2 * NSA Security-Enhanced Linux (SELinux) security module
4 * This file contains the SELinux hook function implementations.
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul@paul-moore.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
21 * This program is free software; you can redistribute it and/or modify
22 * it under the terms of the GNU General Public License version 2,
23 * as published by the Free Software Foundation.
26 #include <linux/init.h>
28 #include <linux/kernel.h>
29 #include <linux/tracehook.h>
30 #include <linux/errno.h>
31 #include <linux/sched/signal.h>
32 #include <linux/sched/task.h>
33 #include <linux/lsm_hooks.h>
34 #include <linux/xattr.h>
35 #include <linux/capability.h>
36 #include <linux/unistd.h>
38 #include <linux/mman.h>
39 #include <linux/slab.h>
40 #include <linux/pagemap.h>
41 #include <linux/proc_fs.h>
42 #include <linux/swap.h>
43 #include <linux/spinlock.h>
44 #include <linux/syscalls.h>
45 #include <linux/dcache.h>
46 #include <linux/file.h>
47 #include <linux/fdtable.h>
48 #include <linux/namei.h>
49 #include <linux/mount.h>
50 #include <linux/netfilter_ipv4.h>
51 #include <linux/netfilter_ipv6.h>
52 #include <linux/tty.h>
54 #include <net/ip.h> /* for local_port_range[] */
55 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
56 #include <net/inet_connection_sock.h>
57 #include <net/net_namespace.h>
58 #include <net/netlabel.h>
59 #include <linux/uaccess.h>
60 #include <asm/ioctls.h>
61 #include <linux/atomic.h>
62 #include <linux/bitops.h>
63 #include <linux/interrupt.h>
64 #include <linux/netdevice.h> /* for network interface checks */
65 #include <net/netlink.h>
66 #include <linux/tcp.h>
67 #include <linux/udp.h>
68 #include <linux/dccp.h>
69 #include <linux/quota.h>
70 #include <linux/un.h> /* for Unix socket types */
71 #include <net/af_unix.h> /* for Unix socket types */
72 #include <linux/parser.h>
73 #include <linux/nfs_mount.h>
75 #include <linux/hugetlb.h>
76 #include <linux/personality.h>
77 #include <linux/audit.h>
78 #include <linux/string.h>
79 #include <linux/selinux.h>
80 #include <linux/mutex.h>
81 #include <linux/posix-timers.h>
82 #include <linux/syslog.h>
83 #include <linux/user_namespace.h>
84 #include <linux/export.h>
85 #include <linux/msg.h>
86 #include <linux/shm.h>
98 /* SECMARK reference count */
99 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
101 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
102 int selinux_enforcing;
104 static int __init enforcing_setup(char *str)
106 unsigned long enforcing;
107 if (!kstrtoul(str, 0, &enforcing))
108 selinux_enforcing = enforcing ? 1 : 0;
111 __setup("enforcing=", enforcing_setup);
114 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
115 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
117 static int __init selinux_enabled_setup(char *str)
119 unsigned long enabled;
120 if (!kstrtoul(str, 0, &enabled))
121 selinux_enabled = enabled ? 1 : 0;
124 __setup("selinux=", selinux_enabled_setup);
126 int selinux_enabled = 1;
129 static struct kmem_cache *sel_inode_cache;
130 static struct kmem_cache *file_security_cache;
133 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
136 * This function checks the SECMARK reference counter to see if any SECMARK
137 * targets are currently configured, if the reference counter is greater than
138 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
139 * enabled, false (0) if SECMARK is disabled. If the always_check_network
140 * policy capability is enabled, SECMARK is always considered enabled.
143 static int selinux_secmark_enabled(void)
145 return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
149 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
152 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
153 * (1) if any are enabled or false (0) if neither are enabled. If the
154 * always_check_network policy capability is enabled, peer labeling
155 * is always considered enabled.
158 static int selinux_peerlbl_enabled(void)
160 return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
163 static int selinux_netcache_avc_callback(u32 event)
165 if (event == AVC_CALLBACK_RESET) {
175 * initialise the security for the init task
177 static void cred_init_security(void)
179 struct cred *cred = (struct cred *) current->real_cred;
180 struct task_security_struct *tsec;
182 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
184 panic("SELinux: Failed to initialize initial task.\n");
186 tsec->osid = tsec->sid = SECINITSID_KERNEL;
187 cred->security = tsec;
191 * get the security ID of a set of credentials
193 static inline u32 cred_sid(const struct cred *cred)
195 const struct task_security_struct *tsec;
197 tsec = cred->security;
202 * get the objective security ID of a task
204 static inline u32 task_sid(const struct task_struct *task)
209 sid = cred_sid(__task_cred(task));
214 /* Allocate and free functions for each kind of security blob. */
216 static int inode_alloc_security(struct inode *inode)
218 struct inode_security_struct *isec;
219 u32 sid = current_sid();
221 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
225 spin_lock_init(&isec->lock);
226 INIT_LIST_HEAD(&isec->list);
228 isec->sid = SECINITSID_UNLABELED;
229 isec->sclass = SECCLASS_FILE;
230 isec->task_sid = sid;
231 isec->initialized = LABEL_INVALID;
232 inode->i_security = isec;
237 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
240 * Try reloading inode security labels that have been marked as invalid. The
241 * @may_sleep parameter indicates when sleeping and thus reloading labels is
242 * allowed; when set to false, returns -ECHILD when the label is
243 * invalid. The @opt_dentry parameter should be set to a dentry of the inode;
244 * when no dentry is available, set it to NULL instead.
246 static int __inode_security_revalidate(struct inode *inode,
247 struct dentry *opt_dentry,
250 struct inode_security_struct *isec = inode->i_security;
252 might_sleep_if(may_sleep);
254 if (ss_initialized && isec->initialized != LABEL_INITIALIZED) {
259 * Try reloading the inode security label. This will fail if
260 * @opt_dentry is NULL and no dentry for this inode can be
261 * found; in that case, continue using the old label.
263 inode_doinit_with_dentry(inode, opt_dentry);
268 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
270 return inode->i_security;
273 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
277 error = __inode_security_revalidate(inode, NULL, !rcu);
279 return ERR_PTR(error);
280 return inode->i_security;
284 * Get the security label of an inode.
286 static struct inode_security_struct *inode_security(struct inode *inode)
288 __inode_security_revalidate(inode, NULL, true);
289 return inode->i_security;
292 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
294 struct inode *inode = d_backing_inode(dentry);
296 return inode->i_security;
300 * Get the security label of a dentry's backing inode.
302 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
304 struct inode *inode = d_backing_inode(dentry);
306 __inode_security_revalidate(inode, dentry, true);
307 return inode->i_security;
310 static void inode_free_rcu(struct rcu_head *head)
312 struct inode_security_struct *isec;
314 isec = container_of(head, struct inode_security_struct, rcu);
315 kmem_cache_free(sel_inode_cache, isec);
318 static void inode_free_security(struct inode *inode)
320 struct inode_security_struct *isec = inode->i_security;
321 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
324 * As not all inode security structures are in a list, we check for
325 * empty list outside of the lock to make sure that we won't waste
326 * time taking a lock doing nothing.
328 * The list_del_init() function can be safely called more than once.
329 * It should not be possible for this function to be called with
330 * concurrent list_add(), but for better safety against future changes
331 * in the code, we use list_empty_careful() here.
333 if (!list_empty_careful(&isec->list)) {
334 spin_lock(&sbsec->isec_lock);
335 list_del_init(&isec->list);
336 spin_unlock(&sbsec->isec_lock);
340 * The inode may still be referenced in a path walk and
341 * a call to selinux_inode_permission() can be made
342 * after inode_free_security() is called. Ideally, the VFS
343 * wouldn't do this, but fixing that is a much harder
344 * job. For now, simply free the i_security via RCU, and
345 * leave the current inode->i_security pointer intact.
346 * The inode will be freed after the RCU grace period too.
348 call_rcu(&isec->rcu, inode_free_rcu);
351 static int file_alloc_security(struct file *file)
353 struct file_security_struct *fsec;
354 u32 sid = current_sid();
356 fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
361 fsec->fown_sid = sid;
362 file->f_security = fsec;
367 static void file_free_security(struct file *file)
369 struct file_security_struct *fsec = file->f_security;
370 file->f_security = NULL;
371 kmem_cache_free(file_security_cache, fsec);
374 static int superblock_alloc_security(struct super_block *sb)
376 struct superblock_security_struct *sbsec;
378 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
382 mutex_init(&sbsec->lock);
383 INIT_LIST_HEAD(&sbsec->isec_head);
384 spin_lock_init(&sbsec->isec_lock);
386 sbsec->sid = SECINITSID_UNLABELED;
387 sbsec->def_sid = SECINITSID_FILE;
388 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
389 sb->s_security = sbsec;
394 static void superblock_free_security(struct super_block *sb)
396 struct superblock_security_struct *sbsec = sb->s_security;
397 sb->s_security = NULL;
401 /* The file system's label must be initialized prior to use. */
403 static const char *labeling_behaviors[7] = {
405 "uses transition SIDs",
407 "uses genfs_contexts",
408 "not configured for labeling",
409 "uses mountpoint labeling",
410 "uses native labeling",
413 static inline int inode_doinit(struct inode *inode)
415 return inode_doinit_with_dentry(inode, NULL);
424 Opt_labelsupport = 5,
428 #define NUM_SEL_MNT_OPTS (Opt_nextmntopt - 1)
430 static const match_table_t tokens = {
431 {Opt_context, CONTEXT_STR "%s"},
432 {Opt_fscontext, FSCONTEXT_STR "%s"},
433 {Opt_defcontext, DEFCONTEXT_STR "%s"},
434 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
435 {Opt_labelsupport, LABELSUPP_STR},
439 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
441 static int may_context_mount_sb_relabel(u32 sid,
442 struct superblock_security_struct *sbsec,
443 const struct cred *cred)
445 const struct task_security_struct *tsec = cred->security;
448 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
449 FILESYSTEM__RELABELFROM, NULL);
453 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
454 FILESYSTEM__RELABELTO, NULL);
458 static int may_context_mount_inode_relabel(u32 sid,
459 struct superblock_security_struct *sbsec,
460 const struct cred *cred)
462 const struct task_security_struct *tsec = cred->security;
464 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
465 FILESYSTEM__RELABELFROM, NULL);
469 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
470 FILESYSTEM__ASSOCIATE, NULL);
474 static int selinux_is_sblabel_mnt(struct super_block *sb)
476 struct superblock_security_struct *sbsec = sb->s_security;
478 return sbsec->behavior == SECURITY_FS_USE_XATTR ||
479 sbsec->behavior == SECURITY_FS_USE_TRANS ||
480 sbsec->behavior == SECURITY_FS_USE_TASK ||
481 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
482 /* Special handling. Genfs but also in-core setxattr handler */
483 !strcmp(sb->s_type->name, "sysfs") ||
484 !strcmp(sb->s_type->name, "pstore") ||
485 !strcmp(sb->s_type->name, "debugfs") ||
486 !strcmp(sb->s_type->name, "tracefs") ||
487 !strcmp(sb->s_type->name, "rootfs") ||
488 (selinux_policycap_cgroupseclabel &&
489 (!strcmp(sb->s_type->name, "cgroup") ||
490 !strcmp(sb->s_type->name, "cgroup2")));
493 static int sb_finish_set_opts(struct super_block *sb)
495 struct superblock_security_struct *sbsec = sb->s_security;
496 struct dentry *root = sb->s_root;
497 struct inode *root_inode = d_backing_inode(root);
500 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
501 /* Make sure that the xattr handler exists and that no
502 error other than -ENODATA is returned by getxattr on
503 the root directory. -ENODATA is ok, as this may be
504 the first boot of the SELinux kernel before we have
505 assigned xattr values to the filesystem. */
506 if (!(root_inode->i_opflags & IOP_XATTR)) {
507 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
508 "xattr support\n", sb->s_id, sb->s_type->name);
513 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
514 if (rc < 0 && rc != -ENODATA) {
515 if (rc == -EOPNOTSUPP)
516 printk(KERN_WARNING "SELinux: (dev %s, type "
517 "%s) has no security xattr handler\n",
518 sb->s_id, sb->s_type->name);
520 printk(KERN_WARNING "SELinux: (dev %s, type "
521 "%s) getxattr errno %d\n", sb->s_id,
522 sb->s_type->name, -rc);
527 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
528 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
529 sb->s_id, sb->s_type->name);
531 sbsec->flags |= SE_SBINITIALIZED;
532 if (selinux_is_sblabel_mnt(sb))
533 sbsec->flags |= SBLABEL_MNT;
535 /* Initialize the root inode. */
536 rc = inode_doinit_with_dentry(root_inode, root);
538 /* Initialize any other inodes associated with the superblock, e.g.
539 inodes created prior to initial policy load or inodes created
540 during get_sb by a pseudo filesystem that directly
542 spin_lock(&sbsec->isec_lock);
544 if (!list_empty(&sbsec->isec_head)) {
545 struct inode_security_struct *isec =
546 list_entry(sbsec->isec_head.next,
547 struct inode_security_struct, list);
548 struct inode *inode = isec->inode;
549 list_del_init(&isec->list);
550 spin_unlock(&sbsec->isec_lock);
551 inode = igrab(inode);
553 if (!IS_PRIVATE(inode))
557 spin_lock(&sbsec->isec_lock);
560 spin_unlock(&sbsec->isec_lock);
566 * This function should allow an FS to ask what it's mount security
567 * options were so it can use those later for submounts, displaying
568 * mount options, or whatever.
570 static int selinux_get_mnt_opts(const struct super_block *sb,
571 struct security_mnt_opts *opts)
574 struct superblock_security_struct *sbsec = sb->s_security;
575 char *context = NULL;
579 security_init_mnt_opts(opts);
581 if (!(sbsec->flags & SE_SBINITIALIZED))
587 /* make sure we always check enough bits to cover the mask */
588 BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
590 tmp = sbsec->flags & SE_MNTMASK;
591 /* count the number of mount options for this sb */
592 for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
594 opts->num_mnt_opts++;
597 /* Check if the Label support flag is set */
598 if (sbsec->flags & SBLABEL_MNT)
599 opts->num_mnt_opts++;
601 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
602 if (!opts->mnt_opts) {
607 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
608 if (!opts->mnt_opts_flags) {
614 if (sbsec->flags & FSCONTEXT_MNT) {
615 rc = security_sid_to_context(sbsec->sid, &context, &len);
618 opts->mnt_opts[i] = context;
619 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
621 if (sbsec->flags & CONTEXT_MNT) {
622 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
625 opts->mnt_opts[i] = context;
626 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
628 if (sbsec->flags & DEFCONTEXT_MNT) {
629 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
632 opts->mnt_opts[i] = context;
633 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
635 if (sbsec->flags & ROOTCONTEXT_MNT) {
636 struct dentry *root = sbsec->sb->s_root;
637 struct inode_security_struct *isec = backing_inode_security(root);
639 rc = security_sid_to_context(isec->sid, &context, &len);
642 opts->mnt_opts[i] = context;
643 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
645 if (sbsec->flags & SBLABEL_MNT) {
646 opts->mnt_opts[i] = NULL;
647 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
650 BUG_ON(i != opts->num_mnt_opts);
655 security_free_mnt_opts(opts);
659 static int bad_option(struct superblock_security_struct *sbsec, char flag,
660 u32 old_sid, u32 new_sid)
662 char mnt_flags = sbsec->flags & SE_MNTMASK;
664 /* check if the old mount command had the same options */
665 if (sbsec->flags & SE_SBINITIALIZED)
666 if (!(sbsec->flags & flag) ||
667 (old_sid != new_sid))
670 /* check if we were passed the same options twice,
671 * aka someone passed context=a,context=b
673 if (!(sbsec->flags & SE_SBINITIALIZED))
674 if (mnt_flags & flag)
680 * Allow filesystems with binary mount data to explicitly set mount point
681 * labeling information.
