]> bbs.cooldavid.org Git - net-next-2.6.git/blame - security/selinux/hooks.c
git://bbs.cooldavid.org / net-next-2.6.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
[PATCH] cs89x0: collect tx_bytes statistics
[net-next-2.6.git] / security / selinux / hooks.c
CommitLineData
1da177e4
LT		 1/*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
15 *
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License version 2,
18 * as published by the Free Software Foundation.
19 */
20
21#include <linux/config.h>
22#include <linux/module.h>
23#include <linux/init.h>
24#include <linux/kernel.h>
25#include <linux/ptrace.h>
26#include <linux/errno.h>
27#include <linux/sched.h>
28#include <linux/security.h>
29#include <linux/xattr.h>
30#include <linux/capability.h>
31#include <linux/unistd.h>
32#include <linux/mm.h>
33#include <linux/mman.h>
34#include <linux/slab.h>
35#include <linux/pagemap.h>
36#include <linux/swap.h>
37#include <linux/smp_lock.h>
38#include <linux/spinlock.h>
39#include <linux/syscalls.h>
40#include <linux/file.h>
41#include <linux/namei.h>
42#include <linux/mount.h>
43#include <linux/ext2_fs.h>
44#include <linux/proc_fs.h>
45#include <linux/kd.h>
46#include <linux/netfilter_ipv4.h>
47#include <linux/netfilter_ipv6.h>
48#include <linux/tty.h>
49#include <net/icmp.h>
50#include <net/ip.h> /* for sysctl_local_port_range[] */
51#include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
52#include <asm/uaccess.h>
53#include <asm/semaphore.h>
54#include <asm/ioctls.h>
55#include <linux/bitops.h>
56#include <linux/interrupt.h>
57#include <linux/netdevice.h> /* for network interface checks */
58#include <linux/netlink.h>
59#include <linux/tcp.h>
60#include <linux/udp.h>
61#include <linux/quota.h>
62#include <linux/un.h> /* for Unix socket types */
63#include <net/af_unix.h> /* for Unix socket types */
64#include <linux/parser.h>
65#include <linux/nfs_mount.h>
66#include <net/ipv6.h>
67#include <linux/hugetlb.h>
68#include <linux/personality.h>
69#include <linux/sysctl.h>
70#include <linux/audit.h>
6931dfc9 71#include <linux/string.h>
1da177e4
LT		 72
73#include "avc.h"
74#include "objsec.h"
75#include "netif.h"
76
77#define XATTR_SELINUX_SUFFIX "selinux"
78#define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
79
80extern unsigned int policydb_loaded_version;
81extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
82
83#ifdef CONFIG_SECURITY_SELINUX_DEVELOP
84int selinux_enforcing = 0;
85
86static int __init enforcing_setup(char *str)
87{
88 selinux_enforcing = simple_strtol(str,NULL,0);
89 return 1;
90}
91__setup("enforcing=", enforcing_setup);
92#endif
93
94#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
95int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
96
97static int __init selinux_enabled_setup(char *str)
98{
99 selinux_enabled = simple_strtol(str, NULL, 0);
100 return 1;
101}
102__setup("selinux=", selinux_enabled_setup);
103#endif
104
105/* Original (dummy) security module. */
106static struct security_operations *original_ops = NULL;
107
108/* Minimal support for a secondary security module,
109 just to allow the use of the dummy or capability modules.
110 The owlsm module can alternatively be used as a secondary
111 module as long as CONFIG_OWLSM_FD is not enabled. */
112static struct security_operations *secondary_ops = NULL;
113
114/* Lists of inode and superblock security structures initialized
115 before the policy was loaded. */
116static LIST_HEAD(superblock_security_head);
117static DEFINE_SPINLOCK(sb_security_lock);
118
119/* Allocate and free functions for each kind of security blob. */
120
121static int task_alloc_security(struct task_struct *task)
122{
123 struct task_security_struct *tsec;
124
125 tsec = kmalloc(sizeof(struct task_security_struct), GFP_KERNEL);
126 if (!tsec)
127 return -ENOMEM;
128
129 memset(tsec, 0, sizeof(struct task_security_struct));
130 tsec->magic = SELINUX_MAGIC;
131 tsec->task = task;
132 tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
133 task->security = tsec;
134
135 return 0;
136}
137
138static void task_free_security(struct task_struct *task)
139{
140 struct task_security_struct *tsec = task->security;
141
142 if (!tsec || tsec->magic != SELINUX_MAGIC)
143 return;
144
145 task->security = NULL;
146 kfree(tsec);
147}
148
149static int inode_alloc_security(struct inode *inode)
150{
151 struct task_security_struct *tsec = current->security;
152 struct inode_security_struct *isec;
153
154 isec = kmalloc(sizeof(struct inode_security_struct), GFP_KERNEL);
155 if (!isec)
156 return -ENOMEM;
157
158 memset(isec, 0, sizeof(struct inode_security_struct));
159 init_MUTEX(&isec->sem);
160 INIT_LIST_HEAD(&isec->list);
161 isec->magic = SELINUX_MAGIC;
162 isec->inode = inode;
163 isec->sid = SECINITSID_UNLABELED;
164 isec->sclass = SECCLASS_FILE;
165 if (tsec && tsec->magic == SELINUX_MAGIC)
166 isec->task_sid = tsec->sid;
167 else
168 isec->task_sid = SECINITSID_UNLABELED;
169 inode->i_security = isec;
170
171 return 0;
172}
173
174static void inode_free_security(struct inode *inode)
175{
176 struct inode_security_struct *isec = inode->i_security;
177 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
178
179 if (!isec || isec->magic != SELINUX_MAGIC)
180 return;
181
182 spin_lock(&sbsec->isec_lock);
183 if (!list_empty(&isec->list))
184 list_del_init(&isec->list);
185 spin_unlock(&sbsec->isec_lock);
186
187 inode->i_security = NULL;
188 kfree(isec);
189}
190
191static int file_alloc_security(struct file *file)
192{
193 struct task_security_struct *tsec = current->security;
194 struct file_security_struct *fsec;
195
196 fsec = kmalloc(sizeof(struct file_security_struct), GFP_ATOMIC);
197 if (!fsec)
198 return -ENOMEM;
199
200 memset(fsec, 0, sizeof(struct file_security_struct));
201 fsec->magic = SELINUX_MAGIC;
202 fsec->file = file;
203 if (tsec && tsec->magic == SELINUX_MAGIC) {
204 fsec->sid = tsec->sid;
205 fsec->fown_sid = tsec->sid;
206 } else {
207 fsec->sid = SECINITSID_UNLABELED;
208 fsec->fown_sid = SECINITSID_UNLABELED;
209 }
210 file->f_security = fsec;
211
212 return 0;
213}
214
215static void file_free_security(struct file *file)
216{
217 struct file_security_struct *fsec = file->f_security;
218
219 if (!fsec || fsec->magic != SELINUX_MAGIC)
220 return;
221
222 file->f_security = NULL;
223 kfree(fsec);
224}
225
226static int superblock_alloc_security(struct super_block *sb)
227{
228 struct superblock_security_struct *sbsec;
229
230 sbsec = kmalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
231 if (!sbsec)
232 return -ENOMEM;
233
234 memset(sbsec, 0, sizeof(struct superblock_security_struct));
235 init_MUTEX(&sbsec->sem);
236 INIT_LIST_HEAD(&sbsec->list);
237 INIT_LIST_HEAD(&sbsec->isec_head);
238 spin_lock_init(&sbsec->isec_lock);
239 sbsec->magic = SELINUX_MAGIC;
240 sbsec->sb = sb;
241 sbsec->sid = SECINITSID_UNLABELED;
242 sbsec->def_sid = SECINITSID_FILE;
243 sb->s_security = sbsec;
244
245 return 0;
246}
247
248static void superblock_free_security(struct super_block *sb)
249{
250 struct superblock_security_struct *sbsec = sb->s_security;
251
252 if (!sbsec || sbsec->magic != SELINUX_MAGIC)
253 return;
254
255 spin_lock(&sb_security_lock);
256 if (!list_empty(&sbsec->list))
257 list_del_init(&sbsec->list);
258 spin_unlock(&sb_security_lock);
259
260 sb->s_security = NULL;
261 kfree(sbsec);
262}
263
264#ifdef CONFIG_SECURITY_NETWORK
265static int sk_alloc_security(struct sock *sk, int family, int priority)
266{
267 struct sk_security_struct *ssec;
268
269 if (family != PF_UNIX)
270 return 0;
271
272 ssec = kmalloc(sizeof(*ssec), priority);
273 if (!ssec)
274 return -ENOMEM;
275
276 memset(ssec, 0, sizeof(*ssec));
