struct udphdr _udph, *uh;
4071 if (ntohs(ih->frag_off) & IP_OFFSET)
4075 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4079 ad->u.net->sport = uh->source;
4080 ad->u.net->dport = uh->dest;
4084 case IPPROTO_DCCP: {
4085 struct dccp_hdr _dccph, *dh;
4087 if (ntohs(ih->frag_off) & IP_OFFSET)
4091 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4095 ad->u.net->sport = dh->dccph_sport;
4096 ad->u.net->dport = dh->dccph_dport;
4100 #if IS_ENABLED(CONFIG_IP_SCTP)
4101 case IPPROTO_SCTP: {
4102 struct sctphdr _sctph, *sh;
4104 if (ntohs(ih->frag_off) & IP_OFFSET)
4108 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4112 ad->u.net->sport = sh->source;
4113 ad->u.net->dport = sh->dest;
4124 #if IS_ENABLED(CONFIG_IPV6)
4126 /* Returns error only if unable to parse addresses */
4127 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4128 struct common_audit_data *ad, u8 *proto)
4131 int ret = -EINVAL, offset;
4132 struct ipv6hdr _ipv6h, *ip6;
4135 offset = skb_network_offset(skb);
4136 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4140 ad->u.net->v6info.saddr = ip6->saddr;
4141 ad->u.net->v6info.daddr = ip6->daddr;
4144 nexthdr = ip6->nexthdr;
4145 offset += sizeof(_ipv6h);
4146 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4155 struct tcphdr _tcph, *th;
4157 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4161 ad->u.net->sport = th->source;
4162 ad->u.net->dport = th->dest;
4167 struct udphdr _udph, *uh;
4169 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4173 ad->u.net->sport = uh->source;
4174 ad->u.net->dport = uh->dest;
4178 case IPPROTO_DCCP: {
4179 struct dccp_hdr _dccph, *dh;
4181 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4185 ad->u.net->sport = dh->dccph_sport;
4186 ad->u.net->dport = dh->dccph_dport;
4190 #if IS_ENABLED(CONFIG_IP_SCTP)
4191 case IPPROTO_SCTP: {
4192 struct sctphdr _sctph, *sh;
4194 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4198 ad->u.net->sport = sh->source;
4199 ad->u.net->dport = sh->dest;
4203 /* includes fragments */
4213 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4214 char **_addrp, int src, u8 *proto)
4219 switch (ad->u.net->family) {
4221 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4224 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4225 &ad->u.net->v4info.daddr);
4228 #if IS_ENABLED(CONFIG_IPV6)
4230 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4233 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4234 &ad->u.net->v6info.daddr);
4244 "SELinux: failure in selinux_parse_skb(),"
4245 " unable to parse packet\n");
4255 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4257 * @family: protocol family
4258 * @sid: the packet's peer label SID
4261 * Check the various different forms of network peer labeling and determine
4262 * the peer label/SID for the packet; most of the magic actually occurs in
4263 * the security server function security_net_peersid_cmp(). The function
4264 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4265 * or -EACCES if @sid is invalid due to inconsistencies with the different
4269 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4276 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4279 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4283 err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4284 nlbl_type, xfrm_sid, sid);
4285 if (unlikely(err)) {
4287 "SELinux: failure in selinux_skb_peerlbl_sid(),"
4288 " unable to determine packet's peer label\n");
4296 * selinux_conn_sid - Determine the child socket label for a connection
4297 * @sk_sid: the parent socket's SID
4298 * @skb_sid: the packet's SID
4299 * @conn_sid: the resulting connection SID
4301 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4302 * combined with the MLS information from @skb_sid in order to create
4303 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
4304 * of @sk_sid. Returns zero on success, negative values on failure.
4307 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4311 if (skb_sid != SECSID_NULL)
4312 err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4320 /* socket security operations */
4322 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4323 u16 secclass, u32 *socksid)
4325 if (tsec->sockcreate_sid > SECSID_NULL) {
4326 *socksid = tsec->sockcreate_sid;
4330 return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4331 secclass, NULL, socksid);
4334 static int sock_has_perm(struct sock *sk, u32 perms)
4336 struct sk_security_struct *sksec = sk->sk_security;
4337 struct common_audit_data ad;
4338 struct lsm_network_audit net = {0,};
4340 if (sksec->sid == SECINITSID_KERNEL)
4343 ad.type = LSM_AUDIT_DATA_NET;
4347 return avc_has_perm(&selinux_state,
4348 current_sid(), sksec->sid, sksec->sclass, perms,
4352 static int selinux_socket_create(int family, int type,
4353 int protocol, int kern)
4355 const struct task_security_struct *tsec = selinux_cred(current_cred());
4363 secclass = socket_type_to_security_class(family, type, protocol);
4364 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4368 return avc_has_perm(&selinux_state,
4369 tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4372 static int selinux_socket_post_create(struct socket *sock, int family,
4373 int type, int protocol, int kern)
4375 const struct task_security_struct *tsec = selinux_cred(current_cred());
4376 struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4377 struct sk_security_struct *sksec;
4378 u16 sclass = socket_type_to_security_class(family, type, protocol);
4379 u32 sid = SECINITSID_KERNEL;
4383 err = socket_sockcreate_sid(tsec, sclass, &sid);
4388 isec->sclass = sclass;
4390 isec->initialized = LABEL_INITIALIZED;
4393 sksec = sock->sk->sk_security;
4394 sksec->sclass = sclass;
4396 /* Allows detection of the first association on this socket */
4397 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4398 sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4400 err = selinux_netlbl_socket_post_create(sock->sk, family);
4406 static int selinux_socket_socketpair(struct socket *socka,
4407 struct socket *sockb)
4409 struct sk_security_struct *sksec_a = socka->sk->sk_security;
4410 struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4412 sksec_a->peer_sid = sksec_b->sid;
4413 sksec_b->peer_sid = sksec_a->sid;
4418 /* Range of port numbers used to automatically bind.
4419 Need to determine whether we should perform a name_bind
4420 permission check between the socket and the port number. */
4422 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4424 struct sock *sk = sock->sk;
4425 struct sk_security_struct *sksec = sk->sk_security;
4429 err = sock_has_perm(sk, SOCKET__BIND);
4433 /* If PF_INET or PF_INET6, check name_bind permission for the port. */
4434 family = sk->sk_family;
4435 if (family == PF_INET || family == PF_INET6) {
4437 struct common_audit_data ad;
4438 struct lsm_network_audit net = {0,};
4439 struct sockaddr_in *addr4 = NULL;
4440 struct sockaddr_in6 *addr6 = NULL;
4441 u16 family_sa = address->sa_family;
4442 unsigned short snum;
4446 * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4447 * that validates multiple binding addresses. Because of this
4448 * need to check address->sa_family as it is possible to have
4449 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4451 switch (family_sa) {
4454 if (addrlen < sizeof(struct sockaddr_in))
4456 addr4 = (struct sockaddr_in *)address;
4457 if (family_sa == AF_UNSPEC) {
4458 /* see __inet_bind(), we only want to allow
4459 * AF_UNSPEC if the address is INADDR_ANY
4461 if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4463 family_sa = AF_INET;
4465 snum = ntohs(addr4->sin_port);
4466 addrp = (char *)&addr4->sin_addr.s_addr;
4469 if (addrlen < SIN6_LEN_RFC2133)
4471 addr6 = (struct sockaddr_in6 *)address;
4472 snum = ntohs(addr6->sin6_port);
4473 addrp = (char *)&addr6->sin6_addr.s6_addr;
4479 ad.type = LSM_AUDIT_DATA_NET;
4481 ad.u.net->sport = htons(snum);
4482 ad.u.net->family = family_sa;
4487 inet_get_local_port_range(sock_net(sk), &low, &high);
4489 if (snum < max(inet_prot_sock(sock_net(sk)), low) ||
4491 err = sel_netport_sid(sk->sk_protocol,
4495 err = avc_has_perm(&selinux_state,
4498 SOCKET__NAME_BIND, &ad);
4504 switch (sksec->sclass) {
4505 case SECCLASS_TCP_SOCKET:
4506 node_perm = TCP_SOCKET__NODE_BIND;
4509 case SECCLASS_UDP_SOCKET:
4510 node_perm = UDP_SOCKET__NODE_BIND;
4513 case SECCLASS_DCCP_SOCKET:
4514 node_perm = DCCP_SOCKET__NODE_BIND;
4517 case SECCLASS_SCTP_SOCKET:
4518 node_perm = SCTP_SOCKET__NODE_BIND;
4522 node_perm = RAWIP_SOCKET__NODE_BIND;
4526 err = sel_netnode_sid(addrp, family_sa, &sid);
4530 if (family_sa == AF_INET)
4531 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4533 ad.u.net->v6info.saddr = addr6->sin6_addr;
4535 err = avc_has_perm(&selinux_state,
4537 sksec->sclass, node_perm, &ad);
4544 /* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4545 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4547 return -EAFNOSUPPORT;
4550 /* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4551 * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst
4553 static int selinux_socket_connect_helper(struct socket *sock,
4554 struct sockaddr *address, int addrlen)
4556 struct sock *sk = sock->sk;
4557 struct sk_security_struct *sksec = sk->sk_security;
4560 err = sock_has_perm(sk, SOCKET__CONNECT);
4565 * If a TCP, DCCP or SCTP socket, check name_connect permission
4568 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4569 sksec->sclass == SECCLASS_DCCP_SOCKET ||
4570 sksec->sclass == SECCLASS_SCTP_SOCKET) {
4571 struct common_audit_data ad;
4572 struct lsm_network_audit net = {0,};
4573 struct sockaddr_in *addr4 = NULL;
4574 struct sockaddr_in6 *addr6 = NULL;
4575 unsigned short snum;
4578 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4579 * that validates multiple connect addresses. Because of this
4580 * need to check address->sa_family as it is possible to have
4581 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4583 switch (address->sa_family) {
4585 addr4 = (struct sockaddr_in *)address;
4586 if (addrlen < sizeof(struct sockaddr_in))
4588 snum = ntohs(addr4->sin_port);
4591 addr6 = (struct sockaddr_in6 *)address;
4592 if (addrlen < SIN6_LEN_RFC2133)
4594 snum = ntohs(addr6->sin6_port);
4597 /* Note that SCTP services expect -EINVAL, whereas
4598 * others expect -EAFNOSUPPORT.
