]> git.ipfire.org Git - thirdparty/kernel/stable.git/blob - security/selinux/hooks.c
projects / thirdparty / kernel / stable.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
net :sunrpc :clnt :Fix xps refcount imbalance on the error path
[thirdparty/kernel/stable.git] / security / selinux / hooks.c
1 /*
2 * NSA Security-Enhanced Linux (SELinux) security module
3 *
4 * This file contains the SELinux hook function implementations.
5 *
6 * Authors: Stephen Smalley, <sds@tycho.nsa.gov>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
10 *
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Eric Paris <eparis@redhat.com>
14 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
15 * <dgoeddel@trustedcs.com>
16 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
17 * Paul Moore <paul@paul-moore.com>
18 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
19 * Yuichi Nakamura <ynakam@hitachisoft.jp>
20 * Copyright (C) 2016 Mellanox Technologies
21 *
22 * This program is free software; you can redistribute it and/or modify
23 * it under the terms of the GNU General Public License version 2,
24 * as published by the Free Software Foundation.
25 */
26
27 #include <linux/init.h>
28 #include <linux/kd.h>
29 #include <linux/kernel.h>
30 #include <linux/tracehook.h>
31 #include <linux/errno.h>
32 #include <linux/sched/signal.h>
33 #include <linux/sched/task.h>
34 #include <linux/lsm_hooks.h>
35 #include <linux/xattr.h>
36 #include <linux/capability.h>
37 #include <linux/unistd.h>
38 #include <linux/mm.h>
39 #include <linux/mman.h>
40 #include <linux/slab.h>
41 #include <linux/pagemap.h>
42 #include <linux/proc_fs.h>
43 #include <linux/swap.h>
44 #include <linux/spinlock.h>
45 #include <linux/syscalls.h>
46 #include <linux/dcache.h>
47 #include <linux/file.h>
48 #include <linux/fdtable.h>
49 #include <linux/namei.h>
50 #include <linux/mount.h>
51 #include <linux/fs_context.h>
52 #include <linux/fs_parser.h>
53 #include <linux/netfilter_ipv4.h>
54 #include <linux/netfilter_ipv6.h>
55 #include <linux/tty.h>
56 #include <net/icmp.h>
57 #include <net/ip.h> /* for local_port_range[] */
58 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
59 #include <net/inet_connection_sock.h>
60 #include <net/net_namespace.h>
61 #include <net/netlabel.h>
62 #include <linux/uaccess.h>
63 #include <asm/ioctls.h>
64 #include <linux/atomic.h>
65 #include <linux/bitops.h>
66 #include <linux/interrupt.h>
67 #include <linux/netdevice.h> /* for network interface checks */
68 #include <net/netlink.h>
69 #include <linux/tcp.h>
70 #include <linux/udp.h>
71 #include <linux/dccp.h>
72 #include <linux/sctp.h>
73 #include <net/sctp/structs.h>
74 #include <linux/quota.h>
75 #include <linux/un.h> /* for Unix socket types */
76 #include <net/af_unix.h> /* for Unix socket types */
77 #include <linux/parser.h>
78 #include <linux/nfs_mount.h>
79 #include <net/ipv6.h>
80 #include <linux/hugetlb.h>
81 #include <linux/personality.h>
82 #include <linux/audit.h>
83 #include <linux/string.h>
84 #include <linux/mutex.h>
85 #include <linux/posix-timers.h>
86 #include <linux/syslog.h>
87 #include <linux/user_namespace.h>
88 #include <linux/export.h>
89 #include <linux/msg.h>
90 #include <linux/shm.h>
91 #include <linux/bpf.h>
92 #include <linux/kernfs.h>
93 #include <linux/stringhash.h> /* for hashlen_string() */
94 #include <uapi/linux/mount.h>
95
96 #include "avc.h"
97 #include "objsec.h"
98 #include "netif.h"
99 #include "netnode.h"
100 #include "netport.h"
101 #include "ibpkey.h"
102 #include "xfrm.h"
103 #include "netlabel.h"
104 #include "audit.h"
105 #include "avc_ss.h"
106
107 struct selinux_state selinux_state;
108
109 /* SECMARK reference count */
110 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
111
112 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
113 static int selinux_enforcing_boot;
114
115 static int __init enforcing_setup(char *str)
116 {
117 unsigned long enforcing;
118 if (!kstrtoul(str, 0, &enforcing))
119 selinux_enforcing_boot = enforcing ? 1 : 0;
120 return 1;
121 }
122 __setup("enforcing=", enforcing_setup);
123 #else
124 #define selinux_enforcing_boot 1
125 #endif
126
127 int selinux_enabled __lsm_ro_after_init = 1;
128 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
129 static int __init selinux_enabled_setup(char *str)
130 {
131 unsigned long enabled;
132 if (!kstrtoul(str, 0, &enabled))
133 selinux_enabled = enabled ? 1 : 0;
134 return 1;
135 }
136 __setup("selinux=", selinux_enabled_setup);
137 #endif
138
139 static unsigned int selinux_checkreqprot_boot =
140 CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
141
142 static int __init checkreqprot_setup(char *str)
143 {
144 unsigned long checkreqprot;
145
146 if (!kstrtoul(str, 0, &checkreqprot))
147 selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
148 return 1;
149 }
150 __setup("checkreqprot=", checkreqprot_setup);
151
152 /**
153 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
154 *
155 * Description:
156 * This function checks the SECMARK reference counter to see if any SECMARK
157 * targets are currently configured, if the reference counter is greater than
158 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
159 * enabled, false (0) if SECMARK is disabled. If the always_check_network
160 * policy capability is enabled, SECMARK is always considered enabled.
161 *
162 */
163 static int selinux_secmark_enabled(void)
164 {
165 return (selinux_policycap_alwaysnetwork() ||
166 atomic_read(&selinux_secmark_refcount));
167 }
168
169 /**
170 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
171 *
172 * Description:
173 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
174 * (1) if any are enabled or false (0) if neither are enabled. If the
175 * always_check_network policy capability is enabled, peer labeling
176 * is always considered enabled.
177 *
178 */
179 static int selinux_peerlbl_enabled(void)
180 {
181 return (selinux_policycap_alwaysnetwork() ||
182 netlbl_enabled() || selinux_xfrm_enabled());
183 }
184
185 static int selinux_netcache_avc_callback(u32 event)
186 {
187 if (event == AVC_CALLBACK_RESET) {
188 sel_netif_flush();
189 sel_netnode_flush();
190 sel_netport_flush();
191 synchronize_net();
192 }
193 return 0;
194 }
195
196 static int selinux_lsm_notifier_avc_callback(u32 event)
197 {
198 if (event == AVC_CALLBACK_RESET) {
199 sel_ib_pkey_flush();
200 call_lsm_notifier(LSM_POLICY_CHANGE, NULL);
201 }
202
203 return 0;
204 }
205
206 /*
207 * initialise the security for the init task
208 */
209 static void cred_init_security(void)
210 {
211 struct cred *cred = (struct cred *) current->real_cred;
212 struct task_security_struct *tsec;
213
214 tsec = selinux_cred(cred);
215 tsec->osid = tsec->sid = SECINITSID_KERNEL;
216 }
217
218 /*
219 * get the security ID of a set of credentials
220 */
221 static inline u32 cred_sid(const struct cred *cred)
222 {
223 const struct task_security_struct *tsec;
224
225 tsec = selinux_cred(cred);
226 return tsec->sid;
227 }
228
229 /*
230 * get the objective security ID of a task
231 */
232 static inline u32 task_sid(const struct task_struct *task)
233 {
234 u32 sid;
235
236 rcu_read_lock();
237 sid = cred_sid(__task_cred(task));
238 rcu_read_unlock();
239 return sid;
240 }
241
242 /* Allocate and free functions for each kind of security blob. */
243
244 static int inode_alloc_security(struct inode *inode)
245 {
246 struct inode_security_struct *isec = selinux_inode(inode);
247 u32 sid = current_sid();
248
249 spin_lock_init(&isec->lock);
250 INIT_LIST_HEAD(&isec->list);
251 isec->inode = inode;
252 isec->sid = SECINITSID_UNLABELED;
253 isec->sclass = SECCLASS_FILE;
254 isec->task_sid = sid;
255 isec->initialized = LABEL_INVALID;
256
257 return 0;
258 }
259
260 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
261
262 /*
263 * Try reloading inode security labels that have been marked as invalid. The
264 * @may_sleep parameter indicates when sleeping and thus reloading labels is
265 * allowed; when set to false, returns -ECHILD when the label is
266 * invalid. The @dentry parameter should be set to a dentry of the inode.
267 */
268 static int __inode_security_revalidate(struct inode *inode,
269 struct dentry *dentry,
270 bool may_sleep)
271 {
272 struct inode_security_struct *isec = selinux_inode(inode);
273
274 might_sleep_if(may_sleep);
275
276 if (selinux_state.initialized &&
277 isec->initialized != LABEL_INITIALIZED) {
278 if (!may_sleep)
279 return -ECHILD;
280
281 /*
282 * Try reloading the inode security label. This will fail if
283 * @opt_dentry is NULL and no dentry for this inode can be
284 * found; in that case, continue using the old label.
285 */
286 inode_doinit_with_dentry(inode, dentry);
287 }
288 return 0;
289 }
290
291 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
292 {
293 return selinux_inode(inode);
294 }
295
296 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
297 {
298 int error;
299
300 error = __inode_security_revalidate(inode, NULL, !rcu);
301 if (error)
302 return ERR_PTR(error);
303 return selinux_inode(inode);
304 }
305
306 /*
307 * Get the security label of an inode.
308 */
309 static struct inode_security_struct *inode_security(struct inode *inode)
310 {
311 __inode_security_revalidate(inode, NULL, true);
312 return selinux_inode(inode);
313 }
314
315 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
316 {
317 struct inode *inode = d_backing_inode(dentry);
318
319 return selinux_inode(inode);
320 }
321
322 /*
323 * Get the security label of a dentry's backing inode.
324 */
325 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
326 {
327 struct inode *inode = d_backing_inode(dentry);
328
329 __inode_security_revalidate(inode, dentry, true);
330 return selinux_inode(inode);
331 }
332
333 static void inode_free_security(struct inode *inode)
334 {
335 struct inode_security_struct *isec = selinux_inode(inode);
336 struct superblock_security_struct *sbsec;
337
338 if (!isec)
339 return;
340 sbsec = inode->i_sb->s_security;
341 /*
342 * As not all inode security structures are in a list, we check for
343 * empty list outside of the lock to make sure that we won't waste
344 * time taking a lock doing nothing.
345 *
346 * The list_del_init() function can be safely called more than once.
347 * It should not be possible for this function to be called with
348 * concurrent list_add(), but for better safety against future changes
349 * in the code, we use list_empty_careful() here.