277 ssec->magic = SELINUX_MAGIC;
278 ssec->sk = sk;
279 ssec->peer_sid = SECINITSID_UNLABELED;
280 sk->sk_security = ssec;
281
282 return 0;
283}
284
285static void sk_free_security(struct sock *sk)
286{
287 struct sk_security_struct *ssec = sk->sk_security;
288
289 if (sk->sk_family != PF_UNIX || ssec->magic != SELINUX_MAGIC)
290 return;
291
292 sk->sk_security = NULL;
293 kfree(ssec);
294}
295#endif /* CONFIG_SECURITY_NETWORK */
296
297/* The security server must be initialized before
298 any labeling or access decisions can be provided. */
299extern int ss_initialized;
300
301/* The file system's label must be initialized prior to use. */
302
303static char *labeling_behaviors[6] = {
304 "uses xattr",
305 "uses transition SIDs",
306 "uses task SIDs",
307 "uses genfs_contexts",
308 "not configured for labeling",
309 "uses mountpoint labeling",
310};
311
312static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
313
314static inline int inode_doinit(struct inode *inode)
315{
316 return inode_doinit_with_dentry(inode, NULL);
317}
318
319enum {
320 Opt_context = 1,
321 Opt_fscontext = 2,
322 Opt_defcontext = 4,
323};
324
325static match_table_t tokens = {
326 {Opt_context, "context=%s"},
327 {Opt_fscontext, "fscontext=%s"},
328 {Opt_defcontext, "defcontext=%s"},
329};
330
331#define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
332
333static int try_context_mount(struct super_block *sb, void *data)
334{
335 char *context = NULL, *defcontext = NULL;
336 const char *name;
337 u32 sid;
338 int alloc = 0, rc = 0, seen = 0;
339 struct task_security_struct *tsec = current->security;
340 struct superblock_security_struct *sbsec = sb->s_security;
341
342 if (!data)
343 goto out;
344
345 name = sb->s_type->name;
346
347 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
348
349 /* NFS we understand. */
350 if (!strcmp(name, "nfs")) {
351 struct nfs_mount_data *d = data;
352
353 if (d->version < NFS_MOUNT_VERSION)
354 goto out;
355
356 if (d->context[0]) {
357 context = d->context;
358 seen |= Opt_context;
359 }
360 } else
361 goto out;
362
363 } else {
364 /* Standard string-based options. */
365 char *p, *options = data;
366
367 while ((p = strsep(&options, ",")) != NULL) {
368 int token;
369 substring_t args[MAX_OPT_ARGS];
370
371 if (!*p)
372 continue;
373
374 token = match_token(p, tokens, args);
375
376 switch (token) {
377 case Opt_context:
378 if (seen) {
379 rc = -EINVAL;
380 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
381 goto out_free;
382 }
383 context = match_strdup(&args[0]);
384 if (!context) {
385 rc = -ENOMEM;
386 goto out_free;
387 }
388 if (!alloc)
389 alloc = 1;
390 seen |= Opt_context;
391 break;
392
393 case Opt_fscontext:
394 if (seen & (Opt_context|Opt_fscontext)) {
395 rc = -EINVAL;
396 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
397 goto out_free;
398 }
399 context = match_strdup(&args[0]);
400 if (!context) {
401 rc = -ENOMEM;
402 goto out_free;
403 }
404 if (!alloc)
405 alloc = 1;
406 seen |= Opt_fscontext;
407 break;
408
409 case Opt_defcontext:
410 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
411 rc = -EINVAL;
412 printk(KERN_WARNING "SELinux: "
413 "defcontext option is invalid "
414 "for this filesystem type\n");
415 goto out_free;
416 }
417 if (seen & (Opt_context|Opt_defcontext)) {
418 rc = -EINVAL;
419 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
420 goto out_free;
421 }
422 defcontext = match_strdup(&args[0]);
423 if (!defcontext) {
424 rc = -ENOMEM;
425 goto out_free;
426 }
427 if (!alloc)
428 alloc = 1;
429 seen |= Opt_defcontext;
430 break;
431
432 default:
433 rc = -EINVAL;
434 printk(KERN_WARNING "SELinux: unknown mount "
435 "option\n");
436 goto out_free;
437
438 }
439 }
440 }
441
442 if (!seen)
443 goto out;
444
445 if (context) {
446 rc = security_context_to_sid(context, strlen(context), &sid);
447 if (rc) {
448 printk(KERN_WARNING "SELinux: security_context_to_sid"
449 "(%s) failed for (dev %s, type %s) errno=%d\n",
450 context, sb->s_id, name, rc);
451 goto out_free;
452 }
453
454 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
455 FILESYSTEM__RELABELFROM, NULL);
456 if (rc)
457 goto out_free;
458
459 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
460 FILESYSTEM__RELABELTO, NULL);
461 if (rc)
462 goto out_free;
463
464 sbsec->sid = sid;
465
466 if (seen & Opt_context)
467 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
468 }
469
470 if (defcontext) {
471 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
472 if (rc) {
473 printk(KERN_WARNING "SELinux: security_context_to_sid"
474 "(%s) failed for (dev %s, type %s) errno=%d\n",
475 defcontext, sb->s_id, name, rc);
476 goto out_free;
477 }
478
479 if (sid == sbsec->def_sid)
480 goto out_free;
481
482 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
483 FILESYSTEM__RELABELFROM, NULL);
484 if (rc)
485 goto out_free;
486
487 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
488 FILESYSTEM__ASSOCIATE, NULL);
489 if (rc)
490 goto out_free;
491
492 sbsec->def_sid = sid;
493 }
494
495out_free:
496 if (alloc) {
497 kfree(context);
498 kfree(defcontext);
499 }
500out:
501 return rc;
502}
503
504static int superblock_doinit(struct super_block *sb, void *data)
505{
506 struct superblock_security_struct *sbsec = sb->s_security;
507 struct dentry *root = sb->s_root;
508 struct inode *inode = root->d_inode;
509 int rc = 0;
510
511 down(&sbsec->sem);
512 if (sbsec->initialized)
513 goto out;
514
515 if (!ss_initialized) {
516 /* Defer initialization until selinux_complete_init,
517 after the initial policy is loaded and the security
518 server is ready to handle calls. */
519 spin_lock(&sb_security_lock);
520 if (list_empty(&sbsec->list))
521 list_add(&sbsec->list, &superblock_security_head);
522 spin_unlock(&sb_security_lock);
523 goto out;
524 }
525
526 /* Determine the labeling behavior to use for this filesystem type. */
527 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
528 if (rc) {
529 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
530 __FUNCTION__, sb->s_type->name, rc);
531 goto out;
532 }
533
534 rc = try_context_mount(sb, data);
535 if (rc)
536 goto out;
537
538 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
539 /* Make sure that the xattr handler exists and that no
540 error other than -ENODATA is returned by getxattr on
541 the root directory. -ENODATA is ok, as this may be
542 the first boot of the SELinux kernel before we have
543 assigned xattr values to the filesystem. */
544 if (!inode->i_op->getxattr) {
545 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
546 "xattr support\n", sb->s_id, sb->s_type->name);
547 rc = -EOPNOTSUPP;
548 goto out;
549 }
550 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
551 if (rc < 0 && rc != -ENODATA) {
552 if (rc == -EOPNOTSUPP)
553 printk(KERN_WARNING "SELinux: (dev %s, type "
554 "%s) has no security xattr handler\n",
555 sb->s_id, sb->s_type->name);
556 else
557 printk(KERN_WARNING "SELinux: (dev %s, type "
558 "%s) getxattr errno %d\n", sb->s_id,
559 sb->s_type->name, -rc);
560 goto out;
561 }
562 }
563
564 if (strcmp(sb->s_type->name, "proc") == 0)
565 sbsec->proc = 1;
566
567 sbsec->initialized = 1;
568
569 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
570 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
571 sb->s_id, sb->s_type->name);
572 }
573 else {
574 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
575 sb->s_id, sb->s_type->name,
576 labeling_behaviors[sbsec->behavior-1]);
577 }
578
579 /* Initialize the root inode. */
580 rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
581
582 /* Initialize any other inodes associated with the superblock, e.g.