683 static int selinux_set_mnt_opts(struct super_block *sb,
684 struct security_mnt_opts *opts,
685 unsigned long kern_flags,
686 unsigned long *set_kern_flags)
688 const struct cred *cred = current_cred();
690 struct superblock_security_struct *sbsec = sb->s_security;
691 const char *name = sb->s_type->name;
692 struct dentry *root = sbsec->sb->s_root;
693 struct inode_security_struct *root_isec;
694 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
695 u32 defcontext_sid = 0;
696 char **mount_options = opts->mnt_opts;
697 int *flags = opts->mnt_opts_flags;
698 int num_opts = opts->num_mnt_opts;
700 mutex_lock(&sbsec->lock);
702 if (!ss_initialized) {
704 /* Defer initialization until selinux_complete_init,
705 after the initial policy is loaded and the security
706 server is ready to handle calls. */
710 printk(KERN_WARNING "SELinux: Unable to set superblock options "
711 "before the security server is initialized\n");
714 if (kern_flags && !set_kern_flags) {
715 /* Specifying internal flags without providing a place to
716 * place the results is not allowed */
722 * Binary mount data FS will come through this function twice. Once
723 * from an explicit call and once from the generic calls from the vfs.
724 * Since the generic VFS calls will not contain any security mount data
725 * we need to skip the double mount verification.
727 * This does open a hole in which we will not notice if the first
728 * mount using this sb set explict options and a second mount using
729 * this sb does not set any security options. (The first options
730 * will be used for both mounts)
732 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
736 root_isec = backing_inode_security_novalidate(root);
739 * parse the mount options, check if they are valid sids.
740 * also check if someone is trying to mount the same sb more
741 * than once with different security options.
743 for (i = 0; i < num_opts; i++) {
746 if (flags[i] == SBLABEL_MNT)
748 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
750 printk(KERN_WARNING "SELinux: security_context_str_to_sid"
751 "(%s) failed for (dev %s, type %s) errno=%d\n",
752 mount_options[i], sb->s_id, name, rc);
759 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
761 goto out_double_mount;
763 sbsec->flags |= FSCONTEXT_MNT;
768 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
770 goto out_double_mount;
772 sbsec->flags |= CONTEXT_MNT;
774 case ROOTCONTEXT_MNT:
775 rootcontext_sid = sid;
777 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
779 goto out_double_mount;
781 sbsec->flags |= ROOTCONTEXT_MNT;
785 defcontext_sid = sid;
787 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
789 goto out_double_mount;
791 sbsec->flags |= DEFCONTEXT_MNT;
800 if (sbsec->flags & SE_SBINITIALIZED) {
801 /* previously mounted with options, but not on this attempt? */
802 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
803 goto out_double_mount;
808 if (strcmp(sb->s_type->name, "proc") == 0)
809 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
811 if (!strcmp(sb->s_type->name, "debugfs") ||
812 !strcmp(sb->s_type->name, "sysfs") ||
813 !strcmp(sb->s_type->name, "pstore"))
814 sbsec->flags |= SE_SBGENFS;
816 if (!sbsec->behavior) {
818 * Determine the labeling behavior to use for this
821 rc = security_fs_use(sb);
824 "%s: security_fs_use(%s) returned %d\n",
825 __func__, sb->s_type->name, rc);
831 * If this is a user namespace mount and the filesystem type is not
832 * explicitly whitelisted, then no contexts are allowed on the command
833 * line and security labels must be ignored.
835 if (sb->s_user_ns != &init_user_ns &&
836 strcmp(sb->s_type->name, "tmpfs") &&
837 strcmp(sb->s_type->name, "ramfs") &&
838 strcmp(sb->s_type->name, "devpts")) {
839 if (context_sid || fscontext_sid || rootcontext_sid ||
844 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
845 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
846 rc = security_transition_sid(current_sid(), current_sid(),
848 &sbsec->mntpoint_sid);
855 /* sets the context of the superblock for the fs being mounted. */
857 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
861 sbsec->sid = fscontext_sid;
865 * Switch to using mount point labeling behavior.
866 * sets the label used on all file below the mountpoint, and will set
867 * the superblock context if not already set.
869 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
870 sbsec->behavior = SECURITY_FS_USE_NATIVE;
871 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
875 if (!fscontext_sid) {
876 rc = may_context_mount_sb_relabel(context_sid, sbsec,
880 sbsec->sid = context_sid;
882 rc = may_context_mount_inode_relabel(context_sid, sbsec,
887 if (!rootcontext_sid)
888 rootcontext_sid = context_sid;
890 sbsec->mntpoint_sid = context_sid;
891 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
894 if (rootcontext_sid) {
895 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
900 root_isec->sid = rootcontext_sid;
901 root_isec->initialized = LABEL_INITIALIZED;
904 if (defcontext_sid) {
905 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
906 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
908 printk(KERN_WARNING "SELinux: defcontext option is "
909 "invalid for this filesystem type\n");
913 if (defcontext_sid != sbsec->def_sid) {
914 rc = may_context_mount_inode_relabel(defcontext_sid,
920 sbsec->def_sid = defcontext_sid;
924 rc = sb_finish_set_opts(sb);
926 mutex_unlock(&sbsec->lock);
930 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
931 "security settings for (dev %s, type %s)\n", sb->s_id, name);
935 static int selinux_cmp_sb_context(const struct super_block *oldsb,
936 const struct super_block *newsb)
938 struct superblock_security_struct *old = oldsb->s_security;
939 struct superblock_security_struct *new = newsb->s_security;
940 char oldflags = old->flags & SE_MNTMASK;
941 char newflags = new->flags & SE_MNTMASK;
943 if (oldflags != newflags)
945 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
947 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
949 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
951 if (oldflags & ROOTCONTEXT_MNT) {
952 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
953 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
954 if (oldroot->sid != newroot->sid)
959 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, "
960 "different security settings for (dev %s, "
961 "type %s)\n", newsb->s_id, newsb->s_type->name);
965 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
966 struct super_block *newsb)
968 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
969 struct superblock_security_struct *newsbsec = newsb->s_security;
971 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
972 int set_context = (oldsbsec->flags & CONTEXT_MNT);
973 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
976 * if the parent was able to be mounted it clearly had no special lsm
977 * mount options. thus we can safely deal with this superblock later
982 /* how can we clone if the old one wasn't set up?? */
983 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
985 /* if fs is reusing a sb, make sure that the contexts match */
986 if (newsbsec->flags & SE_SBINITIALIZED)
987 return selinux_cmp_sb_context(oldsb, newsb);
989 mutex_lock(&newsbsec->lock);
991 newsbsec->flags = oldsbsec->flags;
993 newsbsec->sid = oldsbsec->sid;
994 newsbsec->def_sid = oldsbsec->def_sid;
995 newsbsec->behavior = oldsbsec->behavior;
998 u32 sid = oldsbsec->mntpoint_sid;
1001 newsbsec->sid = sid;
1002 if (!set_rootcontext) {
1003 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1006 newsbsec->mntpoint_sid = sid;
1008 if (set_rootcontext) {
1009 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
1010 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
1012 newisec->sid = oldisec->sid;
1015 sb_finish_set_opts(newsb);
1016 mutex_unlock(&newsbsec->lock);
1020 static int selinux_parse_opts_str(char *options,
1021 struct security_mnt_opts *opts)
1024 char *context = NULL, *defcontext = NULL;
1025 char *fscontext = NULL, *rootcontext = NULL;
1026 int rc, num_mnt_opts = 0;
1028 opts->num_mnt_opts = 0;
1030 /* Standard string-based options. */
1031 while ((p = strsep(&options, "|")) != NULL) {
1033 substring_t args[MAX_OPT_ARGS];
1038 token = match_token(p, tokens, args);
1042 if (context || defcontext) {
1044 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1047 context = match_strdup(&args[0]);
1057 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1060 fscontext = match_strdup(&args[0]);
1067 case Opt_rootcontext:
1070 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1073 rootcontext = match_strdup(&args[0]);
1080 case Opt_defcontext:
1081 if (context || defcontext) {
1083 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
1086 defcontext = match_strdup(&args[0]);
1092 case Opt_labelsupport:
1096 printk(KERN_WARNING "SELinux: unknown mount option\n");
1103 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_KERNEL);
1104 if (!opts->mnt_opts)
1107 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int),
1109 if (!opts->mnt_opts_flags) {
1110 kfree(opts->mnt_opts);
1115 opts->mnt_opts[num_mnt_opts] = fscontext;
1116 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1119 opts->mnt_opts[num_mnt_opts] = context;
1120 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1123 opts->mnt_opts[num_mnt_opts] = rootcontext;
1124 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1127 opts->mnt_opts[num_mnt_opts] = defcontext;
1128 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1131 opts->num_mnt_opts = num_mnt_opts;
1142 * string mount options parsing and call set the sbsec
1144 static int superblock_doinit(struct super_block *sb, void *data)
1147 char *options = data;
1148 struct security_mnt_opts opts;
1150 security_init_mnt_opts(&opts);
1155 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1157 rc = selinux_parse_opts_str(options, &opts);
1162 rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1165 security_free_mnt_opts(&opts);
1169 static void selinux_write_opts(struct seq_file *m,
1170 struct security_mnt_opts *opts)
1175 for (i = 0; i < opts->num_mnt_opts; i++) {
1178 if (opts->mnt_opts[i])
1179 has_comma = strchr(opts->mnt_opts[i], ',');
1183 switch (opts->mnt_opts_flags[i]) {
1185 prefix = CONTEXT_STR;
1188 prefix = FSCONTEXT_STR;
1190 case ROOTCONTEXT_MNT:
1191 prefix = ROOTCONTEXT_STR;
1193 case DEFCONTEXT_MNT:
1194 prefix = DEFCONTEXT_STR;
1198 seq_puts(m, LABELSUPP_STR);
1204 /* we need a comma before each option */
1206 seq_puts(m, prefix);
1209 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1215 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1217 struct security_mnt_opts opts;
1220 rc = selinux_get_mnt_opts(sb, &opts);
1222 /* before policy load we may get EINVAL, don't show anything */
1228 selinux_write_opts(m, &opts);
1230 security_free_mnt_opts(&opts);
1235 static inline u16 inode_mode_to_security_class(umode_t mode)
1237 switch (mode & S_IFMT) {
1239 return SECCLASS_SOCK_FILE;
1241 return SECCLASS_LNK_FILE;
1243 return SECCLASS_FILE;
1245 return SECCLASS_BLK_FILE;
1247 return SECCLASS_DIR;
1249 return SECCLASS_CHR_FILE;
1251 return SECCLASS_FIFO_FILE;
1255 return SECCLASS_FILE;
1258 static inline int default_protocol_stream(int protocol)
1260 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1263 static inline int default_protocol_dgram(int protocol)
1265 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1268 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1270 int extsockclass = selinux_policycap_extsockclass;
1276 case SOCK_SEQPACKET:
1277 return SECCLASS_UNIX_STREAM_SOCKET;
1279 return SECCLASS_UNIX_DGRAM_SOCKET;
1286 case SOCK_SEQPACKET:
1287 if (default_protocol_stream(protocol))
1288 return SECCLASS_TCP_SOCKET;
1289 else if (extsockclass && protocol == IPPROTO_SCTP)
1290 return SECCLASS_SCTP_SOCKET;
1292 return SECCLASS_RAWIP_SOCKET;
1294 if (default_protocol_dgram(protocol))
1295 return SECCLASS_UDP_SOCKET;
1296 else if (extsockclass && (protocol == IPPROTO_ICMP ||
1297 protocol == IPPROTO_ICMPV6))
1298 return SECCLASS_ICMP_SOCKET;
1300 return SECCLASS_RAWIP_SOCKET;
1302 return SECCLASS_DCCP_SOCKET;
1304 return SECCLASS_RAWIP_SOCKET;
1310 return SECCLASS_NETLINK_ROUTE_SOCKET;
1311 case NETLINK_SOCK_DIAG:
1312 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1314 return SECCLASS_NETLINK_NFLOG_SOCKET;
1316 return SECCLASS_NETLINK_XFRM_SOCKET;
1317 case NETLINK_SELINUX:
1318 return SECCLASS_NETLINK_SELINUX_SOCKET;
1320 return SECCLASS_NETLINK_ISCSI_SOCKET;
1322 return SECCLASS_NETLINK_AUDIT_SOCKET;
1323 case NETLINK_FIB_LOOKUP:
1324 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1325 case NETLINK_CONNECTOR:
1326 return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1327 case NETLINK_NETFILTER:
1328 return SECCLASS_NETLINK_NETFILTER_SOCKET;
1329 case NETLINK_DNRTMSG:
1330 return SECCLASS_NETLINK_DNRT_SOCKET;
1331 case NETLINK_KOBJECT_UEVENT:
1332 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1333 case NETLINK_GENERIC:
1334 return SECCLASS_NETLINK_GENERIC_SOCKET;
1335 case NETLINK_SCSITRANSPORT:
1336 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1338 return SECCLASS_NETLINK_RDMA_SOCKET;
1339 case NETLINK_CRYPTO:
1340 return SECCLASS_NETLINK_CRYPTO_SOCKET;
1342 return SECCLASS_NETLINK_SOCKET;
1345 return SECCLASS_PACKET_SOCKET;
1347 return SECCLASS_KEY_SOCKET;
1349 return SECCLASS_APPLETALK_SOCKET;
1355 return SECCLASS_AX25_SOCKET;
1357 return SECCLASS_IPX_SOCKET;
1359 return SECCLASS_NETROM_SOCKET;
1361 return SECCLASS_ATMPVC_SOCKET;
1363 return SECCLASS_X25_SOCKET;
1365 return SECCLASS_ROSE_SOCKET;
1367 return SECCLASS_DECNET_SOCKET;
1369 return SECCLASS_ATMSVC_SOCKET;
1371 return SECCLASS_RDS_SOCKET;
1373 return SECCLASS_IRDA_SOCKET;
1375 return SECCLASS_PPPOX_SOCKET;
1377 return SECCLASS_LLC_SOCKET;
1379 return SECCLASS_CAN_SOCKET;
1381 return SECCLASS_TIPC_SOCKET;
1383 return SECCLASS_BLUETOOTH_SOCKET;
1385 return SECCLASS_IUCV_SOCKET;
1387 return SECCLASS_RXRPC_SOCKET;
1389 return SECCLASS_ISDN_SOCKET;
1391 return SECCLASS_PHONET_SOCKET;
1393 return SECCLASS_IEEE802154_SOCKET;
1395 return SECCLASS_CAIF_SOCKET;
1397 return SECCLASS_ALG_SOCKET;
1399 return SECCLASS_NFC_SOCKET;
1401 return SECCLASS_VSOCK_SOCKET;
1403 return SECCLASS_KCM_SOCKET;
1405 return SECCLASS_QIPCRTR_SOCKET;
1407 return SECCLASS_SMC_SOCKET;
1409 #error New address family defined, please update this function.
1414 return SECCLASS_SOCKET;
1417 static int selinux_genfs_get_sid(struct dentry *dentry,
1423 struct super_block *sb = dentry->d_sb;
1424 char *buffer, *path;
1426 buffer = (char *)__get_free_page(GFP_KERNEL);
1430 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1434 if (flags & SE_SBPROC) {
1435 /* each process gets a /proc/PID/ entry. Strip off the
1436 * PID part to get a valid selinux labeling.
1437 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1438 while (path[1] >= '0' && path[1] <= '9') {
1443 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1445 free_page((unsigned long)buffer);
1449 /* The inode's security attributes must be initialized before first use. */
1450 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1452 struct superblock_security_struct *sbsec = NULL;
1453 struct inode_security_struct *isec = inode->i_security;
1454 u32 task_sid, sid = 0;
1456 struct dentry *dentry;
1457 #define INITCONTEXTLEN 255
1458 char *context = NULL;
1462 if (isec->initialized == LABEL_INITIALIZED)
1465 spin_lock(&isec->lock);
1466 if (isec->initialized == LABEL_INITIALIZED)
1469 if (isec->sclass == SECCLASS_FILE)
1470 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1472 sbsec = inode->i_sb->s_security;
1473 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1474 /* Defer initialization until selinux_complete_init,
1475 after the initial policy is loaded and the security
1476 server is ready to handle calls. */
1477 spin_lock(&sbsec->isec_lock);
1478 if (list_empty(&isec->list))
1479 list_add(&isec->list, &sbsec->isec_head);
1480 spin_unlock(&sbsec->isec_lock);
1484 sclass = isec->sclass;
1485 task_sid = isec->task_sid;
1487 isec->initialized = LABEL_PENDING;
1488 spin_unlock(&isec->lock);
1490 switch (sbsec->behavior) {
1491 case SECURITY_FS_USE_NATIVE:
1493 case SECURITY_FS_USE_XATTR:
1494 if (!(inode->i_opflags & IOP_XATTR)) {
1495 sid = sbsec->def_sid;
1498 /* Need a dentry, since the xattr API requires one.