4600 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4603 return -EAFNOSUPPORT;
4606 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4610 switch (sksec->sclass) {
4611 case SECCLASS_TCP_SOCKET:
4612 perm = TCP_SOCKET__NAME_CONNECT;
4614 case SECCLASS_DCCP_SOCKET:
4615 perm = DCCP_SOCKET__NAME_CONNECT;
4617 case SECCLASS_SCTP_SOCKET:
4618 perm = SCTP_SOCKET__NAME_CONNECT;
4622 ad.type = LSM_AUDIT_DATA_NET;
4624 ad.u.net->dport = htons(snum);
4625 ad.u.net->family = address->sa_family;
4626 err = avc_has_perm(&selinux_state,
4627 sksec->sid, sid, sksec->sclass, perm, &ad);
4635 /* Supports connect(2), see comments in selinux_socket_connect_helper() */
4636 static int selinux_socket_connect(struct socket *sock,
4637 struct sockaddr *address, int addrlen)
4640 struct sock *sk = sock->sk;
4642 err = selinux_socket_connect_helper(sock, address, addrlen);
4646 return selinux_netlbl_socket_connect(sk, address);
4649 static int selinux_socket_listen(struct socket *sock, int backlog)
4651 return sock_has_perm(sock->sk, SOCKET__LISTEN);
4654 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4657 struct inode_security_struct *isec;
4658 struct inode_security_struct *newisec;
4662 err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4666 isec = inode_security_novalidate(SOCK_INODE(sock));
4667 spin_lock(&isec->lock);
4668 sclass = isec->sclass;
4670 spin_unlock(&isec->lock);
4672 newisec = inode_security_novalidate(SOCK_INODE(newsock));
4673 newisec->sclass = sclass;
4675 newisec->initialized = LABEL_INITIALIZED;
4680 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4683 return sock_has_perm(sock->sk, SOCKET__WRITE);
4686 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4687 int size, int flags)
4689 return sock_has_perm(sock->sk, SOCKET__READ);
4692 static int selinux_socket_getsockname(struct socket *sock)
4694 return sock_has_perm(sock->sk, SOCKET__GETATTR);
4697 static int selinux_socket_getpeername(struct socket *sock)
4699 return sock_has_perm(sock->sk, SOCKET__GETATTR);
4702 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4706 err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4710 return selinux_netlbl_socket_setsockopt(sock, level, optname);
4713 static int selinux_socket_getsockopt(struct socket *sock, int level,
4716 return sock_has_perm(sock->sk, SOCKET__GETOPT);
4719 static int selinux_socket_shutdown(struct socket *sock, int how)
4721 return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4724 static int selinux_socket_unix_stream_connect(struct sock *sock,
4728 struct sk_security_struct *sksec_sock = sock->sk_security;
4729 struct sk_security_struct *sksec_other = other->sk_security;
4730 struct sk_security_struct *sksec_new = newsk->sk_security;
4731 struct common_audit_data ad;
4732 struct lsm_network_audit net = {0,};
4735 ad.type = LSM_AUDIT_DATA_NET;
4737 ad.u.net->sk = other;
4739 err = avc_has_perm(&selinux_state,
4740 sksec_sock->sid, sksec_other->sid,
4741 sksec_other->sclass,
4742 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4746 /* server child socket */
4747 sksec_new->peer_sid = sksec_sock->sid;
4748 err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
4749 sksec_sock->sid, &sksec_new->sid);
4753 /* connecting socket */
4754 sksec_sock->peer_sid = sksec_new->sid;
4759 static int selinux_socket_unix_may_send(struct socket *sock,
4760 struct socket *other)
4762 struct sk_security_struct *ssec = sock->sk->sk_security;
4763 struct sk_security_struct *osec = other->sk->sk_security;
4764 struct common_audit_data ad;
4765 struct lsm_network_audit net = {0,};
4767 ad.type = LSM_AUDIT_DATA_NET;
4769 ad.u.net->sk = other->sk;
4771 return avc_has_perm(&selinux_state,
4772 ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4776 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4777 char *addrp, u16 family, u32 peer_sid,
4778 struct common_audit_data *ad)
4784 err = sel_netif_sid(ns, ifindex, &if_sid);
4787 err = avc_has_perm(&selinux_state,
4789 SECCLASS_NETIF, NETIF__INGRESS, ad);
4793 err = sel_netnode_sid(addrp, family, &node_sid);
4796 return avc_has_perm(&selinux_state,
4798 SECCLASS_NODE, NODE__RECVFROM, ad);
4801 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4805 struct sk_security_struct *sksec = sk->sk_security;
4806 u32 sk_sid = sksec->sid;
4807 struct common_audit_data ad;
4808 struct lsm_network_audit net = {0,};
4811 ad.type = LSM_AUDIT_DATA_NET;
4813 ad.u.net->netif = skb->skb_iif;
4814 ad.u.net->family = family;
4815 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4819 if (selinux_secmark_enabled()) {
4820 err = avc_has_perm(&selinux_state,
4821 sk_sid, skb->secmark, SECCLASS_PACKET,
4827 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4830 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4835 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4838 struct sk_security_struct *sksec = sk->sk_security;
4839 u16 family = sk->sk_family;
4840 u32 sk_sid = sksec->sid;
4841 struct common_audit_data ad;
4842 struct lsm_network_audit net = {0,};
4847 if (family != PF_INET && family != PF_INET6)
4850 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4851 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4854 /* If any sort of compatibility mode is enabled then handoff processing
4855 * to the selinux_sock_rcv_skb_compat() function to deal with the
4856 * special handling. We do this in an attempt to keep this function
4857 * as fast and as clean as possible. */
4858 if (!selinux_policycap_netpeer())
4859 return selinux_sock_rcv_skb_compat(sk, skb, family);
4861 secmark_active = selinux_secmark_enabled();
4862 peerlbl_active = selinux_peerlbl_enabled();
4863 if (!secmark_active && !peerlbl_active)
4866 ad.type = LSM_AUDIT_DATA_NET;
4868 ad.u.net->netif = skb->skb_iif;
4869 ad.u.net->family = family;
4870 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4874 if (peerlbl_active) {
4877 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4880 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4881 addrp, family, peer_sid, &ad);
4883 selinux_netlbl_err(skb, family, err, 0);
4886 err = avc_has_perm(&selinux_state,
4887 sk_sid, peer_sid, SECCLASS_PEER,
4890 selinux_netlbl_err(skb, family, err, 0);
4895 if (secmark_active) {
4896 err = avc_has_perm(&selinux_state,
4897 sk_sid, skb->secmark, SECCLASS_PACKET,
4906 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4907 int __user *optlen, unsigned len)
4912 struct sk_security_struct *sksec = sock->sk->sk_security;
4913 u32 peer_sid = SECSID_NULL;
4915 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4916 sksec->sclass == SECCLASS_TCP_SOCKET ||
4917 sksec->sclass == SECCLASS_SCTP_SOCKET)
4918 peer_sid = sksec->peer_sid;
4919 if (peer_sid == SECSID_NULL)
4920 return -ENOPROTOOPT;
4922 err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
4927 if (scontext_len > len) {
4932 if (copy_to_user(optval, scontext, scontext_len))
4936 if (put_user(scontext_len, optlen))