350 */
351 if (!list_empty_careful(&isec->list)) {
352 spin_lock(&sbsec->isec_lock);
353 list_del_init(&isec->list);
354 spin_unlock(&sbsec->isec_lock);
355 }
356 }
357
358 static int file_alloc_security(struct file *file)
359 {
360 struct file_security_struct *fsec = selinux_file(file);
361 u32 sid = current_sid();
362
363 fsec->sid = sid;
364 fsec->fown_sid = sid;
365
366 return 0;
367 }
368
369 static int superblock_alloc_security(struct super_block *sb)
370 {
371 struct superblock_security_struct *sbsec;
372
373 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
374 if (!sbsec)
375 return -ENOMEM;
376
377 mutex_init(&sbsec->lock);
378 INIT_LIST_HEAD(&sbsec->isec_head);
379 spin_lock_init(&sbsec->isec_lock);
380 sbsec->sb = sb;
381 sbsec->sid = SECINITSID_UNLABELED;
382 sbsec->def_sid = SECINITSID_FILE;
383 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
384 sb->s_security = sbsec;
385
386 return 0;
387 }
388
389 static void superblock_free_security(struct super_block *sb)
390 {
391 struct superblock_security_struct *sbsec = sb->s_security;
392 sb->s_security = NULL;
393 kfree(sbsec);
394 }
395
396 struct selinux_mnt_opts {
397 const char *fscontext, *context, *rootcontext, *defcontext;
398 };
399
400 static void selinux_free_mnt_opts(void *mnt_opts)
401 {
402 struct selinux_mnt_opts *opts = mnt_opts;
403 kfree(opts->fscontext);
404 kfree(opts->context);
405 kfree(opts->rootcontext);
406 kfree(opts->defcontext);
407 kfree(opts);
408 }
409
410 static inline int inode_doinit(struct inode *inode)
411 {
412 return inode_doinit_with_dentry(inode, NULL);
413 }
414
415 enum {
416 Opt_error = -1,
417 Opt_context = 0,
418 Opt_defcontext = 1,
419 Opt_fscontext = 2,
420 Opt_rootcontext = 3,
421 Opt_seclabel = 4,
422 };
423
424 #define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg}
425 static struct {
426 const char *name;
427 int len;
428 int opt;
429 bool has_arg;
430 } tokens[] = {
431 A(context, true),
432 A(fscontext, true),
433 A(defcontext, true),
434 A(rootcontext, true),
435 A(seclabel, false),
436 };
437 #undef A
438
439 static int match_opt_prefix(char *s, int l, char **arg)
440 {
441 int i;
442
443 for (i = 0; i < ARRAY_SIZE(tokens); i++) {
444 size_t len = tokens[i].len;
445 if (len > l || memcmp(s, tokens[i].name, len))
446 continue;
447 if (tokens[i].has_arg) {
448 if (len == l || s[len] != '=')
449 continue;
450 *arg = s + len + 1;
451 } else if (len != l)
452 continue;
453 return tokens[i].opt;
454 }
455 return Opt_error;
456 }
457
458 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
459
460 static int may_context_mount_sb_relabel(u32 sid,
461 struct superblock_security_struct *sbsec,
462 const struct cred *cred)
463 {
464 const struct task_security_struct *tsec = selinux_cred(cred);
465 int rc;
466
467 rc = avc_has_perm(&selinux_state,
468 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
469 FILESYSTEM__RELABELFROM, NULL);
470 if (rc)
471 return rc;
472
473 rc = avc_has_perm(&selinux_state,
474 tsec->sid, sid, SECCLASS_FILESYSTEM,
475 FILESYSTEM__RELABELTO, NULL);
476 return rc;
477 }
478
479 static int may_context_mount_inode_relabel(u32 sid,
480 struct superblock_security_struct *sbsec,
481 const struct cred *cred)
482 {
483 const struct task_security_struct *tsec = selinux_cred(cred);
484 int rc;
485 rc = avc_has_perm(&selinux_state,
486 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
487 FILESYSTEM__RELABELFROM, NULL);
488 if (rc)
489 return rc;
490
491 rc = avc_has_perm(&selinux_state,
492 sid, sbsec->sid, SECCLASS_FILESYSTEM,
493 FILESYSTEM__ASSOCIATE, NULL);
494 return rc;
495 }
496
497 static int selinux_is_genfs_special_handling(struct super_block *sb)
498 {
499 /* Special handling. Genfs but also in-core setxattr handler */
500 return !strcmp(sb->s_type->name, "sysfs") ||
501 !strcmp(sb->s_type->name, "pstore") ||
502 !strcmp(sb->s_type->name, "debugfs") ||
503 !strcmp(sb->s_type->name, "tracefs") ||
504 !strcmp(sb->s_type->name, "rootfs") ||
505 (selinux_policycap_cgroupseclabel() &&
506 (!strcmp(sb->s_type->name, "cgroup") ||
507 !strcmp(sb->s_type->name, "cgroup2")));
508 }
509
510 static int selinux_is_sblabel_mnt(struct super_block *sb)
511 {
512 struct superblock_security_struct *sbsec = sb->s_security;
513
514 /*
515 * IMPORTANT: Double-check logic in this function when adding a new
516 * SECURITY_FS_USE_* definition!
517 */
518 BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
519
520 switch (sbsec->behavior) {
521 case SECURITY_FS_USE_XATTR:
522 case SECURITY_FS_USE_TRANS:
523 case SECURITY_FS_USE_TASK:
524 case SECURITY_FS_USE_NATIVE:
525 return 1;
526
527 case SECURITY_FS_USE_GENFS:
528 return selinux_is_genfs_special_handling(sb);
529
530 /* Never allow relabeling on context mounts */
531 case SECURITY_FS_USE_MNTPOINT:
532 case SECURITY_FS_USE_NONE:
533 default:
534 return 0;
535 }
536 }
537
538 static int sb_finish_set_opts(struct super_block *sb)
539 {
540 struct superblock_security_struct *sbsec = sb->s_security;
541 struct dentry *root = sb->s_root;
542 struct inode *root_inode = d_backing_inode(root);
543 int rc = 0;
544
545 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
546 /* Make sure that the xattr handler exists and that no
547 error other than -ENODATA is returned by getxattr on
548 the root directory. -ENODATA is ok, as this may be
549 the first boot of the SELinux kernel before we have
550 assigned xattr values to the filesystem. */
551 if (!(root_inode->i_opflags & IOP_XATTR)) {
552 pr_warn("SELinux: (dev %s, type %s) has no "
553 "xattr support\n", sb->s_id, sb->s_type->name);
554 rc = -EOPNOTSUPP;
555 goto out;
556 }
557
558 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
559 if (rc < 0 && rc != -ENODATA) {
560 if (rc == -EOPNOTSUPP)
561 pr_warn("SELinux: (dev %s, type "
562 "%s) has no security xattr handler\n",
563 sb->s_id, sb->s_type->name);
564 else
565 pr_warn("SELinux: (dev %s, type "
566 "%s) getxattr errno %d\n", sb->s_id,
567 sb->s_type->name, -rc);
568 goto out;
569 }
570 }
571
572 sbsec->flags |= SE_SBINITIALIZED;
573
574 /*
575 * Explicitly set or clear SBLABEL_MNT. It's not sufficient to simply
576 * leave the flag untouched because sb_clone_mnt_opts might be handing
577 * us a superblock that needs the flag to be cleared.
578 */
579 if (selinux_is_sblabel_mnt(sb))
580 sbsec->flags |= SBLABEL_MNT;
581 else
582 sbsec->flags &= ~SBLABEL_MNT;
583
584 /* Initialize the root inode. */
585 rc = inode_doinit_with_dentry(root_inode, root);
586
587 /* Initialize any other inodes associated with the superblock, e.g.
588 inodes created prior to initial policy load or inodes created
589 during get_sb by a pseudo filesystem that directly
590 populates itself. */
591 spin_lock(&sbsec->isec_lock);
592 while (!list_empty(&sbsec->isec_head)) {
593 struct inode_security_struct *isec =
594 list_first_entry(&sbsec->isec_head,
595 struct inode_security_struct, list);
596 struct inode *inode = isec->inode;
597 list_del_init(&isec->list);
598 spin_unlock(&sbsec->isec_lock);
599 inode = igrab(inode);
600 if (inode) {
601 if (!IS_PRIVATE(inode))
602 inode_doinit(inode);
603 iput(inode);
604 }
605 spin_lock(&sbsec->isec_lock);
606 }
607 spin_unlock(&sbsec->isec_lock);
608 out:
609 return rc;
610 }
611
612 static int bad_option(struct superblock_security_struct *sbsec, char flag,
613 u32 old_sid, u32 new_sid)
614 {
615 char mnt_flags = sbsec->flags & SE_MNTMASK;
616
617 /* check if the old mount command had the same options */
618 if (sbsec->flags & SE_SBINITIALIZED)
619 if (!(sbsec->flags & flag) ||
620 (old_sid != new_sid))
621 return 1;
622
623 /* check if we were passed the same options twice,
624 * aka someone passed context=a,context=b
625 */
626 if (!(sbsec->flags & SE_SBINITIALIZED))
627 if (mnt_flags & flag)
628 return 1;
629 return 0;
630 }
631
632 static int parse_sid(struct super_block *sb, const char *s, u32 *sid)
633 {
634 int rc = security_context_str_to_sid(&selinux_state, s,
635 sid, GFP_KERNEL);
636 if (rc)
637 pr_warn("SELinux: security_context_str_to_sid"
638 "(%s) failed for (dev %s, type %s) errno=%d\n",
639 s, sb->s_id, sb->s_type->name, rc);
640 return rc;
641 }
642
643 /*
644 * Allow filesystems with binary mount data to explicitly set mount point
645 * labeling information.
646 */
647 static int selinux_set_mnt_opts(struct super_block *sb,
648 void *mnt_opts,
649 unsigned long kern_flags,
650 unsigned long *set_kern_flags)
651 {
652 const struct cred *cred = current_cred();
653 struct superblock_security_struct *sbsec = sb->s_security;
654 struct dentry *root = sbsec->sb->s_root;
655 struct selinux_mnt_opts *opts = mnt_opts;
656 struct inode_security_struct *root_isec;
657 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
658 u32 defcontext_sid = 0;
659 int rc = 0;
660
661 mutex_lock(&sbsec->lock);
662
663 if (!selinux_state.initialized) {
664 if (!opts) {
665 /* Defer initialization until selinux_complete_init,
666 after the initial policy is loaded and the security
667 server is ready to handle calls. */
668 goto out;
669 }
670 rc = -EINVAL;
671 pr_warn("SELinux: Unable to set superblock options "
672 "before the security server is initialized\n");
673 goto out;
674 }
675 if (kern_flags && !set_kern_flags) {
676 /* Specifying internal flags without providing a place to
677 * place the results is not allowed */
678 rc = -EINVAL;
679 goto out;
680 }
681
682 /*
683 * Binary mount data FS will come through this function twice. Once
684 * from an explicit call and once from the generic calls from the vfs.
685 * Since the generic VFS calls will not contain any security mount data
686 * we need to skip the double mount verification.
687 *
688 * This does open a hole in which we will not notice if the first
689 * mount using this sb set explict options and a second mount using
690 * this sb does not set any security options. (The first options
691 * will be used for both mounts)
692 */
693 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
694 && !opts)
695 goto out;
696
697 root_isec = backing_inode_security_novalidate(root);
698
699 /*
700 * parse the mount options, check if they are valid sids.
701 * also check if someone is trying to mount the same sb more
702 * than once with different security options.
703 */
704 if (opts) {
705 if (opts->fscontext) {
706 rc = parse_sid(sb, opts->fscontext, &fscontext_sid);
707 if (rc)
708 goto out;
709 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
710 fscontext_sid))
711 goto out_double_mount;
712 sbsec->flags |= FSCONTEXT_MNT;
713 }
714 if (opts->context) {
715 rc = parse_sid(sb, opts->context, &context_sid);
716 if (rc)
717 goto out;
718 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
719 context_sid))
720 goto out_double_mount;
721 sbsec->flags |= CONTEXT_MNT;
722 }
723 if (opts->rootcontext) {
724 rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid);
725 if (rc)
726 goto out;
727 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
728 rootcontext_sid))
729 goto out_double_mount;
730 sbsec->flags |= ROOTCONTEXT_MNT;
731 }
732 if (opts->defcontext) {
733 rc = parse_sid(sb, opts->defcontext, &defcontext_sid);
734 if (rc)
735 goto out;
736 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
737 defcontext_sid))
738 goto out_double_mount;
739 sbsec->flags |= DEFCONTEXT_MNT;
740 }
741 }
742
743 if (sbsec->flags & SE_SBINITIALIZED) {
744 /* previously mounted with options, but not on this attempt? */
745 if ((sbsec->flags & SE_MNTMASK) && !opts)
746 goto out_double_mount;
747 rc = 0;
748 goto out;
749 }
750
751 if (strcmp(sb->s_type->name, "proc") == 0)
752 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
753
754 if (!strcmp(sb->s_type->name, "debugfs") ||
755 !strcmp(sb->s_type->name, "tracefs") ||
756 !strcmp(sb->s_type->name, "pstore"))
757 sbsec->flags |= SE_SBGENFS;
758
759 if (!strcmp(sb->s_type->name, "sysfs") ||
760 !strcmp(sb->s_type->name, "cgroup") ||
761 !strcmp(sb->s_type->name, "cgroup2"))
762 sbsec->flags |= SE_SBGENFS | SE_SBGENFS_XATTR;
763
764 if (!sbsec->behavior) {
765 /*
766 * Determine the labeling behavior to use for this
767 * filesystem type.