1499 Life would be simpler if we could just pass the inode. */
1501 /* Called from d_instantiate or d_splice_alias. */
1502 dentry = dget(opt_dentry);
1504 /* Called from selinux_complete_init, try to find a dentry. */
1505 dentry = d_find_alias(inode);
1509 * this is can be hit on boot when a file is accessed
1510 * before the policy is loaded. When we load policy we
1511 * may find inodes that have no dentry on the
1512 * sbsec->isec_head list. No reason to complain as these
1513 * will get fixed up the next time we go through
1514 * inode_doinit with a dentry, before these inodes could
1515 * be used again by userspace.
1520 len = INITCONTEXTLEN;
1521 context = kmalloc(len+1, GFP_NOFS);
1527 context[len] = '\0';
1528 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1529 if (rc == -ERANGE) {
1532 /* Need a larger buffer. Query for the right size. */
1533 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1539 context = kmalloc(len+1, GFP_NOFS);
1545 context[len] = '\0';
1546 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1550 if (rc != -ENODATA) {
1551 printk(KERN_WARNING "SELinux: %s: getxattr returned "
1552 "%d for dev=%s ino=%ld\n", __func__,
1553 -rc, inode->i_sb->s_id, inode->i_ino);
1557 /* Map ENODATA to the default file SID */
1558 sid = sbsec->def_sid;
1561 rc = security_context_to_sid_default(context, rc, &sid,
1565 char *dev = inode->i_sb->s_id;
1566 unsigned long ino = inode->i_ino;
1568 if (rc == -EINVAL) {
1569 if (printk_ratelimit())
1570 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1571 "context=%s. This indicates you may need to relabel the inode or the "
1572 "filesystem in question.\n", ino, dev, context);
1574 printk(KERN_WARNING "SELinux: %s: context_to_sid(%s) "
1575 "returned %d for dev=%s ino=%ld\n",
1576 __func__, context, -rc, dev, ino);
1579 /* Leave with the unlabeled SID */
1586 case SECURITY_FS_USE_TASK:
1589 case SECURITY_FS_USE_TRANS:
1590 /* Default to the fs SID. */
1593 /* Try to obtain a transition SID. */
1594 rc = security_transition_sid(task_sid, sid, sclass, NULL, &sid);
1598 case SECURITY_FS_USE_MNTPOINT:
1599 sid = sbsec->mntpoint_sid;
1602 /* Default to the fs superblock SID. */
1605 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1606 /* We must have a dentry to determine the label on
1609 /* Called from d_instantiate or
1610 * d_splice_alias. */
1611 dentry = dget(opt_dentry);
1613 /* Called from selinux_complete_init, try to
1615 dentry = d_find_alias(inode);
1617 * This can be hit on boot when a file is accessed
1618 * before the policy is loaded. When we load policy we
1619 * may find inodes that have no dentry on the
1620 * sbsec->isec_head list. No reason to complain as
1621 * these will get fixed up the next time we go through
1622 * inode_doinit() with a dentry, before these inodes
1623 * could be used again by userspace.
1627 rc = selinux_genfs_get_sid(dentry, sclass,
1628 sbsec->flags, &sid);
1637 spin_lock(&isec->lock);
1638 if (isec->initialized == LABEL_PENDING) {
1640 isec->initialized = LABEL_INVALID;
1644 isec->initialized = LABEL_INITIALIZED;
1649 spin_unlock(&isec->lock);
1653 /* Convert a Linux signal to an access vector. */
1654 static inline u32 signal_to_av(int sig)
1660 /* Commonly granted from child to parent. */
1661 perm = PROCESS__SIGCHLD;
1664 /* Cannot be caught or ignored */
1665 perm = PROCESS__SIGKILL;
1668 /* Cannot be caught or ignored */
1669 perm = PROCESS__SIGSTOP;
1672 /* All other signals. */
1673 perm = PROCESS__SIGNAL;
1680 #if CAP_LAST_CAP > 63
1681 #error Fix SELinux to handle capabilities > 63.
1684 /* Check whether a task is allowed to use a capability. */
1685 static int cred_has_capability(const struct cred *cred,
1686 int cap, int audit, bool initns)
1688 struct common_audit_data ad;
1689 struct av_decision avd;
1691 u32 sid = cred_sid(cred);
1692 u32 av = CAP_TO_MASK(cap);
1695 ad.type = LSM_AUDIT_DATA_CAP;
1698 switch (CAP_TO_INDEX(cap)) {
1700 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1703 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1707 "SELinux: out of range capability %d\n", cap);
1712 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1713 if (audit == SECURITY_CAP_AUDIT) {
1714 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1721 /* Check whether a task has a particular permission to an inode.
1722 The 'adp' parameter is optional and allows other audit
1723 data to be passed (e.g. the dentry). */
1724 static int inode_has_perm(const struct cred *cred,
1725 struct inode *inode,
1727 struct common_audit_data *adp)
1729 struct inode_security_struct *isec;
1732 validate_creds(cred);
1734 if (unlikely(IS_PRIVATE(inode)))
1737 sid = cred_sid(cred);
1738 isec = inode->i_security;
1740 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1743 /* Same as inode_has_perm, but pass explicit audit data containing
1744 the dentry to help the auditing code to more easily generate the
1745 pathname if needed. */
1746 static inline int dentry_has_perm(const struct cred *cred,
1747 struct dentry *dentry,
1750 struct inode *inode = d_backing_inode(dentry);
1751 struct common_audit_data ad;
1753 ad.type = LSM_AUDIT_DATA_DENTRY;
1754 ad.u.dentry = dentry;
1755 __inode_security_revalidate(inode, dentry, true);
1756 return inode_has_perm(cred, inode, av, &ad);
1759 /* Same as inode_has_perm, but pass explicit audit data containing
1760 the path to help the auditing code to more easily generate the
1761 pathname if needed. */
1762 static inline int path_has_perm(const struct cred *cred,
1763 const struct path *path,
1766 struct inode *inode = d_backing_inode(path->dentry);
1767 struct common_audit_data ad;
1769 ad.type = LSM_AUDIT_DATA_PATH;
1771 __inode_security_revalidate(inode, path->dentry, true);
1772 return inode_has_perm(cred, inode, av, &ad);
1775 /* Same as path_has_perm, but uses the inode from the file struct. */
1776 static inline int file_path_has_perm(const struct cred *cred,
1780 struct common_audit_data ad;
1782 ad.type = LSM_AUDIT_DATA_FILE;
1784 return inode_has_perm(cred, file_inode(file), av, &ad);
1787 /* Check whether a task can use an open file descriptor to
1788 access an inode in a given way. Check access to the
1789 descriptor itself, and then use dentry_has_perm to
1790 check a particular permission to the file.
1791 Access to the descriptor is implicitly granted if it
1792 has the same SID as the process. If av is zero, then
1793 access to the file is not checked, e.g. for cases
1794 where only the descriptor is affected like seek. */
1795 static int file_has_perm(const struct cred *cred,
1799 struct file_security_struct *fsec = file->f_security;
1800 struct inode *inode = file_inode(file);
1801 struct common_audit_data ad;
1802 u32 sid = cred_sid(cred);
1805 ad.type = LSM_AUDIT_DATA_FILE;
1808 if (sid != fsec->sid) {
1809 rc = avc_has_perm(sid, fsec->sid,
1817 /* av is zero if only checking access to the descriptor. */
1820 rc = inode_has_perm(cred, inode, av, &ad);
1827 * Determine the label for an inode that might be unioned.
1830 selinux_determine_inode_label(const struct task_security_struct *tsec,
1832 const struct qstr *name, u16 tclass,
1835 const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1837 if ((sbsec->flags & SE_SBINITIALIZED) &&
1838 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1839 *_new_isid = sbsec->mntpoint_sid;
1840 } else if ((sbsec->flags & SBLABEL_MNT) &&
1842 *_new_isid = tsec->create_sid;
1844 const struct inode_security_struct *dsec = inode_security(dir);
1845 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1852 /* Check whether a task can create a file. */
1853 static int may_create(struct inode *dir,
1854 struct dentry *dentry,
1857 const struct task_security_struct *tsec = current_security();
1858 struct inode_security_struct *dsec;
1859 struct superblock_security_struct *sbsec;
1861 struct common_audit_data ad;
1864 dsec = inode_security(dir);
1865 sbsec = dir->i_sb->s_security;
1869 ad.type = LSM_AUDIT_DATA_DENTRY;
1870 ad.u.dentry = dentry;
1872 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1873 DIR__ADD_NAME | DIR__SEARCH,
1878 rc = selinux_determine_inode_label(current_security(), dir,
1879 &dentry->d_name, tclass, &newsid);
1883 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1887 return avc_has_perm(newsid, sbsec->sid,
1888 SECCLASS_FILESYSTEM,
1889 FILESYSTEM__ASSOCIATE, &ad);
1893 #define MAY_UNLINK 1
1896 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1897 static int may_link(struct inode *dir,
1898 struct dentry *dentry,
1902 struct inode_security_struct *dsec, *isec;
1903 struct common_audit_data ad;
1904 u32 sid = current_sid();
1908 dsec = inode_security(dir);
1909 isec = backing_inode_security(dentry);
1911 ad.type = LSM_AUDIT_DATA_DENTRY;
1912 ad.u.dentry = dentry;
1915 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1916 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1931 printk(KERN_WARNING "SELinux: %s: unrecognized kind %d\n",
1936 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1940 static inline int may_rename(struct inode *old_dir,
1941 struct dentry *old_dentry,
1942 struct inode *new_dir,
1943 struct dentry *new_dentry)
1945 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1946 struct common_audit_data ad;
1947 u32 sid = current_sid();
1949 int old_is_dir, new_is_dir;
1952 old_dsec = inode_security(old_dir);
1953 old_isec = backing_inode_security(old_dentry);
1954 old_is_dir = d_is_dir(old_dentry);
1955 new_dsec = inode_security(new_dir);
1957 ad.type = LSM_AUDIT_DATA_DENTRY;
1959 ad.u.dentry = old_dentry;
1960 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1961 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1964 rc = avc_has_perm(sid, old_isec->sid,
1965 old_isec->sclass, FILE__RENAME, &ad);
1968 if (old_is_dir && new_dir != old_dir) {
1969 rc = avc_has_perm(sid, old_isec->sid,
1970 old_isec->sclass, DIR__REPARENT, &ad);
1975 ad.u.dentry = new_dentry;
1976 av = DIR__ADD_NAME | DIR__SEARCH;
1977 if (d_is_positive(new_dentry))
1978 av |= DIR__REMOVE_NAME;
1979 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1982 if (d_is_positive(new_dentry)) {
1983 new_isec = backing_inode_security(new_dentry);
1984 new_is_dir = d_is_dir(new_dentry);
1985 rc = avc_has_perm(sid, new_isec->sid,
1987 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1995 /* Check whether a task can perform a filesystem operation. */
1996 static int superblock_has_perm(const struct cred *cred,
1997 struct super_block *sb,
1999 struct common_audit_data *ad)
2001 struct superblock_security_struct *sbsec;
2002 u32 sid = cred_sid(cred);
2004 sbsec = sb->s_security;
2005 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
2008 /* Convert a Linux mode and permission mask to an access vector. */
2009 static inline u32 file_mask_to_av(int mode, int mask)
2013 if (!S_ISDIR(mode)) {
2014 if (mask & MAY_EXEC)
2015 av |= FILE__EXECUTE;
2016 if (mask & MAY_READ)
2019 if (mask & MAY_APPEND)
2021 else if (mask & MAY_WRITE)
2025 if (mask & MAY_EXEC)
2027 if (mask & MAY_WRITE)
2029 if (mask & MAY_READ)
2036 /* Convert a Linux file to an access vector. */
2037 static inline u32 file_to_av(struct file *file)
2041 if (file->f_mode & FMODE_READ)
2043 if (file->f_mode & FMODE_WRITE) {
2044 if (file->f_flags & O_APPEND)
2051 * Special file opened with flags 3 for ioctl-only use.
2060 * Convert a file to an access vector and include the correct open
2063 static inline u32 open_file_to_av(struct file *file)
2065 u32 av = file_to_av(file);
2067 if (selinux_policycap_openperm)
2073 /* Hook functions begin here. */
2075 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2077 u32 mysid = current_sid();
2078 u32 mgrsid = task_sid(mgr);
2080 return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
2081 BINDER__SET_CONTEXT_MGR, NULL);
2084 static int selinux_binder_transaction(struct task_struct *from,
2085 struct task_struct *to)
2087 u32 mysid = current_sid();
2088 u32 fromsid = task_sid(from);
2089 u32 tosid = task_sid(to);
2092 if (mysid != fromsid) {
2093 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
2094 BINDER__IMPERSONATE, NULL);
2099 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2103 static int selinux_binder_transfer_binder(struct task_struct *from,
2104 struct task_struct *to)
2106 u32 fromsid = task_sid(from);
2107 u32 tosid = task_sid(to);
2109 return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2113 static int selinux_binder_transfer_file(struct task_struct *from,
2114 struct task_struct *to,
2117 u32 sid = task_sid(to);
2118 struct file_security_struct *fsec = file->f_security;
2119 struct dentry *dentry = file->f_path.dentry;
2120 struct inode_security_struct *isec;
2121 struct common_audit_data ad;
2124 ad.type = LSM_AUDIT_DATA_PATH;
2125 ad.u.path = file->f_path;
2127 if (sid != fsec->sid) {
2128 rc = avc_has_perm(sid, fsec->sid,
2136 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2139 isec = backing_inode_security(dentry);
2140 return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2144 static int selinux_ptrace_access_check(struct task_struct *child,
2147 u32 sid = current_sid();
2148 u32 csid = task_sid(child);
2150 if (mode & PTRACE_MODE_READ)
2151 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2153 return avc_has_perm(sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2156 static int selinux_ptrace_traceme(struct task_struct *parent)
2158 return avc_has_perm(task_sid(parent), current_sid(), SECCLASS_PROCESS,
2159 PROCESS__PTRACE, NULL);
2162 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2163 kernel_cap_t *inheritable, kernel_cap_t *permitted)
2165 return avc_has_perm(current_sid(), task_sid(target), SECCLASS_PROCESS,
2166 PROCESS__GETCAP, NULL);
2169 static int selinux_capset(struct cred *new, const struct cred *old,
2170 const kernel_cap_t *effective,
2171 const kernel_cap_t *inheritable,
2172 const kernel_cap_t *permitted)
2174 return avc_has_perm(cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2175 PROCESS__SETCAP, NULL);
2179 * (This comment used to live with the selinux_task_setuid hook,
2180 * which was removed).
2182 * Since setuid only affects the current process, and since the SELinux
2183 * controls are not based on the Linux identity attributes, SELinux does not
2184 * need to control this operation. However, SELinux does control the use of
2185 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2188 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2191 return cred_has_capability(cred, cap, audit, ns == &init_user_ns);
2194 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2196 const struct cred *cred = current_cred();
2208 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2213 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2216 rc = 0; /* let the kernel handle invalid cmds */
2222 static int selinux_quota_on(struct dentry *dentry)
2224 const struct cred *cred = current_cred();
2226 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2229 static int selinux_syslog(int type)
2232 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2233 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2234 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2235 SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2236 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2237 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2238 /* Set level of messages printed to console */
2239 case SYSLOG_ACTION_CONSOLE_LEVEL:
2240 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2241 SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2244 /* All other syslog types */
2245 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2246 SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2250 * Check that a process has enough memory to allocate a new virtual
2251 * mapping. 0 means there is enough memory for the allocation to
2252 * succeed and -ENOMEM implies there is not.
2254 * Do not audit the selinux permission check, as this is applied to all
2255 * processes that allocate mappings.
2257 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2259 int rc, cap_sys_admin = 0;
2261 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2262 SECURITY_CAP_NOAUDIT, true);
2266 return cap_sys_admin;
2269 /* binprm security operations */
2271 static u32 ptrace_parent_sid(void)
2274 struct task_struct *tracer;
2277 tracer = ptrace_parent(current);
2279 sid = task_sid(tracer);
2285 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2286 const struct task_security_struct *old_tsec,
2287 const struct task_security_struct *new_tsec)
2289 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2290 int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2293 if (!nnp && !nosuid)
2294 return 0; /* neither NNP nor nosuid */
2296 if (new_tsec->sid == old_tsec->sid)
2297 return 0; /* No change in credentials */
2300 * The only transitions we permit under NNP or nosuid
2301 * are transitions to bounded SIDs, i.e. SIDs that are
2302 * guaranteed to only be allowed a subset of the permissions
2303 * of the current SID.
2305 rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2308 * On failure, preserve the errno values for NNP vs nosuid.
