]> bbs.cooldavid.org Git - net-next-2.6.git/blame - security/selinux/hooks.c
git://bbs.cooldavid.org / net-next-2.6.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
[PATCH] node hotplug: register cpu: remove node struct
[net-next-2.6.git] / security / selinux / hooks.c
CommitLineData
1da177e4
LT		 1/*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
15 *
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License version 2,
18 * as published by the Free Software Foundation.
19 */
20
21#include <linux/config.h>
22#include <linux/module.h>
23#include <linux/init.h>
24#include <linux/kernel.h>
25#include <linux/ptrace.h>
26#include <linux/errno.h>
27#include <linux/sched.h>
28#include <linux/security.h>
29#include <linux/xattr.h>
30#include <linux/capability.h>
31#include <linux/unistd.h>
32#include <linux/mm.h>
33#include <linux/mman.h>
34#include <linux/slab.h>
35#include <linux/pagemap.h>
36#include <linux/swap.h>
37#include <linux/smp_lock.h>
38#include <linux/spinlock.h>
39#include <linux/syscalls.h>
40#include <linux/file.h>
41#include <linux/namei.h>
42#include <linux/mount.h>
43#include <linux/ext2_fs.h>
44#include <linux/proc_fs.h>
45#include <linux/kd.h>
46#include <linux/netfilter_ipv4.h>
47#include <linux/netfilter_ipv6.h>
48#include <linux/tty.h>
49#include <net/icmp.h>
50#include <net/ip.h> /* for sysctl_local_port_range[] */
51#include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
52#include <asm/uaccess.h>
53#include <asm/semaphore.h>
54#include <asm/ioctls.h>
55#include <linux/bitops.h>
56#include <linux/interrupt.h>
57#include <linux/netdevice.h> /* for network interface checks */
58#include <linux/netlink.h>
59#include <linux/tcp.h>
60#include <linux/udp.h>
61#include <linux/quota.h>
62#include <linux/un.h> /* for Unix socket types */
63#include <net/af_unix.h> /* for Unix socket types */
64#include <linux/parser.h>
65#include <linux/nfs_mount.h>
66#include <net/ipv6.h>
67#include <linux/hugetlb.h>
68#include <linux/personality.h>
69#include <linux/sysctl.h>
70#include <linux/audit.h>
6931dfc9 71#include <linux/string.h>
1da177e4
LT		 72
73#include "avc.h"
74#include "objsec.h"
75#include "netif.h"
d28d1e08 76#include "xfrm.h"
1da177e4
LT		 77
78#define XATTR_SELINUX_SUFFIX "selinux"
79#define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
80
81extern unsigned int policydb_loaded_version;
82extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
4e5ab4cb 83extern int selinux_compat_net;
1da177e4
LT		 84
85#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
86int selinux_enforcing = 0;
87
88static int __init enforcing_setup(char *str)
89{
90 selinux_enforcing = simple_strtol(str,NULL,0);
91 return 1;
92}
93__setup("enforcing=", enforcing_setup);
94#endif
95
96#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
97int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
98
99static int __init selinux_enabled_setup(char *str)
100{
101 selinux_enabled = simple_strtol(str, NULL, 0);
102 return 1;
103}
104__setup("selinux=", selinux_enabled_setup);
30d55280
SS		 105#else
106int selinux_enabled = 1;
1da177e4
LT		 107#endif
108
109/* Original (dummy) security module. */
110static struct security_operations *original_ops = NULL;
111
112/* Minimal support for a secondary security module,
113 just to allow the use of the dummy or capability modules.
114 The owlsm module can alternatively be used as a secondary
115 module as long as CONFIG_OWLSM_FD is not enabled. */
116static struct security_operations *secondary_ops = NULL;
117
118/* Lists of inode and superblock security structures initialized
119 before the policy was loaded. */
120static LIST_HEAD(superblock_security_head);
121static DEFINE_SPINLOCK(sb_security_lock);
122
7cae7e26
JM		 123static kmem_cache_t *sel_inode_cache;
124
8c8570fb
DK		 125/* Return security context for a given sid or just the context
126 length if the buffer is null or length is 0 */
127static int selinux_getsecurity(u32 sid, void *buffer, size_t size)
128{
129 char *context;
130 unsigned len;
131 int rc;
132
133 rc = security_sid_to_context(sid, &context, &len);
134 if (rc)
135 return rc;
136
137 if (!buffer || !size)
138 goto getsecurity_exit;
139
140 if (size < len) {
141 len = -ERANGE;
142 goto getsecurity_exit;
143 }
144 memcpy(buffer, context, len);
145
146getsecurity_exit:
147 kfree(context);
148 return len;
149}
150
1da177e4
LT		 151/* Allocate and free functions for each kind of security blob. */
152
153static int task_alloc_security(struct task_struct *task)
154{
155 struct task_security_struct *tsec;
156
89d155ef 157 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
1da177e4
LT		 158 if (!tsec)
159 return -ENOMEM;
160
1da177e4
LT		 161 tsec->task = task;
162 tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
163 task->security = tsec;
164
165 return 0;
166}
167
168static void task_free_security(struct task_struct *task)
169{
170 struct task_security_struct *tsec = task->security;
1da177e4
LT		 171 task->security = NULL;
172 kfree(tsec);
173}
174
175static int inode_alloc_security(struct inode *inode)
176{
177 struct task_security_struct *tsec = current->security;
178 struct inode_security_struct *isec;
179
7cae7e26 180 isec = kmem_cache_alloc(sel_inode_cache, SLAB_KERNEL);
1da177e4
LT		 181 if (!isec)
182 return -ENOMEM;
183
7cae7e26 184 memset(isec, 0, sizeof(*isec));
1da177e4
LT		 185 init_MUTEX(&isec->sem);
186 INIT_LIST_HEAD(&isec->list);
1da177e4
LT		 187 isec->inode = inode;
188 isec->sid = SECINITSID_UNLABELED;
189 isec->sclass = SECCLASS_FILE;
9ac49d22 190 isec->task_sid = tsec->sid;
1da177e4
LT		 191 inode->i_security = isec;
192
193 return 0;
194}
195
196static void inode_free_security(struct inode *inode)
197{
198 struct inode_security_struct *isec = inode->i_security;
199 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
200
1da177e4
LT		 201 spin_lock(&sbsec->isec_lock);
202 if (!list_empty(&isec->list))
203 list_del_init(&isec->list);
204 spin_unlock(&sbsec->isec_lock);
205
206 inode->i_security = NULL;
7cae7e26 207 kmem_cache_free(sel_inode_cache, isec);
1da177e4
LT		 208}
209
210static int file_alloc_security(struct file *file)
211{
212 struct task_security_struct *tsec = current->security;
213 struct file_security_struct *fsec;
214
26d2a4be 215 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
1da177e4
LT		 216 if (!fsec)
217 return -ENOMEM;
218
1da177e4 219 fsec->file = file;
9ac49d22
SS		 220 fsec->sid = tsec->sid;
221 fsec->fown_sid = tsec->sid;
1da177e4
LT		 222 file->f_security = fsec;
223
224 return 0;
225}
226
227static void file_free_security(struct file *file)
228{
229 struct file_security_struct *fsec = file->f_security;
1da177e4
LT		 230 file->f_security = NULL;
231 kfree(fsec);
232}
233
234static int superblock_alloc_security(struct super_block *sb)
235{
236 struct superblock_security_struct *sbsec;
237
89d155ef 238 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
1da177e4
LT		 239 if (!sbsec)
240 return -ENOMEM;
241
1da177e4
LT		 242 init_MUTEX(&sbsec->sem);
243 INIT_LIST_HEAD(&sbsec->list);
244 INIT_LIST_HEAD(&sbsec->isec_head);
245 spin_lock_init(&sbsec->isec_lock);
1da177e4
LT		 246 sbsec->sb = sb;
247 sbsec->sid = SECINITSID_UNLABELED;
248 sbsec->def_sid = SECINITSID_FILE;
249 sb->s_security = sbsec;
250
251 return 0;
252}
253
254static void superblock_free_security(struct super_block *sb)
255{
256 struct superblock_security_struct *sbsec = sb->s_security;
257
1da177e4
LT		 258 spin_lock(&sb_security_lock);
259 if (!list_empty(&sbsec->list))
260 list_del_init(&sbsec->list);
261 spin_unlock(&sb_security_lock);
262
263 sb->s_security = NULL;
264 kfree(sbsec);
265}
266
7d877f3b 267static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
1da177e4
LT		 268{
269 struct sk_security_struct *ssec;