768 */
769 rc = security_fs_use(&selinux_state, sb);
770 if (rc) {
771 pr_warn("%s: security_fs_use(%s) returned %d\n",
772 __func__, sb->s_type->name, rc);
773 goto out;
774 }
775 }
776
777 /*
778 * If this is a user namespace mount and the filesystem type is not
779 * explicitly whitelisted, then no contexts are allowed on the command
780 * line and security labels must be ignored.
781 */
782 if (sb->s_user_ns != &init_user_ns &&
783 strcmp(sb->s_type->name, "tmpfs") &&
784 strcmp(sb->s_type->name, "ramfs") &&
785 strcmp(sb->s_type->name, "devpts")) {
786 if (context_sid || fscontext_sid || rootcontext_sid ||
787 defcontext_sid) {
788 rc = -EACCES;
789 goto out;
790 }
791 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
792 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
793 rc = security_transition_sid(&selinux_state,
794 current_sid(),
795 current_sid(),
796 SECCLASS_FILE, NULL,
797 &sbsec->mntpoint_sid);
798 if (rc)
799 goto out;
800 }
801 goto out_set_opts;
802 }
803
804 /* sets the context of the superblock for the fs being mounted. */
805 if (fscontext_sid) {
806 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
807 if (rc)
808 goto out;
809
810 sbsec->sid = fscontext_sid;
811 }
812
813 /*
814 * Switch to using mount point labeling behavior.
815 * sets the label used on all file below the mountpoint, and will set
816 * the superblock context if not already set.
817 */
818 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
819 sbsec->behavior = SECURITY_FS_USE_NATIVE;
820 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
821 }
822
823 if (context_sid) {
824 if (!fscontext_sid) {
825 rc = may_context_mount_sb_relabel(context_sid, sbsec,
826 cred);
827 if (rc)
828 goto out;
829 sbsec->sid = context_sid;
830 } else {
831 rc = may_context_mount_inode_relabel(context_sid, sbsec,
832 cred);
833 if (rc)
834 goto out;
835 }
836 if (!rootcontext_sid)
837 rootcontext_sid = context_sid;
838
839 sbsec->mntpoint_sid = context_sid;
840 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
841 }
842
843 if (rootcontext_sid) {
844 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
845 cred);
846 if (rc)
847 goto out;
848
849 root_isec->sid = rootcontext_sid;
850 root_isec->initialized = LABEL_INITIALIZED;
851 }
852
853 if (defcontext_sid) {
854 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
855 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
856 rc = -EINVAL;
857 pr_warn("SELinux: defcontext option is "
858 "invalid for this filesystem type\n");
859 goto out;
860 }
861
862 if (defcontext_sid != sbsec->def_sid) {
863 rc = may_context_mount_inode_relabel(defcontext_sid,
864 sbsec, cred);
865 if (rc)
866 goto out;
867 }
868
869 sbsec->def_sid = defcontext_sid;
870 }
871
872 out_set_opts:
873 rc = sb_finish_set_opts(sb);
874 out:
875 mutex_unlock(&sbsec->lock);
876 return rc;
877 out_double_mount:
878 rc = -EINVAL;
879 pr_warn("SELinux: mount invalid. Same superblock, different "
880 "security settings for (dev %s, type %s)\n", sb->s_id,
881 sb->s_type->name);
882 goto out;
883 }
884
885 static int selinux_cmp_sb_context(const struct super_block *oldsb,
886 const struct super_block *newsb)
887 {
888 struct superblock_security_struct *old = oldsb->s_security;
889 struct superblock_security_struct *new = newsb->s_security;
890 char oldflags = old->flags & SE_MNTMASK;
891 char newflags = new->flags & SE_MNTMASK;
892
893 if (oldflags != newflags)
894 goto mismatch;
895 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
896 goto mismatch;
897 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
898 goto mismatch;
899 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
900 goto mismatch;
901 if (oldflags & ROOTCONTEXT_MNT) {
902 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
903 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
904 if (oldroot->sid != newroot->sid)
905 goto mismatch;
906 }
907 return 0;
908 mismatch:
909 pr_warn("SELinux: mount invalid. Same superblock, "
910 "different security settings for (dev %s, "
911 "type %s)\n", newsb->s_id, newsb->s_type->name);
912 return -EBUSY;
913 }
914
915 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
916 struct super_block *newsb,
917 unsigned long kern_flags,
918 unsigned long *set_kern_flags)
919 {
920 int rc = 0;
921 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
922 struct superblock_security_struct *newsbsec = newsb->s_security;
923
924 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
925 int set_context = (oldsbsec->flags & CONTEXT_MNT);
926 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
927
928 /*
929 * if the parent was able to be mounted it clearly had no special lsm
930 * mount options. thus we can safely deal with this superblock later
931 */
932 if (!selinux_state.initialized)
933 return 0;
934
935 /*
936 * Specifying internal flags without providing a place to
937 * place the results is not allowed.
938 */
939 if (kern_flags && !set_kern_flags)
940 return -EINVAL;
941
942 /* how can we clone if the old one wasn't set up?? */
943 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
944
945 /* if fs is reusing a sb, make sure that the contexts match */
946 if (newsbsec->flags & SE_SBINITIALIZED) {
947 if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
948 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
949 return selinux_cmp_sb_context(oldsb, newsb);
950 }
951
952 mutex_lock(&newsbsec->lock);
953
954 newsbsec->flags = oldsbsec->flags;
955
956 newsbsec->sid = oldsbsec->sid;
957 newsbsec->def_sid = oldsbsec->def_sid;
958 newsbsec->behavior = oldsbsec->behavior;
959
960 if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
961 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
962 rc = security_fs_use(&selinux_state, newsb);
963 if (rc)
964 goto out;
965 }
966
967 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
968 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
969 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
970 }
971
972 if (set_context) {
973 u32 sid = oldsbsec->mntpoint_sid;
974
975 if (!set_fscontext)
976 newsbsec->sid = sid;
977 if (!set_rootcontext) {
978 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
979 newisec->sid = sid;
980 }
981 newsbsec->mntpoint_sid = sid;
982 }
983 if (set_rootcontext) {
984 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
985 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
986
987 newisec->sid = oldisec->sid;
988 }
989
990 sb_finish_set_opts(newsb);
991 out:
992 mutex_unlock(&newsbsec->lock);
993 return rc;
994 }
995
996 static int selinux_add_opt(int token, const char *s, void **mnt_opts)
997 {
998 struct selinux_mnt_opts *opts = *mnt_opts;
999
1000 if (token == Opt_seclabel) /* eaten and completely ignored */
1001 return 0;
1002
1003 if (!opts) {
1004 opts = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
1005 if (!opts)
1006 return -ENOMEM;
1007 *mnt_opts = opts;
1008 }
1009 if (!s)
1010 return -ENOMEM;
1011 switch (token) {
1012 case Opt_context:
1013 if (opts->context || opts->defcontext)
1014 goto Einval;
1015 opts->context = s;
1016 break;
1017 case Opt_fscontext:
1018 if (opts->fscontext)
1019 goto Einval;
1020 opts->fscontext = s;
1021 break;
1022 case Opt_rootcontext:
1023 if (opts->rootcontext)
1024 goto Einval;
1025 opts->rootcontext = s;
1026 break;
1027 case Opt_defcontext:
1028 if (opts->context || opts->defcontext)
1029 goto Einval;
1030 opts->defcontext = s;
1031 break;
1032 }
1033 return 0;
1034 Einval:
1035 pr_warn(SEL_MOUNT_FAIL_MSG);
1036 return -EINVAL;
1037 }
1038
1039 static int selinux_add_mnt_opt(const char *option, const char *val, int len,
1040 void **mnt_opts)
1041 {
1042 int token = Opt_error;
1043 int rc, i;
1044
1045 for (i = 0; i < ARRAY_SIZE(tokens); i++) {
1046 if (strcmp(option, tokens[i].name) == 0) {
1047 token = tokens[i].opt;
1048 break;
1049 }
1050 }
1051
1052 if (token == Opt_error)
1053 return -EINVAL;
1054
1055 if (token != Opt_seclabel) {
1056 val = kmemdup_nul(val, len, GFP_KERNEL);
1057 if (!val) {
1058 rc = -ENOMEM;
1059 goto free_opt;
1060 }
1061 }
1062 rc = selinux_add_opt(token, val, mnt_opts);
1063 if (unlikely(rc)) {
1064 kfree(val);
1065 goto free_opt;
1066 }
1067 return rc;
1068
1069 free_opt:
1070 if (*mnt_opts) {
1071 selinux_free_mnt_opts(*mnt_opts);
1072 *mnt_opts = NULL;
1073 }
1074 return rc;
1075 }
1076
1077 static int show_sid(struct seq_file *m, u32 sid)
1078 {
1079 char *context = NULL;
1080 u32 len;
1081 int rc;
1082
1083 rc = security_sid_to_context(&selinux_state, sid,
1084 &context, &len);
1085 if (!rc) {
1086 bool has_comma = context && strchr(context, ',');
1087
1088 seq_putc(m, '=');
1089 if (has_comma)
1090 seq_putc(m, '\"');
1091 seq_escape(m, context, "\"\n\\");
1092 if (has_comma)
1093 seq_putc(m, '\"');
1094 }
1095 kfree(context);
1096 return rc;
1097 }
1098
1099 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1100 {
1101 struct superblock_security_struct *sbsec = sb->s_security;
1102 int rc;
1103
1104 if (!(sbsec->flags & SE_SBINITIALIZED))
1105 return 0;
1106
1107 if (!selinux_state.initialized)
1108 return 0;
1109
1110 if (sbsec->flags & FSCONTEXT_MNT) {
1111 seq_putc(m, ',');
1112 seq_puts(m, FSCONTEXT_STR);
1113 rc = show_sid(m, sbsec->sid);
1114 if (rc)
1115 return rc;
1116 }
1117 if (sbsec->flags & CONTEXT_MNT) {
1118 seq_putc(m, ',');
1119 seq_puts(m, CONTEXT_STR);
1120 rc = show_sid(m, sbsec->mntpoint_sid);
1121 if (rc)
1122 return rc;
1123 }
1124 if (sbsec->flags & DEFCONTEXT_MNT) {
1125 seq_putc(m, ',');
1126 seq_puts(m, DEFCONTEXT_STR);
1127 rc = show_sid(m, sbsec->def_sid);
1128 if (rc)
1129 return rc;
1130 }
1131 if (sbsec->flags & ROOTCONTEXT_MNT) {
1132 struct dentry *root = sbsec->sb->s_root;
1133 struct inode_security_struct *isec = backing_inode_security(root);
1134 seq_putc(m, ',');
1135 seq_puts(m, ROOTCONTEXT_STR);
1136 rc = show_sid(m, isec->sid);
1137 if (rc)
1138 return rc;
1139 }
1140 if (sbsec->flags & SBLABEL_MNT) {
1141 seq_putc(m, ',');
1142 seq_puts(m, SECLABEL_STR);
1143 }
1144 return 0;
1145 }
1146
1147 static inline u16 inode_mode_to_security_class(umode_t mode)
1148 {
1149 switch (mode & S_IFMT) {
1150 case S_IFSOCK:
1151 return SECCLASS_SOCK_FILE;
1152 case S_IFLNK:
1153 return SECCLASS_LNK_FILE;
1154 case S_IFREG:
1155 return SECCLASS_FILE;
1156 case S_IFBLK:
1157 return SECCLASS_BLK_FILE;
1158 case S_IFDIR:
1159 return SECCLASS_DIR;
1160 case S_IFCHR:
1161 return SECCLASS_CHR_FILE;
1162 case S_IFIFO:
1163 return SECCLASS_FIFO_FILE;
1164
1165 }
1166
1167 return SECCLASS_FILE;
1168 }
1169
1170 static inline int default_protocol_stream(int protocol)
1171 {
1172 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1173 }
1174