583 inodes created prior to initial policy load or inodes created
584 during get_sb by a pseudo filesystem that directly
585 populates itself. */
586 spin_lock(&sbsec->isec_lock);
587next_inode:
588 if (!list_empty(&sbsec->isec_head)) {
589 struct inode_security_struct *isec =
590 list_entry(sbsec->isec_head.next,
591 struct inode_security_struct, list);
592 struct inode *inode = isec->inode;
593 spin_unlock(&sbsec->isec_lock);
594 inode = igrab(inode);
595 if (inode) {
596 if (!IS_PRIVATE (inode))
597 inode_doinit(inode);
598 iput(inode);
599 }
600 spin_lock(&sbsec->isec_lock);
601 list_del_init(&isec->list);
602 goto next_inode;
603 }
604 spin_unlock(&sbsec->isec_lock);
605out:
606 up(&sbsec->sem);
607 return rc;
608}
609
610static inline u16 inode_mode_to_security_class(umode_t mode)
611{
612 switch (mode & S_IFMT) {
613 case S_IFSOCK:
614 return SECCLASS_SOCK_FILE;
615 case S_IFLNK:
616 return SECCLASS_LNK_FILE;
617 case S_IFREG:
618 return SECCLASS_FILE;
619 case S_IFBLK:
620 return SECCLASS_BLK_FILE;
621 case S_IFDIR:
622 return SECCLASS_DIR;
623 case S_IFCHR:
624 return SECCLASS_CHR_FILE;
625 case S_IFIFO:
626 return SECCLASS_FIFO_FILE;
627
628 }
629
630 return SECCLASS_FILE;
631}
632
633static inline u16 socket_type_to_security_class(int family, int type, int protocol)
634{
635 switch (family) {
636 case PF_UNIX:
637 switch (type) {
638 case SOCK_STREAM:
639 case SOCK_SEQPACKET:
640 return SECCLASS_UNIX_STREAM_SOCKET;
641 case SOCK_DGRAM:
642 return SECCLASS_UNIX_DGRAM_SOCKET;
643 }
644 break;
645 case PF_INET:
646 case PF_INET6:
647 switch (type) {
648 case SOCK_STREAM:
649 return SECCLASS_TCP_SOCKET;
650 case SOCK_DGRAM:
651 return SECCLASS_UDP_SOCKET;
652 case SOCK_RAW:
653 return SECCLASS_RAWIP_SOCKET;
654 }
655 break;
656 case PF_NETLINK:
657 switch (protocol) {
658 case NETLINK_ROUTE:
659 return SECCLASS_NETLINK_ROUTE_SOCKET;
660 case NETLINK_FIREWALL:
661 return SECCLASS_NETLINK_FIREWALL_SOCKET;
662 case NETLINK_TCPDIAG:
663 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
664 case NETLINK_NFLOG:
665 return SECCLASS_NETLINK_NFLOG_SOCKET;
666 case NETLINK_XFRM:
667 return SECCLASS_NETLINK_XFRM_SOCKET;
668 case NETLINK_SELINUX:
669 return SECCLASS_NETLINK_SELINUX_SOCKET;
670 case NETLINK_AUDIT:
671 return SECCLASS_NETLINK_AUDIT_SOCKET;
672 case NETLINK_IP6_FW:
673 return SECCLASS_NETLINK_IP6FW_SOCKET;
674 case NETLINK_DNRTMSG:
675 return SECCLASS_NETLINK_DNRT_SOCKET;
0c9b7942
JM		 676 case NETLINK_KOBJECT_UEVENT:
677 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1da177e4
LT		 678 default:
679 return SECCLASS_NETLINK_SOCKET;
680 }
681 case PF_PACKET:
682 return SECCLASS_PACKET_SOCKET;
683 case PF_KEY:
684 return SECCLASS_KEY_SOCKET;
685 }
686
687 return SECCLASS_SOCKET;
688}
689
690#ifdef CONFIG_PROC_FS
691static int selinux_proc_get_sid(struct proc_dir_entry *de,
692 u16 tclass,
693 u32 *sid)
694{
695 int buflen, rc;
696 char *buffer, *path, *end;
697
698 buffer = (char*)__get_free_page(GFP_KERNEL);
699 if (!buffer)
700 return -ENOMEM;
701
702 buflen = PAGE_SIZE;
703 end = buffer+buflen;
704 *--end = '\0';
705 buflen--;
706 path = end-1;
707 *path = '/';
708 while (de && de != de->parent) {
709 buflen -= de->namelen + 1;
710 if (buflen < 0)
711 break;
712 end -= de->namelen;
713 memcpy(end, de->name, de->namelen);
714 *--end = '/';
715 path = end;
716 de = de->parent;
717 }
718 rc = security_genfs_sid("proc", path, tclass, sid);
719 free_page((unsigned long)buffer);
720 return rc;
721}
722#else
723static int selinux_proc_get_sid(struct proc_dir_entry *de,
724 u16 tclass,
725 u32 *sid)
726{
727 return -EINVAL;
728}
729#endif
730
731/* The inode's security attributes must be initialized before first use. */
732static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
733{
734 struct superblock_security_struct *sbsec = NULL;
735 struct inode_security_struct *isec = inode->i_security;
736 u32 sid;
737 struct dentry *dentry;
738#define INITCONTEXTLEN 255
739 char *context = NULL;
740 unsigned len = 0;
741 int rc = 0;
742 int hold_sem = 0;
743
744 if (isec->initialized)
745 goto out;
746
747 down(&isec->sem);
748 hold_sem = 1;
749 if (isec->initialized)
750 goto out;
751
752 sbsec = inode->i_sb->s_security;
753 if (!sbsec->initialized) {
754 /* Defer initialization until selinux_complete_init,
755 after the initial policy is loaded and the security
756 server is ready to handle calls. */
757 spin_lock(&sbsec->isec_lock);
758 if (list_empty(&isec->list))
759 list_add(&isec->list, &sbsec->isec_head);
760 spin_unlock(&sbsec->isec_lock);
761 goto out;
762 }
763
764 switch (sbsec->behavior) {
765 case SECURITY_FS_USE_XATTR:
766 if (!inode->i_op->getxattr) {
767 isec->sid = sbsec->def_sid;
768 break;
769 }
770
771 /* Need a dentry, since the xattr API requires one.
772 Life would be simpler if we could just pass the inode. */
773 if (opt_dentry) {
774 /* Called from d_instantiate or d_splice_alias. */
775 dentry = dget(opt_dentry);
776 } else {
777 /* Called from selinux_complete_init, try to find a dentry. */
778 dentry = d_find_alias(inode);
779 }
780 if (!dentry) {
781 printk(KERN_WARNING "%s: no dentry for dev=%s "
782 "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
783 inode->i_ino);
784 goto out;
785 }
786
787 len = INITCONTEXTLEN;
788 context = kmalloc(len, GFP_KERNEL);
789 if (!context) {
790 rc = -ENOMEM;
791 dput(dentry);
792 goto out;
793 }
794 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
795 context, len);
796 if (rc == -ERANGE) {
797 /* Need a larger buffer. Query for the right size. */
798 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
799 NULL, 0);
800 if (rc < 0) {
801 dput(dentry);
802 goto out;
803 }
804 kfree(context);
805 len = rc;
806 context = kmalloc(len, GFP_KERNEL);
807 if (!context) {
808 rc = -ENOMEM;
809 dput(dentry);
810 goto out;
811 }
812 rc = inode->i_op->getxattr(dentry,
813 XATTR_NAME_SELINUX,
814 context, len);
815 }
816 dput(dentry);
817 if (rc < 0) {
818 if (rc != -ENODATA) {
819 printk(KERN_WARNING "%s: getxattr returned "
820 "%d for dev=%s ino=%ld\n", __FUNCTION__,
821 -rc, inode->i_sb->s_id, inode->i_ino);
822 kfree(context);
823 goto out;
824 }
825 /* Map ENODATA to the default file SID */
826 sid = sbsec->def_sid;
827 rc = 0;
828 } else {
829 rc = security_context_to_sid(context, rc, &sid);
830 if (rc) {
831 printk(KERN_WARNING "%s: context_to_sid(%s) "
832 "returned %d for dev=%s ino=%ld\n",
833 __FUNCTION__, context, -rc,
834 inode->i_sb->s_id, inode->i_ino);
835 kfree(context);
836 /* Leave with the unlabeled SID */
837 rc = 0;
838 break;
839 }
840 }
841 kfree(context);
842 isec->sid = sid;
843 break;
844 case SECURITY_FS_USE_TASK:
845 isec->sid = isec->task_sid;
846 break;
847 case SECURITY_FS_USE_TRANS:
848 /* Default to the fs SID. */
849 isec->sid = sbsec->sid;
850
851 /* Try to obtain a transition SID. */
852 isec->sclass = inode_mode_to_security_class(inode->i_mode);
853 rc = security_transition_sid(isec->task_sid,
854 sbsec->sid,
855 isec->sclass,
856 &sid);
857 if (rc)
858 goto out;
859 isec->sid = sid;
860 break;
861 default:
862 /* Default to the fs SID. */
863 isec->sid = sbsec->sid;
864
865 if (sbsec->proc) {
866 struct proc_inode *proci = PROC_I(inode);
867 if (proci->pde) {
868 isec->sclass = inode_mode_to_security_class(inode->i_mode);
869 rc = selinux_proc_get_sid(proci->pde,
870 isec->sclass,
871 &sid);
872 if (rc)
873 goto out;
874 isec->sid = sid;
875 }
876 }
877 break;
878 }
879
880 isec->initialized = 1;
881
882out:
883 if (isec->sclass == SECCLASS_FILE)
884 isec->sclass = inode_mode_to_security_class(inode->i_mode);
885
886 if (hold_sem)
887 up(&isec->sem);
888 return rc;
889}
890
891/* Convert a Linux signal to an access vector. */
892static inline u32 signal_to_av(int sig)
893{
894 u32 perm = 0;
895
896 switch (sig) {
897 case SIGCHLD:
898 /* Commonly granted from child to parent. */
899 perm = PROCESS__SIGCHLD;
900 break;
901 case SIGKILL:
902 /* Cannot be caught or ignored */
903 perm = PROCESS__SIGKILL;
904 break;
905 case SIGSTOP:
906 /* Cannot be caught or ignored */
907 perm = PROCESS__SIGSTOP;
908 break;
909 default:
910 /* All other signals. */
911 perm = PROCESS__SIGNAL;
912 break;
913 }
914
915 return perm;
916}
917
918/* Check permission betweeen a pair of tasks, e.g. signal checks,
919 fork check, ptrace check, etc. */
920static int task_has_perm(struct task_struct *tsk1,
921 struct task_struct *tsk2,
922 u32 perms)
923{
924 struct task_security_struct *tsec1, *tsec2;
925
926 tsec1 = tsk1->security;
927 tsec2 = tsk2->security;
928 return avc_has_perm(tsec1->sid, tsec2->sid,
929 SECCLASS_PROCESS, perms, NULL);
930}
931
932/* Check whether a task is allowed to use a capability. */
933static int task_has_capability(struct task_struct *tsk,
934 int cap)
935{
936 struct task_security_struct *tsec;
937 struct avc_audit_data ad;
938
939 tsec = tsk->security;
940
941 AVC_AUDIT_DATA_INIT(&ad,CAP);
942 ad.tsk = tsk;
943 ad.u.cap = cap;
944
945 return avc_has_perm(tsec->sid, tsec->sid,
946 SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
947}
948
949/* Check whether a task is allowed to use a system operation. */
950static int task_has_system(struct task_struct *tsk,
951 u32 perms)
952{
953 struct task_security_struct *tsec;
954
955 tsec = tsk->security;
956
957 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
958 SECCLASS_SYSTEM, perms, NULL);
959}
960
961/* Check whether a task has a particular permission to an inode.