270
271 if (family != PF_UNIX)
272 return 0;
273
89d155ef 274 ssec = kzalloc(sizeof(*ssec), priority);
1da177e4
LT		 275 if (!ssec)
276 return -ENOMEM;
277
1da177e4
LT		 278 ssec->sk = sk;
279 ssec->peer_sid = SECINITSID_UNLABELED;
280 sk->sk_security = ssec;
281
282 return 0;
283}
284
285static void sk_free_security(struct sock *sk)
286{
287 struct sk_security_struct *ssec = sk->sk_security;
288
9ac49d22 289 if (sk->sk_family != PF_UNIX)
1da177e4
LT		 290 return;
291
292 sk->sk_security = NULL;
293 kfree(ssec);
294}
1da177e4
LT		 295
296/* The security server must be initialized before
297 any labeling or access decisions can be provided. */
298extern int ss_initialized;
299
300/* The file system's label must be initialized prior to use. */
301
302static char *labeling_behaviors[6] = {
303 "uses xattr",
304 "uses transition SIDs",
305 "uses task SIDs",
306 "uses genfs_contexts",
307 "not configured for labeling",
308 "uses mountpoint labeling",
309};
310
311static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
312
313static inline int inode_doinit(struct inode *inode)
314{
315 return inode_doinit_with_dentry(inode, NULL);
316}
317
318enum {
319 Opt_context = 1,
320 Opt_fscontext = 2,
321 Opt_defcontext = 4,
322};
323
324static match_table_t tokens = {
325 {Opt_context, "context=%s"},
326 {Opt_fscontext, "fscontext=%s"},
327 {Opt_defcontext, "defcontext=%s"},
328};
329
330#define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
331
332static int try_context_mount(struct super_block *sb, void *data)
333{
334 char *context = NULL, *defcontext = NULL;
335 const char *name;
336 u32 sid;
337 int alloc = 0, rc = 0, seen = 0;
338 struct task_security_struct *tsec = current->security;
339 struct superblock_security_struct *sbsec = sb->s_security;
340
341 if (!data)
342 goto out;
343
344 name = sb->s_type->name;
345
346 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
347
348 /* NFS we understand. */
349 if (!strcmp(name, "nfs")) {
350 struct nfs_mount_data *d = data;
351
352 if (d->version < NFS_MOUNT_VERSION)
353 goto out;
354
355 if (d->context[0]) {
356 context = d->context;
357 seen |= Opt_context;
358 }
359 } else
360 goto out;
361
362 } else {
363 /* Standard string-based options. */
364 char *p, *options = data;
365
366 while ((p = strsep(&options, ",")) != NULL) {
367 int token;
368 substring_t args[MAX_OPT_ARGS];
369
370 if (!*p)
371 continue;
372
373 token = match_token(p, tokens, args);
374
375 switch (token) {
376 case Opt_context:
377 if (seen) {
378 rc = -EINVAL;
379 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
380 goto out_free;
381 }
382 context = match_strdup(&args[0]);
383 if (!context) {
384 rc = -ENOMEM;
385 goto out_free;
386 }
387 if (!alloc)
388 alloc = 1;
389 seen |= Opt_context;
390 break;
391
392 case Opt_fscontext:
393 if (seen & (Opt_context|Opt_fscontext)) {
394 rc = -EINVAL;
395 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
396 goto out_free;
397 }
398 context = match_strdup(&args[0]);
399 if (!context) {
400 rc = -ENOMEM;
401 goto out_free;
402 }
403 if (!alloc)
404 alloc = 1;
405 seen |= Opt_fscontext;
406 break;
407
408 case Opt_defcontext:
409 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
410 rc = -EINVAL;
411 printk(KERN_WARNING "SELinux: "
412 "defcontext option is invalid "
413 "for this filesystem type\n");
414 goto out_free;
415 }
416 if (seen & (Opt_context|Opt_defcontext)) {
417 rc = -EINVAL;
418 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
419 goto out_free;
420 }
421 defcontext = match_strdup(&args[0]);
422 if (!defcontext) {
423 rc = -ENOMEM;
424 goto out_free;
425 }
426 if (!alloc)
427 alloc = 1;
428 seen |= Opt_defcontext;
429 break;
430
431 default:
432 rc = -EINVAL;
433 printk(KERN_WARNING "SELinux: unknown mount "
434 "option\n");
435 goto out_free;
436
437 }
438 }
439 }
440
441 if (!seen)
442 goto out;
443
444 if (context) {
445 rc = security_context_to_sid(context, strlen(context), &sid);
446 if (rc) {
447 printk(KERN_WARNING "SELinux: security_context_to_sid"
448 "(%s) failed for (dev %s, type %s) errno=%d\n",
449 context, sb->s_id, name, rc);
450 goto out_free;
451 }
452
453 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
454 FILESYSTEM__RELABELFROM, NULL);
455 if (rc)
456 goto out_free;
457
458 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
459 FILESYSTEM__RELABELTO, NULL);
460 if (rc)
461 goto out_free;
462
463 sbsec->sid = sid;
464
465 if (seen & Opt_context)
466 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
467 }
468
469 if (defcontext) {
470 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
471 if (rc) {
472 printk(KERN_WARNING "SELinux: security_context_to_sid"
473 "(%s) failed for (dev %s, type %s) errno=%d\n",
474 defcontext, sb->s_id, name, rc);
475 goto out_free;
476 }
477
478 if (sid == sbsec->def_sid)
479 goto out_free;
480
481 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
482 FILESYSTEM__RELABELFROM, NULL);
483 if (rc)
484 goto out_free;
485
486 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
487 FILESYSTEM__ASSOCIATE, NULL);
488 if (rc)
489 goto out_free;
490
491 sbsec->def_sid = sid;
492 }
493
494out_free:
495 if (alloc) {
496 kfree(context);
497 kfree(defcontext);
498 }
499out:
500 return rc;
501}
502
503static int superblock_doinit(struct super_block *sb, void *data)
504{
505 struct superblock_security_struct *sbsec = sb->s_security;
506 struct dentry *root = sb->s_root;
507 struct inode *inode = root->d_inode;
508 int rc = 0;
509
510 down(&sbsec->sem);
511 if (sbsec->initialized)
512 goto out;
513
514 if (!ss_initialized) {
515 /* Defer initialization until selinux_complete_init,
516 after the initial policy is loaded and the security
517 server is ready to handle calls. */
518 spin_lock(&sb_security_lock);
519 if (list_empty(&sbsec->list))
520 list_add(&sbsec->list, &superblock_security_head);
521 spin_unlock(&sb_security_lock);
522 goto out;
523 }
524
525 /* Determine the labeling behavior to use for this filesystem type. */
526 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
527 if (rc) {
528 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
529 __FUNCTION__, sb->s_type->name, rc);
530 goto out;
531 }
532
533 rc = try_context_mount(sb, data);
534 if (rc)
535 goto out;
536
537 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
538 /* Make sure that the xattr handler exists and that no
539 error other than -ENODATA is returned by getxattr on
540 the root directory. -ENODATA is ok, as this may be
541 the first boot of the SELinux kernel before we have
542 assigned xattr values to the filesystem. */
543 if (!inode->i_op->getxattr) {
544 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
545 "xattr support\n", sb->s_id, sb->s_type->name);
546 rc = -EOPNOTSUPP;
547 goto out;
548 }
549 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
550 if (rc < 0 && rc != -ENODATA) {
551 if (rc == -EOPNOTSUPP)
552 printk(KERN_WARNING "SELinux: (dev %s, type "
553 "%s) has no security xattr handler\n",
554 sb->s_id, sb->s_type->name);
555 else
556 printk(KERN_WARNING "SELinux: (dev %s, type "
557 "%s) getxattr errno %d\n", sb->s_id,
558 sb->s_type->name, -rc);
559 goto out;
560 }
561 }
562
563 if (strcmp(sb->s_type->name, "proc") == 0)
564 sbsec->proc = 1;
565
566 sbsec->initialized = 1;
567
568 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
569 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
570 sb->s_id, sb->s_type->name);
571 }
572 else {
573 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
574 sb->s_id, sb->s_type->name,
575 labeling_behaviors[sbsec->behavior-1]);
576 }
577
578 /* Initialize the root inode. */
579 rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
580
581 /* Initialize any other inodes associated with the superblock, e.g.