2309 * NNP: Operation not permitted for caller.
2310 * nosuid: Permission denied to file.
2320 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2322 const struct task_security_struct *old_tsec;
2323 struct task_security_struct *new_tsec;
2324 struct inode_security_struct *isec;
2325 struct common_audit_data ad;
2326 struct inode *inode = file_inode(bprm->file);
2329 /* SELinux context only depends on initial program or script and not
2330 * the script interpreter */
2331 if (bprm->cred_prepared)
2334 old_tsec = current_security();
2335 new_tsec = bprm->cred->security;
2336 isec = inode_security(inode);
2338 /* Default to the current task SID. */
2339 new_tsec->sid = old_tsec->sid;
2340 new_tsec->osid = old_tsec->sid;
2342 /* Reset fs, key, and sock SIDs on execve. */
2343 new_tsec->create_sid = 0;
2344 new_tsec->keycreate_sid = 0;
2345 new_tsec->sockcreate_sid = 0;
2347 if (old_tsec->exec_sid) {
2348 new_tsec->sid = old_tsec->exec_sid;
2349 /* Reset exec SID on execve. */
2350 new_tsec->exec_sid = 0;
2352 /* Fail on NNP or nosuid if not an allowed transition. */
2353 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2357 /* Check for a default transition on this program. */
2358 rc = security_transition_sid(old_tsec->sid, isec->sid,
2359 SECCLASS_PROCESS, NULL,
2365 * Fallback to old SID on NNP or nosuid if not an allowed
2368 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2370 new_tsec->sid = old_tsec->sid;
2373 ad.type = LSM_AUDIT_DATA_FILE;
2374 ad.u.file = bprm->file;
2376 if (new_tsec->sid == old_tsec->sid) {
2377 rc = avc_has_perm(old_tsec->sid, isec->sid,
2378 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2382 /* Check permissions for the transition. */
2383 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2384 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2388 rc = avc_has_perm(new_tsec->sid, isec->sid,
2389 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2393 /* Check for shared state */
2394 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2395 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2396 SECCLASS_PROCESS, PROCESS__SHARE,
2402 /* Make sure that anyone attempting to ptrace over a task that
2403 * changes its SID has the appropriate permit */
2404 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2405 u32 ptsid = ptrace_parent_sid();
2407 rc = avc_has_perm(ptsid, new_tsec->sid,
2409 PROCESS__PTRACE, NULL);
2415 /* Clear any possibly unsafe personality bits on exec: */
2416 bprm->per_clear |= PER_CLEAR_ON_SETID;
2422 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2424 const struct task_security_struct *tsec = current_security();
2432 /* Enable secure mode for SIDs transitions unless
2433 the noatsecure permission is granted between
2434 the two SIDs, i.e. ahp returns 0. */
2435 atsecure = avc_has_perm(osid, sid,
2437 PROCESS__NOATSECURE, NULL);
2443 static int match_file(const void *p, struct file *file, unsigned fd)
2445 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2448 /* Derived from fs/exec.c:flush_old_files. */
2449 static inline void flush_unauthorized_files(const struct cred *cred,
2450 struct files_struct *files)
2452 struct file *file, *devnull = NULL;
2453 struct tty_struct *tty;
2457 tty = get_current_tty();
2459 spin_lock(&tty->files_lock);
2460 if (!list_empty(&tty->tty_files)) {
2461 struct tty_file_private *file_priv;
2463 /* Revalidate access to controlling tty.
2464 Use file_path_has_perm on the tty path directly
2465 rather than using file_has_perm, as this particular
2466 open file may belong to another process and we are
2467 only interested in the inode-based check here. */
2468 file_priv = list_first_entry(&tty->tty_files,
2469 struct tty_file_private, list);
2470 file = file_priv->file;
2471 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2474 spin_unlock(&tty->files_lock);
2477 /* Reset controlling tty. */
2481 /* Revalidate access to inherited open files. */
2482 n = iterate_fd(files, 0, match_file, cred);
2483 if (!n) /* none found? */
2486 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2487 if (IS_ERR(devnull))
2489 /* replace all the matching ones with this */
2491 replace_fd(n - 1, devnull, 0);
2492 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2498 * Prepare a process for imminent new credential changes due to exec
2500 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2502 struct task_security_struct *new_tsec;
2503 struct rlimit *rlim, *initrlim;
2506 new_tsec = bprm->cred->security;
2507 if (new_tsec->sid == new_tsec->osid)
2510 /* Close files for which the new task SID is not authorized. */
2511 flush_unauthorized_files(bprm->cred, current->files);
2513 /* Always clear parent death signal on SID transitions. */
2514 current->pdeath_signal = 0;
2516 /* Check whether the new SID can inherit resource limits from the old
2517 * SID. If not, reset all soft limits to the lower of the current
2518 * task's hard limit and the init task's soft limit.
2520 * Note that the setting of hard limits (even to lower them) can be
2521 * controlled by the setrlimit check. The inclusion of the init task's
2522 * soft limit into the computation is to avoid resetting soft limits
2523 * higher than the default soft limit for cases where the default is
2524 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2526 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2527 PROCESS__RLIMITINH, NULL);
2529 /* protect against do_prlimit() */
2531 for (i = 0; i < RLIM_NLIMITS; i++) {
2532 rlim = current->signal->rlim + i;
2533 initrlim = init_task.signal->rlim + i;
2534 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2536 task_unlock(current);
2537 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2538 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2543 * Clean up the process immediately after the installation of new credentials
2546 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2548 const struct task_security_struct *tsec = current_security();
2549 struct itimerval itimer;
2559 /* Check whether the new SID can inherit signal state from the old SID.
2560 * If not, clear itimers to avoid subsequent signal generation and
2561 * flush and unblock signals.
2563 * This must occur _after_ the task SID has been updated so that any
2564 * kill done after the flush will be checked against the new SID.
2566 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2568 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) {
2569 memset(&itimer, 0, sizeof itimer);
2570 for (i = 0; i < 3; i++)
2571 do_setitimer(i, &itimer, NULL);
2573 spin_lock_irq(¤t->sighand->siglock);
2574 if (!fatal_signal_pending(current)) {
2575 flush_sigqueue(¤t->pending);
2576 flush_sigqueue(¤t->signal->shared_pending);
2577 flush_signal_handlers(current, 1);
2578 sigemptyset(¤t->blocked);
2579 recalc_sigpending();
2581 spin_unlock_irq(¤t->sighand->siglock);
2584 /* Wake up the parent if it is waiting so that it can recheck
2585 * wait permission to the new task SID. */
2586 read_lock(&tasklist_lock);
2587 __wake_up_parent(current, current->real_parent);
2588 read_unlock(&tasklist_lock);
2591 /* superblock security operations */
2593 static int selinux_sb_alloc_security(struct super_block *sb)
2595 return superblock_alloc_security(sb);
2598 static void selinux_sb_free_security(struct super_block *sb)
2600 superblock_free_security(sb);
2603 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2608 return !memcmp(prefix, option, plen);
2611 static inline int selinux_option(char *option, int len)
2613 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2614 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2615 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2616 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2617 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2620 static inline void take_option(char **to, char *from, int *first, int len)
2627 memcpy(*to, from, len);
2631 static inline void take_selinux_option(char **to, char *from, int *first,
2634 int current_size = 0;
2642 while (current_size < len) {
2652 static int selinux_sb_copy_data(char *orig, char *copy)
2654 int fnosec, fsec, rc = 0;
2655 char *in_save, *in_curr, *in_end;
2656 char *sec_curr, *nosec_save, *nosec;
2662 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2670 in_save = in_end = orig;
2674 open_quote = !open_quote;
2675 if ((*in_end == ',' && open_quote == 0) ||
2677 int len = in_end - in_curr;
2679 if (selinux_option(in_curr, len))
2680 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2682 take_option(&nosec, in_curr, &fnosec, len);
2684 in_curr = in_end + 1;
2686 } while (*in_end++);
2688 strcpy(in_save, nosec_save);
2689 free_page((unsigned long)nosec_save);
2694 static int selinux_sb_remount(struct super_block *sb, void *data)
2697 struct security_mnt_opts opts;
2698 char *secdata, **mount_options;
2699 struct superblock_security_struct *sbsec = sb->s_security;
2701 if (!(sbsec->flags & SE_SBINITIALIZED))
2707 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2710 security_init_mnt_opts(&opts);
2711 secdata = alloc_secdata();
2714 rc = selinux_sb_copy_data(data, secdata);
2716 goto out_free_secdata;
2718 rc = selinux_parse_opts_str(secdata, &opts);
2720 goto out_free_secdata;
2722 mount_options = opts.mnt_opts;
2723 flags = opts.mnt_opts_flags;
2725 for (i = 0; i < opts.num_mnt_opts; i++) {
2728 if (flags[i] == SBLABEL_MNT)
2730 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
2732 printk(KERN_WARNING "SELinux: security_context_str_to_sid"
2733 "(%s) failed for (dev %s, type %s) errno=%d\n",
2734 mount_options[i], sb->s_id, sb->s_type->name, rc);
2740 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2741 goto out_bad_option;
2744 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2745 goto out_bad_option;
2747 case ROOTCONTEXT_MNT: {
2748 struct inode_security_struct *root_isec;
2749 root_isec = backing_inode_security(sb->s_root);
2751 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2752 goto out_bad_option;
2755 case DEFCONTEXT_MNT:
2756 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2757 goto out_bad_option;
2766 security_free_mnt_opts(&opts);
2768 free_secdata(secdata);
2771 printk(KERN_WARNING "SELinux: unable to change security options "
2772 "during remount (dev %s, type=%s)\n", sb->s_id,
2777 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2779 const struct cred *cred = current_cred();
2780 struct common_audit_data ad;
2783 rc = superblock_doinit(sb, data);
2787 /* Allow all mounts performed by the kernel */
2788 if (flags & MS_KERNMOUNT)
2791 ad.type = LSM_AUDIT_DATA_DENTRY;
2792 ad.u.dentry = sb->s_root;
2793 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2796 static int selinux_sb_statfs(struct dentry *dentry)
2798 const struct cred *cred = current_cred();
2799 struct common_audit_data ad;
2801 ad.type = LSM_AUDIT_DATA_DENTRY;
2802 ad.u.dentry = dentry->d_sb->s_root;
2803 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2806 static int selinux_mount(const char *dev_name,
2807 const struct path *path,
2809 unsigned long flags,
2812 const struct cred *cred = current_cred();
2814 if (flags & MS_REMOUNT)
2815 return superblock_has_perm(cred, path->dentry->d_sb,
2816 FILESYSTEM__REMOUNT, NULL);
2818 return path_has_perm(cred, path, FILE__MOUNTON);
2821 static int selinux_umount(struct vfsmount *mnt, int flags)
2823 const struct cred *cred = current_cred();
2825 return superblock_has_perm(cred, mnt->mnt_sb,
2826 FILESYSTEM__UNMOUNT, NULL);
2829 /* inode security operations */
2831 static int selinux_inode_alloc_security(struct inode *inode)
2833 return inode_alloc_security(inode);
2836 static void selinux_inode_free_security(struct inode *inode)
2838 inode_free_security(inode);
2841 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2842 const struct qstr *name, void **ctx,
2848 rc = selinux_determine_inode_label(current_security(),
2849 d_inode(dentry->d_parent), name,
2850 inode_mode_to_security_class(mode),
2855 return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2858 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2860 const struct cred *old,
2865 struct task_security_struct *tsec;
2867 rc = selinux_determine_inode_label(old->security,
2868 d_inode(dentry->d_parent), name,
2869 inode_mode_to_security_class(mode),
2874 tsec = new->security;
2875 tsec->create_sid = newsid;
2879 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2880 const struct qstr *qstr,
2882 void **value, size_t *len)
2884 const struct task_security_struct *tsec = current_security();
2885 struct superblock_security_struct *sbsec;
2886 u32 sid, newsid, clen;
2890 sbsec = dir->i_sb->s_security;
2893 newsid = tsec->create_sid;
2895 rc = selinux_determine_inode_label(current_security(),
2897 inode_mode_to_security_class(inode->i_mode),
2902 /* Possibly defer initialization to selinux_complete_init. */
2903 if (sbsec->flags & SE_SBINITIALIZED) {
2904 struct inode_security_struct *isec = inode->i_security;
2905 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2907 isec->initialized = LABEL_INITIALIZED;
2910 if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2914 *name = XATTR_SELINUX_SUFFIX;
2917 rc = security_sid_to_context_force(newsid, &context, &clen);
2927 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2929 return may_create(dir, dentry, SECCLASS_FILE);
2932 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2934 return may_link(dir, old_dentry, MAY_LINK);
2937 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2939 return may_link(dir, dentry, MAY_UNLINK);
2942 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2944 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2947 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2949 return may_create(dir, dentry, SECCLASS_DIR);
2952 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2954 return may_link(dir, dentry, MAY_RMDIR);
2957 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2959 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2962 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2963 struct inode *new_inode, struct dentry *new_dentry)
2965 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2968 static int selinux_inode_readlink(struct dentry *dentry)
2970 const struct cred *cred = current_cred();
2972 return dentry_has_perm(cred, dentry, FILE__READ);
2975 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2978 const struct cred *cred = current_cred();
2979 struct common_audit_data ad;
2980 struct inode_security_struct *isec;
2983 validate_creds(cred);
2985 ad.type = LSM_AUDIT_DATA_DENTRY;
2986 ad.u.dentry = dentry;
2987 sid = cred_sid(cred);
2988 isec = inode_security_rcu(inode, rcu);
2990 return PTR_ERR(isec);
2992 return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2993 rcu ? MAY_NOT_BLOCK : 0);
2996 static noinline int audit_inode_permission(struct inode *inode,
2997 u32 perms, u32 audited, u32 denied,
3001 struct common_audit_data ad;
3002 struct inode_security_struct *isec = inode->i_security;
3005 ad.type = LSM_AUDIT_DATA_INODE;
3008 rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
3009 audited, denied, result, &ad, flags);
3015 static int selinux_inode_permission(struct inode *inode, int mask)
3017 const struct cred *cred = current_cred();
3020 unsigned flags = mask & MAY_NOT_BLOCK;
3021 struct inode_security_struct *isec;
3023 struct av_decision avd;
3025 u32 audited, denied;
3027 from_access = mask & MAY_ACCESS;
3028 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3030 /* No permission to check. Existence test. */
3034 validate_creds(cred);
3036 if (unlikely(IS_PRIVATE(inode)))
3039 perms = file_mask_to_av(inode->i_mode, mask);
3041 sid = cred_sid(cred);
3042 isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3044 return PTR_ERR(isec);
3046 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
3047 audited = avc_audit_required(perms, &avd, rc,
3048 from_access ? FILE__AUDIT_ACCESS : 0,
3050 if (likely(!audited))
3053 rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
3059 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3061 const struct cred *cred = current_cred();
3062 unsigned int ia_valid = iattr->ia_valid;
3063 __u32 av = FILE__WRITE;
3065 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3066 if (ia_valid & ATTR_FORCE) {
3067 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3073 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3074 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3075 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3077 if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE)
3078 && !(ia_valid & ATTR_FILE))
3081 return dentry_has_perm(cred, dentry, av);
3084 static int selinux_inode_getattr(const struct path *path)
3086 return path_has_perm(current_cred(), path, FILE__GETATTR);
3089 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
3091 const struct cred *cred = current_cred();
3093 if (!strncmp(name, XATTR_SECURITY_PREFIX,
3094 sizeof XATTR_SECURITY_PREFIX - 1)) {
3095 if (!strcmp(name, XATTR_NAME_CAPS)) {
3096 if (!capable(CAP_SETFCAP))
3098 } else if (!capable(CAP_SYS_ADMIN)) {
3099 /* A different attribute in the security namespace.