962 The 'adp' parameter is optional and allows other audit
963 data to be passed (e.g. the dentry). */
964static int inode_has_perm(struct task_struct *tsk,
965 struct inode *inode,
966 u32 perms,
967 struct avc_audit_data *adp)
968{
969 struct task_security_struct *tsec;
970 struct inode_security_struct *isec;
971 struct avc_audit_data ad;
972
973 tsec = tsk->security;
974 isec = inode->i_security;
975
976 if (!adp) {
977 adp = &ad;
978 AVC_AUDIT_DATA_INIT(&ad, FS);
979 ad.u.fs.inode = inode;
980 }
981
982 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
983}
984
985/* Same as inode_has_perm, but pass explicit audit data containing
986 the dentry to help the auditing code to more easily generate the
987 pathname if needed. */
988static inline int dentry_has_perm(struct task_struct *tsk,
989 struct vfsmount *mnt,
990 struct dentry *dentry,
991 u32 av)
992{
993 struct inode *inode = dentry->d_inode;
994 struct avc_audit_data ad;
995 AVC_AUDIT_DATA_INIT(&ad,FS);
996 ad.u.fs.mnt = mnt;
997 ad.u.fs.dentry = dentry;
998 return inode_has_perm(tsk, inode, av, &ad);
999}
1000
1001/* Check whether a task can use an open file descriptor to
1002 access an inode in a given way. Check access to the
1003 descriptor itself, and then use dentry_has_perm to
1004 check a particular permission to the file.
1005 Access to the descriptor is implicitly granted if it
1006 has the same SID as the process. If av is zero, then
1007 access to the file is not checked, e.g. for cases
1008 where only the descriptor is affected like seek. */
1009static inline int file_has_perm(struct task_struct *tsk,
1010 struct file *file,
1011 u32 av)
1012{
1013 struct task_security_struct *tsec = tsk->security;
1014 struct file_security_struct *fsec = file->f_security;
1015 struct vfsmount *mnt = file->f_vfsmnt;
1016 struct dentry *dentry = file->f_dentry;
1017 struct inode *inode = dentry->d_inode;
1018 struct avc_audit_data ad;
1019 int rc;
1020
1021 AVC_AUDIT_DATA_INIT(&ad, FS);
1022 ad.u.fs.mnt = mnt;
1023 ad.u.fs.dentry = dentry;
1024
1025 if (tsec->sid != fsec->sid) {
1026 rc = avc_has_perm(tsec->sid, fsec->sid,
1027 SECCLASS_FD,
1028 FD__USE,
1029 &ad);
1030 if (rc)
1031 return rc;
1032 }
1033
1034 /* av is zero if only checking access to the descriptor. */
1035 if (av)
1036 return inode_has_perm(tsk, inode, av, &ad);
1037
1038 return 0;
1039}
1040
1041/* Check whether a task can create a file. */
1042static int may_create(struct inode *dir,
1043 struct dentry *dentry,
1044 u16 tclass)
1045{
1046 struct task_security_struct *tsec;
1047 struct inode_security_struct *dsec;
1048 struct superblock_security_struct *sbsec;
1049 u32 newsid;
1050 struct avc_audit_data ad;
1051 int rc;
1052
1053 tsec = current->security;
1054 dsec = dir->i_security;
1055 sbsec = dir->i_sb->s_security;
1056
1057 AVC_AUDIT_DATA_INIT(&ad, FS);
1058 ad.u.fs.dentry = dentry;
1059
1060 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1061 DIR__ADD_NAME | DIR__SEARCH,
1062 &ad);
1063 if (rc)
1064 return rc;
1065
1066 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1067 newsid = tsec->create_sid;
1068 } else {
1069 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1070 &newsid);
1071 if (rc)
1072 return rc;
1073 }
1074
1075 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1076 if (rc)
1077 return rc;
1078
1079 return avc_has_perm(newsid, sbsec->sid,
1080 SECCLASS_FILESYSTEM,
1081 FILESYSTEM__ASSOCIATE, &ad);
1082}
1083
1084#define MAY_LINK 0
1085#define MAY_UNLINK 1
1086#define MAY_RMDIR 2
1087
1088/* Check whether a task can link, unlink, or rmdir a file/directory. */
1089static int may_link(struct inode *dir,
1090 struct dentry *dentry,
1091 int kind)
1092
1093{
1094 struct task_security_struct *tsec;
1095 struct inode_security_struct *dsec, *isec;
1096 struct avc_audit_data ad;
1097 u32 av;
1098 int rc;
1099
1100 tsec = current->security;
1101 dsec = dir->i_security;
1102 isec = dentry->d_inode->i_security;
1103
1104 AVC_AUDIT_DATA_INIT(&ad, FS);
1105 ad.u.fs.dentry = dentry;
1106
1107 av = DIR__SEARCH;
1108 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1109 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1110 if (rc)
1111 return rc;
1112
1113 switch (kind) {
1114 case MAY_LINK:
1115 av = FILE__LINK;
1116 break;
1117 case MAY_UNLINK:
1118 av = FILE__UNLINK;
1119 break;
1120 case MAY_RMDIR:
1121 av = DIR__RMDIR;
1122 break;
1123 default:
1124 printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
1125 return 0;
1126 }
1127
1128 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1129 return rc;
1130}
1131
1132static inline int may_rename(struct inode *old_dir,
1133 struct dentry *old_dentry,
1134 struct inode *new_dir,
1135 struct dentry *new_dentry)
1136{
1137 struct task_security_struct *tsec;
1138 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1139 struct avc_audit_data ad;
1140 u32 av;
1141 int old_is_dir, new_is_dir;
1142 int rc;
1143
1144 tsec = current->security;
1145 old_dsec = old_dir->i_security;
1146 old_isec = old_dentry->d_inode->i_security;
1147 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1148 new_dsec = new_dir->i_security;
1149
1150 AVC_AUDIT_DATA_INIT(&ad, FS);
1151
1152 ad.u.fs.dentry = old_dentry;
1153 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1154 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1155 if (rc)
1156 return rc;
1157 rc = avc_has_perm(tsec->sid, old_isec->sid,
1158 old_isec->sclass, FILE__RENAME, &ad);
1159 if (rc)
1160 return rc;
1161 if (old_is_dir && new_dir != old_dir) {
1162 rc = avc_has_perm(tsec->sid, old_isec->sid,
1163 old_isec->sclass, DIR__REPARENT, &ad);
1164 if (rc)
1165 return rc;
1166 }
1167
1168 ad.u.fs.dentry = new_dentry;
1169 av = DIR__ADD_NAME | DIR__SEARCH;
1170 if (new_dentry->d_inode)
1171 av |= DIR__REMOVE_NAME;
1172 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1173 if (rc)
1174 return rc;
1175 if (new_dentry->d_inode) {
1176 new_isec = new_dentry->d_inode->i_security;
1177 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1178 rc = avc_has_perm(tsec->sid, new_isec->sid,
1179 new_isec->sclass,
1180 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1181 if (rc)
1182 return rc;
1183 }
1184
1185 return 0;
1186}
1187
1188/* Check whether a task can perform a filesystem operation. */
1189static int superblock_has_perm(struct task_struct *tsk,
1190 struct super_block *sb,
1191 u32 perms,
1192 struct avc_audit_data *ad)
1193{
1194 struct task_security_struct *tsec;
1195 struct superblock_security_struct *sbsec;
1196
1197 tsec = tsk->security;
1198 sbsec = sb->s_security;
1199 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1200 perms, ad);
1201}
1202
1203/* Convert a Linux mode and permission mask to an access vector. */
1204static inline u32 file_mask_to_av(int mode, int mask)
1205{
1206 u32 av = 0;
1207
1208 if ((mode & S_IFMT) != S_IFDIR) {
1209 if (mask & MAY_EXEC)
1210 av |= FILE__EXECUTE;
1211 if (mask & MAY_READ)
1212 av |= FILE__READ;
1213
1214 if (mask & MAY_APPEND)
1215 av |= FILE__APPEND;
1216 else if (mask & MAY_WRITE)
1217 av |= FILE__WRITE;
1218
1219 } else {
1220 if (mask & MAY_EXEC)
1221 av |= DIR__SEARCH;
1222 if (mask & MAY_WRITE)
1223 av |= DIR__WRITE;
1224 if (mask & MAY_READ)
1225 av |= DIR__READ;
1226 }
1227
1228 return av;
1229}
1230
1231/* Convert a Linux file to an access vector. */
1232static inline u32 file_to_av(struct file *file)
1233{
1234 u32 av = 0;
1235