582 inodes created prior to initial policy load or inodes created
583 during get_sb by a pseudo filesystem that directly
584 populates itself. */
585 spin_lock(&sbsec->isec_lock);
586next_inode:
587 if (!list_empty(&sbsec->isec_head)) {
588 struct inode_security_struct *isec =
589 list_entry(sbsec->isec_head.next,
590 struct inode_security_struct, list);
591 struct inode *inode = isec->inode;
592 spin_unlock(&sbsec->isec_lock);
593 inode = igrab(inode);
594 if (inode) {
595 if (!IS_PRIVATE (inode))
596 inode_doinit(inode);
597 iput(inode);
598 }
599 spin_lock(&sbsec->isec_lock);
600 list_del_init(&isec->list);
601 goto next_inode;
602 }
603 spin_unlock(&sbsec->isec_lock);
604out:
605 up(&sbsec->sem);
606 return rc;
607}
608
609static inline u16 inode_mode_to_security_class(umode_t mode)
610{
611 switch (mode & S_IFMT) {
612 case S_IFSOCK:
613 return SECCLASS_SOCK_FILE;
614 case S_IFLNK:
615 return SECCLASS_LNK_FILE;
616 case S_IFREG:
617 return SECCLASS_FILE;
618 case S_IFBLK:
619 return SECCLASS_BLK_FILE;
620 case S_IFDIR:
621 return SECCLASS_DIR;
622 case S_IFCHR:
623 return SECCLASS_CHR_FILE;
624 case S_IFIFO:
625 return SECCLASS_FIFO_FILE;
626
627 }
628
629 return SECCLASS_FILE;
630}
631
13402580
JM		 632static inline int default_protocol_stream(int protocol)
633{
634 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
635}
636
637static inline int default_protocol_dgram(int protocol)
638{
639 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
640}
641
1da177e4
LT		 642static inline u16 socket_type_to_security_class(int family, int type, int protocol)
643{
644 switch (family) {
645 case PF_UNIX:
646 switch (type) {
647 case SOCK_STREAM:
648 case SOCK_SEQPACKET:
649 return SECCLASS_UNIX_STREAM_SOCKET;
650 case SOCK_DGRAM:
651 return SECCLASS_UNIX_DGRAM_SOCKET;
652 }
653 break;
654 case PF_INET:
655 case PF_INET6:
656 switch (type) {
657 case SOCK_STREAM:
13402580
JM		 658 if (default_protocol_stream(protocol))
659 return SECCLASS_TCP_SOCKET;
660 else
661 return SECCLASS_RAWIP_SOCKET;
1da177e4 662 case SOCK_DGRAM:
13402580
JM		 663 if (default_protocol_dgram(protocol))
664 return SECCLASS_UDP_SOCKET;
665 else
666 return SECCLASS_RAWIP_SOCKET;
667 default:
1da177e4
LT		 668 return SECCLASS_RAWIP_SOCKET;
669 }
670 break;
671 case PF_NETLINK:
672 switch (protocol) {
673 case NETLINK_ROUTE:
674 return SECCLASS_NETLINK_ROUTE_SOCKET;
675 case NETLINK_FIREWALL:
676 return SECCLASS_NETLINK_FIREWALL_SOCKET;
216efaaa 677 case NETLINK_INET_DIAG:
1da177e4
LT		 678 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
679 case NETLINK_NFLOG:
680 return SECCLASS_NETLINK_NFLOG_SOCKET;
681 case NETLINK_XFRM:
682 return SECCLASS_NETLINK_XFRM_SOCKET;
683 case NETLINK_SELINUX:
684 return SECCLASS_NETLINK_SELINUX_SOCKET;
685 case NETLINK_AUDIT:
686 return SECCLASS_NETLINK_AUDIT_SOCKET;
687 case NETLINK_IP6_FW:
688 return SECCLASS_NETLINK_IP6FW_SOCKET;
689 case NETLINK_DNRTMSG:
690 return SECCLASS_NETLINK_DNRT_SOCKET;
0c9b7942
JM		 691 case NETLINK_KOBJECT_UEVENT:
692 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1da177e4
LT		 693 default:
694 return SECCLASS_NETLINK_SOCKET;
695 }
696 case PF_PACKET:
697 return SECCLASS_PACKET_SOCKET;
698 case PF_KEY:
699 return SECCLASS_KEY_SOCKET;
3e3ff15e
CP		 700 case PF_APPLETALK:
701 return SECCLASS_APPLETALK_SOCKET;
1da177e4
LT		 702 }
703
704 return SECCLASS_SOCKET;
705}
706
707#ifdef CONFIG_PROC_FS
708static int selinux_proc_get_sid(struct proc_dir_entry *de,
709 u16 tclass,
710 u32 *sid)
711{
712 int buflen, rc;
713 char *buffer, *path, *end;
714
715 buffer = (char*)__get_free_page(GFP_KERNEL);
716 if (!buffer)
717 return -ENOMEM;
718
719 buflen = PAGE_SIZE;
720 end = buffer+buflen;
721 *--end = '\0';
722 buflen--;
723 path = end-1;
724 *path = '/';
725 while (de && de != de->parent) {
726 buflen -= de->namelen + 1;
727 if (buflen < 0)
728 break;
729 end -= de->namelen;
730 memcpy(end, de->name, de->namelen);
731 *--end = '/';
732 path = end;
733 de = de->parent;
734 }
735 rc = security_genfs_sid("proc", path, tclass, sid);
736 free_page((unsigned long)buffer);
737 return rc;
738}
739#else
740static int selinux_proc_get_sid(struct proc_dir_entry *de,
741 u16 tclass,
742 u32 *sid)
743{
744 return -EINVAL;
745}
746#endif
747
748/* The inode's security attributes must be initialized before first use. */
749static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
750{
751 struct superblock_security_struct *sbsec = NULL;
752 struct inode_security_struct *isec = inode->i_security;
753 u32 sid;
754 struct dentry *dentry;
755#define INITCONTEXTLEN 255
756 char *context = NULL;
757 unsigned len = 0;
758 int rc = 0;
759 int hold_sem = 0;
760
761 if (isec->initialized)
762 goto out;
763
764 down(&isec->sem);
765 hold_sem = 1;
766 if (isec->initialized)
767 goto out;
768
769 sbsec = inode->i_sb->s_security;
770 if (!sbsec->initialized) {
771 /* Defer initialization until selinux_complete_init,
772 after the initial policy is loaded and the security
773 server is ready to handle calls. */
774 spin_lock(&sbsec->isec_lock);
775 if (list_empty(&isec->list))
776 list_add(&isec->list, &sbsec->isec_head);
777 spin_unlock(&sbsec->isec_lock);
778 goto out;
779 }
780
781 switch (sbsec->behavior) {
782 case SECURITY_FS_USE_XATTR:
783 if (!inode->i_op->getxattr) {
784 isec->sid = sbsec->def_sid;
785 break;
786 }
787
788 /* Need a dentry, since the xattr API requires one.
789 Life would be simpler if we could just pass the inode. */
790 if (opt_dentry) {
791 /* Called from d_instantiate or d_splice_alias. */
792 dentry = dget(opt_dentry);
793 } else {
794 /* Called from selinux_complete_init, try to find a dentry. */
795 dentry = d_find_alias(inode);
796 }
797 if (!dentry) {
798 printk(KERN_WARNING "%s: no dentry for dev=%s "
799 "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
800 inode->i_ino);
801 goto out;
802 }
803
804 len = INITCONTEXTLEN;
805 context = kmalloc(len, GFP_KERNEL);
806 if (!context) {
807 rc = -ENOMEM;
808 dput(dentry);
809 goto out;
810 }
811 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
812 context, len);
813 if (rc == -ERANGE) {
814 /* Need a larger buffer. Query for the right size. */
815 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
816 NULL, 0);
817 if (rc < 0) {
818 dput(dentry);
819 goto out;
820 }
821 kfree(context);
822 len = rc;
823 context = kmalloc(len, GFP_KERNEL);
824 if (!context) {
825 rc = -ENOMEM;
826 dput(dentry);
827 goto out;
828 }
829 rc = inode->i_op->getxattr(dentry,
830 XATTR_NAME_SELINUX,
831 context, len);
832 }
833 dput(dentry);
834 if (rc < 0) {
835 if (rc != -ENODATA) {
836 printk(KERN_WARNING "%s: getxattr returned "
837 "%d for dev=%s ino=%ld\n", __FUNCTION__,
838 -rc, inode->i_sb->s_id, inode->i_ino);
839 kfree(context);
840 goto out;
841 }
842 /* Map ENODATA to the default file SID */
843 sid = sbsec->def_sid;
844 rc = 0;
845 } else {
f5c1d5b2
JM		 846 rc = security_context_to_sid_default(context, rc, &sid,
847 sbsec->def_sid);
1da177e4
LT		 848 if (rc) {
849 printk(KERN_WARNING "%s: context_to_sid(%s) "
850 "returned %d for dev=%s ino=%ld\n",
851 __FUNCTION__, context, -rc,
852 inode->i_sb->s_id, inode->i_ino);
853 kfree(context);
854 /* Leave with the unlabeled SID */
855 rc = 0;
856 break;
857 }
858 }
859 kfree(context);
860 isec->sid = sid;
861 break;
862 case SECURITY_FS_USE_TASK:
863 isec->sid = isec->task_sid;
864 break;
865 case SECURITY_FS_USE_TRANS:
866 /* Default to the fs SID. */
867 isec->sid = sbsec->sid;
868
869 /* Try to obtain a transition SID. */
870 isec->sclass = inode_mode_to_security_class(inode->i_mode);
871 rc = security_transition_sid(isec->task_sid,
872 sbsec->sid,
873 isec->sclass,
874 &sid);
875 if (rc)
876 goto out;
877 isec->sid = sid;
878 break;
879 default:
880 /* Default to the fs SID. */
881 isec->sid = sbsec->sid;
882
883 if (sbsec->proc) {
884 struct proc_inode *proci = PROC_I(inode);
885 if (proci->pde) {
886 isec->sclass = inode_mode_to_security_class(inode->i_mode);
887 rc = selinux_proc_get_sid(proci->pde,
888 isec->sclass,
889 &sid);
890 if (rc)
891 goto out;
892 isec->sid = sid;
893 }
894 }
895 break;
896 }
897
898 isec->initialized = 1;
899
900out:
901 if (isec->sclass == SECCLASS_FILE)
902 isec->sclass = inode_mode_to_security_class(inode->i_mode);
903
904 if (hold_sem)
905 up(&isec->sem);
906 return rc;
907}
908
909/* Convert a Linux signal to an access vector. */
910static inline u32 signal_to_av(int sig)
911{
912 u32 perm = 0;
913
914 switch (sig) {
915 case SIGCHLD:
916 /* Commonly granted from child to parent. */
917 perm = PROCESS__SIGCHLD;
918 break;
919 case SIGKILL:
920 /* Cannot be caught or ignored */
921 perm = PROCESS__SIGKILL;
922 break;
923 case SIGSTOP:
924 /* Cannot be caught or ignored */
925 perm = PROCESS__SIGSTOP;
926 break;
927 default:
928 /* All other signals. */
929 perm = PROCESS__SIGNAL;
930 break;
931 }
932
933 return perm;
934}
935
936/* Check permission betweeen a pair of tasks, e.g. signal checks,
937 fork check, ptrace check, etc. */
938static int task_has_perm(struct task_struct *tsk1,
939 struct task_struct *tsk2,
940 u32 perms)
941{
942 struct task_security_struct *tsec1, *tsec2;
943
944 tsec1 = tsk1->security;
945 tsec2 = tsk2->security;
946 return avc_has_perm(tsec1->sid, tsec2->sid,
947 SECCLASS_PROCESS, perms, NULL);
948}
949
950/* Check whether a task is allowed to use a capability. */
951static int task_has_capability(struct task_struct *tsk,
952 int cap)
953{
954 struct task_security_struct *tsec;
955 struct avc_audit_data ad;
956
957 tsec = tsk->security;
958
959 AVC_AUDIT_DATA_INIT(&ad,CAP);
960 ad.tsk = tsk;
961 ad.u.cap = cap;
962
963 return avc_has_perm(tsec->sid, tsec->sid,
964 SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
965}
966
967/* Check whether a task is allowed to use a system operation. */
968static int task_has_system(struct task_struct *tsk,
969 u32 perms)
970{
971 struct task_security_struct *tsec;
972
973 tsec = tsk->security;
974
975 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
976 SECCLASS_SYSTEM, perms, NULL);
977}
978
979/* Check whether a task has a particular permission to an inode.