3100 Restrict to administrator. */
3105 /* Not an attribute we recognize, so just check the
3106 ordinary setattr permission. */
3107 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3110 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3111 const void *value, size_t size, int flags)
3113 struct inode *inode = d_backing_inode(dentry);
3114 struct inode_security_struct *isec;
3115 struct superblock_security_struct *sbsec;
3116 struct common_audit_data ad;
3117 u32 newsid, sid = current_sid();
3120 if (strcmp(name, XATTR_NAME_SELINUX))
3121 return selinux_inode_setotherxattr(dentry, name);
3123 sbsec = inode->i_sb->s_security;
3124 if (!(sbsec->flags & SBLABEL_MNT))
3127 if (!inode_owner_or_capable(inode))
3130 ad.type = LSM_AUDIT_DATA_DENTRY;
3131 ad.u.dentry = dentry;
3133 isec = backing_inode_security(dentry);
3134 rc = avc_has_perm(sid, isec->sid, isec->sclass,
3135 FILE__RELABELFROM, &ad);
3139 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3140 if (rc == -EINVAL) {
3141 if (!capable(CAP_MAC_ADMIN)) {
3142 struct audit_buffer *ab;
3146 /* We strip a nul only if it is at the end, otherwise the
3147 * context contains a nul and we should audit that */
3150 if (str[size - 1] == '\0')
3151 audit_size = size - 1;
3158 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3159 audit_log_format(ab, "op=setxattr invalid_context=");
3160 audit_log_n_untrustedstring(ab, value, audit_size);
3165 rc = security_context_to_sid_force(value, size, &newsid);
3170 rc = avc_has_perm(sid, newsid, isec->sclass,
3171 FILE__RELABELTO, &ad);
3175 rc = security_validate_transition(isec->sid, newsid, sid,
3180 return avc_has_perm(newsid,
3182 SECCLASS_FILESYSTEM,
3183 FILESYSTEM__ASSOCIATE,
3187 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3188 const void *value, size_t size,
3191 struct inode *inode = d_backing_inode(dentry);
3192 struct inode_security_struct *isec;
3196 if (strcmp(name, XATTR_NAME_SELINUX)) {
3197 /* Not an attribute we recognize, so nothing to do. */
3201 rc = security_context_to_sid_force(value, size, &newsid);
3203 printk(KERN_ERR "SELinux: unable to map context to SID"
3204 "for (%s, %lu), rc=%d\n",
3205 inode->i_sb->s_id, inode->i_ino, -rc);
3209 isec = backing_inode_security(dentry);
3210 spin_lock(&isec->lock);
3211 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3213 isec->initialized = LABEL_INITIALIZED;
3214 spin_unlock(&isec->lock);
3219 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3221 const struct cred *cred = current_cred();
3223 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3226 static int selinux_inode_listxattr(struct dentry *dentry)
3228 const struct cred *cred = current_cred();
3230 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3233 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3235 if (strcmp(name, XATTR_NAME_SELINUX))
3236 return selinux_inode_setotherxattr(dentry, name);
3238 /* No one is allowed to remove a SELinux security label.
3239 You can change the label, but all data must be labeled. */
3244 * Copy the inode security context value to the user.
3246 * Permission check is handled by selinux_inode_getxattr hook.
3248 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3252 char *context = NULL;
3253 struct inode_security_struct *isec;
3255 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3259 * If the caller has CAP_MAC_ADMIN, then get the raw context
3260 * value even if it is not defined by current policy; otherwise,
3261 * use the in-core value under current policy.
3262 * Use the non-auditing forms of the permission checks since
3263 * getxattr may be called by unprivileged processes commonly
3264 * and lack of permission just means that we fall back to the
3265 * in-core context value, not a denial.
3267 error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3268 SECURITY_CAP_NOAUDIT);
3270 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3271 SECURITY_CAP_NOAUDIT, true);
3272 isec = inode_security(inode);
3274 error = security_sid_to_context_force(isec->sid, &context,
3277 error = security_sid_to_context(isec->sid, &context, &size);
3290 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3291 const void *value, size_t size, int flags)
3293 struct inode_security_struct *isec = inode_security_novalidate(inode);
3297 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3300 if (!value || !size)
3303 rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3307 spin_lock(&isec->lock);
3308 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3310 isec->initialized = LABEL_INITIALIZED;
3311 spin_unlock(&isec->lock);
3315 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3317 const int len = sizeof(XATTR_NAME_SELINUX);
3318 if (buffer && len <= buffer_size)
3319 memcpy(buffer, XATTR_NAME_SELINUX, len);
3323 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3325 struct inode_security_struct *isec = inode_security_novalidate(inode);
3329 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3332 struct task_security_struct *tsec;
3333 struct cred *new_creds = *new;
3335 if (new_creds == NULL) {
3336 new_creds = prepare_creds();
3341 tsec = new_creds->security;
3342 /* Get label from overlay inode and set it in create_sid */
3343 selinux_inode_getsecid(d_inode(src), &sid);
3344 tsec->create_sid = sid;
3349 static int selinux_inode_copy_up_xattr(const char *name)
3351 /* The copy_up hook above sets the initial context on an inode, but we
3352 * don't then want to overwrite it by blindly copying all the lower
3353 * xattrs up. Instead, we have to filter out SELinux-related xattrs.
3355 if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3356 return 1; /* Discard */
3358 * Any other attribute apart from SELINUX is not claimed, supported
3364 /* file security operations */
3366 static int selinux_revalidate_file_permission(struct file *file, int mask)
3368 const struct cred *cred = current_cred();
3369 struct inode *inode = file_inode(file);
3371 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3372 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3375 return file_has_perm(cred, file,
3376 file_mask_to_av(inode->i_mode, mask));
3379 static int selinux_file_permission(struct file *file, int mask)
3381 struct inode *inode = file_inode(file);
3382 struct file_security_struct *fsec = file->f_security;
3383 struct inode_security_struct *isec;
3384 u32 sid = current_sid();
3387 /* No permission to check. Existence test. */
3390 isec = inode_security(inode);
3391 if (sid == fsec->sid && fsec->isid == isec->sid &&
3392 fsec->pseqno == avc_policy_seqno())
3393 /* No change since file_open check. */
3396 return selinux_revalidate_file_permission(file, mask);
3399 static int selinux_file_alloc_security(struct file *file)
3401 return file_alloc_security(file);
3404 static void selinux_file_free_security(struct file *file)
3406 file_free_security(file);
3410 * Check whether a task has the ioctl permission and cmd
3411 * operation to an inode.
3413 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3414 u32 requested, u16 cmd)
3416 struct common_audit_data ad;
3417 struct file_security_struct *fsec = file->f_security;
3418 struct inode *inode = file_inode(file);
3419 struct inode_security_struct *isec;
3420 struct lsm_ioctlop_audit ioctl;
3421 u32 ssid = cred_sid(cred);
3423 u8 driver = cmd >> 8;
3424 u8 xperm = cmd & 0xff;
3426 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3429 ad.u.op->path = file->f_path;
3431 if (ssid != fsec->sid) {
3432 rc = avc_has_perm(ssid, fsec->sid,
3440 if (unlikely(IS_PRIVATE(inode)))
3443 isec = inode_security(inode);
3444 rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3445 requested, driver, xperm, &ad);
3450 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3453 const struct cred *cred = current_cred();
3463 case FS_IOC_GETFLAGS:
3465 case FS_IOC_GETVERSION:
3466 error = file_has_perm(cred, file, FILE__GETATTR);
3469 case FS_IOC_SETFLAGS:
3471 case FS_IOC_SETVERSION:
3472 error = file_has_perm(cred, file, FILE__SETATTR);
3475 /* sys_ioctl() checks */
3479 error = file_has_perm(cred, file, 0);
3484 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3485 SECURITY_CAP_AUDIT, true);
3488 /* default case assumes that the command will go
3489 * to the file's ioctl() function.
3492 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3497 static int default_noexec;
3499 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3501 const struct cred *cred = current_cred();
3502 u32 sid = cred_sid(cred);
3505 if (default_noexec &&
3506 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3507 (!shared && (prot & PROT_WRITE)))) {
3509 * We are making executable an anonymous mapping or a
3510 * private file mapping that will also be writable.
3511 * This has an additional check.
3513 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3514 PROCESS__EXECMEM, NULL);
3520 /* read access is always possible with a mapping */
3521 u32 av = FILE__READ;
3523 /* write access only matters if the mapping is shared */
3524 if (shared && (prot & PROT_WRITE))
3527 if (prot & PROT_EXEC)
3528 av |= FILE__EXECUTE;
3530 return file_has_perm(cred, file, av);
3537 static int selinux_mmap_addr(unsigned long addr)
3541 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3542 u32 sid = current_sid();
3543 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3544 MEMPROTECT__MMAP_ZERO, NULL);
3550 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3551 unsigned long prot, unsigned long flags)
3553 if (selinux_checkreqprot)
3556 return file_map_prot_check(file, prot,
3557 (flags & MAP_TYPE) == MAP_SHARED);
3560 static int selinux_file_mprotect(struct vm_area_struct *vma,
3561 unsigned long reqprot,
3564 const struct cred *cred = current_cred();
3565 u32 sid = cred_sid(cred);
3567 if (selinux_checkreqprot)
3570 if (default_noexec &&
3571 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3573 if (vma->vm_start >= vma->vm_mm->start_brk &&
3574 vma->vm_end <= vma->vm_mm->brk) {
3575 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3576 PROCESS__EXECHEAP, NULL);
3577 } else if (!vma->vm_file &&
3578 ((vma->vm_start <= vma->vm_mm->start_stack &&
3579 vma->vm_end >= vma->vm_mm->start_stack) ||
3580 vma_is_stack_for_current(vma))) {
3581 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3582 PROCESS__EXECSTACK, NULL);
3583 } else if (vma->vm_file && vma->anon_vma) {
3585 * We are making executable a file mapping that has
3586 * had some COW done. Since pages might have been
3587 * written, check ability to execute the possibly
3588 * modified content. This typically should only
3589 * occur for text relocations.
3591 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3597 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3600 static int selinux_file_lock(struct file *file, unsigned int cmd)
3602 const struct cred *cred = current_cred();
3604 return file_has_perm(cred, file, FILE__LOCK);
3607 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3610 const struct cred *cred = current_cred();
3615 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3616 err = file_has_perm(cred, file, FILE__WRITE);
3625 case F_GETOWNER_UIDS:
3626 /* Just check FD__USE permission */
3627 err = file_has_perm(cred, file, 0);
3635 #if BITS_PER_LONG == 32
3640 err = file_has_perm(cred, file, FILE__LOCK);
3647 static void selinux_file_set_fowner(struct file *file)
3649 struct file_security_struct *fsec;
3651 fsec = file->f_security;
3652 fsec->fown_sid = current_sid();
3655 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3656 struct fown_struct *fown, int signum)
3659 u32 sid = task_sid(tsk);
3661 struct file_security_struct *fsec;
3663 /* struct fown_struct is never outside the context of a struct file */
3664 file = container_of(fown, struct file, f_owner);
3666 fsec = file->f_security;
3669 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3671 perm = signal_to_av(signum);
3673 return avc_has_perm(fsec->fown_sid, sid,
3674 SECCLASS_PROCESS, perm, NULL);
3677 static int selinux_file_receive(struct file *file)
3679 const struct cred *cred = current_cred();
3681 return file_has_perm(cred, file, file_to_av(file));
3684 static int selinux_file_open(struct file *file, const struct cred *cred)
3686 struct file_security_struct *fsec;
3687 struct inode_security_struct *isec;
3689 fsec = file->f_security;
3690 isec = inode_security(file_inode(file));
3692 * Save inode label and policy sequence number
3693 * at open-time so that selinux_file_permission
3694 * can determine whether revalidation is necessary.
3695 * Task label is already saved in the file security
3696 * struct as its SID.
3698 fsec->isid = isec->sid;
3699 fsec->pseqno = avc_policy_seqno();
3701 * Since the inode label or policy seqno may have changed
3702 * between the selinux_inode_permission check and the saving
3703 * of state above, recheck that access is still permitted.
3704 * Otherwise, access might never be revalidated against the
3705 * new inode label or new policy.
3706 * This check is not redundant - do not remove.
3708 return file_path_has_perm(cred, file, open_file_to_av(file));
3711 /* task security operations */
3713 static int selinux_task_create(unsigned long clone_flags)
3715 u32 sid = current_sid();
3717 return avc_has_perm(sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
3721 * allocate the SELinux part of blank credentials
3723 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3725 struct task_security_struct *tsec;
3727 tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3731 cred->security = tsec;
3736 * detach and free the LSM part of a set of credentials
3738 static void selinux_cred_free(struct cred *cred)
3740 struct task_security_struct *tsec = cred->security;
3743 * cred->security == NULL if security_cred_alloc_blank() or
3744 * security_prepare_creds() returned an error.