1236 if (file->f_mode & FMODE_READ)
1237 av |= FILE__READ;
1238 if (file->f_mode & FMODE_WRITE) {
1239 if (file->f_flags & O_APPEND)
1240 av |= FILE__APPEND;
1241 else
1242 av |= FILE__WRITE;
1243 }
1244
1245 return av;
1246}
1247
1248/* Set an inode's SID to a specified value. */
1249static int inode_security_set_sid(struct inode *inode, u32 sid)
1250{
1251 struct inode_security_struct *isec = inode->i_security;
1252 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
1253
1254 if (!sbsec->initialized) {
1255 /* Defer initialization to selinux_complete_init. */
1256 return 0;
1257 }
1258
1259 down(&isec->sem);
1260 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1261 isec->sid = sid;
1262 isec->initialized = 1;
1263 up(&isec->sem);
1264 return 0;
1265}
1266
1267/* Set the security attributes on a newly created file. */
1268static int post_create(struct inode *dir,
1269 struct dentry *dentry)
1270{
1271
1272 struct task_security_struct *tsec;
1273 struct inode *inode;
1274 struct inode_security_struct *dsec;
1275 struct superblock_security_struct *sbsec;
1276 u32 newsid;
1277 char *context;
1278 unsigned int len;
1279 int rc;
1280
1281 tsec = current->security;
1282 dsec = dir->i_security;
1283 sbsec = dir->i_sb->s_security;
1284
1285 inode = dentry->d_inode;
1286 if (!inode) {
1287 /* Some file system types (e.g. NFS) may not instantiate
1288 a dentry for all create operations (e.g. symlink),
1289 so we have to check to see if the inode is non-NULL. */
1290 printk(KERN_WARNING "post_create: no inode, dir (dev=%s, "
1291 "ino=%ld)\n", dir->i_sb->s_id, dir->i_ino);
1292 return 0;
1293 }
1294
1295 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1296 newsid = tsec->create_sid;
1297 } else {
1298 rc = security_transition_sid(tsec->sid, dsec->sid,
1299 inode_mode_to_security_class(inode->i_mode),
1300 &newsid);
1301 if (rc) {
1302 printk(KERN_WARNING "post_create: "
1303 "security_transition_sid failed, rc=%d (dev=%s "
1304 "ino=%ld)\n",
1305 -rc, inode->i_sb->s_id, inode->i_ino);
1306 return rc;
1307 }
1308 }
1309
1310 rc = inode_security_set_sid(inode, newsid);
1311 if (rc) {
1312 printk(KERN_WARNING "post_create: inode_security_set_sid "
1313 "failed, rc=%d (dev=%s ino=%ld)\n",
1314 -rc, inode->i_sb->s_id, inode->i_ino);
1315 return rc;
1316 }
1317
1318 if (sbsec->behavior == SECURITY_FS_USE_XATTR &&
1319 inode->i_op->setxattr) {
1320 /* Use extended attributes. */
1321 rc = security_sid_to_context(newsid, &context, &len);
1322 if (rc) {
1323 printk(KERN_WARNING "post_create: sid_to_context "
1324 "failed, rc=%d (dev=%s ino=%ld)\n",
1325 -rc, inode->i_sb->s_id, inode->i_ino);
1326 return rc;
1327 }
1328 down(&inode->i_sem);
1329 rc = inode->i_op->setxattr(dentry,
1330 XATTR_NAME_SELINUX,
1331 context, len, 0);
1332 up(&inode->i_sem);
1333 kfree(context);
1334 if (rc < 0) {
1335 printk(KERN_WARNING "post_create: setxattr failed, "
1336 "rc=%d (dev=%s ino=%ld)\n",
1337 -rc, inode->i_sb->s_id, inode->i_ino);
1338 return rc;
1339 }
1340 }
1341
1342 return 0;
1343}
1344
1345
1346/* Hook functions begin here. */
1347
1348static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1349{
1350 struct task_security_struct *psec = parent->security;
1351 struct task_security_struct *csec = child->security;
1352 int rc;
1353
1354 rc = secondary_ops->ptrace(parent,child);
1355 if (rc)
1356 return rc;
1357
1358 rc = task_has_perm(parent, child, PROCESS__PTRACE);
1359 /* Save the SID of the tracing process for later use in apply_creds. */
1360 if (!rc)
1361 csec->ptrace_sid = psec->sid;
1362 return rc;
1363}
1364
1365static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1366 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1367{
1368 int error;
1369
1370 error = task_has_perm(current, target, PROCESS__GETCAP);
1371 if (error)
1372 return error;
1373
1374 return secondary_ops->capget(target, effective, inheritable, permitted);
1375}
1376
1377static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1378 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1379{
1380 int error;
1381
1382 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1383 if (error)
1384 return error;
1385
1386 return task_has_perm(current, target, PROCESS__SETCAP);
1387}
1388
1389static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1390 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1391{
1392 secondary_ops->capset_set(target, effective, inheritable, permitted);
1393}
1394
1395static int selinux_capable(struct task_struct *tsk, int cap)
1396{
1397 int rc;
1398
1399 rc = secondary_ops->capable(tsk, cap);
1400 if (rc)
1401 return rc;
1402
1403 return task_has_capability(tsk,cap);
1404}
1405
1406static int selinux_sysctl(ctl_table *table, int op)
1407{
1408 int error = 0;
1409 u32 av;
1410 struct task_security_struct *tsec;
1411 u32 tsid;
1412 int rc;
1413
1414 rc = secondary_ops->sysctl(table, op);
1415 if (rc)
1416 return rc;
1417
1418 tsec = current->security;
1419
1420 rc = selinux_proc_get_sid(table->de, (op == 001) ?
1421 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1422 if (rc) {
1423 /* Default to the well-defined sysctl SID. */
1424 tsid = SECINITSID_SYSCTL;
1425 }
1426
1427 /* The op values are "defined" in sysctl.c, thereby creating
1428 * a bad coupling between this module and sysctl.c */
1429 if(op == 001) {
1430 error = avc_has_perm(tsec->sid, tsid,
1431 SECCLASS_DIR, DIR__SEARCH, NULL);
1432 } else {
1433 av = 0;
1434 if (op & 004)
1435 av |= FILE__READ;
1436 if (op & 002)
1437 av |= FILE__WRITE;
1438 if (av)
1439 error = avc_has_perm(tsec->sid, tsid,
1440 SECCLASS_FILE, av, NULL);
1441 }
1442
1443 return error;
1444}
1445
1446static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1447{
1448 int rc = 0;
1449
1450 if (!sb)
1451 return 0;
1452
1453 switch (cmds) {
1454 case Q_SYNC:
1455 case Q_QUOTAON:
1456 case Q_QUOTAOFF:
1457 case Q_SETINFO:
1458 case Q_SETQUOTA:
1459 rc = superblock_has_perm(current,
1460 sb,
1461 FILESYSTEM__QUOTAMOD, NULL);
1462 break;
1463 case Q_GETFMT:
1464 case Q_GETINFO:
1465 case Q_GETQUOTA:
1466 rc = superblock_has_perm(current,
1467 sb,
1468 FILESYSTEM__QUOTAGET, NULL);
1469 break;
1470 default:
1471 rc = 0; /* let the kernel handle invalid cmds */
1472 break;
1473 }
1474 return rc;
1475}
1476
1477static int selinux_quota_on(struct dentry *dentry)
1478{
1479 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1480}
1481
1482static int selinux_syslog(int type)
1483{
1484 int rc;
1485
1486 rc = secondary_ops->syslog(type);
1487 if (rc)
1488 return rc;
1489
1490 switch (type) {
1491 case 3: /* Read last kernel messages */
1492 case 10: /* Return size of the log buffer */
1493 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1494 break;
1495 case 6: /* Disable logging to console */
1496 case 7: /* Enable logging to console */
1497 case 8: /* Set level of messages printed to console */
1498 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1499 break;
1500 case 0: /* Close log */
1501 case 1: /* Open log */
1502 case 2: /* Read from log */
1503 case 4: /* Read/clear last kernel messages */
1504 case 5: /* Clear ring buffer */
1505 default:
1506 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1507 break;
1508 }
1509 return rc;
1510}
1511
1512/*
1513 * Check that a process has enough memory to allocate a new virtual
1514 * mapping. 0 means there is enough memory for the allocation to
1515 * succeed and -ENOMEM implies there is not.