4942 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4944 u32 peer_secid = SECSID_NULL;
4946 struct inode_security_struct *isec;
4948 if (skb && skb->protocol == htons(ETH_P_IP))
4950 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4953 family = sock->sk->sk_family;
4957 if (sock && family == PF_UNIX) {
4958 isec = inode_security_novalidate(SOCK_INODE(sock));
4959 peer_secid = isec->sid;
4961 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4964 *secid = peer_secid;
4965 if (peer_secid == SECSID_NULL)
4970 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4972 struct sk_security_struct *sksec;
4974 sksec = kzalloc(sizeof(*sksec), priority);
4978 sksec->peer_sid = SECINITSID_UNLABELED;
4979 sksec->sid = SECINITSID_UNLABELED;
4980 sksec->sclass = SECCLASS_SOCKET;
4981 selinux_netlbl_sk_security_reset(sksec);
4982 sk->sk_security = sksec;
4987 static void selinux_sk_free_security(struct sock *sk)
4989 struct sk_security_struct *sksec = sk->sk_security;
4991 sk->sk_security = NULL;
4992 selinux_netlbl_sk_security_free(sksec);
4996 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4998 struct sk_security_struct *sksec = sk->sk_security;
4999 struct sk_security_struct *newsksec = newsk->sk_security;
5001 newsksec->sid = sksec->sid;
5002 newsksec->peer_sid = sksec->peer_sid;
5003 newsksec->sclass = sksec->sclass;
5005 selinux_netlbl_sk_security_reset(newsksec);
5008 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
5011 *secid = SECINITSID_ANY_SOCKET;
5013 struct sk_security_struct *sksec = sk->sk_security;
5015 *secid = sksec->sid;
5019 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
5021 struct inode_security_struct *isec =
5022 inode_security_novalidate(SOCK_INODE(parent));
5023 struct sk_security_struct *sksec = sk->sk_security;
5025 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5026 sk->sk_family == PF_UNIX)
5027 isec->sid = sksec->sid;
5028 sksec->sclass = isec->sclass;
5031 /* Called whenever SCTP receives an INIT chunk. This happens when an incoming
5032 * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
5035 static int selinux_sctp_assoc_request(struct sctp_endpoint *ep,
5036 struct sk_buff *skb)
5038 struct sk_security_struct *sksec = ep->base.sk->sk_security;
5039 struct common_audit_data ad;
5040 struct lsm_network_audit net = {0,};
5042 u32 peer_sid = SECINITSID_UNLABELED;
5046 if (!selinux_policycap_extsockclass())
5049 peerlbl_active = selinux_peerlbl_enabled();
5051 if (peerlbl_active) {
5052 /* This will return peer_sid = SECSID_NULL if there are
5053 * no peer labels, see security_net_peersid_resolve().
5055 err = selinux_skb_peerlbl_sid(skb, ep->base.sk->sk_family,
5060 if (peer_sid == SECSID_NULL)
5061 peer_sid = SECINITSID_UNLABELED;
5064 if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5065 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5067 /* Here as first association on socket. As the peer SID
5068 * was allowed by peer recv (and the netif/node checks),
5069 * then it is approved by policy and used as the primary
5070 * peer SID for getpeercon(3).
5072 sksec->peer_sid = peer_sid;
5073 } else if (sksec->peer_sid != peer_sid) {
5074 /* Other association peer SIDs are checked to enforce
5075 * consistency among the peer SIDs.
5077 ad.type = LSM_AUDIT_DATA_NET;
5079 ad.u.net->sk = ep->base.sk;
5080 err = avc_has_perm(&selinux_state,
5081 sksec->peer_sid, peer_sid, sksec->sclass,
5082 SCTP_SOCKET__ASSOCIATION, &ad);
5087 /* Compute the MLS component for the connection and store
5088 * the information in ep. This will be used by SCTP TCP type
5089 * sockets and peeled off connections as they cause a new
5090 * socket to be generated. selinux_sctp_sk_clone() will then
5091 * plug this into the new socket.
5093 err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
5097 ep->secid = conn_sid;
5098 ep->peer_secid = peer_sid;
5100 /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5101 return selinux_netlbl_sctp_assoc_request(ep, skb);
5104 /* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5105 * based on their @optname.
5107 static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5108 struct sockaddr *address,
5111 int len, err = 0, walk_size = 0;
5113 struct sockaddr *addr;
5114 struct socket *sock;
5116 if (!selinux_policycap_extsockclass())
5119 /* Process one or more addresses that may be IPv4 or IPv6 */
5120 sock = sk->sk_socket;
5123 while (walk_size < addrlen) {
5124 if (walk_size + sizeof(sa_family_t) > addrlen)
5128 switch (addr->sa_family) {
5131 len = sizeof(struct sockaddr_in);
5134 len = sizeof(struct sockaddr_in6);
5140 if (walk_size + len > addrlen)
5146 case SCTP_PRIMARY_ADDR:
5147 case SCTP_SET_PEER_PRIMARY_ADDR:
5148 case SCTP_SOCKOPT_BINDX_ADD:
5149 err = selinux_socket_bind(sock, addr, len);
5151 /* Connect checks */
5152 case SCTP_SOCKOPT_CONNECTX:
5153 case SCTP_PARAM_SET_PRIMARY:
5154 case SCTP_PARAM_ADD_IP:
5155 case SCTP_SENDMSG_CONNECT:
5156 err = selinux_socket_connect_helper(sock, addr, len);
5160 /* As selinux_sctp_bind_connect() is called by the
5161 * SCTP protocol layer, the socket is already locked,
5162 * therefore selinux_netlbl_socket_connect_locked() is
5163 * is called here. The situations handled are:
5164 * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5165 * whenever a new IP address is added or when a new
5166 * primary address is selected.
5167 * Note that an SCTP connect(2) call happens before
5168 * the SCTP protocol layer and is handled via
5169 * selinux_socket_connect().
5171 err = selinux_netlbl_socket_connect_locked(sk, addr);
5185 /* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5186 static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
5189 struct sk_security_struct *sksec = sk->sk_security;
5190 struct sk_security_struct *newsksec = newsk->sk_security;
5192 /* If policy does not support SECCLASS_SCTP_SOCKET then call
5193 * the non-sctp clone version.
5195 if (!selinux_policycap_extsockclass())
5196 return selinux_sk_clone_security(sk, newsk);
5198 newsksec->sid = ep->secid;
5199 newsksec->peer_sid = ep->peer_secid;
5200 newsksec->sclass = sksec->sclass;
5201 selinux_netlbl_sctp_sk_clone(sk, newsk);
5204 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
5205 struct request_sock *req)
5207 struct sk_security_struct *sksec = sk->sk_security;
5209 u16 family = req->rsk_ops->family;
5213 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
5216 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5219 req->secid = connsid;
5220 req->peer_secid = peersid;
5222 return selinux_netlbl_inet_conn_request(req, family);
5225 static void selinux_inet_csk_clone(struct sock *newsk,
5226 const struct request_sock *req)
5228 struct sk_security_struct *newsksec = newsk->sk_security;
5230 newsksec->sid = req->secid;
5231 newsksec->peer_sid = req->peer_secid;
5232 /* NOTE: Ideally, we should also get the isec->sid for the
5233 new socket in sync, but we don't have the isec available yet.