1175 static inline int default_protocol_dgram(int protocol)
1176 {
1177 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1178 }
1179
1180 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1181 {
1182 int extsockclass = selinux_policycap_extsockclass();
1183
1184 switch (family) {
1185 case PF_UNIX:
1186 switch (type) {
1187 case SOCK_STREAM:
1188 case SOCK_SEQPACKET:
1189 return SECCLASS_UNIX_STREAM_SOCKET;
1190 case SOCK_DGRAM:
1191 case SOCK_RAW:
1192 return SECCLASS_UNIX_DGRAM_SOCKET;
1193 }
1194 break;
1195 case PF_INET:
1196 case PF_INET6:
1197 switch (type) {
1198 case SOCK_STREAM:
1199 case SOCK_SEQPACKET:
1200 if (default_protocol_stream(protocol))
1201 return SECCLASS_TCP_SOCKET;
1202 else if (extsockclass && protocol == IPPROTO_SCTP)
1203 return SECCLASS_SCTP_SOCKET;
1204 else
1205 return SECCLASS_RAWIP_SOCKET;
1206 case SOCK_DGRAM:
1207 if (default_protocol_dgram(protocol))
1208 return SECCLASS_UDP_SOCKET;
1209 else if (extsockclass && (protocol == IPPROTO_ICMP ||
1210 protocol == IPPROTO_ICMPV6))
1211 return SECCLASS_ICMP_SOCKET;
1212 else
1213 return SECCLASS_RAWIP_SOCKET;
1214 case SOCK_DCCP:
1215 return SECCLASS_DCCP_SOCKET;
1216 default:
1217 return SECCLASS_RAWIP_SOCKET;
1218 }
1219 break;
1220 case PF_NETLINK:
1221 switch (protocol) {
1222 case NETLINK_ROUTE:
1223 return SECCLASS_NETLINK_ROUTE_SOCKET;
1224 case NETLINK_SOCK_DIAG:
1225 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1226 case NETLINK_NFLOG:
1227 return SECCLASS_NETLINK_NFLOG_SOCKET;
1228 case NETLINK_XFRM:
1229 return SECCLASS_NETLINK_XFRM_SOCKET;
1230 case NETLINK_SELINUX:
1231 return SECCLASS_NETLINK_SELINUX_SOCKET;
1232 case NETLINK_ISCSI:
1233 return SECCLASS_NETLINK_ISCSI_SOCKET;
1234 case NETLINK_AUDIT:
1235 return SECCLASS_NETLINK_AUDIT_SOCKET;
1236 case NETLINK_FIB_LOOKUP:
1237 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1238 case NETLINK_CONNECTOR:
1239 return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1240 case NETLINK_NETFILTER:
1241 return SECCLASS_NETLINK_NETFILTER_SOCKET;
1242 case NETLINK_DNRTMSG:
1243 return SECCLASS_NETLINK_DNRT_SOCKET;
1244 case NETLINK_KOBJECT_UEVENT:
1245 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1246 case NETLINK_GENERIC:
1247 return SECCLASS_NETLINK_GENERIC_SOCKET;
1248 case NETLINK_SCSITRANSPORT:
1249 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1250 case NETLINK_RDMA:
1251 return SECCLASS_NETLINK_RDMA_SOCKET;
1252 case NETLINK_CRYPTO:
1253 return SECCLASS_NETLINK_CRYPTO_SOCKET;
1254 default:
1255 return SECCLASS_NETLINK_SOCKET;
1256 }
1257 case PF_PACKET:
1258 return SECCLASS_PACKET_SOCKET;
1259 case PF_KEY:
1260 return SECCLASS_KEY_SOCKET;
1261 case PF_APPLETALK:
1262 return SECCLASS_APPLETALK_SOCKET;
1263 }
1264
1265 if (extsockclass) {
1266 switch (family) {
1267 case PF_AX25:
1268 return SECCLASS_AX25_SOCKET;
1269 case PF_IPX:
1270 return SECCLASS_IPX_SOCKET;
1271 case PF_NETROM:
1272 return SECCLASS_NETROM_SOCKET;
1273 case PF_ATMPVC:
1274 return SECCLASS_ATMPVC_SOCKET;
1275 case PF_X25:
1276 return SECCLASS_X25_SOCKET;
1277 case PF_ROSE:
1278 return SECCLASS_ROSE_SOCKET;
1279 case PF_DECnet:
1280 return SECCLASS_DECNET_SOCKET;
1281 case PF_ATMSVC:
1282 return SECCLASS_ATMSVC_SOCKET;
1283 case PF_RDS:
1284 return SECCLASS_RDS_SOCKET;
1285 case PF_IRDA:
1286 return SECCLASS_IRDA_SOCKET;
1287 case PF_PPPOX:
1288 return SECCLASS_PPPOX_SOCKET;
1289 case PF_LLC:
1290 return SECCLASS_LLC_SOCKET;
1291 case PF_CAN:
1292 return SECCLASS_CAN_SOCKET;
1293 case PF_TIPC:
1294 return SECCLASS_TIPC_SOCKET;
1295 case PF_BLUETOOTH:
1296 return SECCLASS_BLUETOOTH_SOCKET;
1297 case PF_IUCV:
1298 return SECCLASS_IUCV_SOCKET;
1299 case PF_RXRPC:
1300 return SECCLASS_RXRPC_SOCKET;
1301 case PF_ISDN:
1302 return SECCLASS_ISDN_SOCKET;
1303 case PF_PHONET:
1304 return SECCLASS_PHONET_SOCKET;
1305 case PF_IEEE802154:
1306 return SECCLASS_IEEE802154_SOCKET;
1307 case PF_CAIF:
1308 return SECCLASS_CAIF_SOCKET;
1309 case PF_ALG:
1310 return SECCLASS_ALG_SOCKET;
1311 case PF_NFC:
1312 return SECCLASS_NFC_SOCKET;
1313 case PF_VSOCK:
1314 return SECCLASS_VSOCK_SOCKET;
1315 case PF_KCM:
1316 return SECCLASS_KCM_SOCKET;
1317 case PF_QIPCRTR:
1318 return SECCLASS_QIPCRTR_SOCKET;
1319 case PF_SMC:
1320 return SECCLASS_SMC_SOCKET;
1321 case PF_XDP:
1322 return SECCLASS_XDP_SOCKET;
1323 #if PF_MAX > 45
1324 #error New address family defined, please update this function.
1325 #endif
1326 }
1327 }
1328
1329 return SECCLASS_SOCKET;
1330 }
1331
1332 static int selinux_genfs_get_sid(struct dentry *dentry,
1333 u16 tclass,
1334 u16 flags,
1335 u32 *sid)
1336 {
1337 int rc;
1338 struct super_block *sb = dentry->d_sb;
1339 char *buffer, *path;
1340
1341 buffer = (char *)__get_free_page(GFP_KERNEL);
1342 if (!buffer)
1343 return -ENOMEM;
1344
1345 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1346 if (IS_ERR(path))
1347 rc = PTR_ERR(path);
1348 else {
1349 if (flags & SE_SBPROC) {
1350 /* each process gets a /proc/PID/ entry. Strip off the
1351 * PID part to get a valid selinux labeling.
1352 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1353 while (path[1] >= '0' && path[1] <= '9') {
1354 path[1] = '/';
1355 path++;
1356 }
1357 }
1358 rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1359 path, tclass, sid);
1360 if (rc == -ENOENT) {
1361 /* No match in policy, mark as unlabeled. */
1362 *sid = SECINITSID_UNLABELED;
1363 rc = 0;
1364 }
1365 }
1366 free_page((unsigned long)buffer);
1367 return rc;
1368 }
1369
1370 static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry,
1371 u32 def_sid, u32 *sid)
1372 {
1373 #define INITCONTEXTLEN 255
1374 char *context;
1375 unsigned int len;
1376 int rc;
1377
1378 len = INITCONTEXTLEN;
1379 context = kmalloc(len + 1, GFP_NOFS);
1380 if (!context)
1381 return -ENOMEM;
1382
1383 context[len] = '\0';
1384 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1385 if (rc == -ERANGE) {
1386 kfree(context);
1387
1388 /* Need a larger buffer. Query for the right size. */
1389 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1390 if (rc < 0)
1391 return rc;
1392
1393 len = rc;
1394 context = kmalloc(len + 1, GFP_NOFS);
1395 if (!context)
1396 return -ENOMEM;
1397
1398 context[len] = '\0';
1399 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX,
1400 context, len);
1401 }
1402 if (rc < 0) {
1403 kfree(context);
1404 if (rc != -ENODATA) {
1405 pr_warn("SELinux: %s: getxattr returned %d for dev=%s ino=%ld\n",
1406 __func__, -rc, inode->i_sb->s_id, inode->i_ino);
1407 return rc;
1408 }
1409 *sid = def_sid;
1410 return 0;
1411 }
1412
1413 rc = security_context_to_sid_default(&selinux_state, context, rc, sid,
1414 def_sid, GFP_NOFS);
1415 if (rc) {
1416 char *dev = inode->i_sb->s_id;
1417 unsigned long ino = inode->i_ino;
1418
1419 if (rc == -EINVAL) {
1420 pr_notice_ratelimited("SELinux: inode=%lu on dev=%s was found to have an invalid context=%s. This indicates you may need to relabel the inode or the filesystem in question.\n",
1421 ino, dev, context);
1422 } else {
1423 pr_warn("SELinux: %s: context_to_sid(%s) returned %d for dev=%s ino=%ld\n",
1424 __func__, context, -rc, dev, ino);
1425 }
1426 }
1427 kfree(context);
1428 return 0;
1429 }
1430
1431 /* The inode's security attributes must be initialized before first use. */
1432 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1433 {
1434 struct superblock_security_struct *sbsec = NULL;
1435 struct inode_security_struct *isec = selinux_inode(inode);
1436 u32 task_sid, sid = 0;
1437 u16 sclass;
1438 struct dentry *dentry;
1439 int rc = 0;
1440
1441 if (isec->initialized == LABEL_INITIALIZED)
1442 return 0;
1443
1444 spin_lock(&isec->lock);
1445 if (isec->initialized == LABEL_INITIALIZED)
1446 goto out_unlock;
1447
1448 if (isec->sclass == SECCLASS_FILE)
1449 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1450
1451 sbsec = inode->i_sb->s_security;
1452 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1453 /* Defer initialization until selinux_complete_init,
1454 after the initial policy is loaded and the security
1455 server is ready to handle calls. */
1456 spin_lock(&sbsec->isec_lock);
1457 if (list_empty(&isec->list))
1458 list_add(&isec->list, &sbsec->isec_head);
1459 spin_unlock(&sbsec->isec_lock);
1460 goto out_unlock;
1461 }
1462
1463 sclass = isec->sclass;
1464 task_sid = isec->task_sid;
1465 sid = isec->sid;
1466 isec->initialized = LABEL_PENDING;
1467 spin_unlock(&isec->lock);
1468
1469 switch (sbsec->behavior) {
1470 case SECURITY_FS_USE_NATIVE:
1471 break;
1472 case SECURITY_FS_USE_XATTR:
1473 if (!(inode->i_opflags & IOP_XATTR)) {
1474 sid = sbsec->def_sid;
1475 break;
1476 }
1477 /* Need a dentry, since the xattr API requires one.
1478 Life would be simpler if we could just pass the inode. */
1479 if (opt_dentry) {
1480 /* Called from d_instantiate or d_splice_alias. */
1481 dentry = dget(opt_dentry);
1482 } else {
1483 /*
1484 * Called from selinux_complete_init, try to find a dentry.
1485 * Some filesystems really want a connected one, so try
1486 * that first. We could split SECURITY_FS_USE_XATTR in
1487 * two, depending upon that...
1488 */
1489 dentry = d_find_alias(inode);
1490 if (!dentry)
1491 dentry = d_find_any_alias(inode);
1492 }
1493 if (!dentry) {
1494 /*
1495 * this is can be hit on boot when a file is accessed
1496 * before the policy is loaded. When we load policy we
1497 * may find inodes that have no dentry on the
1498 * sbsec->isec_head list. No reason to complain as these
1499 * will get fixed up the next time we go through
1500 * inode_doinit with a dentry, before these inodes could
1501 * be used again by userspace.
1502 */
1503 goto out;
1504 }
1505
1506 rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
1507 &sid);
1508 dput(dentry);
1509 if (rc)
1510 goto out;
1511 break;
1512 case SECURITY_FS_USE_TASK:
1513 sid = task_sid;
1514 break;
1515 case SECURITY_FS_USE_TRANS:
1516 /* Default to the fs SID. */
1517 sid = sbsec->sid;
1518
1519 /* Try to obtain a transition SID. */
1520 rc = security_transition_sid(&selinux_state, task_sid, sid,
1521 sclass, NULL, &sid);
1522 if (rc)
1523 goto out;
1524 break;
1525 case SECURITY_FS_USE_MNTPOINT:
1526 sid = sbsec->mntpoint_sid;
1527 break;
1528 default:
1529 /* Default to the fs superblock SID. */
1530 sid = sbsec->sid;
1531
1532 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1533 /* We must have a dentry to determine the label on
1534 * procfs inodes */
1535 if (opt_dentry) {
1536 /* Called from d_instantiate or
1537 * d_splice_alias. */
1538 dentry = dget(opt_dentry);
1539 } else {
1540 /* Called from selinux_complete_init, try to
1541 * find a dentry. Some filesystems really want
1542 * a connected one, so try that first.