1516 *
1517 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1518 * if the capability is granted, but __vm_enough_memory requires 1 if
1519 * the capability is granted.
1520 *
1521 * Do not audit the selinux permission check, as this is applied to all
1522 * processes that allocate mappings.
1523 */
1524static int selinux_vm_enough_memory(long pages)
1525{
1526 int rc, cap_sys_admin = 0;
1527 struct task_security_struct *tsec = current->security;
1528
1529 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1530 if (rc == 0)
1531 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1532 SECCLASS_CAPABILITY,
1533 CAP_TO_MASK(CAP_SYS_ADMIN),
1534 NULL);
1535
1536 if (rc == 0)
1537 cap_sys_admin = 1;
1538
1539 return __vm_enough_memory(pages, cap_sys_admin);
1540}
1541
1542/* binprm security operations */
1543
1544static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1545{
1546 struct bprm_security_struct *bsec;
1547
1548 bsec = kmalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1549 if (!bsec)
1550 return -ENOMEM;
1551
1552 memset(bsec, 0, sizeof *bsec);
1553 bsec->magic = SELINUX_MAGIC;
1554 bsec->bprm = bprm;
1555 bsec->sid = SECINITSID_UNLABELED;
1556 bsec->set = 0;
1557
1558 bprm->security = bsec;
1559 return 0;
1560}
1561
1562static int selinux_bprm_set_security(struct linux_binprm *bprm)
1563{
1564 struct task_security_struct *tsec;
1565 struct inode *inode = bprm->file->f_dentry->d_inode;
1566 struct inode_security_struct *isec;
1567 struct bprm_security_struct *bsec;
1568 u32 newsid;
1569 struct avc_audit_data ad;
1570 int rc;
1571
1572 rc = secondary_ops->bprm_set_security(bprm);
1573 if (rc)
1574 return rc;
1575
1576 bsec = bprm->security;
1577
1578 if (bsec->set)
1579 return 0;
1580
1581 tsec = current->security;
1582 isec = inode->i_security;
1583
1584 /* Default to the current task SID. */
1585 bsec->sid = tsec->sid;
1586
1587 /* Reset create SID on execve. */
1588 tsec->create_sid = 0;
1589
1590 if (tsec->exec_sid) {
1591 newsid = tsec->exec_sid;
1592 /* Reset exec SID on execve. */
1593 tsec->exec_sid = 0;
1594 } else {
1595 /* Check for a default transition on this program. */
1596 rc = security_transition_sid(tsec->sid, isec->sid,
1597 SECCLASS_PROCESS, &newsid);
1598 if (rc)
1599 return rc;
1600 }
1601
1602 AVC_AUDIT_DATA_INIT(&ad, FS);
1603 ad.u.fs.mnt = bprm->file->f_vfsmnt;
1604 ad.u.fs.dentry = bprm->file->f_dentry;
1605
1606 if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
1607 newsid = tsec->sid;
1608
1609 if (tsec->sid == newsid) {
1610 rc = avc_has_perm(tsec->sid, isec->sid,
1611 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1612 if (rc)
1613 return rc;
1614 } else {
1615 /* Check permissions for the transition. */
1616 rc = avc_has_perm(tsec->sid, newsid,
1617 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1618 if (rc)
1619 return rc;
1620
1621 rc = avc_has_perm(newsid, isec->sid,
1622 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1623 if (rc)
1624 return rc;
1625
1626 /* Clear any possibly unsafe personality bits on exec: */
1627 current->personality &= ~PER_CLEAR_ON_SETID;
1628
1629 /* Set the security field to the new SID. */
1630 bsec->sid = newsid;
1631 }
1632
1633 bsec->set = 1;
1634 return 0;
1635}
1636
1637static int selinux_bprm_check_security (struct linux_binprm *bprm)
1638{
1639 return secondary_ops->bprm_check_security(bprm);
1640}
1641
1642
1643static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1644{
1645 struct task_security_struct *tsec = current->security;
1646 int atsecure = 0;
1647
1648 if (tsec->osid != tsec->sid) {
1649 /* Enable secure mode for SIDs transitions unless
1650 the noatsecure permission is granted between
1651 the two SIDs, i.e. ahp returns 0. */
1652 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1653 SECCLASS_PROCESS,
1654 PROCESS__NOATSECURE, NULL);
1655 }
1656
1657 return (atsecure || secondary_ops->bprm_secureexec(bprm));
1658}
1659
1660static void selinux_bprm_free_security(struct linux_binprm *bprm)
1661{
9a5f04bf 1662 kfree(bprm->security);
1da177e4 1663 bprm->security = NULL;
1da177e4
LT		 1664}
1665
1666extern struct vfsmount *selinuxfs_mount;
1667extern struct dentry *selinux_null;
1668
1669/* Derived from fs/exec.c:flush_old_files. */
1670static inline void flush_unauthorized_files(struct files_struct * files)
1671{
1672 struct avc_audit_data ad;
1673 struct file *file, *devnull = NULL;
1674 struct tty_struct *tty = current->signal->tty;
1675 long j = -1;
1676
1677 if (tty) {
1678 file_list_lock();
1679 file = list_entry(tty->tty_files.next, typeof(*file), f_list);
1680 if (file) {
1681 /* Revalidate access to controlling tty.
1682 Use inode_has_perm on the tty inode directly rather
1683 than using file_has_perm, as this particular open
1684 file may belong to another process and we are only
1685 interested in the inode-based check here. */
1686 struct inode *inode = file->f_dentry->d_inode;
1687 if (inode_has_perm(current, inode,
1688 FILE__READ | FILE__WRITE, NULL)) {
1689 /* Reset controlling tty. */
1690 current->signal->tty = NULL;
1691 current->signal->tty_old_pgrp = 0;
1692 }
1693 }
1694 file_list_unlock();
1695 }
1696
1697 /* Revalidate access to inherited open files. */
1698
1699 AVC_AUDIT_DATA_INIT(&ad,FS);
1700
1701 spin_lock(&files->file_lock);
1702 for (;;) {
1703 unsigned long set, i;
1704 int fd;
1705
1706 j++;
1707 i = j * __NFDBITS;
1708 if (i >= files->max_fds || i >= files->max_fdset)
1709 break;
1710 set = files->open_fds->fds_bits[j];
1711 if (!set)
1712 continue;
1713 spin_unlock(&files->file_lock);
1714 for ( ; set ; i++,set >>= 1) {
1715 if (set & 1) {
1716 file = fget(i);
1717 if (!file)
1718 continue;
1719 if (file_has_perm(current,
1720 file,
1721 file_to_av(file))) {
1722 sys_close(i);
1723 fd = get_unused_fd();
1724 if (fd != i) {
1725 if (fd >= 0)
1726 put_unused_fd(fd);
1727 fput(file);
1728 continue;
1729 }
1730 if (devnull) {
1731 atomic_inc(&devnull->f_count);
1732 } else {
1733 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1734 if (!devnull) {
1735 put_unused_fd(fd);
1736 fput(file);
1737 continue;
1738 }
1739 }
1740 fd_install(fd, devnull);
1741 }
1742 fput(file);
1743 }
1744 }
1745 spin_lock(&files->file_lock);
1746
1747 }
1748 spin_unlock(&files->file_lock);
1749}
1750
1751static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1752{
1753 struct task_security_struct *tsec;
1754 struct bprm_security_struct *bsec;
1755 u32 sid;
1756 int rc;
1757
1758 secondary_ops->bprm_apply_creds(bprm, unsafe);
1759
1760 tsec = current->security;
1761
1762 bsec = bprm->security;
1763 sid = bsec->sid;
1764
1765 tsec->osid = tsec->sid;
1766 bsec->unsafe = 0;
1767 if (tsec->sid != sid) {
1768 /* Check for shared state. If not ok, leave SID
1769 unchanged and kill. */
1770 if (unsafe & LSM_UNSAFE_SHARE) {
1771 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1772 PROCESS__SHARE, NULL);
1773 if (rc) {
1774 bsec->unsafe = 1;
1775 return;
1776 }
1777 }
1778
1779 /* Check for ptracing, and update the task SID if ok.