5234 So we will wait until sock_graft to do it, by which
5235 time it will have been created and available. */
5237 /* We don't need to take any sort of lock here as we are the only
5238 * thread with access to newsksec */
5239 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
5242 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
5244 u16 family = sk->sk_family;
5245 struct sk_security_struct *sksec = sk->sk_security;
5247 /* handle mapped IPv4 packets arriving via IPv6 sockets */
5248 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5251 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
5254 static int selinux_secmark_relabel_packet(u32 sid)
5256 const struct task_security_struct *__tsec;
5259 __tsec = selinux_cred(current_cred());
5262 return avc_has_perm(&selinux_state,
5263 tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5267 static void selinux_secmark_refcount_inc(void)
5269 atomic_inc(&selinux_secmark_refcount);
5272 static void selinux_secmark_refcount_dec(void)
5274 atomic_dec(&selinux_secmark_refcount);
5277 static void selinux_req_classify_flow(const struct request_sock *req,
5280 fl->flowi_secid = req->secid;
5283 static int selinux_tun_dev_alloc_security(void **security)
5285 struct tun_security_struct *tunsec;
5287 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5290 tunsec->sid = current_sid();
5296 static void selinux_tun_dev_free_security(void *security)
5301 static int selinux_tun_dev_create(void)
5303 u32 sid = current_sid();
5305 /* we aren't taking into account the "sockcreate" SID since the socket
5306 * that is being created here is not a socket in the traditional sense,
5307 * instead it is a private sock, accessible only to the kernel, and
5308 * representing a wide range of network traffic spanning multiple
5309 * connections unlike traditional sockets - check the TUN driver to
5310 * get a better understanding of why this socket is special */
5312 return avc_has_perm(&selinux_state,
5313 sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5317 static int selinux_tun_dev_attach_queue(void *security)
5319 struct tun_security_struct *tunsec = security;
5321 return avc_has_perm(&selinux_state,
5322 current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5323 TUN_SOCKET__ATTACH_QUEUE, NULL);
5326 static int selinux_tun_dev_attach(struct sock *sk, void *security)
5328 struct tun_security_struct *tunsec = security;
5329 struct sk_security_struct *sksec = sk->sk_security;
5331 /* we don't currently perform any NetLabel based labeling here and it
5332 * isn't clear that we would want to do so anyway; while we could apply
5333 * labeling without the support of the TUN user the resulting labeled
5334 * traffic from the other end of the connection would almost certainly
5335 * cause confusion to the TUN user that had no idea network labeling
5336 * protocols were being used */
5338 sksec->sid = tunsec->sid;
5339 sksec->sclass = SECCLASS_TUN_SOCKET;
5344 static int selinux_tun_dev_open(void *security)
5346 struct tun_security_struct *tunsec = security;
5347 u32 sid = current_sid();
5350 err = avc_has_perm(&selinux_state,
5351 sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5352 TUN_SOCKET__RELABELFROM, NULL);
5355 err = avc_has_perm(&selinux_state,
5356 sid, sid, SECCLASS_TUN_SOCKET,
5357 TUN_SOCKET__RELABELTO, NULL);
5365 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5369 struct nlmsghdr *nlh;
5370 struct sk_security_struct *sksec = sk->sk_security;
5372 if (skb->len < NLMSG_HDRLEN) {
5376 nlh = nlmsg_hdr(skb);
5378 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
5380 if (err == -EINVAL) {
5381 pr_warn_ratelimited("SELinux: unrecognized netlink"
5382 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5383 " pig=%d comm=%s\n",
5384 sk->sk_protocol, nlh->nlmsg_type,
5385 secclass_map[sksec->sclass - 1].name,
5386 task_pid_nr(current), current->comm);
5387 if (!enforcing_enabled(&selinux_state) ||
5388 security_get_allow_unknown(&selinux_state))
5398 err = sock_has_perm(sk, perm);
5403 #ifdef CONFIG_NETFILTER
5405 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5406 const struct net_device *indev,
5412 struct common_audit_data ad;
5413 struct lsm_network_audit net = {0,};
5418 if (!selinux_policycap_netpeer())
5421 secmark_active = selinux_secmark_enabled();
5422 netlbl_active = netlbl_enabled();
5423 peerlbl_active = selinux_peerlbl_enabled();
5424 if (!secmark_active && !peerlbl_active)
5427 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5430 ad.type = LSM_AUDIT_DATA_NET;
5432 ad.u.net->netif = indev->ifindex;
5433 ad.u.net->family = family;
5434 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5437 if (peerlbl_active) {
5438 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5439 addrp, family, peer_sid, &ad);
5441 selinux_netlbl_err(skb, family, err, 1);
5447 if (avc_has_perm(&selinux_state,
5448 peer_sid, skb->secmark,
5449 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5453 /* we do this in the FORWARD path and not the POST_ROUTING
5454 * path because we want to make sure we apply the necessary
5455 * labeling before IPsec is applied so we can leverage AH
5457 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5463 static unsigned int selinux_ipv4_forward(void *priv,
5464 struct sk_buff *skb,
5465 const struct nf_hook_state *state)
5467 return selinux_ip_forward(skb, state->in, PF_INET);
5470 #if IS_ENABLED(CONFIG_IPV6)
5471 static unsigned int selinux_ipv6_forward(void *priv,
5472 struct sk_buff *skb,
5473 const struct nf_hook_state *state)
5475 return selinux_ip_forward(skb, state->in, PF_INET6);
5479 static unsigned int selinux_ip_output(struct sk_buff *skb,
5485 if (!netlbl_enabled())
5488 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5489 * because we want to make sure we apply the necessary labeling
5490 * before IPsec is applied so we can leverage AH protection */
5493 struct sk_security_struct *sksec;
5495 if (sk_listener(sk))
5496 /* if the socket is the listening state then this
5497 * packet is a SYN-ACK packet which means it needs to
5498 * be labeled based on the connection/request_sock and
5499 * not the parent socket. unfortunately, we can't
5500 * lookup the request_sock yet as it isn't queued on
5501 * the parent socket until after the SYN-ACK is sent.
5502 * the "solution" is to simply pass the packet as-is
5503 * as any IP option based labeling should be copied
5504 * from the initial connection request (in the IP
5505 * layer). it is far from ideal, but until we get a
5506 * security label in the packet itself this is the
5507 * best we can do. */
5510 /* standard practice, label using the parent socket */
5511 sksec = sk->sk_security;
5514 sid = SECINITSID_KERNEL;
5515 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5521 static unsigned int selinux_ipv4_output(void *priv,
5522 struct sk_buff *skb,
5523 const struct nf_hook_state *state)
5525 return selinux_ip_output(skb, PF_INET);
5528 #if IS_ENABLED(CONFIG_IPV6)
5529 static unsigned int selinux_ipv6_output(void *priv,
5530 struct sk_buff *skb,
5531 const struct nf_hook_state *state)
5533 return selinux_ip_output(skb, PF_INET6);
5537 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5541 struct sock *sk = skb_to_full_sk(skb);
5542 struct sk_security_struct *sksec;
5543 struct common_audit_data ad;
5544 struct lsm_network_audit net = {0,};
5550 sksec = sk->sk_security;
5552 ad.type = LSM_AUDIT_DATA_NET;
5554 ad.u.net->netif = ifindex;
5555 ad.u.net->family = family;
5556 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5559 if (selinux_secmark_enabled())
5560 if (avc_has_perm(&selinux_state,
5561 sksec->sid, skb->secmark,
5562 SECCLASS_PACKET, PACKET__SEND, &ad))
5563 return NF_DROP_ERR(-ECONNREFUSED);
5565 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5566 return NF_DROP_ERR(-ECONNREFUSED);
5571 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5572 const struct net_device *outdev,
5577 int ifindex = outdev->ifindex;
5579 struct common_audit_data ad;
5580 struct lsm_network_audit net = {0,};
5585 /* If any sort of compatibility mode is enabled then handoff processing
5586 * to the selinux_ip_postroute_compat() function to deal with the
5587 * special handling. We do this in an attempt to keep this function
5588 * as fast and as clean as possible. */
5589 if (!selinux_policycap_netpeer())
5590 return selinux_ip_postroute_compat(skb, ifindex, family);
5592 secmark_active = selinux_secmark_enabled();
5593 peerlbl_active = selinux_peerlbl_enabled();
5594 if (!secmark_active && !peerlbl_active)
5597 sk = skb_to_full_sk(skb);
5600 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5601 * packet transformation so allow the packet to pass without any checks
5602 * since we'll have another chance to perform access control checks
5603 * when the packet is on it's final way out.