1543 */
1544 dentry = d_find_alias(inode);
1545 if (!dentry)
1546 dentry = d_find_any_alias(inode);
1547 }
1548 /*
1549 * This can be hit on boot when a file is accessed
1550 * before the policy is loaded. When we load policy we
1551 * may find inodes that have no dentry on the
1552 * sbsec->isec_head list. No reason to complain as
1553 * these will get fixed up the next time we go through
1554 * inode_doinit() with a dentry, before these inodes
1555 * could be used again by userspace.
1556 */
1557 if (!dentry)
1558 goto out;
1559 rc = selinux_genfs_get_sid(dentry, sclass,
1560 sbsec->flags, &sid);
1561 if (rc) {
1562 dput(dentry);
1563 goto out;
1564 }
1565
1566 if ((sbsec->flags & SE_SBGENFS_XATTR) &&
1567 (inode->i_opflags & IOP_XATTR)) {
1568 rc = inode_doinit_use_xattr(inode, dentry,
1569 sid, &sid);
1570 if (rc) {
1571 dput(dentry);
1572 goto out;
1573 }
1574 }
1575 dput(dentry);
1576 }
1577 break;
1578 }
1579
1580 out:
1581 spin_lock(&isec->lock);
1582 if (isec->initialized == LABEL_PENDING) {
1583 if (!sid || rc) {
1584 isec->initialized = LABEL_INVALID;
1585 goto out_unlock;
1586 }
1587
1588 isec->initialized = LABEL_INITIALIZED;
1589 isec->sid = sid;
1590 }
1591
1592 out_unlock:
1593 spin_unlock(&isec->lock);
1594 return rc;
1595 }
1596
1597 /* Convert a Linux signal to an access vector. */
1598 static inline u32 signal_to_av(int sig)
1599 {
1600 u32 perm = 0;
1601
1602 switch (sig) {
1603 case SIGCHLD:
1604 /* Commonly granted from child to parent. */
1605 perm = PROCESS__SIGCHLD;
1606 break;
1607 case SIGKILL:
1608 /* Cannot be caught or ignored */
1609 perm = PROCESS__SIGKILL;
1610 break;
1611 case SIGSTOP:
1612 /* Cannot be caught or ignored */
1613 perm = PROCESS__SIGSTOP;
1614 break;
1615 default:
1616 /* All other signals. */
1617 perm = PROCESS__SIGNAL;
1618 break;
1619 }
1620
1621 return perm;
1622 }
1623
1624 #if CAP_LAST_CAP > 63
1625 #error Fix SELinux to handle capabilities > 63.
1626 #endif
1627
1628 /* Check whether a task is allowed to use a capability. */
1629 static int cred_has_capability(const struct cred *cred,
1630 int cap, unsigned int opts, bool initns)
1631 {
1632 struct common_audit_data ad;
1633 struct av_decision avd;
1634 u16 sclass;
1635 u32 sid = cred_sid(cred);
1636 u32 av = CAP_TO_MASK(cap);
1637 int rc;
1638
1639 ad.type = LSM_AUDIT_DATA_CAP;
1640 ad.u.cap = cap;
1641
1642 switch (CAP_TO_INDEX(cap)) {
1643 case 0:
1644 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1645 break;
1646 case 1:
1647 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1648 break;
1649 default:
1650 pr_err("SELinux: out of range capability %d\n", cap);
1651 BUG();
1652 return -EINVAL;
1653 }
1654
1655 rc = avc_has_perm_noaudit(&selinux_state,
1656 sid, sid, sclass, av, 0, &avd);
1657 if (!(opts & CAP_OPT_NOAUDIT)) {
1658 int rc2 = avc_audit(&selinux_state,
1659 sid, sid, sclass, av, &avd, rc, &ad, 0);
1660 if (rc2)
1661 return rc2;
1662 }
1663 return rc;
1664 }
1665
1666 /* Check whether a task has a particular permission to an inode.
1667 The 'adp' parameter is optional and allows other audit
1668 data to be passed (e.g. the dentry). */
1669 static int inode_has_perm(const struct cred *cred,
1670 struct inode *inode,
1671 u32 perms,
1672 struct common_audit_data *adp)
1673 {
1674 struct inode_security_struct *isec;
1675 u32 sid;
1676
1677 validate_creds(cred);
1678
1679 if (unlikely(IS_PRIVATE(inode)))
1680 return 0;
1681
1682 sid = cred_sid(cred);
1683 isec = selinux_inode(inode);
1684
1685 return avc_has_perm(&selinux_state,
1686 sid, isec->sid, isec->sclass, perms, adp);
1687 }
1688
1689 /* Same as inode_has_perm, but pass explicit audit data containing
1690 the dentry to help the auditing code to more easily generate the
1691 pathname if needed. */
1692 static inline int dentry_has_perm(const struct cred *cred,
1693 struct dentry *dentry,
1694 u32 av)
1695 {
1696 struct inode *inode = d_backing_inode(dentry);
1697 struct common_audit_data ad;
1698
1699 ad.type = LSM_AUDIT_DATA_DENTRY;
1700 ad.u.dentry = dentry;
1701 __inode_security_revalidate(inode, dentry, true);
1702 return inode_has_perm(cred, inode, av, &ad);
1703 }
1704
1705 /* Same as inode_has_perm, but pass explicit audit data containing
1706 the path to help the auditing code to more easily generate the
1707 pathname if needed. */
1708 static inline int path_has_perm(const struct cred *cred,
1709 const struct path *path,
1710 u32 av)
1711 {
1712 struct inode *inode = d_backing_inode(path->dentry);
1713 struct common_audit_data ad;
1714
1715 ad.type = LSM_AUDIT_DATA_PATH;
1716 ad.u.path = *path;
1717 __inode_security_revalidate(inode, path->dentry, true);
1718 return inode_has_perm(cred, inode, av, &ad);
1719 }
1720
1721 /* Same as path_has_perm, but uses the inode from the file struct. */
1722 static inline int file_path_has_perm(const struct cred *cred,
1723 struct file *file,
1724 u32 av)
1725 {
1726 struct common_audit_data ad;
1727
1728 ad.type = LSM_AUDIT_DATA_FILE;
1729 ad.u.file = file;
1730 return inode_has_perm(cred, file_inode(file), av, &ad);
1731 }
1732
1733 #ifdef CONFIG_BPF_SYSCALL
1734 static int bpf_fd_pass(struct file *file, u32 sid);
1735 #endif
1736
1737 /* Check whether a task can use an open file descriptor to
1738 access an inode in a given way. Check access to the
1739 descriptor itself, and then use dentry_has_perm to
1740 check a particular permission to the file.
1741 Access to the descriptor is implicitly granted if it
1742 has the same SID as the process. If av is zero, then
1743 access to the file is not checked, e.g. for cases
1744 where only the descriptor is affected like seek. */
1745 static int file_has_perm(const struct cred *cred,
1746 struct file *file,
1747 u32 av)
1748 {
1749 struct file_security_struct *fsec = selinux_file(file);
1750 struct inode *inode = file_inode(file);
1751 struct common_audit_data ad;
1752 u32 sid = cred_sid(cred);
1753 int rc;
1754
1755 ad.type = LSM_AUDIT_DATA_FILE;
1756 ad.u.file = file;
1757
1758 if (sid != fsec->sid) {
1759 rc = avc_has_perm(&selinux_state,
1760 sid, fsec->sid,
1761 SECCLASS_FD,
1762 FD__USE,
1763 &ad);
1764 if (rc)
1765 goto out;
1766 }
1767
1768 #ifdef CONFIG_BPF_SYSCALL
1769 rc = bpf_fd_pass(file, cred_sid(cred));
1770 if (rc)
1771 return rc;
1772 #endif
1773
1774 /* av is zero if only checking access to the descriptor. */
1775 rc = 0;
1776 if (av)
1777 rc = inode_has_perm(cred, inode, av, &ad);
1778
1779 out:
1780 return rc;
1781 }
1782
1783 /*
1784 * Determine the label for an inode that might be unioned.
1785 */
1786 static int
1787 selinux_determine_inode_label(const struct task_security_struct *tsec,
1788 struct inode *dir,
1789 const struct qstr *name, u16 tclass,
1790 u32 *_new_isid)
1791 {
1792 const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1793
1794 if ((sbsec->flags & SE_SBINITIALIZED) &&
1795 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1796 *_new_isid = sbsec->mntpoint_sid;
1797 } else if ((sbsec->flags & SBLABEL_MNT) &&
1798 tsec->create_sid) {
1799 *_new_isid = tsec->create_sid;
1800 } else {
1801 const struct inode_security_struct *dsec = inode_security(dir);
1802 return security_transition_sid(&selinux_state, tsec->sid,
1803 dsec->sid, tclass,
1804 name, _new_isid);
1805 }
1806
1807 return 0;
1808 }
1809
1810 /* Check whether a task can create a file. */
1811 static int may_create(struct inode *dir,
1812 struct dentry *dentry,
1813 u16 tclass)
1814 {
1815 const struct task_security_struct *tsec = selinux_cred(current_cred());
1816 struct inode_security_struct *dsec;
1817 struct superblock_security_struct *sbsec;
1818 u32 sid, newsid;
1819 struct common_audit_data ad;
1820 int rc;
1821
1822 dsec = inode_security(dir);
1823 sbsec = dir->i_sb->s_security;
1824
1825 sid = tsec->sid;
1826
1827 ad.type = LSM_AUDIT_DATA_DENTRY;
1828 ad.u.dentry = dentry;
1829
1830 rc = avc_has_perm(&selinux_state,
1831 sid, dsec->sid, SECCLASS_DIR,
1832 DIR__ADD_NAME | DIR__SEARCH,
1833 &ad);
1834 if (rc)
1835 return rc;
1836
1837 rc = selinux_determine_inode_label(selinux_cred(current_cred()), dir,
1838 &dentry->d_name, tclass, &newsid);
1839 if (rc)
1840 return rc;
1841
1842 rc = avc_has_perm(&selinux_state,
1843 sid, newsid, tclass, FILE__CREATE, &ad);
1844 if (rc)
1845 return rc;
1846
1847 return avc_has_perm(&selinux_state,
1848 newsid, sbsec->sid,
1849 SECCLASS_FILESYSTEM,
1850 FILESYSTEM__ASSOCIATE, &ad);
1851 }
1852
1853 #define MAY_LINK 0
1854 #define MAY_UNLINK 1
1855 #define MAY_RMDIR 2
1856
1857 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1858 static int may_link(struct inode *dir,
1859 struct dentry *dentry,
1860 int kind)
1861
1862 {
1863 struct inode_security_struct *dsec, *isec;
1864 struct common_audit_data ad;
1865 u32 sid = current_sid();
1866 u32 av;
1867 int rc;
1868
1869 dsec = inode_security(dir);
1870 isec = backing_inode_security(dentry);
1871
1872 ad.type = LSM_AUDIT_DATA_DENTRY;
1873 ad.u.dentry = dentry;
1874
1875 av = DIR__SEARCH;
1876 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1877 rc = avc_has_perm(&selinux_state,
1878 sid, dsec->sid, SECCLASS_DIR, av, &ad);
1879 if (rc)
1880 return rc;
1881
1882 switch (kind) {
1883 case MAY_LINK:
1884 av = FILE__LINK;
1885 break;
1886 case MAY_UNLINK:
1887 av = FILE__UNLINK;
1888 break;
1889 case MAY_RMDIR:
1890 av = DIR__RMDIR;
1891 break;
1892 default:
1893 pr_warn("SELinux: %s: unrecognized kind %d\n",
1894 __func__, kind);
1895 return 0;
1896 }
1897
1898 rc = avc_has_perm(&selinux_state,
1899 sid, isec->sid, isec->sclass, av, &ad);
1900 return rc;
1901 }
1902
1903 static inline int may_rename(struct inode *old_dir,
1904 struct dentry *old_dentry,
1905 struct inode *new_dir,
1906 struct dentry *new_dentry)
1907 {
1908 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1909 struct common_audit_data ad;
1910 u32 sid = current_sid();
1911 u32 av;
1912 int old_is_dir, new_is_dir;
1913 int rc;
1914
1915 old_dsec = inode_security(old_dir);
1916 old_isec = backing_inode_security(old_dentry);
1917 old_is_dir = d_is_dir(old_dentry);
1918 new_dsec = inode_security(new_dir);
1919
1920 ad.type = LSM_AUDIT_DATA_DENTRY;
1921
1922 ad.u.dentry = old_dentry;
1923 rc = avc_has_perm(&selinux_state,
1924 sid, old_dsec->sid, SECCLASS_DIR,