3746 BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3747 cred->security = (void *) 0x7UL;
3752 * prepare a new set of credentials for modification
3754 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3757 const struct task_security_struct *old_tsec;
3758 struct task_security_struct *tsec;
3760 old_tsec = old->security;
3762 tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3766 new->security = tsec;
3771 * transfer the SELinux data to a blank set of creds
3773 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3775 const struct task_security_struct *old_tsec = old->security;
3776 struct task_security_struct *tsec = new->security;
3782 * set the security data for a kernel service
3783 * - all the creation contexts are set to unlabelled
3785 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3787 struct task_security_struct *tsec = new->security;
3788 u32 sid = current_sid();
3791 ret = avc_has_perm(sid, secid,
3792 SECCLASS_KERNEL_SERVICE,
3793 KERNEL_SERVICE__USE_AS_OVERRIDE,
3797 tsec->create_sid = 0;
3798 tsec->keycreate_sid = 0;
3799 tsec->sockcreate_sid = 0;
3805 * set the file creation context in a security record to the same as the
3806 * objective context of the specified inode
3808 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3810 struct inode_security_struct *isec = inode_security(inode);
3811 struct task_security_struct *tsec = new->security;
3812 u32 sid = current_sid();
3815 ret = avc_has_perm(sid, isec->sid,
3816 SECCLASS_KERNEL_SERVICE,
3817 KERNEL_SERVICE__CREATE_FILES_AS,
3821 tsec->create_sid = isec->sid;
3825 static int selinux_kernel_module_request(char *kmod_name)
3827 struct common_audit_data ad;
3829 ad.type = LSM_AUDIT_DATA_KMOD;
3830 ad.u.kmod_name = kmod_name;
3832 return avc_has_perm(current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
3833 SYSTEM__MODULE_REQUEST, &ad);
3836 static int selinux_kernel_module_from_file(struct file *file)
3838 struct common_audit_data ad;
3839 struct inode_security_struct *isec;
3840 struct file_security_struct *fsec;
3841 u32 sid = current_sid();
3846 return avc_has_perm(sid, sid, SECCLASS_SYSTEM,
3847 SYSTEM__MODULE_LOAD, NULL);
3851 ad.type = LSM_AUDIT_DATA_FILE;
3854 fsec = file->f_security;
3855 if (sid != fsec->sid) {
3856 rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3861 isec = inode_security(file_inode(file));
3862 return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM,
3863 SYSTEM__MODULE_LOAD, &ad);
3866 static int selinux_kernel_read_file(struct file *file,
3867 enum kernel_read_file_id id)
3872 case READING_MODULE:
3873 rc = selinux_kernel_module_from_file(file);
3882 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3884 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3885 PROCESS__SETPGID, NULL);
3888 static int selinux_task_getpgid(struct task_struct *p)
3890 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3891 PROCESS__GETPGID, NULL);
3894 static int selinux_task_getsid(struct task_struct *p)
3896 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3897 PROCESS__GETSESSION, NULL);
3900 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3902 *secid = task_sid(p);
3905 static int selinux_task_setnice(struct task_struct *p, int nice)
3907 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3908 PROCESS__SETSCHED, NULL);
3911 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3913 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3914 PROCESS__SETSCHED, NULL);
3917 static int selinux_task_getioprio(struct task_struct *p)
3919 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3920 PROCESS__GETSCHED, NULL);
3923 int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
3928 if (flags & LSM_PRLIMIT_WRITE)
3929 av |= PROCESS__SETRLIMIT;
3930 if (flags & LSM_PRLIMIT_READ)
3931 av |= PROCESS__GETRLIMIT;
3932 return avc_has_perm(cred_sid(cred), cred_sid(tcred),
3933 SECCLASS_PROCESS, av, NULL);
3936 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3937 struct rlimit *new_rlim)
3939 struct rlimit *old_rlim = p->signal->rlim + resource;
3941 /* Control the ability to change the hard limit (whether
3942 lowering or raising it), so that the hard limit can
3943 later be used as a safe reset point for the soft limit
3944 upon context transitions. See selinux_bprm_committing_creds. */
3945 if (old_rlim->rlim_max != new_rlim->rlim_max)
3946 return avc_has_perm(current_sid(), task_sid(p),
3947 SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
3952 static int selinux_task_setscheduler(struct task_struct *p)
3954 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3955 PROCESS__SETSCHED, NULL);
3958 static int selinux_task_getscheduler(struct task_struct *p)
3960 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3961 PROCESS__GETSCHED, NULL);
3964 static int selinux_task_movememory(struct task_struct *p)
3966 return avc_has_perm(current_sid(), task_sid(p), SECCLASS_PROCESS,
3967 PROCESS__SETSCHED, NULL);
3970 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3976 perm = PROCESS__SIGNULL; /* null signal; existence test */
3978 perm = signal_to_av(sig);
3980 secid = current_sid();
3981 return avc_has_perm(secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
3984 static void selinux_task_to_inode(struct task_struct *p,
3985 struct inode *inode)
3987 struct inode_security_struct *isec = inode->i_security;
3988 u32 sid = task_sid(p);
3990 spin_lock(&isec->lock);
3991 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3993 isec->initialized = LABEL_INITIALIZED;
3994 spin_unlock(&isec->lock);
3997 /* Returns error only if unable to parse addresses */
3998 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3999 struct common_audit_data *ad, u8 *proto)
4001 int offset, ihlen, ret = -EINVAL;
4002 struct iphdr _iph, *ih;
4004 offset = skb_network_offset(skb);
4005 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4009 ihlen = ih->ihl * 4;
4010 if (ihlen < sizeof(_iph))
4013 ad->u.net->v4info.saddr = ih->saddr;
4014 ad->u.net->v4info.daddr = ih->daddr;
4018 *proto = ih->protocol;
4020 switch (ih->protocol) {
4022 struct tcphdr _tcph, *th;
4024 if (ntohs(ih->frag_off) & IP_OFFSET)
4028 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4032 ad->u.net->sport = th->source;
4033 ad->u.net->dport = th->dest;
4038 struct udphdr _udph, *uh;
4040 if (ntohs(ih->frag_off) & IP_OFFSET)
4044 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4048 ad->u.net->sport = uh->source;
4049 ad->u.net->dport = uh->dest;
4053 case IPPROTO_DCCP: {
4054 struct dccp_hdr _dccph, *dh;
4056 if (ntohs(ih->frag_off) & IP_OFFSET)
4060 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4064 ad->u.net->sport = dh->dccph_sport;
4065 ad->u.net->dport = dh->dccph_dport;
4076 #if IS_ENABLED(CONFIG_IPV6)
4078 /* Returns error only if unable to parse addresses */
4079 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4080 struct common_audit_data *ad, u8 *proto)
4083 int ret = -EINVAL, offset;
4084 struct ipv6hdr _ipv6h, *ip6;
4087 offset = skb_network_offset(skb);
4088 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4092 ad->u.net->v6info.saddr = ip6->saddr;
4093 ad->u.net->v6info.daddr = ip6->daddr;
4096 nexthdr = ip6->nexthdr;
4097 offset += sizeof(_ipv6h);
4098 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4107 struct tcphdr _tcph, *th;
4109 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4113 ad->u.net->sport = th->source;
4114 ad->u.net->dport = th->dest;
4119 struct udphdr _udph, *uh;
4121 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4125 ad->u.net->sport = uh->source;
4126 ad->u.net->dport = uh->dest;
4130 case IPPROTO_DCCP: {
4131 struct dccp_hdr _dccph, *dh;
4133 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4137 ad->u.net->sport = dh->dccph_sport;
4138 ad->u.net->dport = dh->dccph_dport;
4142 /* includes fragments */
4152 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4153 char **_addrp, int src, u8 *proto)
4158 switch (ad->u.net->family) {
4160 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4163 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4164 &ad->u.net->v4info.daddr);
4167 #if IS_ENABLED(CONFIG_IPV6)
4169 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4172 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4173 &ad->u.net->v6info.daddr);
4183 "SELinux: failure in selinux_parse_skb(),"
4184 " unable to parse packet\n");
4194 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4196 * @family: protocol family
4197 * @sid: the packet's peer label SID
4200 * Check the various different forms of network peer labeling and determine
4201 * the peer label/SID for the packet; most of the magic actually occurs in
4202 * the security server function security_net_peersid_cmp(). The function
4203 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4204 * or -EACCES if @sid is invalid due to inconsistencies with the different
4208 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4215 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4218 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4222 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
4223 if (unlikely(err)) {
4225 "SELinux: failure in selinux_skb_peerlbl_sid(),"
4226 " unable to determine packet's peer label\n");
4234 * selinux_conn_sid - Determine the child socket label for a connection
4235 * @sk_sid: the parent socket's SID
4236 * @skb_sid: the packet's SID
4237 * @conn_sid: the resulting connection SID
4239 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4240 * combined with the MLS information from @skb_sid in order to create
4241 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
4242 * of @sk_sid. Returns zero on success, negative values on failure.
4245 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4249 if (skb_sid != SECSID_NULL)
4250 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4257 /* socket security operations */
4259 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4260 u16 secclass, u32 *socksid)
4262 if (tsec->sockcreate_sid > SECSID_NULL) {
4263 *socksid = tsec->sockcreate_sid;
4267 return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4271 static int sock_has_perm(struct sock *sk, u32 perms)
4273 struct sk_security_struct *sksec = sk->sk_security;
4274 struct common_audit_data ad;
4275 struct lsm_network_audit net = {0,};
4277 if (sksec->sid == SECINITSID_KERNEL)
4280 ad.type = LSM_AUDIT_DATA_NET;
4284 return avc_has_perm(current_sid(), sksec->sid, sksec->sclass, perms,
4288 static int selinux_socket_create(int family, int type,
4289 int protocol, int kern)
4291 const struct task_security_struct *tsec = current_security();
4299 secclass = socket_type_to_security_class(family, type, protocol);
4300 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4304 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4307 static int selinux_socket_post_create(struct socket *sock, int family,
4308 int type, int protocol, int kern)
4310 const struct task_security_struct *tsec = current_security();
4311 struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4312 struct sk_security_struct *sksec;
4313 u16 sclass = socket_type_to_security_class(family, type, protocol);
4314 u32 sid = SECINITSID_KERNEL;
4318 err = socket_sockcreate_sid(tsec, sclass, &sid);
4323 isec->sclass = sclass;
4325 isec->initialized = LABEL_INITIALIZED;
4328 sksec = sock->sk->sk_security;
4329 sksec->sclass = sclass;
4331 err = selinux_netlbl_socket_post_create(sock->sk, family);
4337 /* Range of port numbers used to automatically bind.
4338 Need to determine whether we should perform a name_bind
4339 permission check between the socket and the port number. */
4341 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4343 struct sock *sk = sock->sk;
4347 err = sock_has_perm(sk, SOCKET__BIND);
4352 * If PF_INET or PF_INET6, check name_bind permission for the port.
4353 * Multiple address binding for SCTP is not supported yet: we just
4354 * check the first address now.
4356 family = sk->sk_family;
4357 if (family == PF_INET || family == PF_INET6) {
4359 struct sk_security_struct *sksec = sk->sk_security;
4360 struct common_audit_data ad;
4361 struct lsm_network_audit net = {0,};
4362 struct sockaddr_in *addr4 = NULL;
4363 struct sockaddr_in6 *addr6 = NULL;
4364 unsigned short snum;
4367 if (family == PF_INET) {
4368 addr4 = (struct sockaddr_in *)address;
4369 snum = ntohs(addr4->sin_port);
4370 addrp = (char *)&addr4->sin_addr.s_addr;
4372 addr6 = (struct sockaddr_in6 *)address;
4373 snum = ntohs(addr6->sin6_port);
4374 addrp = (char *)&addr6->sin6_addr.s6_addr;
4380 inet_get_local_port_range(sock_net(sk), &low, &high);
4382 if (snum < max(inet_prot_sock(sock_net(sk)), low) ||
4384 err = sel_netport_sid(sk->sk_protocol,
4388 ad.type = LSM_AUDIT_DATA_NET;
4390 ad.u.net->sport = htons(snum);
4391 ad.u.net->family = family;
4392 err = avc_has_perm(sksec->sid, sid,
4394 SOCKET__NAME_BIND, &ad);
4400 switch (sksec->sclass) {
4401 case SECCLASS_TCP_SOCKET:
4402 node_perm = TCP_SOCKET__NODE_BIND;
4405 case SECCLASS_UDP_SOCKET:
4406 node_perm = UDP_SOCKET__NODE_BIND;
4409 case SECCLASS_DCCP_SOCKET:
4410 node_perm = DCCP_SOCKET__NODE_BIND;
4414 node_perm = RAWIP_SOCKET__NODE_BIND;
4418 err = sel_netnode_sid(addrp, family, &sid);
4422 ad.type = LSM_AUDIT_DATA_NET;
4424 ad.u.net->sport = htons(snum);
4425 ad.u.net->family = family;
4427 if (family == PF_INET)
4428 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4430 ad.u.net->v6info.saddr = addr6->sin6_addr;
4432 err = avc_has_perm(sksec->sid, sid,
4433 sksec->sclass, node_perm, &ad);
4441 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4443 struct sock *sk = sock->sk;
4444 struct sk_security_struct *sksec = sk->sk_security;
4447 err = sock_has_perm(sk, SOCKET__CONNECT);
4452 * If a TCP or DCCP socket, check name_connect permission for the port.
4454 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4455 sksec->sclass == SECCLASS_DCCP_SOCKET) {
4456 struct common_audit_data ad;
4457 struct lsm_network_audit net = {0,};
4458 struct sockaddr_in *addr4 = NULL;
4459 struct sockaddr_in6 *addr6 = NULL;
4460 unsigned short snum;
4463 if (sk->sk_family == PF_INET) {
4464 addr4 = (struct sockaddr_in *)address;
4465 if (addrlen < sizeof(struct sockaddr_in))
4467 snum = ntohs(addr4->sin_port);
4469 addr6 = (struct sockaddr_in6 *)address;
4470 if (addrlen < SIN6_LEN_RFC2133)
4472 snum = ntohs(addr6->sin6_port);
4475 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4479 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4480 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4482 ad.type = LSM_AUDIT_DATA_NET;
4484 ad.u.net->dport = htons(snum);
4485 ad.u.net->family = sk->sk_family;
4486 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4491 err = selinux_netlbl_socket_connect(sk, address);
4497 static int selinux_socket_listen(struct socket *sock, int backlog)
4499 return sock_has_perm(sock->sk, SOCKET__LISTEN);
4502 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4505 struct inode_security_struct *isec;
4506 struct inode_security_struct *newisec;
4510 err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4514 isec = inode_security_novalidate(SOCK_INODE(sock));
4515 spin_lock(&isec->lock);
4516 sclass = isec->sclass;
4518 spin_unlock(&isec->lock);
4520 newisec = inode_security_novalidate(SOCK_INODE(newsock));
4521 newisec->sclass = sclass;
4523 newisec->initialized = LABEL_INITIALIZED;
4528 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4531 return sock_has_perm(sock->sk, SOCKET__WRITE);
4534 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4535 int size, int flags)
4537 return sock_has_perm(sock->sk, SOCKET__READ);
4540 static int selinux_socket_getsockname(struct socket *sock)
4542 return sock_has_perm(sock->sk, SOCKET__GETATTR);
4545 static int selinux_socket_getpeername(struct socket *sock)
4547 return sock_has_perm(sock->sk, SOCKET__GETATTR);
4550 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4554 err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4558 return selinux_netlbl_socket_setsockopt(sock, level, optname);
4561 static int selinux_socket_getsockopt(struct socket *sock, int level,
4564 return sock_has_perm(sock->sk, SOCKET__GETOPT);
4567 static int selinux_socket_shutdown(struct socket *sock, int how)
4569 return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4572 static int selinux_socket_unix_stream_connect(struct sock *sock,
4576 struct sk_security_struct *sksec_sock = sock->sk_security;
4577 struct sk_security_struct *sksec_other = other->sk_security;
4578 struct sk_security_struct *sksec_new = newsk->sk_security;
4579 struct common_audit_data ad;
4580 struct lsm_network_audit net = {0,};
4583 ad.type = LSM_AUDIT_DATA_NET;
4585 ad.u.net->sk = other;
4587 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4588 sksec_other->sclass,
4589 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4593 /* server child socket */
4594 sksec_new->peer_sid = sksec_sock->sid;
4595 err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4600 /* connecting socket */
4601 sksec_sock->peer_sid = sksec_new->sid;
4606 static int selinux_socket_unix_may_send(struct socket *sock,
4607 struct socket *other)
4609 struct sk_security_struct *ssec = sock->sk->sk_security;
4610 struct sk_security_struct *osec = other->sk->sk_security;
4611 struct common_audit_data ad;
4612 struct lsm_network_audit net = {0,};
4614 ad.type = LSM_AUDIT_DATA_NET;
4616 ad.u.net->sk = other->sk;
4618 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4622 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4623 char *addrp, u16 family, u32 peer_sid,
4624 struct common_audit_data *ad)
4630 err = sel_netif_sid(ns, ifindex, &if_sid);
4633 err = avc_has_perm(peer_sid, if_sid,
4634 SECCLASS_NETIF, NETIF__INGRESS, ad);
4638 err = sel_netnode_sid(addrp, family, &node_sid);
4641 return avc_has_perm(peer_sid, node_sid,
4642 SECCLASS_NODE, NODE__RECVFROM, ad);
4645 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4649 struct sk_security_struct *sksec = sk->sk_security;
4650 u32 sk_sid = sksec->sid;
4651 struct common_audit_data ad;
4652 struct lsm_network_audit net = {0,};
4655 ad.type = LSM_AUDIT_DATA_NET;
4657 ad.u.net->netif = skb->skb_iif;
4658 ad.u.net->family = family;
4659 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4663 if (selinux_secmark_enabled()) {
4664 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4670 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4673 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4678 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4681 struct sk_security_struct *sksec = sk->sk_security;
4682 u16 family = sk->sk_family;
4683 u32 sk_sid = sksec->sid;
4684 struct common_audit_data ad;
4685 struct lsm_network_audit net = {0,};
4690 if (family != PF_INET && family != PF_INET6)
4693 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4694 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4697 /* If any sort of compatibility mode is enabled then handoff processing
4698 * to the selinux_sock_rcv_skb_compat() function to deal with the
4699 * special handling. We do this in an attempt to keep this function
4700 * as fast and as clean as possible. */
4701 if (!selinux_policycap_netpeer)
4702 return selinux_sock_rcv_skb_compat(sk, skb, family);
4704 secmark_active = selinux_secmark_enabled();
4705 peerlbl_active = selinux_peerlbl_enabled();
4706 if (!secmark_active && !peerlbl_active)
4709 ad.type = LSM_AUDIT_DATA_NET;
4711 ad.u.net->netif = skb->skb_iif;
4712 ad.u.net->family = family;
4713 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4717 if (peerlbl_active) {
4720 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4723 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4724 addrp, family, peer_sid, &ad);
4726 selinux_netlbl_err(skb, family, err, 0);
4729 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4732 selinux_netlbl_err(skb, family, err, 0);
4737 if (secmark_active) {
4738 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4747 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4748 int __user *optlen, unsigned len)
4753 struct sk_security_struct *sksec = sock->sk->sk_security;
4754 u32 peer_sid = SECSID_NULL;
4756 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4757 sksec->sclass == SECCLASS_TCP_SOCKET)
4758 peer_sid = sksec->peer_sid;
4759 if (peer_sid == SECSID_NULL)
4760 return -ENOPROTOOPT;
4762 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4766 if (scontext_len > len) {
4771 if (copy_to_user(optval, scontext, scontext_len))
4775 if (put_user(scontext_len, optlen))
4781 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4783 u32 peer_secid = SECSID_NULL;
4785 struct inode_security_struct *isec;
4787 if (skb && skb->protocol == htons(ETH_P_IP))
4789 else if (skb && skb->protocol == htons(ETH_P_IPV6))
4792 family = sock->sk->sk_family;
4796 if (sock && family == PF_UNIX) {
4797 isec = inode_security_novalidate(SOCK_INODE(sock));
4798 peer_secid = isec->sid;
4800 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4803 *secid = peer_secid;
4804 if (peer_secid == SECSID_NULL)
4809 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4811 struct sk_security_struct *sksec;
4813 sksec = kzalloc(sizeof(*sksec), priority);
4817 sksec->peer_sid = SECINITSID_UNLABELED;
4818 sksec->sid = SECINITSID_UNLABELED;
4819 sksec->sclass = SECCLASS_SOCKET;
4820 selinux_netlbl_sk_security_reset(sksec);
4821 sk->sk_security = sksec;
4826 static void selinux_sk_free_security(struct sock *sk)
4828 struct sk_security_struct *sksec = sk->sk_security;
4830 sk->sk_security = NULL;
4831 selinux_netlbl_sk_security_free(sksec);
4835 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4837 struct sk_security_struct *sksec = sk->sk_security;
4838 struct sk_security_struct *newsksec = newsk->sk_security;
4840 newsksec->sid = sksec->sid;
4841 newsksec->peer_sid = sksec->peer_sid;
4842 newsksec->sclass = sksec->sclass;
4844 selinux_netlbl_sk_security_reset(newsksec);
4847 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4850 *secid = SECINITSID_ANY_SOCKET;
4852 struct sk_security_struct *sksec = sk->sk_security;
4854 *secid = sksec->sid;
4858 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4860 struct inode_security_struct *isec =
4861 inode_security_novalidate(SOCK_INODE(parent));
4862 struct sk_security_struct *sksec = sk->sk_security;
4864 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4865 sk->sk_family == PF_UNIX)
4866 isec->sid = sksec->sid;
4867 sksec->sclass = isec->sclass;
4870 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4871 struct request_sock *req)
4873 struct sk_security_struct *sksec = sk->sk_security;
4875 u16 family = req->rsk_ops->family;
4879 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4882 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4885 req->secid = connsid;
4886 req->peer_secid = peersid;
4888 return selinux_netlbl_inet_conn_request(req, family);
4891 static void selinux_inet_csk_clone(struct sock *newsk,
4892 const struct request_sock *req)
4894 struct sk_security_struct *newsksec = newsk->sk_security;
4896 newsksec->sid = req->secid;
4897 newsksec->peer_sid = req->peer_secid;
4898 /* NOTE: Ideally, we should also get the isec->sid for the
4899 new socket in sync, but we don't have the isec available yet.