5604 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5605 * is NULL, in this case go ahead and apply access control.
5606 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5607 * TCP listening state we cannot wait until the XFRM processing
5608 * is done as we will miss out on the SA label if we do;
5609 * unfortunately, this means more work, but it is only once per
5611 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5612 !(sk && sk_listener(sk)))
5617 /* Without an associated socket the packet is either coming
5618 * from the kernel or it is being forwarded; check the packet
5619 * to determine which and if the packet is being forwarded
5620 * query the packet directly to determine the security label. */
5622 secmark_perm = PACKET__FORWARD_OUT;
5623 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5626 secmark_perm = PACKET__SEND;
5627 peer_sid = SECINITSID_KERNEL;
5629 } else if (sk_listener(sk)) {
5630 /* Locally generated packet but the associated socket is in the
5631 * listening state which means this is a SYN-ACK packet. In
5632 * this particular case the correct security label is assigned
5633 * to the connection/request_sock but unfortunately we can't
5634 * query the request_sock as it isn't queued on the parent
5635 * socket until after the SYN-ACK packet is sent; the only
5636 * viable choice is to regenerate the label like we do in
5637 * selinux_inet_conn_request(). See also selinux_ip_output()
5638 * for similar problems. */
5640 struct sk_security_struct *sksec;
5642 sksec = sk->sk_security;
5643 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5645 /* At this point, if the returned skb peerlbl is SECSID_NULL
5646 * and the packet has been through at least one XFRM
5647 * transformation then we must be dealing with the "final"
5648 * form of labeled IPsec packet; since we've already applied
5649 * all of our access controls on this packet we can safely
5650 * pass the packet. */
5651 if (skb_sid == SECSID_NULL) {
5654 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5658 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5662 return NF_DROP_ERR(-ECONNREFUSED);
5665 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5667 secmark_perm = PACKET__SEND;
5669 /* Locally generated packet, fetch the security label from the
5670 * associated socket. */
5671 struct sk_security_struct *sksec = sk->sk_security;
5672 peer_sid = sksec->sid;
5673 secmark_perm = PACKET__SEND;
5676 ad.type = LSM_AUDIT_DATA_NET;
5678 ad.u.net->netif = ifindex;
5679 ad.u.net->family = family;
5680 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5684 if (avc_has_perm(&selinux_state,
5685 peer_sid, skb->secmark,
5686 SECCLASS_PACKET, secmark_perm, &ad))
5687 return NF_DROP_ERR(-ECONNREFUSED);
5689 if (peerlbl_active) {
5693 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5695 if (avc_has_perm(&selinux_state,
5697 SECCLASS_NETIF, NETIF__EGRESS, &ad))
5698 return NF_DROP_ERR(-ECONNREFUSED);
5700 if (sel_netnode_sid(addrp, family, &node_sid))
5702 if (avc_has_perm(&selinux_state,
5704 SECCLASS_NODE, NODE__SENDTO, &ad))
5705 return NF_DROP_ERR(-ECONNREFUSED);
5711 static unsigned int selinux_ipv4_postroute(void *priv,
5712 struct sk_buff *skb,
5713 const struct nf_hook_state *state)
5715 return selinux_ip_postroute(skb, state->out, PF_INET);
5718 #if IS_ENABLED(CONFIG_IPV6)
5719 static unsigned int selinux_ipv6_postroute(void *priv,
5720 struct sk_buff *skb,
5721 const struct nf_hook_state *state)
5723 return selinux_ip_postroute(skb, state->out, PF_INET6);
5727 #endif /* CONFIG_NETFILTER */
5729 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5731 return selinux_nlmsg_perm(sk, skb);
5734 static void ipc_init_security(struct ipc_security_struct *isec, u16 sclass)
5736 isec->sclass = sclass;
5737 isec->sid = current_sid();
5740 static int msg_msg_alloc_security(struct msg_msg *msg)
5742 struct msg_security_struct *msec;
5744 msec = selinux_msg_msg(msg);
5745 msec->sid = SECINITSID_UNLABELED;
5750 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5753 struct ipc_security_struct *isec;
5754 struct common_audit_data ad;
5755 u32 sid = current_sid();
5757 isec = selinux_ipc(ipc_perms);
5759 ad.type = LSM_AUDIT_DATA_IPC;
5760 ad.u.ipc_id = ipc_perms->key;
5762 return avc_has_perm(&selinux_state,
5763 sid, isec->sid, isec->sclass, perms, &ad);
5766 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5768 return msg_msg_alloc_security(msg);
5771 /* message queue security operations */
5772 static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
5774 struct ipc_security_struct *isec;
5775 struct common_audit_data ad;
5776 u32 sid = current_sid();
5779 isec = selinux_ipc(msq);
5780 ipc_init_security(isec, SECCLASS_MSGQ);
5782 ad.type = LSM_AUDIT_DATA_IPC;
5783 ad.u.ipc_id = msq->key;
5785 rc = avc_has_perm(&selinux_state,
5786 sid, isec->sid, SECCLASS_MSGQ,
5791 static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
5793 struct ipc_security_struct *isec;
5794 struct common_audit_data ad;
5795 u32 sid = current_sid();
5797 isec = selinux_ipc(msq);
5799 ad.type = LSM_AUDIT_DATA_IPC;
5800 ad.u.ipc_id = msq->key;
5802 return avc_has_perm(&selinux_state,
5803 sid, isec->sid, SECCLASS_MSGQ,
5804 MSGQ__ASSOCIATE, &ad);
5807 static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
5815 /* No specific object, just general system-wide information. */
5816 return avc_has_perm(&selinux_state,
5817 current_sid(), SECINITSID_KERNEL,
5818 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5822 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5825 perms = MSGQ__SETATTR;
5828 perms = MSGQ__DESTROY;
5834 err = ipc_has_perm(msq, perms);
5838 static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
5840 struct ipc_security_struct *isec;
5841 struct msg_security_struct *msec;
5842 struct common_audit_data ad;
5843 u32 sid = current_sid();
5846 isec = selinux_ipc(msq);
5847 msec = selinux_msg_msg(msg);
5850 * First time through, need to assign label to the message
5852 if (msec->sid == SECINITSID_UNLABELED) {
5854 * Compute new sid based on current process and
5855 * message queue this message will be stored in
5857 rc = security_transition_sid(&selinux_state, sid, isec->sid,
5858 SECCLASS_MSG, NULL, &msec->sid);
5863 ad.type = LSM_AUDIT_DATA_IPC;
5864 ad.u.ipc_id = msq->key;
5866 /* Can this process write to the queue? */
5867 rc = avc_has_perm(&selinux_state,
5868 sid, isec->sid, SECCLASS_MSGQ,
5871 /* Can this process send the message */
5872 rc = avc_has_perm(&selinux_state,
5873 sid, msec->sid, SECCLASS_MSG,
5876 /* Can the message be put in the queue? */
5877 rc = avc_has_perm(&selinux_state,
5878 msec->sid, isec->sid, SECCLASS_MSGQ,
5879 MSGQ__ENQUEUE, &ad);
5884 static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
5885 struct task_struct *target,
5886 long type, int mode)
5888 struct ipc_security_struct *isec;
5889 struct msg_security_struct *msec;
5890 struct common_audit_data ad;
5891 u32 sid = task_sid(target);
5894 isec = selinux_ipc(msq);
5895 msec = selinux_msg_msg(msg);
5897 ad.type = LSM_AUDIT_DATA_IPC;
5898 ad.u.ipc_id = msq->key;