980 The 'adp' parameter is optional and allows other audit
981 data to be passed (e.g. the dentry). */
982static int inode_has_perm(struct task_struct *tsk,
983 struct inode *inode,
984 u32 perms,
985 struct avc_audit_data *adp)
986{
987 struct task_security_struct *tsec;
988 struct inode_security_struct *isec;
989 struct avc_audit_data ad;
990
991 tsec = tsk->security;
992 isec = inode->i_security;
993
994 if (!adp) {
995 adp = &ad;
996 AVC_AUDIT_DATA_INIT(&ad, FS);
997 ad.u.fs.inode = inode;
998 }
999
1000 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1001}
1002
1003/* Same as inode_has_perm, but pass explicit audit data containing
1004 the dentry to help the auditing code to more easily generate the
1005 pathname if needed. */
1006static inline int dentry_has_perm(struct task_struct *tsk,
1007 struct vfsmount *mnt,
1008 struct dentry *dentry,
1009 u32 av)
1010{
1011 struct inode *inode = dentry->d_inode;
1012 struct avc_audit_data ad;
1013 AVC_AUDIT_DATA_INIT(&ad,FS);
1014 ad.u.fs.mnt = mnt;
1015 ad.u.fs.dentry = dentry;
1016 return inode_has_perm(tsk, inode, av, &ad);
1017}
1018
1019/* Check whether a task can use an open file descriptor to
1020 access an inode in a given way. Check access to the
1021 descriptor itself, and then use dentry_has_perm to
1022 check a particular permission to the file.
1023 Access to the descriptor is implicitly granted if it
1024 has the same SID as the process. If av is zero, then
1025 access to the file is not checked, e.g. for cases
1026 where only the descriptor is affected like seek. */
858119e1 1027static int file_has_perm(struct task_struct *tsk,
1da177e4
LT		 1028 struct file *file,
1029 u32 av)
1030{
1031 struct task_security_struct *tsec = tsk->security;
1032 struct file_security_struct *fsec = file->f_security;
1033 struct vfsmount *mnt = file->f_vfsmnt;
1034 struct dentry *dentry = file->f_dentry;
1035 struct inode *inode = dentry->d_inode;
1036 struct avc_audit_data ad;
1037 int rc;
1038
1039 AVC_AUDIT_DATA_INIT(&ad, FS);
1040 ad.u.fs.mnt = mnt;
1041 ad.u.fs.dentry = dentry;
1042
1043 if (tsec->sid != fsec->sid) {
1044 rc = avc_has_perm(tsec->sid, fsec->sid,
1045 SECCLASS_FD,
1046 FD__USE,
1047 &ad);
1048 if (rc)
1049 return rc;
1050 }
1051
1052 /* av is zero if only checking access to the descriptor. */
1053 if (av)
1054 return inode_has_perm(tsk, inode, av, &ad);
1055
1056 return 0;
1057}
1058
1059/* Check whether a task can create a file. */
1060static int may_create(struct inode *dir,
1061 struct dentry *dentry,
1062 u16 tclass)
1063{
1064 struct task_security_struct *tsec;
1065 struct inode_security_struct *dsec;
1066 struct superblock_security_struct *sbsec;
1067 u32 newsid;
1068 struct avc_audit_data ad;
1069 int rc;
1070
1071 tsec = current->security;
1072 dsec = dir->i_security;
1073 sbsec = dir->i_sb->s_security;
1074
1075 AVC_AUDIT_DATA_INIT(&ad, FS);
1076 ad.u.fs.dentry = dentry;
1077
1078 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1079 DIR__ADD_NAME | DIR__SEARCH,
1080 &ad);
1081 if (rc)
1082 return rc;
1083
1084 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1085 newsid = tsec->create_sid;
1086 } else {
1087 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1088 &newsid);
1089 if (rc)
1090 return rc;
1091 }
1092
1093 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1094 if (rc)
1095 return rc;
1096
1097 return avc_has_perm(newsid, sbsec->sid,
1098 SECCLASS_FILESYSTEM,
1099 FILESYSTEM__ASSOCIATE, &ad);
1100}
1101
4eb582cf
ML		 1102/* Check whether a task can create a key. */
1103static int may_create_key(u32 ksid,
1104 struct task_struct *ctx)
1105{
1106 struct task_security_struct *tsec;
1107
1108 tsec = ctx->security;
1109
1110 return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1111}
1112
1da177e4
LT		 1113#define MAY_LINK 0
1114#define MAY_UNLINK 1
1115#define MAY_RMDIR 2
1116
1117/* Check whether a task can link, unlink, or rmdir a file/directory. */
1118static int may_link(struct inode *dir,
1119 struct dentry *dentry,
1120 int kind)
1121
1122{
1123 struct task_security_struct *tsec;
1124 struct inode_security_struct *dsec, *isec;
1125 struct avc_audit_data ad;
1126 u32 av;
1127 int rc;
1128
1129 tsec = current->security;
1130 dsec = dir->i_security;
1131 isec = dentry->d_inode->i_security;
1132
1133 AVC_AUDIT_DATA_INIT(&ad, FS);
1134 ad.u.fs.dentry = dentry;
1135
1136 av = DIR__SEARCH;
1137 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1138 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1139 if (rc)
1140 return rc;
1141
1142 switch (kind) {
1143 case MAY_LINK:
1144 av = FILE__LINK;
1145 break;
1146 case MAY_UNLINK:
1147 av = FILE__UNLINK;
1148 break;
1149 case MAY_RMDIR:
1150 av = DIR__RMDIR;
1151 break;
1152 default:
1153 printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
1154 return 0;
1155 }
1156
1157 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1158 return rc;
1159}
1160
1161static inline int may_rename(struct inode *old_dir,
1162 struct dentry *old_dentry,
1163 struct inode *new_dir,
1164 struct dentry *new_dentry)
1165{
1166 struct task_security_struct *tsec;
1167 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1168 struct avc_audit_data ad;
1169 u32 av;
1170 int old_is_dir, new_is_dir;
1171 int rc;
1172
1173 tsec = current->security;
1174 old_dsec = old_dir->i_security;
1175 old_isec = old_dentry->d_inode->i_security;
1176 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1177 new_dsec = new_dir->i_security;
1178
1179 AVC_AUDIT_DATA_INIT(&ad, FS);
1180
1181 ad.u.fs.dentry = old_dentry;
1182 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1183 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1184 if (rc)
1185 return rc;
1186 rc = avc_has_perm(tsec->sid, old_isec->sid,
1187 old_isec->sclass, FILE__RENAME, &ad);
1188 if (rc)
1189 return rc;
1190 if (old_is_dir && new_dir != old_dir) {
1191 rc = avc_has_perm(tsec->sid, old_isec->sid,
1192 old_isec->sclass, DIR__REPARENT, &ad);
1193 if (rc)
1194 return rc;
1195 }
1196
1197 ad.u.fs.dentry = new_dentry;
1198 av = DIR__ADD_NAME | DIR__SEARCH;
1199 if (new_dentry->d_inode)
1200 av |= DIR__REMOVE_NAME;
1201 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1202 if (rc)
1203 return rc;
1204 if (new_dentry->d_inode) {
1205 new_isec = new_dentry->d_inode->i_security;
1206 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1207 rc = avc_has_perm(tsec->sid, new_isec->sid,
1208 new_isec->sclass,
1209 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1210 if (rc)
1211 return rc;
1212 }
1213
1214 return 0;
1215}
1216
1217/* Check whether a task can perform a filesystem operation. */