4900 So we will wait until sock_graft to do it, by which
4901 time it will have been created and available. */
4903 /* We don't need to take any sort of lock here as we are the only
4904 * thread with access to newsksec */
4905 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4908 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4910 u16 family = sk->sk_family;
4911 struct sk_security_struct *sksec = sk->sk_security;
4913 /* handle mapped IPv4 packets arriving via IPv6 sockets */
4914 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4917 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4920 static int selinux_secmark_relabel_packet(u32 sid)
4922 const struct task_security_struct *__tsec;
4925 __tsec = current_security();
4928 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4931 static void selinux_secmark_refcount_inc(void)
4933 atomic_inc(&selinux_secmark_refcount);
4936 static void selinux_secmark_refcount_dec(void)
4938 atomic_dec(&selinux_secmark_refcount);
4941 static void selinux_req_classify_flow(const struct request_sock *req,
4944 fl->flowi_secid = req->secid;
4947 static int selinux_tun_dev_alloc_security(void **security)
4949 struct tun_security_struct *tunsec;
4951 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4954 tunsec->sid = current_sid();
4960 static void selinux_tun_dev_free_security(void *security)
4965 static int selinux_tun_dev_create(void)
4967 u32 sid = current_sid();
4969 /* we aren't taking into account the "sockcreate" SID since the socket
4970 * that is being created here is not a socket in the traditional sense,
4971 * instead it is a private sock, accessible only to the kernel, and
4972 * representing a wide range of network traffic spanning multiple
4973 * connections unlike traditional sockets - check the TUN driver to
4974 * get a better understanding of why this socket is special */
4976 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4980 static int selinux_tun_dev_attach_queue(void *security)
4982 struct tun_security_struct *tunsec = security;
4984 return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4985 TUN_SOCKET__ATTACH_QUEUE, NULL);
4988 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4990 struct tun_security_struct *tunsec = security;
4991 struct sk_security_struct *sksec = sk->sk_security;
4993 /* we don't currently perform any NetLabel based labeling here and it
4994 * isn't clear that we would want to do so anyway; while we could apply
4995 * labeling without the support of the TUN user the resulting labeled
4996 * traffic from the other end of the connection would almost certainly
4997 * cause confusion to the TUN user that had no idea network labeling
4998 * protocols were being used */
5000 sksec->sid = tunsec->sid;
5001 sksec->sclass = SECCLASS_TUN_SOCKET;
5006 static int selinux_tun_dev_open(void *security)
5008 struct tun_security_struct *tunsec = security;
5009 u32 sid = current_sid();
5012 err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5013 TUN_SOCKET__RELABELFROM, NULL);
5016 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
5017 TUN_SOCKET__RELABELTO, NULL);
5025 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5029 struct nlmsghdr *nlh;
5030 struct sk_security_struct *sksec = sk->sk_security;
5032 if (skb->len < NLMSG_HDRLEN) {
5036 nlh = nlmsg_hdr(skb);
5038 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
5040 if (err == -EINVAL) {
5041 pr_warn_ratelimited("SELinux: unrecognized netlink"
5042 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5043 " pig=%d comm=%s\n",
5044 sk->sk_protocol, nlh->nlmsg_type,
5045 secclass_map[sksec->sclass - 1].name,
5046 task_pid_nr(current), current->comm);
5047 if (!selinux_enforcing || security_get_allow_unknown())
5057 err = sock_has_perm(sk, perm);
5062 #ifdef CONFIG_NETFILTER
5064 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5065 const struct net_device *indev,
5071 struct common_audit_data ad;
5072 struct lsm_network_audit net = {0,};
5077 if (!selinux_policycap_netpeer)
5080 secmark_active = selinux_secmark_enabled();
5081 netlbl_active = netlbl_enabled();
5082 peerlbl_active = selinux_peerlbl_enabled();
5083 if (!secmark_active && !peerlbl_active)
5086 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5089 ad.type = LSM_AUDIT_DATA_NET;
5091 ad.u.net->netif = indev->ifindex;
5092 ad.u.net->family = family;
5093 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5096 if (peerlbl_active) {
5097 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5098 addrp, family, peer_sid, &ad);
5100 selinux_netlbl_err(skb, family, err, 1);
5106 if (avc_has_perm(peer_sid, skb->secmark,
5107 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5111 /* we do this in the FORWARD path and not the POST_ROUTING
5112 * path because we want to make sure we apply the necessary
5113 * labeling before IPsec is applied so we can leverage AH
5115 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5121 static unsigned int selinux_ipv4_forward(void *priv,
5122 struct sk_buff *skb,
5123 const struct nf_hook_state *state)
5125 return selinux_ip_forward(skb, state->in, PF_INET);
5128 #if IS_ENABLED(CONFIG_IPV6)
5129 static unsigned int selinux_ipv6_forward(void *priv,
5130 struct sk_buff *skb,
5131 const struct nf_hook_state *state)
5133 return selinux_ip_forward(skb, state->in, PF_INET6);
5137 static unsigned int selinux_ip_output(struct sk_buff *skb,
5143 if (!netlbl_enabled())
5146 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5147 * because we want to make sure we apply the necessary labeling
5148 * before IPsec is applied so we can leverage AH protection */
5151 struct sk_security_struct *sksec;
5153 if (sk_listener(sk))
5154 /* if the socket is the listening state then this
5155 * packet is a SYN-ACK packet which means it needs to
5156 * be labeled based on the connection/request_sock and
5157 * not the parent socket. unfortunately, we can't
5158 * lookup the request_sock yet as it isn't queued on
5159 * the parent socket until after the SYN-ACK is sent.
5160 * the "solution" is to simply pass the packet as-is
5161 * as any IP option based labeling should be copied
5162 * from the initial connection request (in the IP
5163 * layer). it is far from ideal, but until we get a
5164 * security label in the packet itself this is the
5165 * best we can do. */
5168 /* standard practice, label using the parent socket */
5169 sksec = sk->sk_security;
5172 sid = SECINITSID_KERNEL;
5173 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5179 static unsigned int selinux_ipv4_output(void *priv,
5180 struct sk_buff *skb,
5181 const struct nf_hook_state *state)
5183 return selinux_ip_output(skb, PF_INET);
5186 #if IS_ENABLED(CONFIG_IPV6)
5187 static unsigned int selinux_ipv6_output(void *priv,
5188 struct sk_buff *skb,
5189 const struct nf_hook_state *state)
5191 return selinux_ip_output(skb, PF_INET6);
5195 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5199 struct sock *sk = skb_to_full_sk(skb);
5200 struct sk_security_struct *sksec;
5201 struct common_audit_data ad;
5202 struct lsm_network_audit net = {0,};
5208 sksec = sk->sk_security;
5210 ad.type = LSM_AUDIT_DATA_NET;
5212 ad.u.net->netif = ifindex;
5213 ad.u.net->family = family;
5214 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5217 if (selinux_secmark_enabled())
5218 if (avc_has_perm(sksec->sid, skb->secmark,
5219 SECCLASS_PACKET, PACKET__SEND, &ad))
5220 return NF_DROP_ERR(-ECONNREFUSED);
5222 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5223 return NF_DROP_ERR(-ECONNREFUSED);
5228 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5229 const struct net_device *outdev,
5234 int ifindex = outdev->ifindex;
5236 struct common_audit_data ad;
5237 struct lsm_network_audit net = {0,};
5242 /* If any sort of compatibility mode is enabled then handoff processing
5243 * to the selinux_ip_postroute_compat() function to deal with the
5244 * special handling. We do this in an attempt to keep this function
5245 * as fast and as clean as possible. */
5246 if (!selinux_policycap_netpeer)
5247 return selinux_ip_postroute_compat(skb, ifindex, family);
5249 secmark_active = selinux_secmark_enabled();
5250 peerlbl_active = selinux_peerlbl_enabled();
5251 if (!secmark_active && !peerlbl_active)
5254 sk = skb_to_full_sk(skb);
5257 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5258 * packet transformation so allow the packet to pass without any checks
5259 * since we'll have another chance to perform access control checks
5260 * when the packet is on it's final way out.
5261 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5262 * is NULL, in this case go ahead and apply access control.
5263 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5264 * TCP listening state we cannot wait until the XFRM processing
5265 * is done as we will miss out on the SA label if we do;
5266 * unfortunately, this means more work, but it is only once per
5268 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5269 !(sk && sk_listener(sk)))
5274 /* Without an associated socket the packet is either coming
5275 * from the kernel or it is being forwarded; check the packet
5276 * to determine which and if the packet is being forwarded
5277 * query the packet directly to determine the security label. */
5279 secmark_perm = PACKET__FORWARD_OUT;
5280 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5283 secmark_perm = PACKET__SEND;
5284 peer_sid = SECINITSID_KERNEL;
5286 } else if (sk_listener(sk)) {
5287 /* Locally generated packet but the associated socket is in the
5288 * listening state which means this is a SYN-ACK packet. In
5289 * this particular case the correct security label is assigned
5290 * to the connection/request_sock but unfortunately we can't
5291 * query the request_sock as it isn't queued on the parent
5292 * socket until after the SYN-ACK packet is sent; the only
5293 * viable choice is to regenerate the label like we do in
5294 * selinux_inet_conn_request(). See also selinux_ip_output()
5295 * for similar problems. */
5297 struct sk_security_struct *sksec;
5299 sksec = sk->sk_security;
5300 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5302 /* At this point, if the returned skb peerlbl is SECSID_NULL
5303 * and the packet has been through at least one XFRM
5304 * transformation then we must be dealing with the "final"
5305 * form of labeled IPsec packet; since we've already applied
5306 * all of our access controls on this packet we can safely
5307 * pass the packet. */
5308 if (skb_sid == SECSID_NULL) {
5311 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5315 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5319 return NF_DROP_ERR(-ECONNREFUSED);
5322 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5324 secmark_perm = PACKET__SEND;
5326 /* Locally generated packet, fetch the security label from the
5327 * associated socket. */
5328 struct sk_security_struct *sksec = sk->sk_security;
5329 peer_sid = sksec->sid;
5330 secmark_perm = PACKET__SEND;
5333 ad.type = LSM_AUDIT_DATA_NET;
5335 ad.u.net->netif = ifindex;
5336 ad.u.net->family = family;
5337 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5341 if (avc_has_perm(peer_sid, skb->secmark,
5342 SECCLASS_PACKET, secmark_perm, &ad))
5343 return NF_DROP_ERR(-ECONNREFUSED);
5345 if (peerlbl_active) {
5349 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5351 if (avc_has_perm(peer_sid, if_sid,
5352 SECCLASS_NETIF, NETIF__EGRESS, &ad))
5353 return NF_DROP_ERR(-ECONNREFUSED);
5355 if (sel_netnode_sid(addrp, family, &node_sid))
5357 if (avc_has_perm(peer_sid, node_sid,
5358 SECCLASS_NODE, NODE__SENDTO, &ad))
5359 return NF_DROP_ERR(-ECONNREFUSED);
5365 static unsigned int selinux_ipv4_postroute(void *priv,
5366 struct sk_buff *skb,
5367 const struct nf_hook_state *state)
5369 return selinux_ip_postroute(skb, state->out, PF_INET);
5372 #if IS_ENABLED(CONFIG_IPV6)
5373 static unsigned int selinux_ipv6_postroute(void *priv,
5374 struct sk_buff *skb,
5375 const struct nf_hook_state *state)
5377 return selinux_ip_postroute(skb, state->out, PF_INET6);
5381 #endif /* CONFIG_NETFILTER */
5383 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5385 return selinux_nlmsg_perm(sk, skb);
5388 static int ipc_alloc_security(struct kern_ipc_perm *perm,
5391 struct ipc_security_struct *isec;
5393 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5397 isec->sclass = sclass;
5398 isec->sid = current_sid();
5399 perm->security = isec;
5404 static void ipc_free_security(struct kern_ipc_perm *perm)
5406 struct ipc_security_struct *isec = perm->security;
5407 perm->security = NULL;
5411 static int msg_msg_alloc_security(struct msg_msg *msg)
5413 struct msg_security_struct *msec;
5415 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5419 msec->sid = SECINITSID_UNLABELED;
5420 msg->security = msec;
5425 static void msg_msg_free_security(struct msg_msg *msg)
5427 struct msg_security_struct *msec = msg->security;
5429 msg->security = NULL;
5433 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5436 struct ipc_security_struct *isec;
5437 struct common_audit_data ad;
5438 u32 sid = current_sid();
5440 isec = ipc_perms->security;
5442 ad.type = LSM_AUDIT_DATA_IPC;
5443 ad.u.ipc_id = ipc_perms->key;
5445 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5448 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5450 return msg_msg_alloc_security(msg);
5453 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5455 msg_msg_free_security(msg);
5458 /* message queue security operations */
5459 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5461 struct ipc_security_struct *isec;
5462 struct common_audit_data ad;
5463 u32 sid = current_sid();
5466 rc = ipc_alloc_security(&msq->q_perm, SECCLASS_MSGQ);
5470 isec = msq->q_perm.security;
5472 ad.type = LSM_AUDIT_DATA_IPC;
5473 ad.u.ipc_id = msq->q_perm.key;
5475 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5478 ipc_free_security(&msq->q_perm);
5484 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5486 ipc_free_security(&msq->q_perm);
5489 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5491 struct ipc_security_struct *isec;
5492 struct common_audit_data ad;
5493 u32 sid = current_sid();
5495 isec = msq->q_perm.security;
5497 ad.type = LSM_AUDIT_DATA_IPC;
5498 ad.u.ipc_id = msq->q_perm.key;
5500 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5501 MSGQ__ASSOCIATE, &ad);
5504 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5512 /* No specific object, just general system-wide information. */
5513 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5514 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5517 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5520 perms = MSGQ__SETATTR;
5523 perms = MSGQ__DESTROY;
5529 err = ipc_has_perm(&msq->q_perm, perms);
5533 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5535 struct ipc_security_struct *isec;
5536 struct msg_security_struct *msec;
5537 struct common_audit_data ad;
5538 u32 sid = current_sid();
5541 isec = msq->q_perm.security;
5542 msec = msg->security;
5545 * First time through, need to assign label to the message
5547 if (msec->sid == SECINITSID_UNLABELED) {
5549 * Compute new sid based on current process and
5550 * message queue this message will be stored in
5552 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5558 ad.type = LSM_AUDIT_DATA_IPC;
5559 ad.u.ipc_id = msq->q_perm.key;
5561 /* Can this process write to the queue? */
5562 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5565 /* Can this process send the message */
5566 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5569 /* Can the message be put in the queue? */
5570 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5571 MSGQ__ENQUEUE, &ad);
5576 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5577 struct task_struct *target,
5578 long type, int mode)
5580 struct ipc_security_struct *isec;
5581 struct msg_security_struct *msec;
5582 struct common_audit_data ad;
5583 u32 sid = task_sid(target);
5586 isec = msq->q_perm.security;
5587 msec = msg->security;
5589 ad.type = LSM_AUDIT_DATA_IPC;
5590 ad.u.ipc_id = msq->q_perm.key;
5592 rc = avc_has_perm(sid, isec->sid,
5593 SECCLASS_MSGQ, MSGQ__READ, &ad);
5595 rc = avc_has_perm(sid, msec->sid,
5596 SECCLASS_MSG, MSG__RECEIVE, &ad);
5600 /* Shared Memory security operations */
5601 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5603 struct ipc_security_struct *isec;
5604 struct common_audit_data ad;
5605 u32 sid = current_sid();
5608 rc = ipc_alloc_security(&shp->shm_perm, SECCLASS_SHM);
5612 isec = shp->shm_perm.security;
5614 ad.type = LSM_AUDIT_DATA_IPC;
5615 ad.u.ipc_id = shp->shm_perm.key;
5617 rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5620 ipc_free_security(&shp->shm_perm);
5626 static void selinux_shm_free_security(struct shmid_kernel *shp)
5628 ipc_free_security(&shp->shm_perm);
5631 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5633 struct ipc_security_struct *isec;
5634 struct common_audit_data ad;
5635 u32 sid = current_sid();
5637 isec = shp->shm_perm.security;
5639 ad.type = LSM_AUDIT_DATA_IPC;
5640 ad.u.ipc_id = shp->shm_perm.key;
5642 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5643 SHM__ASSOCIATE, &ad);
5646 /* Note, at this point, shp is locked down */
5647 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5655 /* No specific object, just general system-wide information. */
5656 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5657 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5660 perms = SHM__GETATTR | SHM__ASSOCIATE;
5663 perms = SHM__SETATTR;
5670 perms = SHM__DESTROY;
5676 err = ipc_has_perm(&shp->shm_perm, perms);
5680 static int selinux_shm_shmat(struct shmid_kernel *shp,
5681 char __user *shmaddr, int shmflg)
5685 if (shmflg & SHM_RDONLY)
5688 perms = SHM__READ | SHM__WRITE;
5690 return ipc_has_perm(&shp->shm_perm, perms);
5693 /* Semaphore security operations */
5694 static int selinux_sem_alloc_security(struct sem_array *sma)
5696 struct ipc_security_struct *isec;
5697 struct common_audit_data ad;
5698 u32 sid = current_sid();
5701 rc = ipc_alloc_security(&sma->sem_perm, SECCLASS_SEM);
5705 isec = sma->sem_perm.security;
5707 ad.type = LSM_AUDIT_DATA_IPC;
5708 ad.u.ipc_id = sma->sem_perm.key;
5710 rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5713 ipc_free_security(&sma->sem_perm);
5719 static void selinux_sem_free_security(struct sem_array *sma)
5721 ipc_free_security(&sma->sem_perm);
5724 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5726 struct ipc_security_struct *isec;
5727 struct common_audit_data ad;
5728 u32 sid = current_sid();
5730 isec = sma->sem_perm.security;
5732 ad.type = LSM_AUDIT_DATA_IPC;
5733 ad.u.ipc_id = sma->sem_perm.key;
5735 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5736 SEM__ASSOCIATE, &ad);
5739 /* Note, at this point, sma is locked down */
5740 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5748 /* No specific object, just general system-wide information. */
5749 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
5750 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5754 perms = SEM__GETATTR;
5765 perms = SEM__DESTROY;
5768 perms = SEM__SETATTR;
5772 perms = SEM__GETATTR | SEM__ASSOCIATE;
5778 err = ipc_has_perm(&sma->sem_perm, perms);
5782 static int selinux_sem_semop(struct sem_array *sma,
5783 struct sembuf *sops, unsigned nsops, int alter)
5788 perms = SEM__READ | SEM__WRITE;
5792 return ipc_has_perm(&sma->sem_perm, perms);
5795 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5801 av |= IPC__UNIX_READ;
5803 av |= IPC__UNIX_WRITE;
5808 return ipc_has_perm(ipcp, av);
5811 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5813 struct ipc_security_struct *isec = ipcp->security;
5817 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5820 inode_doinit_with_dentry(inode, dentry);
5823 static int selinux_getprocattr(struct task_struct *p,
5824 char *name, char **value)
5826 const struct task_security_struct *__tsec;