5900 rc = avc_has_perm(&selinux_state,
5902 SECCLASS_MSGQ, MSGQ__READ, &ad);
5904 rc = avc_has_perm(&selinux_state,
5906 SECCLASS_MSG, MSG__RECEIVE, &ad);
5910 /* Shared Memory security operations */
5911 static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
5913 struct ipc_security_struct *isec;
5914 struct common_audit_data ad;
5915 u32 sid = current_sid();
5918 isec = selinux_ipc(shp);
5919 ipc_init_security(isec, SECCLASS_SHM);
5921 ad.type = LSM_AUDIT_DATA_IPC;
5922 ad.u.ipc_id = shp->key;
5924 rc = avc_has_perm(&selinux_state,
5925 sid, isec->sid, SECCLASS_SHM,
5930 static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
5932 struct ipc_security_struct *isec;
5933 struct common_audit_data ad;
5934 u32 sid = current_sid();
5936 isec = selinux_ipc(shp);
5938 ad.type = LSM_AUDIT_DATA_IPC;
5939 ad.u.ipc_id = shp->key;
5941 return avc_has_perm(&selinux_state,
5942 sid, isec->sid, SECCLASS_SHM,
5943 SHM__ASSOCIATE, &ad);
5946 /* Note, at this point, shp is locked down */
5947 static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
5955 /* No specific object, just general system-wide information. */
5956 return avc_has_perm(&selinux_state,
5957 current_sid(), SECINITSID_KERNEL,
5958 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5962 perms = SHM__GETATTR | SHM__ASSOCIATE;
5965 perms = SHM__SETATTR;
5972 perms = SHM__DESTROY;
5978 err = ipc_has_perm(shp, perms);
5982 static int selinux_shm_shmat(struct kern_ipc_perm *shp,
5983 char __user *shmaddr, int shmflg)
5987 if (shmflg & SHM_RDONLY)
5990 perms = SHM__READ | SHM__WRITE;
5992 return ipc_has_perm(shp, perms);
5995 /* Semaphore security operations */
5996 static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
5998 struct ipc_security_struct *isec;
5999 struct common_audit_data ad;
6000 u32 sid = current_sid();
6003 isec = selinux_ipc(sma);
6004 ipc_init_security(isec, SECCLASS_SEM);
6006 ad.type = LSM_AUDIT_DATA_IPC;
6007 ad.u.ipc_id = sma->key;
6009 rc = avc_has_perm(&selinux_state,
6010 sid, isec->sid, SECCLASS_SEM,
6015 static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
6017 struct ipc_security_struct *isec;
6018 struct common_audit_data ad;
6019 u32 sid = current_sid();
6021 isec = selinux_ipc(sma);
6023 ad.type = LSM_AUDIT_DATA_IPC;
6024 ad.u.ipc_id = sma->key;
6026 return avc_has_perm(&selinux_state,
6027 sid, isec->sid, SECCLASS_SEM,
6028 SEM__ASSOCIATE, &ad);
6031 /* Note, at this point, sma is locked down */
6032 static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
6040 /* No specific object, just general system-wide information. */
6041 return avc_has_perm(&selinux_state,
6042 current_sid(), SECINITSID_KERNEL,
6043 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6047 perms = SEM__GETATTR;
6058 perms = SEM__DESTROY;
6061 perms = SEM__SETATTR;
6066 perms = SEM__GETATTR | SEM__ASSOCIATE;
6072 err = ipc_has_perm(sma, perms);
6076 static int selinux_sem_semop(struct kern_ipc_perm *sma,
6077 struct sembuf *sops, unsigned nsops, int alter)
6082 perms = SEM__READ | SEM__WRITE;
6086 return ipc_has_perm(sma, perms);
6089 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6095 av |= IPC__UNIX_READ;
6097 av |= IPC__UNIX_WRITE;
6102 return ipc_has_perm(ipcp, av);
6105 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6107 struct ipc_security_struct *isec = selinux_ipc(ipcp);
6111 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
6114 inode_doinit_with_dentry(inode, dentry);
6117 static int selinux_getprocattr(struct task_struct *p,
6118 char *name, char **value)
6120 const struct task_security_struct *__tsec;
6126 __tsec = selinux_cred(__task_cred(p));
6129 error = avc_has_perm(&selinux_state,
6130 current_sid(), __tsec->sid,
6131 SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6136 if (!strcmp(name, "current"))
6138 else if (!strcmp(name, "prev"))
6140 else if (!strcmp(name, "exec"))
6141 sid = __tsec->exec_sid;
6142 else if (!strcmp(name, "fscreate"))
6143 sid = __tsec->create_sid;
6144 else if (!strcmp(name, "keycreate"))
6145 sid = __tsec->keycreate_sid;
6146 else if (!strcmp(name, "sockcreate"))
6147 sid = __tsec->sockcreate_sid;
6157 error = security_sid_to_context(&selinux_state, sid, value, &len);
6167 static int selinux_setprocattr(const char *name, void *value, size_t size)
6169 struct task_security_struct *tsec;
6171 u32 mysid = current_sid(), sid = 0, ptsid;
6176 * Basic control over ability to set these attributes at all.
6178 if (!strcmp(name, "exec"))
6179 error = avc_has_perm(&selinux_state,
6180 mysid, mysid, SECCLASS_PROCESS,
6181 PROCESS__SETEXEC, NULL);
6182 else if (!strcmp(name, "fscreate"))
6183 error = avc_has_perm(&selinux_state,
6184 mysid, mysid, SECCLASS_PROCESS,
6185 PROCESS__SETFSCREATE, NULL);
6186 else if (!strcmp(name, "keycreate"))
6187 error = avc_has_perm(&selinux_state,
6188 mysid, mysid, SECCLASS_PROCESS,
6189 PROCESS__SETKEYCREATE, NULL);
6190 else if (!strcmp(name, "sockcreate"))
6191 error = avc_has_perm(&selinux_state,
6192 mysid, mysid, SECCLASS_PROCESS,
6193 PROCESS__SETSOCKCREATE, NULL);
6194 else if (!strcmp(name, "current"))
6195 error = avc_has_perm(&selinux_state,
6196 mysid, mysid, SECCLASS_PROCESS,
6197 PROCESS__SETCURRENT, NULL);
6203 /* Obtain a SID for the context, if one was specified. */
6204 if (size && str[0] && str[0] != '\n') {
6205 if (str[size-1] == '\n') {
6209 error = security_context_to_sid(&selinux_state, value, size,
6211 if (error == -EINVAL && !strcmp(name, "fscreate")) {
6212 if (!has_cap_mac_admin(true)) {
6213 struct audit_buffer *ab;
6216 /* We strip a nul only if it is at the end, otherwise the
6217 * context contains a nul and we should audit that */
6218 if (str[size - 1] == '\0')
6219 audit_size = size - 1;
6222 ab = audit_log_start(audit_context(),
6225 audit_log_format(ab, "op=fscreate invalid_context=");
6226 audit_log_n_untrustedstring(ab, value, audit_size);
6231 error = security_context_to_sid_force(
6239 new = prepare_creds();
6243 /* Permission checking based on the specified context is
6244 performed during the actual operation (execve,
6245 open/mkdir/...), when we know the full context of the
6246 operation. See selinux_bprm_set_creds for the execve
6247 checks and may_create for the file creation checks. The
6248 operation will then fail if the context is not permitted. */
6249 tsec = selinux_cred(new);
6250 if (!strcmp(name, "exec")) {
6251 tsec->exec_sid = sid;
6252 } else if (!strcmp(name, "fscreate")) {
6253 tsec->create_sid = sid;
6254 } else if (!strcmp(name, "keycreate")) {
6255 error = avc_has_perm(&selinux_state,
6256 mysid, sid, SECCLASS_KEY, KEY__CREATE,
6260 tsec->keycreate_sid = sid;
6261 } else if (!strcmp(name, "sockcreate")) {
6262 tsec->sockcreate_sid = sid;
6263 } else if (!strcmp(name, "current")) {
6268 /* Only allow single threaded processes to change context */
6270 if (!current_is_single_threaded()) {
6271 error = security_bounded_transition(&selinux_state,
6277 /* Check permissions for the transition. */
6278 error = avc_has_perm(&selinux_state,
6279 tsec->sid, sid, SECCLASS_PROCESS,
6280 PROCESS__DYNTRANSITION, NULL);
6284 /* Check for ptracing, and update the task SID if ok.