1925 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1926 if (rc)
1927 return rc;
1928 rc = avc_has_perm(&selinux_state,
1929 sid, old_isec->sid,
1930 old_isec->sclass, FILE__RENAME, &ad);
1931 if (rc)
1932 return rc;
1933 if (old_is_dir && new_dir != old_dir) {
1934 rc = avc_has_perm(&selinux_state,
1935 sid, old_isec->sid,
1936 old_isec->sclass, DIR__REPARENT, &ad);
1937 if (rc)
1938 return rc;
1939 }
1940
1941 ad.u.dentry = new_dentry;
1942 av = DIR__ADD_NAME | DIR__SEARCH;
1943 if (d_is_positive(new_dentry))
1944 av |= DIR__REMOVE_NAME;
1945 rc = avc_has_perm(&selinux_state,
1946 sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1947 if (rc)
1948 return rc;
1949 if (d_is_positive(new_dentry)) {
1950 new_isec = backing_inode_security(new_dentry);
1951 new_is_dir = d_is_dir(new_dentry);
1952 rc = avc_has_perm(&selinux_state,
1953 sid, new_isec->sid,
1954 new_isec->sclass,
1955 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1956 if (rc)
1957 return rc;
1958 }
1959
1960 return 0;
1961 }
1962
1963 /* Check whether a task can perform a filesystem operation. */
1964 static int superblock_has_perm(const struct cred *cred,
1965 struct super_block *sb,
1966 u32 perms,
1967 struct common_audit_data *ad)
1968 {
1969 struct superblock_security_struct *sbsec;
1970 u32 sid = cred_sid(cred);
1971
1972 sbsec = sb->s_security;
1973 return avc_has_perm(&selinux_state,
1974 sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1975 }
1976
1977 /* Convert a Linux mode and permission mask to an access vector. */
1978 static inline u32 file_mask_to_av(int mode, int mask)
1979 {
1980 u32 av = 0;
1981
1982 if (!S_ISDIR(mode)) {
1983 if (mask & MAY_EXEC)
1984 av |= FILE__EXECUTE;
1985 if (mask & MAY_READ)
1986 av |= FILE__READ;
1987
1988 if (mask & MAY_APPEND)
1989 av |= FILE__APPEND;
1990 else if (mask & MAY_WRITE)
1991 av |= FILE__WRITE;
1992
1993 } else {
1994 if (mask & MAY_EXEC)
1995 av |= DIR__SEARCH;
1996 if (mask & MAY_WRITE)
1997 av |= DIR__WRITE;
1998 if (mask & MAY_READ)
1999 av |= DIR__READ;
2000 }
2001
2002 return av;
2003 }
2004
2005 /* Convert a Linux file to an access vector. */
2006 static inline u32 file_to_av(struct file *file)
2007 {
2008 u32 av = 0;
2009
2010 if (file->f_mode & FMODE_READ)
2011 av |= FILE__READ;
2012 if (file->f_mode & FMODE_WRITE) {
2013 if (file->f_flags & O_APPEND)
2014 av |= FILE__APPEND;
2015 else
2016 av |= FILE__WRITE;
2017 }
2018 if (!av) {
2019 /*
2020 * Special file opened with flags 3 for ioctl-only use.
2021 */
2022 av = FILE__IOCTL;
2023 }
2024
2025 return av;
2026 }
2027
2028 /*
2029 * Convert a file to an access vector and include the correct open
2030 * open permission.
2031 */
2032 static inline u32 open_file_to_av(struct file *file)
2033 {
2034 u32 av = file_to_av(file);
2035 struct inode *inode = file_inode(file);
2036
2037 if (selinux_policycap_openperm() &&
2038 inode->i_sb->s_magic != SOCKFS_MAGIC)
2039 av |= FILE__OPEN;
2040
2041 return av;
2042 }
2043
2044 /* Hook functions begin here. */
2045
2046 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2047 {
2048 u32 mysid = current_sid();
2049 u32 mgrsid = task_sid(mgr);
2050
2051 return avc_has_perm(&selinux_state,
2052 mysid, mgrsid, SECCLASS_BINDER,
2053 BINDER__SET_CONTEXT_MGR, NULL);
2054 }
2055
2056 static int selinux_binder_transaction(struct task_struct *from,
2057 struct task_struct *to)
2058 {
2059 u32 mysid = current_sid();
2060 u32 fromsid = task_sid(from);
2061 u32 tosid = task_sid(to);
2062 int rc;
2063
2064 if (mysid != fromsid) {
2065 rc = avc_has_perm(&selinux_state,
2066 mysid, fromsid, SECCLASS_BINDER,
2067 BINDER__IMPERSONATE, NULL);
2068 if (rc)
2069 return rc;
2070 }
2071
2072 return avc_has_perm(&selinux_state,
2073 fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2074 NULL);
2075 }
2076
2077 static int selinux_binder_transfer_binder(struct task_struct *from,
2078 struct task_struct *to)
2079 {
2080 u32 fromsid = task_sid(from);
2081 u32 tosid = task_sid(to);
2082
2083 return avc_has_perm(&selinux_state,
2084 fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2085 NULL);
2086 }
2087
2088 static int selinux_binder_transfer_file(struct task_struct *from,
2089 struct task_struct *to,
2090 struct file *file)
2091 {
2092 u32 sid = task_sid(to);
2093 struct file_security_struct *fsec = selinux_file(file);
2094 struct dentry *dentry = file->f_path.dentry;
2095 struct inode_security_struct *isec;
2096 struct common_audit_data ad;
2097 int rc;
2098
2099 ad.type = LSM_AUDIT_DATA_PATH;
2100 ad.u.path = file->f_path;
2101
2102 if (sid != fsec->sid) {
2103 rc = avc_has_perm(&selinux_state,
2104 sid, fsec->sid,
2105 SECCLASS_FD,
2106 FD__USE,
2107 &ad);
2108 if (rc)
2109 return rc;
2110 }
2111
2112 #ifdef CONFIG_BPF_SYSCALL
2113 rc = bpf_fd_pass(file, sid);
2114 if (rc)
2115 return rc;
2116 #endif
2117
2118 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2119 return 0;
2120
2121 isec = backing_inode_security(dentry);
2122 return avc_has_perm(&selinux_state,
2123 sid, isec->sid, isec->sclass, file_to_av(file),
2124 &ad);
2125 }
2126
2127 static int selinux_ptrace_access_check(struct task_struct *child,
2128 unsigned int mode)
2129 {
2130 u32 sid = current_sid();
2131 u32 csid = task_sid(child);
2132
2133 if (mode & PTRACE_MODE_READ)
2134 return avc_has_perm(&selinux_state,
2135 sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2136
2137 return avc_has_perm(&selinux_state,
2138 sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2139 }
2140
2141 static int selinux_ptrace_traceme(struct task_struct *parent)
2142 {
2143 return avc_has_perm(&selinux_state,
2144 task_sid(parent), current_sid(), SECCLASS_PROCESS,
2145 PROCESS__PTRACE, NULL);
2146 }
2147
2148 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2149 kernel_cap_t *inheritable, kernel_cap_t *permitted)
2150 {
2151 return avc_has_perm(&selinux_state,
2152 current_sid(), task_sid(target), SECCLASS_PROCESS,
2153 PROCESS__GETCAP, NULL);
2154 }
2155
2156 static int selinux_capset(struct cred *new, const struct cred *old,
2157 const kernel_cap_t *effective,
2158 const kernel_cap_t *inheritable,
2159 const kernel_cap_t *permitted)
2160 {
2161 return avc_has_perm(&selinux_state,
2162 cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2163 PROCESS__SETCAP, NULL);
2164 }
2165
2166 /*
2167 * (This comment used to live with the selinux_task_setuid hook,
2168 * which was removed).
2169 *
2170 * Since setuid only affects the current process, and since the SELinux
2171 * controls are not based on the Linux identity attributes, SELinux does not
2172 * need to control this operation. However, SELinux does control the use of
2173 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2174 */
2175
2176 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2177 int cap, unsigned int opts)
2178 {
2179 return cred_has_capability(cred, cap, opts, ns == &init_user_ns);
2180 }
2181
2182 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2183 {
2184 const struct cred *cred = current_cred();
2185 int rc = 0;
2186
2187 if (!sb)
2188 return 0;
2189
2190 switch (cmds) {
2191 case Q_SYNC:
2192 case Q_QUOTAON:
2193 case Q_QUOTAOFF:
2194 case Q_SETINFO:
2195 case Q_SETQUOTA:
2196 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2197 break;
2198 case Q_GETFMT:
2199 case Q_GETINFO:
2200 case Q_GETQUOTA:
2201 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2202 break;
2203 default:
2204 rc = 0; /* let the kernel handle invalid cmds */
2205 break;
2206 }
2207 return rc;
2208 }
2209
2210 static int selinux_quota_on(struct dentry *dentry)
2211 {
2212 const struct cred *cred = current_cred();
2213
2214 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2215 }
2216
2217 static int selinux_syslog(int type)
2218 {
2219 switch (type) {
2220 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2221 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2222 return avc_has_perm(&selinux_state,
2223 current_sid(), SECINITSID_KERNEL,
2224 SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2225 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2226 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2227 /* Set level of messages printed to console */
2228 case SYSLOG_ACTION_CONSOLE_LEVEL:
2229 return avc_has_perm(&selinux_state,
2230 current_sid(), SECINITSID_KERNEL,
2231 SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2232 NULL);
2233 }
2234 /* All other syslog types */
2235 return avc_has_perm(&selinux_state,
2236 current_sid(), SECINITSID_KERNEL,
2237 SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2238 }
2239
2240 /*
2241 * Check that a process has enough memory to allocate a new virtual
2242 * mapping. 0 means there is enough memory for the allocation to
2243 * succeed and -ENOMEM implies there is not.
2244 *
2245 * Do not audit the selinux permission check, as this is applied to all
2246 * processes that allocate mappings.
2247 */
2248 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2249 {
2250 int rc, cap_sys_admin = 0;
2251
2252 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2253 CAP_OPT_NOAUDIT, true);
2254 if (rc == 0)
2255 cap_sys_admin = 1;
2256
2257 return cap_sys_admin;
2258 }
2259
2260 /* binprm security operations */
2261
2262 static u32 ptrace_parent_sid(void)
2263 {
2264 u32 sid = 0;
2265 struct task_struct *tracer;
2266
2267 rcu_read_lock();
2268 tracer = ptrace_parent(current);
2269 if (tracer)
2270 sid = task_sid(tracer);
2271 rcu_read_unlock();
2272
2273 return sid;
2274 }
2275
2276 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2277 const struct task_security_struct *old_tsec,
2278 const struct task_security_struct *new_tsec)
2279 {
2280 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2281 int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2282 int rc;
2283 u32 av;
2284
2285 if (!nnp && !nosuid)
2286 return 0; /* neither NNP nor nosuid */
2287
2288 if (new_tsec->sid == old_tsec->sid)
2289 return 0; /* No change in credentials */
2290
2291 /*
2292 * If the policy enables the nnp_nosuid_transition policy capability,
2293 * then we permit transitions under NNP or nosuid if the
2294 * policy allows the corresponding permission between
2295 * the old and new contexts.