1218static int superblock_has_perm(struct task_struct *tsk,
1219 struct super_block *sb,
1220 u32 perms,
1221 struct avc_audit_data *ad)
1222{
1223 struct task_security_struct *tsec;
1224 struct superblock_security_struct *sbsec;
1225
1226 tsec = tsk->security;
1227 sbsec = sb->s_security;
1228 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1229 perms, ad);
1230}
1231
1232/* Convert a Linux mode and permission mask to an access vector. */
1233static inline u32 file_mask_to_av(int mode, int mask)
1234{
1235 u32 av = 0;
1236
1237 if ((mode & S_IFMT) != S_IFDIR) {
1238 if (mask & MAY_EXEC)
1239 av |= FILE__EXECUTE;
1240 if (mask & MAY_READ)
1241 av |= FILE__READ;
1242
1243 if (mask & MAY_APPEND)
1244 av |= FILE__APPEND;
1245 else if (mask & MAY_WRITE)
1246 av |= FILE__WRITE;
1247
1248 } else {
1249 if (mask & MAY_EXEC)
1250 av |= DIR__SEARCH;
1251 if (mask & MAY_WRITE)
1252 av |= DIR__WRITE;
1253 if (mask & MAY_READ)
1254 av |= DIR__READ;
1255 }
1256
1257 return av;
1258}
1259
1260/* Convert a Linux file to an access vector. */
1261static inline u32 file_to_av(struct file *file)
1262{
1263 u32 av = 0;
1264
1265 if (file->f_mode & FMODE_READ)
1266 av |= FILE__READ;
1267 if (file->f_mode & FMODE_WRITE) {
1268 if (file->f_flags & O_APPEND)
1269 av |= FILE__APPEND;
1270 else
1271 av |= FILE__WRITE;
1272 }
1273
1274 return av;
1275}
1276
1277/* Set an inode's SID to a specified value. */
1278static int inode_security_set_sid(struct inode *inode, u32 sid)
1279{
1280 struct inode_security_struct *isec = inode->i_security;
1281 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
1282
1283 if (!sbsec->initialized) {
1284 /* Defer initialization to selinux_complete_init. */
1285 return 0;
1286 }
1287
1288 down(&isec->sem);
1289 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1290 isec->sid = sid;
1291 isec->initialized = 1;
1292 up(&isec->sem);
1293 return 0;
1294}
1295
1da177e4
LT		 1296/* Hook functions begin here. */
1297
1298static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1299{
1300 struct task_security_struct *psec = parent->security;
1301 struct task_security_struct *csec = child->security;
1302 int rc;
1303
1304 rc = secondary_ops->ptrace(parent,child);
1305 if (rc)
1306 return rc;
1307
1308 rc = task_has_perm(parent, child, PROCESS__PTRACE);
1309 /* Save the SID of the tracing process for later use in apply_creds. */
341c2d80 1310 if (!(child->ptrace & PT_PTRACED) && !rc)
1da177e4
LT		 1311 csec->ptrace_sid = psec->sid;
1312 return rc;
1313}
1314
1315static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1316 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1317{
1318 int error;
1319
1320 error = task_has_perm(current, target, PROCESS__GETCAP);
1321 if (error)
1322 return error;
1323
1324 return secondary_ops->capget(target, effective, inheritable, permitted);
1325}
1326
1327static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1328 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1329{
1330 int error;
1331
1332 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1333 if (error)
1334 return error;
1335
1336 return task_has_perm(current, target, PROCESS__SETCAP);
1337}
1338
1339static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1340 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1341{
1342 secondary_ops->capset_set(target, effective, inheritable, permitted);
1343}
1344
1345static int selinux_capable(struct task_struct *tsk, int cap)
1346{
1347 int rc;
1348
1349 rc = secondary_ops->capable(tsk, cap);
1350 if (rc)
1351 return rc;
1352
1353 return task_has_capability(tsk,cap);
1354}
1355
1356static int selinux_sysctl(ctl_table *table, int op)
1357{
1358 int error = 0;
1359 u32 av;
1360 struct task_security_struct *tsec;
1361 u32 tsid;
1362 int rc;
1363
1364 rc = secondary_ops->sysctl(table, op);
1365 if (rc)
1366 return rc;
1367
1368 tsec = current->security;
1369
1370 rc = selinux_proc_get_sid(table->de, (op == 001) ?
1371 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1372 if (rc) {
1373 /* Default to the well-defined sysctl SID. */
1374 tsid = SECINITSID_SYSCTL;
1375 }
1376
1377 /* The op values are "defined" in sysctl.c, thereby creating
1378 * a bad coupling between this module and sysctl.c */
1379 if(op == 001) {
1380 error = avc_has_perm(tsec->sid, tsid,
1381 SECCLASS_DIR, DIR__SEARCH, NULL);
1382 } else {
1383 av = 0;
1384 if (op & 004)
1385 av |= FILE__READ;
1386 if (op & 002)
1387 av |= FILE__WRITE;
1388 if (av)
1389 error = avc_has_perm(tsec->sid, tsid,
1390 SECCLASS_FILE, av, NULL);
1391 }
1392
1393 return error;
1394}
1395
1396static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1397{
1398 int rc = 0;
1399
1400 if (!sb)
1401 return 0;
1402
1403 switch (cmds) {
1404 case Q_SYNC:
1405 case Q_QUOTAON:
1406 case Q_QUOTAOFF:
1407 case Q_SETINFO:
1408 case Q_SETQUOTA:
1409 rc = superblock_has_perm(current,
1410 sb,
1411 FILESYSTEM__QUOTAMOD, NULL);
1412 break;
1413 case Q_GETFMT:
1414 case Q_GETINFO:
1415 case Q_GETQUOTA:
1416 rc = superblock_has_perm(current,
1417 sb,
1418 FILESYSTEM__QUOTAGET, NULL);
1419 break;
1420 default:
1421 rc = 0; /* let the kernel handle invalid cmds */
1422 break;
1423 }
1424 return rc;
1425}
1426
1427static int selinux_quota_on(struct dentry *dentry)
1428{
1429 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1430}
1431
1432static int selinux_syslog(int type)
1433{
1434 int rc;
1435
1436 rc = secondary_ops->syslog(type);
1437 if (rc)
1438 return rc;
1439
1440 switch (type) {
1441 case 3: /* Read last kernel messages */
1442 case 10: /* Return size of the log buffer */
1443 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1444 break;
1445 case 6: /* Disable logging to console */
1446 case 7: /* Enable logging to console */
1447 case 8: /* Set level of messages printed to console */
1448 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1449 break;
1450 case 0: /* Close log */
1451 case 1: /* Open log */
1452 case 2: /* Read from log */
1453 case 4: /* Read/clear last kernel messages */
1454 case 5: /* Clear ring buffer */
1455 default:
1456 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1457 break;
1458 }
1459 return rc;
1460}
1461
1462/*
1463 * Check that a process has enough memory to allocate a new virtual
1464 * mapping. 0 means there is enough memory for the allocation to
1465 * succeed and -ENOMEM implies there is not.
1466 *
1467 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1468 * if the capability is granted, but __vm_enough_memory requires 1 if
1469 * the capability is granted.
1470 *
1471 * Do not audit the selinux permission check, as this is applied to all
1472 * processes that allocate mappings.