6285 Otherwise, leave SID unchanged and fail. */
6286 ptsid = ptrace_parent_sid();
6288 error = avc_has_perm(&selinux_state,
6289 ptsid, sid, SECCLASS_PROCESS,
6290 PROCESS__PTRACE, NULL);
6309 static int selinux_ismaclabel(const char *name)
6311 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6314 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6316 return security_sid_to_context(&selinux_state, secid,
6320 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6322 return security_context_to_sid(&selinux_state, secdata, seclen,
6326 static void selinux_release_secctx(char *secdata, u32 seclen)
6331 static void selinux_inode_invalidate_secctx(struct inode *inode)
6333 struct inode_security_struct *isec = selinux_inode(inode);
6335 spin_lock(&isec->lock);
6336 isec->initialized = LABEL_INVALID;
6337 spin_unlock(&isec->lock);
6341 * called with inode->i_mutex locked
6343 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6345 int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
6347 /* Do not return error when suppressing label (SBLABEL_MNT not set). */
6348 return rc == -EOPNOTSUPP ? 0 : rc;
6352 * called with inode->i_mutex locked
6354 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6356 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6359 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6362 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6371 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6372 unsigned long flags)
6374 const struct task_security_struct *tsec;
6375 struct key_security_struct *ksec;
6377 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6381 tsec = selinux_cred(cred);
6382 if (tsec->keycreate_sid)
6383 ksec->sid = tsec->keycreate_sid;
6385 ksec->sid = tsec->sid;
6391 static void selinux_key_free(struct key *k)
6393 struct key_security_struct *ksec = k->security;
6399 static int selinux_key_permission(key_ref_t key_ref,
6400 const struct cred *cred,
6404 struct key_security_struct *ksec;
6407 /* if no specific permissions are requested, we skip the
6408 permission check. No serious, additional covert channels
6409 appear to be created. */
6413 sid = cred_sid(cred);
6415 key = key_ref_to_ptr(key_ref);
6416 ksec = key->security;
6418 return avc_has_perm(&selinux_state,
6419 sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6422 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6424 struct key_security_struct *ksec = key->security;
6425 char *context = NULL;
6429 rc = security_sid_to_context(&selinux_state, ksec->sid,
6438 #ifdef CONFIG_SECURITY_INFINIBAND
6439 static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6441 struct common_audit_data ad;
6444 struct ib_security_struct *sec = ib_sec;
6445 struct lsm_ibpkey_audit ibpkey;
6447 err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6451 ad.type = LSM_AUDIT_DATA_IBPKEY;
6452 ibpkey.subnet_prefix = subnet_prefix;
6453 ibpkey.pkey = pkey_val;
6454 ad.u.ibpkey = &ibpkey;
6455 return avc_has_perm(&selinux_state,
6457 SECCLASS_INFINIBAND_PKEY,
6458 INFINIBAND_PKEY__ACCESS, &ad);
6461 static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6464 struct common_audit_data ad;
6467 struct ib_security_struct *sec = ib_sec;
6468 struct lsm_ibendport_audit ibendport;
6470 err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6476 ad.type = LSM_AUDIT_DATA_IBENDPORT;
6477 strncpy(ibendport.dev_name, dev_name, sizeof(ibendport.dev_name));
6478 ibendport.port = port_num;
6479 ad.u.ibendport = &ibendport;
6480 return avc_has_perm(&selinux_state,
6482 SECCLASS_INFINIBAND_ENDPORT,
6483 INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6486 static int selinux_ib_alloc_security(void **ib_sec)
6488 struct ib_security_struct *sec;
6490 sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6493 sec->sid = current_sid();
6499 static void selinux_ib_free_security(void *ib_sec)
6505 #ifdef CONFIG_BPF_SYSCALL
6506 static int selinux_bpf(int cmd, union bpf_attr *attr,
6509 u32 sid = current_sid();
6513 case BPF_MAP_CREATE:
6514 ret = avc_has_perm(&selinux_state,
6515 sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
6519 ret = avc_has_perm(&selinux_state,
6520 sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
6531 static u32 bpf_map_fmode_to_av(fmode_t fmode)
6535 if (fmode & FMODE_READ)
6536 av |= BPF__MAP_READ;
6537 if (fmode & FMODE_WRITE)
6538 av |= BPF__MAP_WRITE;
6542 /* This function will check the file pass through unix socket or binder to see
6543 * if it is a bpf related object. And apply correspinding checks on the bpf
6544 * object based on the type. The bpf maps and programs, not like other files and
6545 * socket, are using a shared anonymous inode inside the kernel as their inode.
6546 * So checking that inode cannot identify if the process have privilege to
6547 * access the bpf object and that's why we have to add this additional check in
6548 * selinux_file_receive and selinux_binder_transfer_files.
6550 static int bpf_fd_pass(struct file *file, u32 sid)
6552 struct bpf_security_struct *bpfsec;
6553 struct bpf_prog *prog;
6554 struct bpf_map *map;
6557 if (file->f_op == &bpf_map_fops) {
6558 map = file->private_data;
6559 bpfsec = map->security;
6560 ret = avc_has_perm(&selinux_state,
6561 sid, bpfsec->sid, SECCLASS_BPF,
6562 bpf_map_fmode_to_av(file->f_mode), NULL);
6565 } else if (file->f_op == &bpf_prog_fops) {
6566 prog = file->private_data;
6567 bpfsec = prog->aux->security;
6568 ret = avc_has_perm(&selinux_state,
6569 sid, bpfsec->sid, SECCLASS_BPF,
6570 BPF__PROG_RUN, NULL);
6577 static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6579 u32 sid = current_sid();
6580 struct bpf_security_struct *bpfsec;
6582 bpfsec = map->security;
6583 return avc_has_perm(&selinux_state,
6584 sid, bpfsec->sid, SECCLASS_BPF,
6585 bpf_map_fmode_to_av(fmode), NULL);
6588 static int selinux_bpf_prog(struct bpf_prog *prog)
6590 u32 sid = current_sid();
6591 struct bpf_security_struct *bpfsec;
6593 bpfsec = prog->aux->security;
6594 return avc_has_perm(&selinux_state,
6595 sid, bpfsec->sid, SECCLASS_BPF,
6596 BPF__PROG_RUN, NULL);
6599 static int selinux_bpf_map_alloc(struct bpf_map *map)
6601 struct bpf_security_struct *bpfsec;
6603 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6607 bpfsec->sid = current_sid();
6608 map->security = bpfsec;
6613 static void selinux_bpf_map_free(struct bpf_map *map)
6615 struct bpf_security_struct *bpfsec = map->security;
6617 map->security = NULL;
6621 static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6623 struct bpf_security_struct *bpfsec;
6625 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6629 bpfsec->sid = current_sid();
6630 aux->security = bpfsec;
6635 static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
6637 struct bpf_security_struct *bpfsec = aux->security;
6639 aux->security = NULL;
6644 struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = {
6645 .lbs_cred = sizeof(struct task_security_struct),
6646 .lbs_file = sizeof(struct file_security_struct),
6647 .lbs_inode = sizeof(struct inode_security_struct),
6648 .lbs_ipc = sizeof(struct ipc_security_struct),
6649 .lbs_msg_msg = sizeof(struct msg_security_struct),
6652 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
6653 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6654 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6655 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6656 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6658 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6659 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6660 LSM_HOOK_INIT(capget, selinux_capget),
6661 LSM_HOOK_INIT(capset, selinux_capset),
6662 LSM_HOOK_INIT(capable, selinux_capable),
6663 LSM_HOOK_INIT(quotactl, selinux_quotactl),
6664 LSM_HOOK_INIT(quota_on, selinux_quota_on),
6665 LSM_HOOK_INIT(syslog, selinux_syslog),
6666 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6668 LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6670 LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6671 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6672 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6674 LSM_HOOK_INIT(fs_context_dup, selinux_fs_context_dup),
6675 LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param),
6677 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6678 LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6679 LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts),
6680 LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts),
6681 LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6682 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6683 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6684 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6685 LSM_HOOK_INIT(sb_mount, selinux_mount),
6686 LSM_HOOK_INIT(sb_umount, selinux_umount),
6687 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6688 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6689 LSM_HOOK_INIT(sb_add_mnt_opt, selinux_add_mnt_opt),
6691 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6692 LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
6694 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6695 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6696 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6697 LSM_HOOK_INIT(inode_create, selinux_inode_create),
6698 LSM_HOOK_INIT(inode_link, selinux_inode_link),
6699 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6700 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6701 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6702 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6703 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6704 LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6705 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6706 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6707 LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6708 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6709 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6710 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6711 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6712 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6713 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6714 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6715 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6716 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6717 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6718 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
6719 LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
6720 LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
6722 LSM_HOOK_INIT(file_permission, selinux_file_permission),
6723 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6724 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6725 LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6726 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6727 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6728 LSM_HOOK_INIT(file_lock, selinux_file_lock),
6729 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6730 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6731 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6732 LSM_HOOK_INIT(file_receive, selinux_file_receive),
6734 LSM_HOOK_INIT(file_open, selinux_file_open),
6736 LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