1780 Otherwise, leave SID unchanged and kill. */
1781 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1782 rc = avc_has_perm(tsec->ptrace_sid, sid,
1783 SECCLASS_PROCESS, PROCESS__PTRACE,
1784 NULL);
1785 if (rc) {
1786 bsec->unsafe = 1;
1787 return;
1788 }
1789 }
1790 tsec->sid = sid;
1791 }
1792}
1793
1794/*
1795 * called after apply_creds without the task lock held
1796 */
1797static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1798{
1799 struct task_security_struct *tsec;
1800 struct rlimit *rlim, *initrlim;
1801 struct itimerval itimer;
1802 struct bprm_security_struct *bsec;
1803 int rc, i;
1804
1805 tsec = current->security;
1806 bsec = bprm->security;
1807
1808 if (bsec->unsafe) {
1809 force_sig_specific(SIGKILL, current);
1810 return;
1811 }
1812 if (tsec->osid == tsec->sid)
1813 return;
1814
1815 /* Close files for which the new task SID is not authorized. */
1816 flush_unauthorized_files(current->files);
1817
1818 /* Check whether the new SID can inherit signal state
1819 from the old SID. If not, clear itimers to avoid
1820 subsequent signal generation and flush and unblock
1821 signals. This must occur _after_ the task SID has
1822 been updated so that any kill done after the flush
1823 will be checked against the new SID. */
1824 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1825 PROCESS__SIGINH, NULL);
1826 if (rc) {
1827 memset(&itimer, 0, sizeof itimer);
1828 for (i = 0; i < 3; i++)
1829 do_setitimer(i, &itimer, NULL);
1830 flush_signals(current);
1831 spin_lock_irq(&current->sighand->siglock);
1832 flush_signal_handlers(current, 1);
1833 sigemptyset(&current->blocked);
1834 recalc_sigpending();
1835 spin_unlock_irq(&current->sighand->siglock);
1836 }
1837
1838 /* Check whether the new SID can inherit resource limits
1839 from the old SID. If not, reset all soft limits to
1840 the lower of the current task's hard limit and the init
1841 task's soft limit. Note that the setting of hard limits
1842 (even to lower them) can be controlled by the setrlimit
1843 check. The inclusion of the init task's soft limit into
1844 the computation is to avoid resetting soft limits higher
1845 than the default soft limit for cases where the default
1846 is lower than the hard limit, e.g. RLIMIT_CORE or
1847 RLIMIT_STACK.*/
1848 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1849 PROCESS__RLIMITINH, NULL);
1850 if (rc) {
1851 for (i = 0; i < RLIM_NLIMITS; i++) {
1852 rlim = current->signal->rlim + i;
1853 initrlim = init_task.signal->rlim+i;
1854 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1855 }
1856 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1857 /*
1858 * This will cause RLIMIT_CPU calculations
1859 * to be refigured.
1860 */
1861 current->it_prof_expires = jiffies_to_cputime(1);
1862 }
1863 }
1864
1865 /* Wake up the parent if it is waiting so that it can
1866 recheck wait permission to the new task SID. */
1867 wake_up_interruptible(&current->parent->signal->wait_chldexit);
1868}
1869
1870/* superblock security operations */
1871
1872static int selinux_sb_alloc_security(struct super_block *sb)
1873{
1874 return superblock_alloc_security(sb);
1875}
1876
1877static void selinux_sb_free_security(struct super_block *sb)
1878{
1879 superblock_free_security(sb);
1880}
1881
1882static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1883{
1884 if (plen > olen)
1885 return 0;
1886
1887 return !memcmp(prefix, option, plen);
1888}
1889
1890static inline int selinux_option(char *option, int len)
1891{
1892 return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1893 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1894 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len));
1895}
1896
1897static inline void take_option(char **to, char *from, int *first, int len)
1898{
1899 if (!*first) {
1900 **to = ',';
1901 *to += 1;
1902 }
1903 else
1904 *first = 0;
1905 memcpy(*to, from, len);
1906 *to += len;
1907}
1908
1909static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
1910{
1911 int fnosec, fsec, rc = 0;
1912 char *in_save, *in_curr, *in_end;
1913 char *sec_curr, *nosec_save, *nosec;
1914
1915 in_curr = orig;
1916 sec_curr = copy;
1917
1918 /* Binary mount data: just copy */
1919 if (type->fs_flags & FS_BINARY_MOUNTDATA) {
1920 copy_page(sec_curr, in_curr);
1921 goto out;
1922 }
1923
1924 nosec = (char *)get_zeroed_page(GFP_KERNEL);
1925 if (!nosec) {
1926 rc = -ENOMEM;
1927 goto out;
1928 }
1929
1930 nosec_save = nosec;
1931 fnosec = fsec = 1;
1932 in_save = in_end = orig;
1933
1934 do {
1935 if (*in_end == ',' || *in_end == '\0') {
1936 int len = in_end - in_curr;
1937
1938 if (selinux_option(in_curr, len))
1939 take_option(&sec_curr, in_curr, &fsec, len);
1940 else
1941 take_option(&nosec, in_curr, &fnosec, len);
1942
1943 in_curr = in_end + 1;
1944 }
1945 } while (*in_end++);
1946
6931dfc9 1947 strcpy(in_save, nosec_save);
da3caa20 1948 free_page((unsigned long)nosec_save);
1da177e4
LT		 1949out:
1950 return rc;
1951}
1952
1953static int selinux_sb_kern_mount(struct super_block *sb, void *data)
1954{
1955 struct avc_audit_data ad;
1956 int rc;
1957
1958 rc = superblock_doinit(sb, data);
1959 if (rc)
1960 return rc;
1961
1962 AVC_AUDIT_DATA_INIT(&ad,FS);
1963 ad.u.fs.dentry = sb->s_root;
1964 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
1965}
1966
1967static int selinux_sb_statfs(struct super_block *sb)
1968{
1969 struct avc_audit_data ad;
1970
1971 AVC_AUDIT_DATA_INIT(&ad,FS);
1972 ad.u.fs.dentry = sb->s_root;
1973 return superblock_has_perm(current, sb, FILESYSTEM__GETATTR, &ad);
1974}
1975
1976static int selinux_mount(char * dev_name,
1977 struct nameidata *nd,
1978 char * type,
1979 unsigned long flags,
1980 void * data)
1981{
1982 int rc;
1983
1984 rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
1985 if (rc)
1986 return rc;
1987
1988 if (flags & MS_REMOUNT)
1989 return superblock_has_perm(current, nd->mnt->mnt_sb,
1990 FILESYSTEM__REMOUNT, NULL);
1991 else
1992 return dentry_has_perm(current, nd->mnt, nd->dentry,
1993 FILE__MOUNTON);
1994}
1995
1996static int selinux_umount(struct vfsmount *mnt, int flags)
1997{
1998 int rc;
1999
2000 rc = secondary_ops->sb_umount(mnt, flags);
2001 if (rc)
2002 return rc;
2003
2004 return superblock_has_perm(current,mnt->mnt_sb,
2005 FILESYSTEM__UNMOUNT,NULL);
2006}
2007
2008/* inode security operations */
2009
2010static int selinux_inode_alloc_security(struct inode *inode)
2011{
2012 return inode_alloc_security(inode);
2013}
2014
2015static void selinux_inode_free_security(struct inode *inode)
2016{
2017 inode_free_security(inode);
2018}
2019
2020static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2021{
2022 return may_create(dir, dentry, SECCLASS_FILE);
2023}
2024
2025static void selinux_inode_post_create(struct inode *dir, struct dentry *dentry, int mask)
2026{
2027 post_create(dir, dentry);
2028}
2029
2030static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2031{
2032 int rc;
2033
2034 rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2035 if (rc)
2036 return rc;
2037 return may_link(dir, old_dentry, MAY_LINK);
2038}
2039
2040static void selinux_inode_post_link(struct dentry *old_dentry, struct inode *inode, struct dentry *new_dentry)
2041{
2042 return;
2043}
2044
2045static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2046{
2047 int rc;
2048
2049 rc = secondary_ops->inode_unlink(dir, dentry);
2050 if (rc)
2051 return rc;
2052 return may_link(dir, dentry, MAY_UNLINK);
2053}
2054
2055static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2056{
2057 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2058}
2059
2060static void selinux_inode_post_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2061{
2062 post_create(dir, dentry);
2063}
2064
2065static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2066{
2067 return may_create(dir, dentry, SECCLASS_DIR);
2068}
2069
2070static void selinux_inode_post_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2071{
2072 post_create(dir, dentry);
2073}
2074
2075static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2076{
2077 return may_link(dir, dentry, MAY_RMDIR);
2078}
2079
2080static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2081{
2082 int rc;
2083
2084 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2085 if (rc)
2086 return rc;
2087
2088 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2089}
2090
2091static void selinux_inode_post_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2092{
2093 post_create(dir, dentry);
2094}
2095
2096static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2097 struct inode *new_inode, struct dentry *new_dentry)
2098{
2099 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2100}
2101
2102static void selinux_inode_post_rename(struct inode *old_inode, struct dentry *old_dentry,
2103 struct inode *new_inode, struct dentry *new_dentry)
2104{
2105 return;
2106}
2107
2108static int selinux_inode_readlink(struct dentry *dentry)
2109{
2110 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2111}
2112
2113static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2114{
2115 int rc;
2116
2117 rc = secondary_ops->inode_follow_link(dentry,nameidata);
2118 if (rc)
2119 return rc;
2120 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2121}
2122
2123static int selinux_inode_permission(struct inode *inode, int mask,
2124 struct nameidata *nd)
2125{
2126 int rc;
2127
2128 rc = secondary_ops->inode_permission(inode, mask, nd);
2129 if (rc)
2130 return rc;
2131
2132 if (!mask) {
2133 /* No permission to check. Existence test. */
2134 return 0;
2135 }
2136
2137 return inode_has_perm(current, inode,
2138 file_mask_to_av(inode->i_mode, mask), NULL);
2139}
2140
2141static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2142{
2143 int rc;
2144
2145 rc = secondary_ops->inode_setattr(dentry, iattr);
2146 if (rc)
2147 return rc;
2148
2149 if (iattr->ia_valid & ATTR_FORCE)
2150 return 0;
2151
2152 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2153 ATTR_ATIME_SET | ATTR_MTIME_SET))
2154 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2155
2156 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2157}
2158
2159static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2160{
2161 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2162}
2163
2164static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2165{
2166 struct task_security_struct *tsec = current->security;
2167 struct inode *inode = dentry->d_inode;
2168 struct inode_security_struct *isec = inode->i_security;
2169 struct superblock_security_struct *sbsec;
2170 struct avc_audit_data ad;
2171 u32 newsid;
2172 int rc = 0;
2173
2174 if (strcmp(name, XATTR_NAME_SELINUX)) {
2175 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2176 sizeof XATTR_SECURITY_PREFIX - 1) &&
2177 !capable(CAP_SYS_ADMIN)) {
2178 /* A different attribute in the security namespace.