1473 */
1474static int selinux_vm_enough_memory(long pages)
1475{
1476 int rc, cap_sys_admin = 0;
1477 struct task_security_struct *tsec = current->security;
1478
1479 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1480 if (rc == 0)
1481 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1482 SECCLASS_CAPABILITY,
1483 CAP_TO_MASK(CAP_SYS_ADMIN),
1484 NULL);
1485
1486 if (rc == 0)
1487 cap_sys_admin = 1;
1488
1489 return __vm_enough_memory(pages, cap_sys_admin);
1490}
1491
1492/* binprm security operations */
1493
1494static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1495{
1496 struct bprm_security_struct *bsec;
1497
89d155ef 1498 bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1da177e4
LT		 1499 if (!bsec)
1500 return -ENOMEM;
1501
1da177e4
LT		 1502 bsec->bprm = bprm;
1503 bsec->sid = SECINITSID_UNLABELED;
1504 bsec->set = 0;
1505
1506 bprm->security = bsec;
1507 return 0;
1508}
1509
1510static int selinux_bprm_set_security(struct linux_binprm *bprm)
1511{
1512 struct task_security_struct *tsec;
1513 struct inode *inode = bprm->file->f_dentry->d_inode;
1514 struct inode_security_struct *isec;
1515 struct bprm_security_struct *bsec;
1516 u32 newsid;
1517 struct avc_audit_data ad;
1518 int rc;
1519
1520 rc = secondary_ops->bprm_set_security(bprm);
1521 if (rc)
1522 return rc;
1523
1524 bsec = bprm->security;
1525
1526 if (bsec->set)
1527 return 0;
1528
1529 tsec = current->security;
1530 isec = inode->i_security;
1531
1532 /* Default to the current task SID. */
1533 bsec->sid = tsec->sid;
1534
42c3e03e 1535 /* Reset create and sockcreate SID on execve. */
1da177e4 1536 tsec->create_sid = 0;
42c3e03e 1537 tsec->sockcreate_sid = 0;
1da177e4
LT		 1538
1539 if (tsec->exec_sid) {
1540 newsid = tsec->exec_sid;
1541 /* Reset exec SID on execve. */
1542 tsec->exec_sid = 0;
1543 } else {
1544 /* Check for a default transition on this program. */
1545 rc = security_transition_sid(tsec->sid, isec->sid,
1546 SECCLASS_PROCESS, &newsid);
1547 if (rc)
1548 return rc;
1549 }
1550
1551 AVC_AUDIT_DATA_INIT(&ad, FS);
1552 ad.u.fs.mnt = bprm->file->f_vfsmnt;
1553 ad.u.fs.dentry = bprm->file->f_dentry;
1554
1555 if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
1556 newsid = tsec->sid;
1557
1558 if (tsec->sid == newsid) {
1559 rc = avc_has_perm(tsec->sid, isec->sid,
1560 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1561 if (rc)
1562 return rc;
1563 } else {
1564 /* Check permissions for the transition. */
1565 rc = avc_has_perm(tsec->sid, newsid,
1566 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1567 if (rc)
1568 return rc;
1569
1570 rc = avc_has_perm(newsid, isec->sid,
1571 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1572 if (rc)
1573 return rc;
1574
1575 /* Clear any possibly unsafe personality bits on exec: */
1576 current->personality &= ~PER_CLEAR_ON_SETID;
1577
1578 /* Set the security field to the new SID. */
1579 bsec->sid = newsid;
1580 }
1581
1582 bsec->set = 1;
1583 return 0;
1584}
1585
1586static int selinux_bprm_check_security (struct linux_binprm *bprm)
1587{
1588 return secondary_ops->bprm_check_security(bprm);
1589}
1590
1591
1592static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1593{
1594 struct task_security_struct *tsec = current->security;
1595 int atsecure = 0;
1596
1597 if (tsec->osid != tsec->sid) {
1598 /* Enable secure mode for SIDs transitions unless
1599 the noatsecure permission is granted between
1600 the two SIDs, i.e. ahp returns 0. */
1601 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1602 SECCLASS_PROCESS,
1603 PROCESS__NOATSECURE, NULL);
1604 }
1605
1606 return (atsecure || secondary_ops->bprm_secureexec(bprm));
1607}
1608
1609static void selinux_bprm_free_security(struct linux_binprm *bprm)
1610{
9a5f04bf 1611 kfree(bprm->security);
1da177e4 1612 bprm->security = NULL;
1da177e4
LT		 1613}
1614
1615extern struct vfsmount *selinuxfs_mount;
1616extern struct dentry *selinux_null;
1617
1618/* Derived from fs/exec.c:flush_old_files. */
1619static inline void flush_unauthorized_files(struct files_struct * files)
1620{
1621 struct avc_audit_data ad;
1622 struct file *file, *devnull = NULL;
1623 struct tty_struct *tty = current->signal->tty;
badf1662 1624 struct fdtable *fdt;
1da177e4
LT		 1625 long j = -1;
1626
1627 if (tty) {
1628 file_list_lock();
2f512016 1629 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
1da177e4
LT		 1630 if (file) {
1631 /* Revalidate access to controlling tty.
1632 Use inode_has_perm on the tty inode directly rather
1633 than using file_has_perm, as this particular open
1634 file may belong to another process and we are only
1635 interested in the inode-based check here. */
1636 struct inode *inode = file->f_dentry->d_inode;
1637 if (inode_has_perm(current, inode,
1638 FILE__READ | FILE__WRITE, NULL)) {
1639 /* Reset controlling tty. */
1640 current->signal->tty = NULL;
1641 current->signal->tty_old_pgrp = 0;
1642 }
1643 }
1644 file_list_unlock();
1645 }
1646
1647 /* Revalidate access to inherited open files. */
1648
1649 AVC_AUDIT_DATA_INIT(&ad,FS);
1650
1651 spin_lock(&files->file_lock);
1652 for (;;) {
1653 unsigned long set, i;
1654 int fd;
1655
1656 j++;
1657 i = j * __NFDBITS;
badf1662
DS		 1658 fdt = files_fdtable(files);
1659 if (i >= fdt->max_fds || i >= fdt->max_fdset)
1da177e4 1660 break;
badf1662 1661 set = fdt->open_fds->fds_bits[j];
1da177e4
LT		 1662 if (!set)
1663 continue;
1664 spin_unlock(&files->file_lock);
1665 for ( ; set ; i++,set >>= 1) {
1666 if (set & 1) {
1667 file = fget(i);
1668 if (!file)
1669 continue;
1670 if (file_has_perm(current,
1671 file,
1672 file_to_av(file))) {
1673 sys_close(i);
1674 fd = get_unused_fd();
1675 if (fd != i) {
1676 if (fd >= 0)
1677 put_unused_fd(fd);
1678 fput(file);
1679 continue;
1680 }
1681 if (devnull) {
095975da 1682 get_file(devnull);
1da177e4
LT		 1683 } else {
1684 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1685 if (!devnull) {
1686 put_unused_fd(fd);
1687 fput(file);
1688 continue;
1689 }
1690 }
1691 fd_install(fd, devnull);
1692 }
1693 fput(file);
1694 }
1695 }
1696 spin_lock(&files->file_lock);
1697
1698 }
1699 spin_unlock(&files->file_lock);
1700}
1701
1702static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1703{
1704 struct task_security_struct *tsec;
1705 struct bprm_security_struct *bsec;
1706 u32 sid;
1707 int rc;
1708
1709 secondary_ops->bprm_apply_creds(bprm, unsafe);
1710
1711 tsec = current->security;
1712
1713 bsec = bprm->security;
1714 sid = bsec->sid;
1715
1716 tsec->osid = tsec->sid;
1717 bsec->unsafe = 0;
1718 if (tsec->sid != sid) {
1719 /* Check for shared state. If not ok, leave SID
1720 unchanged and kill. */
1721 if (unsafe & LSM_UNSAFE_SHARE) {
1722 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1723 PROCESS__SHARE, NULL);
1724 if (rc) {
1725 bsec->unsafe = 1;
1726 return;
1727 }
1728 }
1729
1730 /* Check for ptracing, and update the task SID if ok.
1731 Otherwise, leave SID unchanged and kill. */
1732 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1733 rc = avc_has_perm(tsec->ptrace_sid, sid,
1734 SECCLASS_PROCESS, PROCESS__PTRACE,
1735 NULL);
1736 if (rc) {
1737 bsec->unsafe = 1;
1738 return;
1739 }
1740 }
1741 tsec->sid = sid;
1742 }
1743}
1744
1745/*
1746 * called after apply_creds without the task lock held
1747 */
1748static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1749{
1750 struct task_security_struct *tsec;
1751 struct rlimit *rlim, *initrlim;
1752 struct itimerval itimer;
1753 struct bprm_security_struct *bsec;
1754 int rc, i;
1755
1756 tsec = current->security;
1757 bsec = bprm->security;
1758
1759 if (bsec->unsafe) {
1760 force_sig_specific(SIGKILL, current);
1761 return;
1762 }
1763 if (tsec->osid == tsec->sid)
1764 return;
1765
1766 /* Close files for which the new task SID is not authorized. */
1767 flush_unauthorized_files(current->files);
1768
1769 /* Check whether the new SID can inherit signal state
1770 from the old SID. If not, clear itimers to avoid
1771 subsequent signal generation and flush and unblock
1772 signals. This must occur _after_ the task SID has
1773 been updated so that any kill done after the flush
1774 will be checked against the new SID. */
1775 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1776 PROCESS__SIGINH, NULL);
1777 if (rc) {
1778 memset(&itimer, 0, sizeof itimer);
1779 for (i = 0; i < 3; i++)
1780 do_setitimer(i, &itimer, NULL);
1781 flush_signals(current);
1782 spin_lock_irq(&current->sighand->siglock);
1783 flush_signal_handlers(current, 1);
1784 sigemptyset(&current->blocked);
1785 recalc_sigpending();
1786 spin_unlock_irq(&current->sighand->siglock);
1787 }
1788
1789 /* Check whether the new SID can inherit resource limits
1790 from the old SID. If not, reset all soft limits to
1791 the lower of the current task's hard limit and the init
1792 task's soft limit. Note that the setting of hard limits
1793 (even to lower them) can be controlled by the setrlimit
1794 check. The inclusion of the init task's soft limit into
1795 the computation is to avoid resetting soft limits higher
1796 than the default soft limit for cases where the default
1797 is lower than the hard limit, e.g. RLIMIT_CORE or
1798 RLIMIT_STACK.*/
1799 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1800 PROCESS__RLIMITINH, NULL);
1801 if (rc) {
1802 for (i = 0; i < RLIM_NLIMITS; i++) {
1803 rlim = current->signal->rlim + i;
1804 initrlim = init_task.signal->rlim+i;
1805 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1806 }
1807 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1808 /*
1809 * This will cause RLIMIT_CPU calculations
1810 * to be refigured.