6737 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6738 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6739 LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
6740 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6741 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6742 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
6743 LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
6744 LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
6745 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6746 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6747 LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6748 LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6749 LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6750 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6751 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
6752 LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
6753 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6754 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6755 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6756 LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6757 LSM_HOOK_INIT(task_kill, selinux_task_kill),
6758 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
6760 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6761 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
6763 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6765 LSM_HOOK_INIT(msg_queue_alloc_security,
6766 selinux_msg_queue_alloc_security),
6767 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6768 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6769 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6770 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
6772 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6773 LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6774 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6775 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6777 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6778 LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6779 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6780 LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6782 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
6784 LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6785 LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
6787 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6788 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6789 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6790 LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6791 LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
6792 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6793 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6794 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6796 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6797 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6799 LSM_HOOK_INIT(socket_create, selinux_socket_create),
6800 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6801 LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
6802 LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6803 LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6804 LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6805 LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6806 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6807 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6808 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6809 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6810 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6811 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6812 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6813 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6814 LSM_HOOK_INIT(socket_getpeersec_stream,
6815 selinux_socket_getpeersec_stream),
6816 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6817 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6818 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6819 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6820 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6821 LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6822 LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
6823 LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
6824 LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
6825 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6826 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6827 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6828 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6829 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6830 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6831 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6832 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6833 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6834 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6835 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6836 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6837 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6838 #ifdef CONFIG_SECURITY_INFINIBAND
6839 LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
6840 LSM_HOOK_INIT(ib_endport_manage_subnet,
6841 selinux_ib_endport_manage_subnet),
6842 LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
6843 LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
6845 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6846 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6847 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6848 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6849 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6850 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6851 LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6852 selinux_xfrm_state_alloc_acquire),
6853 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6854 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6855 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6856 LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6857 selinux_xfrm_state_pol_flow_match),
6858 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6862 LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6863 LSM_HOOK_INIT(key_free, selinux_key_free),
6864 LSM_HOOK_INIT(key_permission, selinux_key_permission),
6865 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6869 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6870 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6871 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6872 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6875 #ifdef CONFIG_BPF_SYSCALL
6876 LSM_HOOK_INIT(bpf, selinux_bpf),
6877 LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
6878 LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
6879 LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
6880 LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
6881 LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
6882 LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
6886 static __init int selinux_init(void)
6888 pr_info("SELinux: Initializing.\n");
6890 memset(&selinux_state, 0, sizeof(selinux_state));
6891 enforcing_set(&selinux_state, selinux_enforcing_boot);
6892 selinux_state.checkreqprot = selinux_checkreqprot_boot;
6893 selinux_ss_init(&selinux_state.ss);
6894 selinux_avc_init(&selinux_state.avc);
6896 /* Set the security state for the initial task. */
6897 cred_init_security();
6899 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6905 ebitmap_cache_init();
6907 hashtab_cache_init();
6909 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
6911 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6912 panic("SELinux: Unable to register AVC netcache callback\n");
6914 if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
6915 panic("SELinux: Unable to register AVC LSM notifier callback\n");
6917 if (selinux_enforcing_boot)
6918 pr_debug("SELinux: Starting in enforcing mode\n");
6920 pr_debug("SELinux: Starting in permissive mode\n");
6922 fs_validate_description(&selinux_fs_parameters);
6927 static void delayed_superblock_init(struct super_block *sb, void *unused)
6929 selinux_set_mnt_opts(sb, NULL, 0, NULL);
6932 void selinux_complete_init(void)
6934 pr_debug("SELinux: Completing initialization.\n");
6936 /* Set up any superblocks initialized prior to the policy load. */
6937 pr_debug("SELinux: Setting up existing superblocks.\n");
6938 iterate_supers(delayed_superblock_init, NULL);
6941 /* SELinux requires early initialization in order to label
6942 all processes and objects when they are created. */
6943 DEFINE_LSM(selinux) = {
6945 .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
6946 .enabled = &selinux_enabled,
6947 .blobs = &selinux_blob_sizes,
6948 .init = selinux_init,
6951 #if defined(CONFIG_NETFILTER)
6953 static const struct nf_hook_ops selinux_nf_ops[] = {
6955 .hook = selinux_ipv4_postroute,
6957 .hooknum = NF_INET_POST_ROUTING,
6958 .priority = NF_IP_PRI_SELINUX_LAST,
6961 .hook = selinux_ipv4_forward,
6963 .hooknum = NF_INET_FORWARD,
6964 .priority = NF_IP_PRI_SELINUX_FIRST,
6967 .hook = selinux_ipv4_output,
6969 .hooknum = NF_INET_LOCAL_OUT,
6970 .priority = NF_IP_PRI_SELINUX_FIRST,
6972 #if IS_ENABLED(CONFIG_IPV6)
6974 .hook = selinux_ipv6_postroute,
6976 .hooknum = NF_INET_POST_ROUTING,
6977 .priority = NF_IP6_PRI_SELINUX_LAST,
6980 .hook = selinux_ipv6_forward,
6982 .hooknum = NF_INET_FORWARD,
6983 .priority = NF_IP6_PRI_SELINUX_FIRST,
6986 .hook = selinux_ipv6_output,
6988 .hooknum = NF_INET_LOCAL_OUT,
6989 .priority = NF_IP6_PRI_SELINUX_FIRST,
6994 static int __net_init selinux_nf_register(struct net *net)
6996 return nf_register_net_hooks(net, selinux_nf_ops,
6997 ARRAY_SIZE(selinux_nf_ops));
7000 static void __net_exit selinux_nf_unregister(struct net *net)
7002 nf_unregister_net_hooks(net, selinux_nf_ops,
7003 ARRAY_SIZE(selinux_nf_ops));
7006 static struct pernet_operations selinux_net_ops = {
7007 .init = selinux_nf_register,
7008 .exit = selinux_nf_unregister,
7011 static int __init selinux_nf_ip_init(void)
7015 if (!selinux_enabled)
7018 pr_debug("SELinux: Registering netfilter hooks\n");
7020 err = register_pernet_subsys(&selinux_net_ops);
7022 panic("SELinux: register_pernet_subsys: error %d\n", err);
7026 __initcall(selinux_nf_ip_init);
7028 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7029 static void selinux_nf_ip_exit(void)
7031 pr_debug("SELinux: Unregistering netfilter hooks\n");
7033 unregister_pernet_subsys(&selinux_net_ops);
7037 #else /* CONFIG_NETFILTER */
7039 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7040 #define selinux_nf_ip_exit()
7043 #endif /* CONFIG_NETFILTER */
7045 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7046 int selinux_disable(struct selinux_state *state)
7048 if (state->initialized) {
7049 /* Not permitted after initial policy load. */
7053 if (state->disabled) {
7054 /* Only do this once. */
7058 state->disabled = 1;
7060 pr_info("SELinux: Disabled at runtime.\n");
7062 selinux_enabled = 0;
7064 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
7066 /* Try to destroy the avc node cache */
7069 /* Unregister netfilter hooks. */
7070 selinux_nf_ip_exit();
7072 /* Unregister selinuxfs. */