2296 */
2297 if (selinux_policycap_nnp_nosuid_transition()) {
2298 av = 0;
2299 if (nnp)
2300 av |= PROCESS2__NNP_TRANSITION;
2301 if (nosuid)
2302 av |= PROCESS2__NOSUID_TRANSITION;
2303 rc = avc_has_perm(&selinux_state,
2304 old_tsec->sid, new_tsec->sid,
2305 SECCLASS_PROCESS2, av, NULL);
2306 if (!rc)
2307 return 0;
2308 }
2309
2310 /*
2311 * We also permit NNP or nosuid transitions to bounded SIDs,
2312 * i.e. SIDs that are guaranteed to only be allowed a subset
2313 * of the permissions of the current SID.
2314 */
2315 rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2316 new_tsec->sid);
2317 if (!rc)
2318 return 0;
2319
2320 /*
2321 * On failure, preserve the errno values for NNP vs nosuid.
2322 * NNP: Operation not permitted for caller.
2323 * nosuid: Permission denied to file.
2324 */
2325 if (nnp)
2326 return -EPERM;
2327 return -EACCES;
2328 }
2329
2330 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2331 {
2332 const struct task_security_struct *old_tsec;
2333 struct task_security_struct *new_tsec;
2334 struct inode_security_struct *isec;
2335 struct common_audit_data ad;
2336 struct inode *inode = file_inode(bprm->file);
2337 int rc;
2338
2339 /* SELinux context only depends on initial program or script and not
2340 * the script interpreter */
2341 if (bprm->called_set_creds)
2342 return 0;
2343
2344 old_tsec = selinux_cred(current_cred());
2345 new_tsec = selinux_cred(bprm->cred);
2346 isec = inode_security(inode);
2347
2348 /* Default to the current task SID. */
2349 new_tsec->sid = old_tsec->sid;
2350 new_tsec->osid = old_tsec->sid;
2351
2352 /* Reset fs, key, and sock SIDs on execve. */
2353 new_tsec->create_sid = 0;
2354 new_tsec->keycreate_sid = 0;
2355 new_tsec->sockcreate_sid = 0;
2356
2357 if (old_tsec->exec_sid) {
2358 new_tsec->sid = old_tsec->exec_sid;
2359 /* Reset exec SID on execve. */
2360 new_tsec->exec_sid = 0;
2361
2362 /* Fail on NNP or nosuid if not an allowed transition. */
2363 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2364 if (rc)
2365 return rc;
2366 } else {
2367 /* Check for a default transition on this program. */
2368 rc = security_transition_sid(&selinux_state, old_tsec->sid,
2369 isec->sid, SECCLASS_PROCESS, NULL,
2370 &new_tsec->sid);
2371 if (rc)
2372 return rc;
2373
2374 /*
2375 * Fallback to old SID on NNP or nosuid if not an allowed
2376 * transition.
2377 */
2378 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2379 if (rc)
2380 new_tsec->sid = old_tsec->sid;
2381 }
2382
2383 ad.type = LSM_AUDIT_DATA_FILE;
2384 ad.u.file = bprm->file;
2385
2386 if (new_tsec->sid == old_tsec->sid) {
2387 rc = avc_has_perm(&selinux_state,
2388 old_tsec->sid, isec->sid,
2389 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2390 if (rc)
2391 return rc;
2392 } else {
2393 /* Check permissions for the transition. */
2394 rc = avc_has_perm(&selinux_state,
2395 old_tsec->sid, new_tsec->sid,
2396 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2397 if (rc)
2398 return rc;
2399
2400 rc = avc_has_perm(&selinux_state,
2401 new_tsec->sid, isec->sid,
2402 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2403 if (rc)
2404 return rc;
2405
2406 /* Check for shared state */
2407 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2408 rc = avc_has_perm(&selinux_state,
2409 old_tsec->sid, new_tsec->sid,
2410 SECCLASS_PROCESS, PROCESS__SHARE,
2411 NULL);
2412 if (rc)
2413 return -EPERM;
2414 }
2415
2416 /* Make sure that anyone attempting to ptrace over a task that
2417 * changes its SID has the appropriate permit */
2418 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2419 u32 ptsid = ptrace_parent_sid();
2420 if (ptsid != 0) {
2421 rc = avc_has_perm(&selinux_state,
2422 ptsid, new_tsec->sid,
2423 SECCLASS_PROCESS,
2424 PROCESS__PTRACE, NULL);
2425 if (rc)
2426 return -EPERM;
2427 }
2428 }
2429
2430 /* Clear any possibly unsafe personality bits on exec: */
2431 bprm->per_clear |= PER_CLEAR_ON_SETID;
2432
2433 /* Enable secure mode for SIDs transitions unless
2434 the noatsecure permission is granted between
2435 the two SIDs, i.e. ahp returns 0. */
2436 rc = avc_has_perm(&selinux_state,
2437 old_tsec->sid, new_tsec->sid,
2438 SECCLASS_PROCESS, PROCESS__NOATSECURE,
2439 NULL);
2440 bprm->secureexec |= !!rc;
2441 }
2442
2443 return 0;
2444 }
2445
2446 static int match_file(const void *p, struct file *file, unsigned fd)
2447 {
2448 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2449 }
2450
2451 /* Derived from fs/exec.c:flush_old_files. */
2452 static inline void flush_unauthorized_files(const struct cred *cred,
2453 struct files_struct *files)
2454 {
2455 struct file *file, *devnull = NULL;
2456 struct tty_struct *tty;
2457 int drop_tty = 0;
2458 unsigned n;
2459
2460 tty = get_current_tty();
2461 if (tty) {
2462 spin_lock(&tty->files_lock);
2463 if (!list_empty(&tty->tty_files)) {
2464 struct tty_file_private *file_priv;
2465
2466 /* Revalidate access to controlling tty.
2467 Use file_path_has_perm on the tty path directly
2468 rather than using file_has_perm, as this particular
2469 open file may belong to another process and we are
2470 only interested in the inode-based check here. */
2471 file_priv = list_first_entry(&tty->tty_files,
2472 struct tty_file_private, list);
2473 file = file_priv->file;
2474 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2475 drop_tty = 1;
2476 }
2477 spin_unlock(&tty->files_lock);
2478 tty_kref_put(tty);
2479 }
2480 /* Reset controlling tty. */
2481 if (drop_tty)
2482 no_tty();
2483
2484 /* Revalidate access to inherited open files. */
2485 n = iterate_fd(files, 0, match_file, cred);
2486 if (!n) /* none found? */
2487 return;
2488
2489 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2490 if (IS_ERR(devnull))
2491 devnull = NULL;
2492 /* replace all the matching ones with this */
2493 do {
2494 replace_fd(n - 1, devnull, 0);
2495 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2496 if (devnull)
2497 fput(devnull);
2498 }
2499
2500 /*
2501 * Prepare a process for imminent new credential changes due to exec
2502 */
2503 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2504 {
2505 struct task_security_struct *new_tsec;
2506 struct rlimit *rlim, *initrlim;
2507 int rc, i;
2508
2509 new_tsec = selinux_cred(bprm->cred);
2510 if (new_tsec->sid == new_tsec->osid)
2511 return;
2512
2513 /* Close files for which the new task SID is not authorized. */
2514 flush_unauthorized_files(bprm->cred, current->files);
2515
2516 /* Always clear parent death signal on SID transitions. */
2517 current->pdeath_signal = 0;
2518
2519 /* Check whether the new SID can inherit resource limits from the old
2520 * SID. If not, reset all soft limits to the lower of the current
2521 * task's hard limit and the init task's soft limit.
2522 *
2523 * Note that the setting of hard limits (even to lower them) can be
2524 * controlled by the setrlimit check. The inclusion of the init task's
2525 * soft limit into the computation is to avoid resetting soft limits
2526 * higher than the default soft limit for cases where the default is
2527 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2528 */
2529 rc = avc_has_perm(&selinux_state,
2530 new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2531 PROCESS__RLIMITINH, NULL);
2532 if (rc) {
2533 /* protect against do_prlimit() */
2534 task_lock(current);
2535 for (i = 0; i < RLIM_NLIMITS; i++) {
2536 rlim = current->signal->rlim + i;
2537 initrlim = init_task.signal->rlim + i;
2538 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2539 }
2540 task_unlock(current);
2541 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2542 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2543 }
2544 }
2545
2546 /*
2547 * Clean up the process immediately after the installation of new credentials
2548 * due to exec
2549 */
2550 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2551 {
2552 const struct task_security_struct *tsec = selinux_cred(current_cred());
2553 struct itimerval itimer;
2554 u32 osid, sid;
2555 int rc, i;
2556
2557 osid = tsec->osid;
2558 sid = tsec->sid;
2559
2560 if (sid == osid)
2561 return;
2562
2563 /* Check whether the new SID can inherit signal state from the old SID.
2564 * If not, clear itimers to avoid subsequent signal generation and
2565 * flush and unblock signals.
2566 *
2567 * This must occur _after_ the task SID has been updated so that any
2568 * kill done after the flush will be checked against the new SID.