5832 __tsec = __task_cred(p)->security;
5835 error = avc_has_perm(current_sid(), __tsec->sid,
5836 SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
5841 if (!strcmp(name, "current"))
5843 else if (!strcmp(name, "prev"))
5845 else if (!strcmp(name, "exec"))
5846 sid = __tsec->exec_sid;
5847 else if (!strcmp(name, "fscreate"))
5848 sid = __tsec->create_sid;
5849 else if (!strcmp(name, "keycreate"))
5850 sid = __tsec->keycreate_sid;
5851 else if (!strcmp(name, "sockcreate"))
5852 sid = __tsec->sockcreate_sid;
5862 error = security_sid_to_context(sid, value, &len);
5872 static int selinux_setprocattr(const char *name, void *value, size_t size)
5874 struct task_security_struct *tsec;
5876 u32 mysid = current_sid(), sid = 0, ptsid;
5881 * Basic control over ability to set these attributes at all.
5883 if (!strcmp(name, "exec"))
5884 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5885 PROCESS__SETEXEC, NULL);
5886 else if (!strcmp(name, "fscreate"))
5887 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5888 PROCESS__SETFSCREATE, NULL);
5889 else if (!strcmp(name, "keycreate"))
5890 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5891 PROCESS__SETKEYCREATE, NULL);
5892 else if (!strcmp(name, "sockcreate"))
5893 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5894 PROCESS__SETSOCKCREATE, NULL);
5895 else if (!strcmp(name, "current"))
5896 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
5897 PROCESS__SETCURRENT, NULL);
5903 /* Obtain a SID for the context, if one was specified. */
5904 if (size && str[0] && str[0] != '\n') {
5905 if (str[size-1] == '\n') {
5909 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5910 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5911 if (!capable(CAP_MAC_ADMIN)) {
5912 struct audit_buffer *ab;
5915 /* We strip a nul only if it is at the end, otherwise the
5916 * context contains a nul and we should audit that */
5917 if (str[size - 1] == '\0')
5918 audit_size = size - 1;
5921 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5922 audit_log_format(ab, "op=fscreate invalid_context=");
5923 audit_log_n_untrustedstring(ab, value, audit_size);
5928 error = security_context_to_sid_force(value, size,
5935 new = prepare_creds();
5939 /* Permission checking based on the specified context is
5940 performed during the actual operation (execve,
5941 open/mkdir/...), when we know the full context of the
5942 operation. See selinux_bprm_set_creds for the execve
5943 checks and may_create for the file creation checks. The
5944 operation will then fail if the context is not permitted. */
5945 tsec = new->security;
5946 if (!strcmp(name, "exec")) {
5947 tsec->exec_sid = sid;
5948 } else if (!strcmp(name, "fscreate")) {
5949 tsec->create_sid = sid;
5950 } else if (!strcmp(name, "keycreate")) {
5951 error = avc_has_perm(mysid, sid, SECCLASS_KEY, KEY__CREATE,
5955 tsec->keycreate_sid = sid;
5956 } else if (!strcmp(name, "sockcreate")) {
5957 tsec->sockcreate_sid = sid;
5958 } else if (!strcmp(name, "current")) {
5963 /* Only allow single threaded processes to change context */
5965 if (!current_is_single_threaded()) {
5966 error = security_bounded_transition(tsec->sid, sid);
5971 /* Check permissions for the transition. */
5972 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5973 PROCESS__DYNTRANSITION, NULL);
5977 /* Check for ptracing, and update the task SID if ok.
5978 Otherwise, leave SID unchanged and fail. */
5979 ptsid = ptrace_parent_sid();
5981 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5982 PROCESS__PTRACE, NULL);
6001 static int selinux_ismaclabel(const char *name)
6003 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6006 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6008 return security_sid_to_context(secid, secdata, seclen);
6011 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6013 return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
6016 static void selinux_release_secctx(char *secdata, u32 seclen)
6021 static void selinux_inode_invalidate_secctx(struct inode *inode)
6023 struct inode_security_struct *isec = inode->i_security;
6025 spin_lock(&isec->lock);
6026 isec->initialized = LABEL_INVALID;
6027 spin_unlock(&isec->lock);
6031 * called with inode->i_mutex locked
6033 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6035 return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
6039 * called with inode->i_mutex locked
6041 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6043 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6046 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6049 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6058 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6059 unsigned long flags)
6061 const struct task_security_struct *tsec;
6062 struct key_security_struct *ksec;
6064 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6068 tsec = cred->security;
6069 if (tsec->keycreate_sid)
6070 ksec->sid = tsec->keycreate_sid;
6072 ksec->sid = tsec->sid;
6078 static void selinux_key_free(struct key *k)
6080 struct key_security_struct *ksec = k->security;
6086 static int selinux_key_permission(key_ref_t key_ref,
6087 const struct cred *cred,
6091 struct key_security_struct *ksec;
6094 /* if no specific permissions are requested, we skip the
6095 permission check. No serious, additional covert channels
6096 appear to be created. */
6100 sid = cred_sid(cred);
6102 key = key_ref_to_ptr(key_ref);
6103 ksec = key->security;
6105 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6108 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6110 struct key_security_struct *ksec = key->security;
6111 char *context = NULL;
6115 rc = security_sid_to_context(ksec->sid, &context, &len);
6124 static struct security_hook_list selinux_hooks[] = {
6125 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6126 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6127 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6128 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6130 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6131 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6132 LSM_HOOK_INIT(capget, selinux_capget),
6133 LSM_HOOK_INIT(capset, selinux_capset),
6134 LSM_HOOK_INIT(capable, selinux_capable),
6135 LSM_HOOK_INIT(quotactl, selinux_quotactl),
6136 LSM_HOOK_INIT(quota_on, selinux_quota_on),
6137 LSM_HOOK_INIT(syslog, selinux_syslog),
6138 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6140 LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6142 LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6143 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6144 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6145 LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
6147 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6148 LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6149 LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
6150 LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6151 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6152 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6153 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6154 LSM_HOOK_INIT(sb_mount, selinux_mount),
6155 LSM_HOOK_INIT(sb_umount, selinux_umount),
6156 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6157 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6158 LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
6160 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6161 LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
6163 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6164 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6165 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6166 LSM_HOOK_INIT(inode_create, selinux_inode_create),
6167 LSM_HOOK_INIT(inode_link, selinux_inode_link),
6168 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6169 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6170 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6171 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6172 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6173 LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6174 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6175 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6176 LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6177 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6178 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6179 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6180 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6181 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6182 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6183 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6184 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6185 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6186 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6187 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
6188 LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
6189 LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
6191 LSM_HOOK_INIT(file_permission, selinux_file_permission),
6192 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6193 LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
6194 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6195 LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6196 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6197 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6198 LSM_HOOK_INIT(file_lock, selinux_file_lock),
6199 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6200 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6201 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6202 LSM_HOOK_INIT(file_receive, selinux_file_receive),
6204 LSM_HOOK_INIT(file_open, selinux_file_open),
6206 LSM_HOOK_INIT(task_create, selinux_task_create),
6207 LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
6208 LSM_HOOK_INIT(cred_free, selinux_cred_free),
6209 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6210 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6211 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6212 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6213 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
6214 LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
6215 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6216 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6217 LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6218 LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6219 LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6220 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6221 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
6222 LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
6223 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6224 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6225 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6226 LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6227 LSM_HOOK_INIT(task_kill, selinux_task_kill),
6228 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
6230 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6231 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
6233 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6234 LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
6236 LSM_HOOK_INIT(msg_queue_alloc_security,
6237 selinux_msg_queue_alloc_security),
6238 LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6239 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6240 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6241 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6242 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
6244 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6245 LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6246 LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6247 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6248 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6250 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6251 LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6252 LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6253 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6254 LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6256 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
6258 LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6259 LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
6261 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6262 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6263 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6264 LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6265 LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
6266 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6267 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6268 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6270 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6271 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6273 LSM_HOOK_INIT(socket_create, selinux_socket_create),
6274 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6275 LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6276 LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6277 LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6278 LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6279 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6280 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6281 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6282 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6283 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6284 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6285 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6286 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6287 LSM_HOOK_INIT(socket_getpeersec_stream,
6288 selinux_socket_getpeersec_stream),
6289 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6290 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6291 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6292 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6293 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6294 LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6295 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6296 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6297 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6298 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6299 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6300 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6301 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6302 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6303 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6304 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6305 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6306 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6307 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6309 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6310 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6311 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6312 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6313 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6314 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6315 LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6316 selinux_xfrm_state_alloc_acquire),
6317 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6318 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6319 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6320 LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6321 selinux_xfrm_state_pol_flow_match),
6322 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6326 LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6327 LSM_HOOK_INIT(key_free, selinux_key_free),
6328 LSM_HOOK_INIT(key_permission, selinux_key_permission),
6329 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6333 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6334 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6335 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6336 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6340 static __init int selinux_init(void)
6342 if (!security_module_enable("selinux")) {
6343 selinux_enabled = 0;
6347 if (!selinux_enabled) {
6348 printk(KERN_INFO "SELinux: Disabled at boot.\n");
6352 printk(KERN_INFO "SELinux: Initializing.\n");
6354 /* Set the security state for the initial task. */
6355 cred_init_security();
6357 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6359 sel_inode_cache = kmem_cache_create("selinux_inode_security",
6360 sizeof(struct inode_security_struct),
6361 0, SLAB_PANIC, NULL);
6362 file_security_cache = kmem_cache_create("selinux_file_security",
6363 sizeof(struct file_security_struct),
6364 0, SLAB_PANIC, NULL);
6367 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
6369 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6370 panic("SELinux: Unable to register AVC netcache callback\n");
6372 if (selinux_enforcing)
6373 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
6375 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
6380 static void delayed_superblock_init(struct super_block *sb, void *unused)
6382 superblock_doinit(sb, NULL);
6385 void selinux_complete_init(void)
6387 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
6389 /* Set up any superblocks initialized prior to the policy load. */
6390 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
6391 iterate_supers(delayed_superblock_init, NULL);
6394 /* SELinux requires early initialization in order to label
6395 all processes and objects when they are created. */
6396 security_initcall(selinux_init);
6398 #if defined(CONFIG_NETFILTER)
6400 static struct nf_hook_ops selinux_nf_ops[] = {
6402 .hook = selinux_ipv4_postroute,
6404 .hooknum = NF_INET_POST_ROUTING,
6405 .priority = NF_IP_PRI_SELINUX_LAST,
6408 .hook = selinux_ipv4_forward,
6410 .hooknum = NF_INET_FORWARD,
6411 .priority = NF_IP_PRI_SELINUX_FIRST,
6414 .hook = selinux_ipv4_output,
6416 .hooknum = NF_INET_LOCAL_OUT,
6417 .priority = NF_IP_PRI_SELINUX_FIRST,
6419 #if IS_ENABLED(CONFIG_IPV6)
6421 .hook = selinux_ipv6_postroute,
6423 .hooknum = NF_INET_POST_ROUTING,
6424 .priority = NF_IP6_PRI_SELINUX_LAST,
6427 .hook = selinux_ipv6_forward,
6429 .hooknum = NF_INET_FORWARD,
6430 .priority = NF_IP6_PRI_SELINUX_FIRST,
6433 .hook = selinux_ipv6_output,
6435 .hooknum = NF_INET_LOCAL_OUT,
6436 .priority = NF_IP6_PRI_SELINUX_FIRST,
6441 static int __init selinux_nf_ip_init(void)
6445 if (!selinux_enabled)
6448 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
6450 err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6452 panic("SELinux: nf_register_hooks: error %d\n", err);
6457 __initcall(selinux_nf_ip_init);
6459 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6460 static void selinux_nf_ip_exit(void)
6462 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
6464 nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6468 #else /* CONFIG_NETFILTER */
6470 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6471 #define selinux_nf_ip_exit()
6474 #endif /* CONFIG_NETFILTER */
6476 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6477 static int selinux_disabled;
6479 int selinux_disable(void)
6481 if (ss_initialized) {
6482 /* Not permitted after initial policy load. */
6486 if (selinux_disabled) {
6487 /* Only do this once. */
6491 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
6493 selinux_disabled = 1;
6494 selinux_enabled = 0;
6496 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6498 /* Try to destroy the avc node cache */
6501 /* Unregister netfilter hooks. */
6502 selinux_nf_ip_exit();
6504 /* Unregister selinuxfs. */