2179 Restrict to administrator. */
2180 return -EPERM;
2181 }
2182
2183 /* Not an attribute we recognize, so just check the
2184 ordinary setattr permission. */
2185 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2186 }
2187
2188 sbsec = inode->i_sb->s_security;
2189 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2190 return -EOPNOTSUPP;
2191
2192 if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2193 return -EPERM;
2194
2195 AVC_AUDIT_DATA_INIT(&ad,FS);
2196 ad.u.fs.dentry = dentry;
2197
2198 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2199 FILE__RELABELFROM, &ad);
2200 if (rc)
2201 return rc;
2202
2203 rc = security_context_to_sid(value, size, &newsid);
2204 if (rc)
2205 return rc;
2206
2207 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2208 FILE__RELABELTO, &ad);
2209 if (rc)
2210 return rc;
2211
2212 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2213 isec->sclass);
2214 if (rc)
2215 return rc;
2216
2217 return avc_has_perm(newsid,
2218 sbsec->sid,
2219 SECCLASS_FILESYSTEM,
2220 FILESYSTEM__ASSOCIATE,
2221 &ad);
2222}
2223
2224static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2225 void *value, size_t size, int flags)
2226{
2227 struct inode *inode = dentry->d_inode;
2228 struct inode_security_struct *isec = inode->i_security;
2229 u32 newsid;
2230 int rc;
2231
2232 if (strcmp(name, XATTR_NAME_SELINUX)) {
2233 /* Not an attribute we recognize, so nothing to do. */
2234 return;
2235 }
2236
2237 rc = security_context_to_sid(value, size, &newsid);
2238 if (rc) {
2239 printk(KERN_WARNING "%s: unable to obtain SID for context "
2240 "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2241 return;
2242 }
2243
2244 isec->sid = newsid;
2245 return;
2246}
2247
2248static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2249{
2250 struct inode *inode = dentry->d_inode;
2251 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
2252
2253 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2254 return -EOPNOTSUPP;
2255
2256 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2257}
2258
2259static int selinux_inode_listxattr (struct dentry *dentry)
2260{
2261 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2262}
2263
2264static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2265{
2266 if (strcmp(name, XATTR_NAME_SELINUX)) {
2267 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2268 sizeof XATTR_SECURITY_PREFIX - 1) &&
2269 !capable(CAP_SYS_ADMIN)) {
2270 /* A different attribute in the security namespace.
2271 Restrict to administrator. */
2272 return -EPERM;
2273 }
2274
2275 /* Not an attribute we recognize, so just check the
2276 ordinary setattr permission. Might want a separate
2277 permission for removexattr. */
2278 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2279 }
2280
2281 /* No one is allowed to remove a SELinux security label.
2282 You can change the label, but all data must be labeled. */
2283 return -EACCES;
2284}
2285
2286static int selinux_inode_getsecurity(struct inode *inode, const char *name, void *buffer, size_t size)
2287{
2288 struct inode_security_struct *isec = inode->i_security;
2289 char *context;
2290 unsigned len;
2291 int rc;
2292
2293 /* Permission check handled by selinux_inode_getxattr hook.*/
2294
2295 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2296 return -EOPNOTSUPP;
2297
2298 rc = security_sid_to_context(isec->sid, &context, &len);
2299 if (rc)
2300 return rc;
2301
2302 if (!buffer || !size) {
2303 kfree(context);
2304 return len;
2305 }
2306 if (size < len) {
2307 kfree(context);
2308 return -ERANGE;
2309 }
2310 memcpy(buffer, context, len);
2311 kfree(context);
2312 return len;
2313}
2314
2315static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2316 const void *value, size_t size, int flags)
2317{
2318 struct inode_security_struct *isec = inode->i_security;
2319 u32 newsid;
2320 int rc;
2321
2322 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2323 return -EOPNOTSUPP;
2324
2325 if (!value || !size)
2326 return -EACCES;
2327
2328 rc = security_context_to_sid((void*)value, size, &newsid);
2329 if (rc)
2330 return rc;
2331
2332 isec->sid = newsid;
2333 return 0;
2334}
2335
2336static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2337{
2338 const int len = sizeof(XATTR_NAME_SELINUX);
2339 if (buffer && len <= buffer_size)
2340 memcpy(buffer, XATTR_NAME_SELINUX, len);
2341 return len;
2342}
2343
2344/* file security operations */
2345
2346static int selinux_file_permission(struct file *file, int mask)
2347{
2348 struct inode *inode = file->f_dentry->d_inode;
2349
2350 if (!mask) {
2351 /* No permission to check. Existence test. */
2352 return 0;
2353 }
2354
2355 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2356 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2357 mask |= MAY_APPEND;
2358
2359 return file_has_perm(current, file,
2360 file_mask_to_av(inode->i_mode, mask));
2361}
2362
2363static int selinux_file_alloc_security(struct file *file)
2364{
2365 return file_alloc_security(file);
2366}
2367
2368static void selinux_file_free_security(struct file *file)
2369{
2370 file_free_security(file);
2371}
2372
2373static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2374 unsigned long arg)
2375{
2376 int error = 0;
2377
2378 switch (cmd) {
2379 case FIONREAD:
2380 /* fall through */
2381 case FIBMAP:
2382 /* fall through */
2383 case FIGETBSZ:
2384 /* fall through */
2385 case EXT2_IOC_GETFLAGS:
2386 /* fall through */
2387 case EXT2_IOC_GETVERSION:
2388 error = file_has_perm(current, file, FILE__GETATTR);
2389 break;
2390
2391 case EXT2_IOC_SETFLAGS:
2392 /* fall through */
2393 case EXT2_IOC_SETVERSION:
2394 error = file_has_perm(current, file, FILE__SETATTR);
2395 break;
2396
2397 /* sys_ioctl() checks */
2398 case FIONBIO:
2399 /* fall through */
2400 case FIOASYNC:
2401 error = file_has_perm(current, file, 0);
2402 break;
2403
2404 case KDSKBENT:
2405 case KDSKBSENT:
2406 error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2407 break;
2408
2409 /* default case assumes that the command will go
2410 * to the file's ioctl() function.
2411 */
2412 default:
2413 error = file_has_perm(current, file, FILE__IOCTL);
2414
2415 }
2416 return error;
2417}
2418
2419static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2420{
2421#ifndef CONFIG_PPC32
2422 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2423 /*
2424 * We are making executable an anonymous mapping or a
2425 * private file mapping that will also be writable.
2426 * This has an additional check.
2427 */
2428 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2429 if (rc)
2430 return rc;
2431 }
2432#endif
2433
2434 if (file) {
2435 /* read access is always possible with a mapping */
2436 u32 av = FILE__READ;
2437
2438 /* write access only matters if the mapping is shared */
2439 if (shared && (prot & PROT_WRITE))
2440 av |= FILE__WRITE;
2441
2442 if (prot & PROT_EXEC)
2443 av |= FILE__EXECUTE;
2444
2445 return file_has_perm(current, file, av);
2446 }
2447 return 0;
2448}
2449
2450static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2451 unsigned long prot, unsigned long flags)
2452{
2453 int rc;
2454
2455 rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2456 if (rc)
2457 return rc;
2458
2459 if (selinux_checkreqprot)
2460 prot = reqprot;
2461
2462 return file_map_prot_check(file, prot,
2463 (flags & MAP_TYPE) == MAP_SHARED);
2464}
2465
2466static int selinux_file_mprotect(struct vm_area_struct *vma,
2467 unsigned long reqprot,
2468 unsigned long prot)
2469{
2470 int rc;
2471
2472 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2473 if (rc)
2474 return rc;
2475
2476 if (selinux_checkreqprot)
2477 prot = reqprot;
2478
2479#ifndef CONFIG_PPC32