1811 */
1812 current->it_prof_expires = jiffies_to_cputime(1);
1813 }
1814 }
1815
1816 /* Wake up the parent if it is waiting so that it can
1817 recheck wait permission to the new task SID. */
1818 wake_up_interruptible(&current->parent->signal->wait_chldexit);
1819}
1820
1821/* superblock security operations */
1822
1823static int selinux_sb_alloc_security(struct super_block *sb)
1824{
1825 return superblock_alloc_security(sb);
1826}
1827
1828static void selinux_sb_free_security(struct super_block *sb)
1829{
1830 superblock_free_security(sb);
1831}
1832
1833static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1834{
1835 if (plen > olen)
1836 return 0;
1837
1838 return !memcmp(prefix, option, plen);
1839}
1840
1841static inline int selinux_option(char *option, int len)
1842{
1843 return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1844 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1845 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len));
1846}
1847
1848static inline void take_option(char **to, char *from, int *first, int len)
1849{
1850 if (!*first) {
1851 **to = ',';
1852 *to += 1;
1853 }
1854 else
1855 *first = 0;
1856 memcpy(*to, from, len);
1857 *to += len;
1858}
1859
1860static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
1861{
1862 int fnosec, fsec, rc = 0;
1863 char *in_save, *in_curr, *in_end;
1864 char *sec_curr, *nosec_save, *nosec;
1865
1866 in_curr = orig;
1867 sec_curr = copy;
1868
1869 /* Binary mount data: just copy */
1870 if (type->fs_flags & FS_BINARY_MOUNTDATA) {
1871 copy_page(sec_curr, in_curr);
1872 goto out;
1873 }
1874
1875 nosec = (char *)get_zeroed_page(GFP_KERNEL);
1876 if (!nosec) {
1877 rc = -ENOMEM;
1878 goto out;
1879 }
1880
1881 nosec_save = nosec;
1882 fnosec = fsec = 1;
1883 in_save = in_end = orig;
1884
1885 do {
1886 if (*in_end == ',' || *in_end == '\0') {
1887 int len = in_end - in_curr;
1888
1889 if (selinux_option(in_curr, len))
1890 take_option(&sec_curr, in_curr, &fsec, len);
1891 else
1892 take_option(&nosec, in_curr, &fnosec, len);
1893
1894 in_curr = in_end + 1;
1895 }
1896 } while (*in_end++);
1897
6931dfc9 1898 strcpy(in_save, nosec_save);
da3caa20 1899 free_page((unsigned long)nosec_save);
1da177e4
LT		 1900out:
1901 return rc;
1902}
1903
1904static int selinux_sb_kern_mount(struct super_block *sb, void *data)
1905{
1906 struct avc_audit_data ad;
1907 int rc;
1908
1909 rc = superblock_doinit(sb, data);
1910 if (rc)
1911 return rc;
1912
1913 AVC_AUDIT_DATA_INIT(&ad,FS);
1914 ad.u.fs.dentry = sb->s_root;
1915 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
1916}
1917
726c3342 1918static int selinux_sb_statfs(struct dentry *dentry)
1da177e4
LT		 1919{
1920 struct avc_audit_data ad;
1921
1922 AVC_AUDIT_DATA_INIT(&ad,FS);
726c3342
DH		 1923 ad.u.fs.dentry = dentry->d_sb->s_root;
1924 return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
1da177e4
LT		 1925}
1926
1927static int selinux_mount(char * dev_name,
1928 struct nameidata *nd,
1929 char * type,
1930 unsigned long flags,
1931 void * data)
1932{
1933 int rc;
1934
1935 rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
1936 if (rc)
1937 return rc;
1938
1939 if (flags & MS_REMOUNT)
1940 return superblock_has_perm(current, nd->mnt->mnt_sb,
1941 FILESYSTEM__REMOUNT, NULL);
1942 else
1943 return dentry_has_perm(current, nd->mnt, nd->dentry,
1944 FILE__MOUNTON);
1945}
1946
1947static int selinux_umount(struct vfsmount *mnt, int flags)
1948{
1949 int rc;
1950
1951 rc = secondary_ops->sb_umount(mnt, flags);
1952 if (rc)
1953 return rc;
1954
1955 return superblock_has_perm(current,mnt->mnt_sb,
1956 FILESYSTEM__UNMOUNT,NULL);
1957}
1958
1959/* inode security operations */
1960
1961static int selinux_inode_alloc_security(struct inode *inode)
1962{
1963 return inode_alloc_security(inode);
1964}
1965
1966static void selinux_inode_free_security(struct inode *inode)
1967{
1968 inode_free_security(inode);
1969}
1970
5e41ff9e
SS		 1971static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
1972 char **name, void **value,
1973 size_t *len)
1974{
1975 struct task_security_struct *tsec;
1976 struct inode_security_struct *dsec;
1977 struct superblock_security_struct *sbsec;
570bc1c2 1978 u32 newsid, clen;
5e41ff9e 1979 int rc;
570bc1c2 1980 char *namep = NULL, *context;
5e41ff9e
SS		 1981
1982 tsec = current->security;
1983 dsec = dir->i_security;
1984 sbsec = dir->i_sb->s_security;
5e41ff9e
SS		 1985
1986 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1987 newsid = tsec->create_sid;
1988 } else {
1989 rc = security_transition_sid(tsec->sid, dsec->sid,
1990 inode_mode_to_security_class(inode->i_mode),
1991 &newsid);
1992 if (rc) {
1993 printk(KERN_WARNING "%s: "
1994 "security_transition_sid failed, rc=%d (dev=%s "
1995 "ino=%ld)\n",
1996 __FUNCTION__,
1997 -rc, inode->i_sb->s_id, inode->i_ino);
1998 return rc;
1999 }
2000 }
2001
2002 inode_security_set_sid(inode, newsid);
2003
8aad3875 2004 if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
25a74f3b
SS		 2005 return -EOPNOTSUPP;
2006
570bc1c2
SS		 2007 if (name) {
2008 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
2009 if (!namep)
2010 return -ENOMEM;
2011 *name = namep;
2012 }
5e41ff9e 2013
570bc1c2
SS		 2014 if (value && len) {
2015 rc = security_sid_to_context(newsid, &context, &clen);
2016 if (rc) {
2017 kfree(namep);
2018 return rc;
2019 }
2020 *value = context;
2021 *len = clen;
5e41ff9e 2022 }
5e41ff9e 2023
5e41ff9e
SS		 2024 return 0;
2025}
2026
1da177e4
LT		 2027static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2028{
2029 return may_create(dir, dentry, SECCLASS_FILE);
2030}
2031
1da177e4
LT		 2032static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2033{
2034 int rc;
2035
2036 rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2037 if (rc)
2038 return rc;
2039 return may_link(dir, old_dentry, MAY_LINK);
2040}
2041
1da177e4
LT		 2042static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2043{
2044 int rc;
2045
2046 rc = secondary_ops->inode_unlink(dir, dentry);
2047 if (rc)
2048 return rc;
2049 return may_link(dir, dentry, MAY_UNLINK);
2050}
2051
2052static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2053{
2054 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2055}
2056
1da177e4
LT		 2057static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2058{
2059 return may_create(dir, dentry, SECCLASS_DIR);
2060}
2061
1da177e4
LT		 2062static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2063{
2064 return may_link(dir, dentry, MAY_RMDIR);
2065}
2066
2067static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2068{
2069 int rc;
2070
2071 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2072 if (rc)
2073 return rc;
2074
2075 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2076}
2077
1da177e4
LT		 2078static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2079 struct inode *new_inode, struct dentry *new_dentry)
2080{
2081 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2082}
2083
1da177e4
LT		 2084static int selinux_inode_readlink(struct dentry *dentry)
2085{
2086 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2087}
2088
2089static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2090{
2091 int rc;
2092
2093 rc = secondary_ops->inode_follow_link(dentry,nameidata);
2094 if (rc)
2095 return rc;
2096 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2097}
2098
2099static int selinux_inode_permission(struct inode *inode, int mask,
2100 struct nameidata *nd)
2101{
2102 int rc;
2103
2104 rc = secondary_ops->inode_permission(inode, mask, nd);
2105 if (rc)
2106 return rc;
2107
2108 if (!mask) {
2109 /* No permission to check. Existence test. */
2110 return 0;
2111 }
2112
2113 return inode_has_perm(current, inode,
2114 file_mask_to_av(inode->i_mode, mask), NULL);
2115}
2116
2117static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2118{
2119 int rc;
2120
2121 rc = secondary_ops->inode_setattr(dentry, iattr);
2122 if (rc)
2123 return rc;
2124
2125 if (iattr->ia_valid & ATTR_FORCE)
2126 return 0;
2127
2128 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2129 ATTR_ATIME_SET | ATTR_MTIME_SET))
2130 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2131
2132 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2133}
2134
2135static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2136{
2137 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2138}
2139
2140static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2141{
2142 struct task_security_struct *tsec = current->security;
2143 struct inode *inode = dentry->d_inode;
2144 struct inode_security_struct *isec = inode->i_security;
2145 struct superblock_security_struct *sbsec;
2146 struct avc_audit_data ad;
2147 u32 newsid;
2148 int rc = 0;
2149
2150 if (strcmp(name, XATTR_NAME_SELINUX)) {
2151 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2152 sizeof XATTR_SECURITY_PREFIX - 1) &&
2153 !capable(CAP_SYS_ADMIN)) {
2154 /* A different attribute in the security namespace.
2155 Restrict to administrator. */
2156 return -EPERM;
2157 }
2158
2159 /* Not an attribute we recognize, so just check the
2160 ordinary setattr permission. */
2161 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2162 }
2163
2164 sbsec = inode->i_sb->s_security;
2165 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2166 return -EOPNOTSUPP;
2167
2168 if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2169 return -EPERM;
2170
2171 AVC_AUDIT_DATA_INIT(&ad,FS);
2172 ad.u.fs.dentry = dentry;
2173
2174 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2175 FILE__RELABELFROM, &ad);
2176 if (rc)
2177 return rc;
2178
2179 rc = security_context_to_sid(value, size, &newsid);
2180 if (rc)
2181 return rc;
2182
2183 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2184 FILE__RELABELTO, &ad);
2185 if (rc)
2186 return rc;
2187
2188 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2189 isec->sclass);
2190 if (rc)
2191 return rc;
2192
2193 return avc_has_perm(newsid,
2194 sbsec->sid,
2195 SECCLASS_FILESYSTEM,
2196 FILESYSTEM__ASSOCIATE,
2197 &ad);
2198}
2199
2200static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2201 void *value, size_t size, int flags)
2202{
2203 struct inode *inode = dentry->d_inode;
2204 struct inode_security_struct *isec = inode->i_security;
2205 u32 newsid;
2206 int rc;
2207
2208 if (strcmp(name, XATTR_NAME_SELINUX)) {
2209 /* Not an attribute we recognize, so nothing to do. */
2210 return;
2211 }
2212
2213 rc = security_context_to_sid(value, size, &newsid);
2214 if (rc) {
2215 printk(KERN_WARNING "%s: unable to obtain SID for context "
2216 "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2217 return;
2218 }
2219
2220 isec->sid = newsid;
2221 return;
2222}
2223
2224static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2225{
1da177e4
LT		 2226 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2227}
2228
2229static int selinux_inode_listxattr (struct dentry *dentry)
2230{
2231 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2232}
2233
2234static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2235{
2236 if (strcmp(name, XATTR_NAME_SELINUX)) {
2237 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2238 sizeof XATTR_SECURITY_PREFIX - 1) &&
2239 !capable(CAP_SYS_ADMIN)) {
2240 /* A different attribute in the security namespace.
2241 Restrict to administrator. */
2242 return -EPERM;
2243 }
2244
2245 /* Not an attribute we recognize, so just check the
2246 ordinary setattr permission. Might want a separate
2247 permission for removexattr. */
2248 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2249 }
2250
2251 /* No one is allowed to remove a SELinux security label.
2252 You can change the label, but all data must be labeled. */
2253 return -EACCES;
2254}
2255
8c8570fb
DK		 2256static const char *selinux_inode_xattr_getsuffix(void)
2257{
2258 return XATTR_SELINUX_SUFFIX;
2259}
2260
d381d8a9
JM		 2261/*
2262 * Copy the in-core inode security context value to the user. If the
2263 * getxattr() prior to this succeeded, check to see if we need to
2264 * canonicalize the value to be finally returned to the user.
2265 *
2266 * Permission check is handled by selinux_inode_getxattr hook.
2267 */
7306a0b9 2268static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void *buffer, size_t size, int err)
1da177e4
LT		 2269{
2270 struct inode_security_struct *isec = inode->i_security;
d381d8a9 2271
8c8570fb
DK		 2272 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2273 return -EOPNOTSUPP;
d381d8a9 2274
8c8570fb 2275 return selinux_getsecurity(isec->sid, buffer, size);
1da177e4
LT		 2276}
2277
2278static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2279 const void *value, size_t size, int flags)
2280{
2281 struct inode_security_struct *isec = inode->i_security;
2282 u32 newsid;
2283 int rc;
2284
2285 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2286 return -EOPNOTSUPP;
2287
2288 if (!value || !size)
2289 return -EACCES;
2290
2291 rc = security_context_to_sid((void*)value, size, &newsid);
2292 if (rc)
2293 return rc;
2294
2295 isec->sid = newsid;
2296 return 0;
2297}
2298
2299static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2300{
2301 const int len = sizeof(XATTR_NAME_SELINUX);
2302 if (buffer && len <= buffer_size)
2303 memcpy(buffer, XATTR_NAME_SELINUX, len);
2304 return len;
2305}
2306
2307/* file security operations */
2308
2309static int selinux_file_permission(struct file *file, int mask)
2310{
2311 struct inode *inode = file->f_dentry->d_inode;
2312
2313 if (!mask) {
2314 /* No permission to check. Existence test. */
2315 return 0;
2316 }
2317
2318 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2319 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2320 mask |= MAY_APPEND;
2321
2322 return file_has_perm(current, file,
2323 file_mask_to_av(inode->i_mode, mask));
2324}
2325
2326static int selinux_file_alloc_security(struct file *file)
2327{
2328 return file_alloc_security(file);
2329}
2330
2331static void selinux_file_free_security(struct file *file)
2332{
2333 file_free_security(file);
2334}
2335
2336static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2337 unsigned long arg)
2338{
2339 int error = 0;
2340
2341 switch (cmd) {
2342 case FIONREAD:
2343 /* fall through */
2344 case FIBMAP:
2345 /* fall through */
2346 case FIGETBSZ:
2347 /* fall through */
2348 case EXT2_IOC_GETFLAGS:
2349 /* fall through */
2350 case EXT2_IOC_GETVERSION:
2351 error = file_has_perm(current, file, FILE__GETATTR);
2352 break;
2353
2354 case EXT2_IOC_SETFLAGS:
2355 /* fall through */
2356 case EXT2_IOC_SETVERSION:
2357 error = file_has_perm(current, file, FILE__SETATTR);
2358 break;
2359
2360 /* sys_ioctl() checks */
2361 case FIONBIO:
2362 /* fall through */
2363 case FIOASYNC:
2364 error = file_has_perm(current, file, 0);
2365 break;
2366
2367 case KDSKBENT:
2368 case KDSKBSENT:
2369 error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2370 break;
2371
2372 /* default case assumes that the command will go
2373 * to the file's ioctl() function.
2374 */
2375 default:
2376 error = file_has_perm(current, file, FILE__IOCTL);
2377
2378 }
2379 return error;
2380}
2381
2382static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2383{
2384#ifndef CONFIG_PPC32
2385 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2386 /*
2387 * We are making executable an anonymous mapping or a
2388 * private file mapping that will also be writable.
2389 * This has an additional check.
2390 */
2391 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2392 if (rc)
2393 return rc;
2394 }
2395#endif
2396
2397 if (file) {
2398 /* read access is always possible with a mapping */
2399 u32 av = FILE__READ;
2400
2401 /* write access only matters if the mapping is shared */
2402 if (shared && (prot & PROT_WRITE))
2403 av |= FILE__WRITE;
2404
2405 if (prot & PROT_EXEC)
2406 av |= FILE__EXECUTE;
2407
2408 return file_has_perm(current, file, av);
2409 }
2410 return 0;
2411}
2412
2413static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2414 unsigned long prot, unsigned long flags)
2415{
2416 int rc;
2417
2418 rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2419 if (rc)
2420 return rc;
2421
2422 if (selinux_checkreqprot)
2423 prot = reqprot;
2424
2425 return file_map_prot_check(file, prot,
2426 (flags & MAP_TYPE) == MAP_SHARED);
2427}
2428
2429static int selinux_file_mprotect(struct vm_area_struct *vma,
2430 unsigned long reqprot,
2431 unsigned long prot)
2432{
2433 int rc;
2434
2435 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2436 if (rc)
2437 return rc;
2438
2439 if (selinux_checkreqprot)
2440 prot = reqprot;
2441
2442#ifndef CONFIG_PPC32
db4c9641
SS		 2443 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2444 rc = 0;
2445 if (vma->vm_start >= vma->vm_mm->start_brk &&
2446 vma->vm_end <= vma->vm_mm->brk) {
2447 rc = task_has_perm(current, current,
2448 PROCESS__EXECHEAP);
2449 } else if (!vma->vm_file &&
2450 vma->vm_start <= vma->vm_mm->start_stack &&
2451 vma->vm_end >= vma->vm_mm->start_stack) {
2452 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2453 } else if (vma->vm_file && vma->anon_vma) {
2454 /*
2455 * We are making executable a file mapping that has
2456 * had some COW done. Since pages might have been
2457 * written, check ability to execute the possibly
2458 * modified content. This typically should only
2459 * occur for text relocations.
2460 */
2461 rc = file_has_perm(current, vma->vm_file,
2462 FILE__EXECMOD);
2463 }