2569 */
2570 rc = avc_has_perm(&selinux_state,
2571 osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2572 if (rc) {
2573 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) {
2574 memset(&itimer, 0, sizeof itimer);
2575 for (i = 0; i < 3; i++)
2576 do_setitimer(i, &itimer, NULL);
2577 }
2578 spin_lock_irq(&current->sighand->siglock);
2579 if (!fatal_signal_pending(current)) {
2580 flush_sigqueue(&current->pending);
2581 flush_sigqueue(&current->signal->shared_pending);
2582 flush_signal_handlers(current, 1);
2583 sigemptyset(&current->blocked);
2584 recalc_sigpending();
2585 }
2586 spin_unlock_irq(&current->sighand->siglock);
2587 }
2588
2589 /* Wake up the parent if it is waiting so that it can recheck
2590 * wait permission to the new task SID. */
2591 read_lock(&tasklist_lock);
2592 __wake_up_parent(current, current->real_parent);
2593 read_unlock(&tasklist_lock);
2594 }
2595
2596 /* superblock security operations */
2597
2598 static int selinux_sb_alloc_security(struct super_block *sb)
2599 {
2600 return superblock_alloc_security(sb);
2601 }
2602
2603 static void selinux_sb_free_security(struct super_block *sb)
2604 {
2605 superblock_free_security(sb);
2606 }
2607
2608 static inline int opt_len(const char *s)
2609 {
2610 bool open_quote = false;
2611 int len;
2612 char c;
2613
2614 for (len = 0; (c = s[len]) != '\0'; len++) {
2615 if (c == '"')
2616 open_quote = !open_quote;
2617 if (c == ',' && !open_quote)
2618 break;
2619 }
2620 return len;
2621 }
2622
2623 static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
2624 {
2625 char *from = options;
2626 char *to = options;
2627 bool first = true;
2628 int rc;
2629
2630 while (1) {
2631 int len = opt_len(from);
2632 int token;
2633 char *arg = NULL;
2634
2635 token = match_opt_prefix(from, len, &arg);
2636
2637 if (token != Opt_error) {
2638 char *p, *q;
2639
2640 /* strip quotes */
2641 if (arg) {
2642 for (p = q = arg; p < from + len; p++) {
2643 char c = *p;
2644 if (c != '"')
2645 *q++ = c;
2646 }
2647 arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);
2648 if (!arg) {
2649 rc = -ENOMEM;
2650 goto free_opt;
2651 }
2652 }
2653 rc = selinux_add_opt(token, arg, mnt_opts);
2654 if (unlikely(rc)) {
2655 kfree(arg);
2656 goto free_opt;
2657 }
2658 } else {
2659 if (!first) { // copy with preceding comma
2660 from--;
2661 len++;
2662 }
2663 if (to != from)
2664 memmove(to, from, len);
2665 to += len;
2666 first = false;
2667 }
2668 if (!from[len])
2669 break;
2670 from += len + 1;
2671 }
2672 *to = '\0';
2673 return 0;
2674
2675 free_opt:
2676 if (*mnt_opts) {
2677 selinux_free_mnt_opts(*mnt_opts);
2678 *mnt_opts = NULL;
2679 }
2680 return rc;
2681 }
2682
2683 static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
2684 {
2685 struct selinux_mnt_opts *opts = mnt_opts;
2686 struct superblock_security_struct *sbsec = sb->s_security;
2687 u32 sid;
2688 int rc;
2689
2690 if (!(sbsec->flags & SE_SBINITIALIZED))
2691 return 0;
2692
2693 if (!opts)
2694 return 0;
2695
2696 if (opts->fscontext) {
2697 rc = parse_sid(sb, opts->fscontext, &sid);
2698 if (rc)
2699 return rc;
2700 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2701 goto out_bad_option;
2702 }
2703 if (opts->context) {
2704 rc = parse_sid(sb, opts->context, &sid);
2705 if (rc)
2706 return rc;
2707 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2708 goto out_bad_option;
2709 }
2710 if (opts->rootcontext) {
2711 struct inode_security_struct *root_isec;
2712 root_isec = backing_inode_security(sb->s_root);
2713 rc = parse_sid(sb, opts->rootcontext, &sid);
2714 if (rc)
2715 return rc;
2716 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2717 goto out_bad_option;
2718 }
2719 if (opts->defcontext) {
2720 rc = parse_sid(sb, opts->defcontext, &sid);
2721 if (rc)
2722 return rc;
2723 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2724 goto out_bad_option;
2725 }
2726 return 0;
2727
2728 out_bad_option:
2729 pr_warn("SELinux: unable to change security options "
2730 "during remount (dev %s, type=%s)\n", sb->s_id,
2731 sb->s_type->name);
2732 return -EINVAL;
2733 }
2734
2735 static int selinux_sb_kern_mount(struct super_block *sb)
2736 {
2737 const struct cred *cred = current_cred();
2738 struct common_audit_data ad;
2739
2740 ad.type = LSM_AUDIT_DATA_DENTRY;
2741 ad.u.dentry = sb->s_root;
2742 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2743 }
2744
2745 static int selinux_sb_statfs(struct dentry *dentry)
2746 {
2747 const struct cred *cred = current_cred();
2748 struct common_audit_data ad;
2749
2750 ad.type = LSM_AUDIT_DATA_DENTRY;
2751 ad.u.dentry = dentry->d_sb->s_root;
2752 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2753 }
2754
2755 static int selinux_mount(const char *dev_name,
2756 const struct path *path,
2757 const char *type,
2758 unsigned long flags,
2759 void *data)
2760 {
2761 const struct cred *cred = current_cred();
2762
2763 if (flags & MS_REMOUNT)
2764 return superblock_has_perm(cred, path->dentry->d_sb,
2765 FILESYSTEM__REMOUNT, NULL);
2766 else
2767 return path_has_perm(cred, path, FILE__MOUNTON);
2768 }
2769
2770 static int selinux_umount(struct vfsmount *mnt, int flags)
2771 {
2772 const struct cred *cred = current_cred();
2773
2774 return superblock_has_perm(cred, mnt->mnt_sb,
2775 FILESYSTEM__UNMOUNT, NULL);
2776 }
2777
2778 static int selinux_fs_context_dup(struct fs_context *fc,
2779 struct fs_context *src_fc)
2780 {
2781 const struct selinux_mnt_opts *src = src_fc->security;
2782 struct selinux_mnt_opts *opts;
2783
2784 if (!src)
2785 return 0;
2786
2787 fc->security = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
2788 if (!fc->security)
2789 return -ENOMEM;
2790
2791 opts = fc->security;
2792
2793 if (src->fscontext) {
2794 opts->fscontext = kstrdup(src->fscontext, GFP_KERNEL);
2795 if (!opts->fscontext)
2796 return -ENOMEM;
2797 }
2798 if (src->context) {
2799 opts->context = kstrdup(src->context, GFP_KERNEL);
2800 if (!opts->context)
2801 return -ENOMEM;
2802 }
2803 if (src->rootcontext) {
2804 opts->rootcontext = kstrdup(src->rootcontext, GFP_KERNEL);
2805 if (!opts->rootcontext)
2806 return -ENOMEM;
2807 }
2808 if (src->defcontext) {
2809 opts->defcontext = kstrdup(src->defcontext, GFP_KERNEL);
2810 if (!opts->defcontext)
2811 return -ENOMEM;
2812 }
2813 return 0;
2814 }
2815
2816 static const struct fs_parameter_spec selinux_param_specs[] = {
2817 fsparam_string(CONTEXT_STR, Opt_context),
2818 fsparam_string(DEFCONTEXT_STR, Opt_defcontext),
2819 fsparam_string(FSCONTEXT_STR, Opt_fscontext),
2820 fsparam_string(ROOTCONTEXT_STR, Opt_rootcontext),
2821 fsparam_flag (SECLABEL_STR, Opt_seclabel),
2822 {}
2823 };
2824
2825 static const struct fs_parameter_description selinux_fs_parameters = {
2826 .name = "SELinux",
2827 .specs = selinux_param_specs,
2828 };
2829
2830 static int selinux_fs_context_parse_param(struct fs_context *fc,
2831 struct fs_parameter *param)
2832 {
2833 struct fs_parse_result result;
2834 int opt, rc;
2835
2836 opt = fs_parse(fc, &selinux_fs_parameters, param, &result);
2837 if (opt < 0)
2838 return opt;
2839
2840 rc = selinux_add_opt(opt, param->string, &fc->security);
2841 if (!rc) {
2842 param->string = NULL;
2843 rc = 1;
2844 }
2845 return rc;
2846 }
2847
2848 /* inode security operations */
2849
2850 static int selinux_inode_alloc_security(struct inode *inode)
2851 {
2852 return inode_alloc_security(inode);
2853 }
2854
2855 static void selinux_inode_free_security(struct inode *inode)
2856 {
2857 inode_free_security(inode);
2858 }
2859
2860 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2861 const struct qstr *name, void **ctx,
2862 u32 *ctxlen)
2863 {
2864 u32 newsid;
2865 int rc;
2866
2867 rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2868 d_inode(dentry->d_parent), name,
2869 inode_mode_to_security_class(mode),
2870 &newsid);
2871 if (rc)
2872 return rc;
2873
2874 return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
2875 ctxlen);
2876 }
2877
2878 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2879 struct qstr *name,
2880 const struct cred *old,
2881 struct cred *new)
2882 {
2883 u32 newsid;
2884 int rc;
2885 struct task_security_struct *tsec;
2886
2887 rc = selinux_determine_inode_label(selinux_cred(old),
2888 d_inode(dentry->d_parent), name,
2889 inode_mode_to_security_class(mode),
2890 &newsid);
2891 if (rc)
2892 return rc;
2893
2894 tsec = selinux_cred(new);
2895 tsec->create_sid = newsid;
2896 return 0;
2897 }
2898
2899 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2900 const struct qstr *qstr,
2901 const char **name,
2902 void **value, size_t *len)
2903 {
2904 const struct task_security_struct *tsec = selinux_cred(current_cred());
2905 struct superblock_security_struct *sbsec;
2906 u32 newsid, clen;
2907 int rc;
2908 char *context;
2909
2910 sbsec = dir->i_sb->s_security;
2911
2912 newsid = tsec->create_sid;
2913
2914 rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2915 dir, qstr,
2916 inode_mode_to_security_class(inode->i_mode),
2917 &newsid);
2918 if (rc)
2919 return rc;
2920
2921 /* Possibly defer initialization to selinux_complete_init. */
2922 if (sbsec->flags & SE_SBINITIALIZED) {
2923 struct inode_security_struct *isec = selinux_inode(inode);
2924 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2925 isec->sid = newsid;
2926 isec->initialized = LABEL_INITIALIZED;
2927 }
2928
2929 if (!selinux_state.initialized || !(sbsec->flags & SBLABEL_MNT))
2930 return -EOPNOTSUPP;
2931
2932 if (name)
2933 *name = XATTR_SELINUX_SUFFIX;
2934
2935 if (value && len) {
2936 rc = security_sid_to_context_force(&selinux_state, newsid,
2937 &context, &clen);
2938 if (rc)
2939 return rc;
2940 *value = context;
2941 *len = clen;
2942 }
2943
2944 return 0;
2945 }
2946
2947 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2948 {
2949 return may_create(dir, dentry, SECCLASS_FILE);
2950 }
2951
2952 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2953 {
2954 return may_link(dir, old_dentry, MAY_LINK);
2955 }
2956
2957 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2958 {
2959 return may_link(dir, dentry, MAY_UNLINK);
2960 }
2961
2962 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2963 {
2964 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2965 }
2966
2967 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2968 {
2969 return may_create(dir, dentry, SECCLASS_DIR);
2970 }
2971
2972 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2973 {
2974 return may_link(dir, dentry, MAY_RMDIR);
2975 }
2976
2977 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2978 {
2979 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2980 }
2981
2982 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2983 struct inode *new_inode, struct dentry *new_dentry)
2984 {
2985 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2986 }
2987
2988 static int selinux_inode_readlink(struct dentry *dentry)
2989 {
2990 const struct cred *cred = current_cred();
2991
2992 return dentry_has_perm(cred, dentry, FILE__READ);
2993 }
2994
2995 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2996 bool rcu)
2997 {
2998 const struct cred *cred = current_cred();
2999 struct common_audit_data ad;
3000 struct inode_security_struct *isec;
3001 u32 sid;
3002
3003 validate_creds(cred);
3004
3005 ad.type = LSM_AUDIT_DATA_DENTRY;
3006 ad.u.dentry = dentry;
3007 sid = cred_sid(cred);
3008 isec = inode_security_rcu(inode, rcu);
3009 if (IS_ERR(isec))
3010 return PTR_ERR(isec);
3011
3012 return avc_has_perm(&selinux_state,
3013 sid, isec->sid, isec->sclass, FILE__READ, &ad);
3014 }
3015
3016 static noinline int audit_inode_permission(struct inode *inode,
3017 u32 perms, u32 audited, u32 denied,
3018 int result,
3019 unsigned flags)
3020 {
3021 struct common_audit_data ad;
3022 struct inode_security_struct *isec = selinux_inode(inode);
3023 int rc;
3024
3025 ad.type = LSM_AUDIT_DATA_INODE;
3026 ad.u.inode = inode;
3027
3028 rc = slow_avc_audit(&selinux_state,
3029 current_sid(), isec->sid, isec->sclass, perms,
3030 audited, denied, result, &ad, flags);
3031 if (rc)
3032 return rc;
3033 return 0;
3034 }
3035
3036 static int selinux_inode_permission(struct inode *inode, int mask)
3037 {
3038 const struct cred *cred = current_cred();
3039 u32 perms;
3040 bool from_access;
3041 unsigned flags = mask & MAY_NOT_BLOCK;
3042 struct inode_security_struct *isec;
3043 u32 sid;
3044 struct av_decision avd;
3045 int rc, rc2;
3046 u32 audited, denied;
3047
3048 from_access = mask & MAY_ACCESS;
3049 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3050
3051 /* No permission to check. Existence test. */
3052 if (!mask)
3053 return 0;
3054
3055 validate_creds(cred);
3056
3057 if (unlikely(IS_PRIVATE(inode)))
3058 return 0;
3059
3060 perms = file_mask_to_av(inode->i_mode, mask);
3061
3062 sid = cred_sid(cred);
3063 isec = inode_security_rcu(inode, flags & MAY_NOT_BLOCK);
3064 if (IS_ERR(isec))
3065 return PTR_ERR(isec);
3066
3067 rc = avc_has_perm_noaudit(&selinux_state,
3068 sid, isec->sid, isec->sclass, perms,
3069 (flags & MAY_NOT_BLOCK) ? AVC_NONBLOCKING : 0,
3070 &avd);
3071 audited = avc_audit_required(perms, &avd, rc,
3072 from_access ? FILE__AUDIT_ACCESS : 0,
3073 &denied);
3074 if (likely(!audited))
3075 return rc;
3076
3077 rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
3078 if (rc2)
3079 return rc2;
3080 return rc;
3081 }
3082
3083 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3084 {
3085 const struct cred *cred = current_cred();
3086 struct inode *inode = d_backing_inode(dentry);
3087 unsigned int ia_valid = iattr->ia_valid;
3088 __u32 av = FILE__WRITE;
3089
3090 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3091 if (ia_valid & ATTR_FORCE) {
3092 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3093 ATTR_FORCE);
3094 if (!ia_valid)
3095 return 0;
3096 }
3097
3098 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3099 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3100 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3101
3102 if (selinux_policycap_openperm() &&
3103 inode->i_sb->s_magic != SOCKFS_MAGIC &&
3104 (ia_valid & ATTR_SIZE) &&
3105 !(ia_valid & ATTR_FILE))
3106 av |= FILE__OPEN;
3107
3108 return dentry_has_perm(cred, dentry, av);
3109 }
3110
3111 static int selinux_inode_getattr(const struct path *path)
3112 {
3113 return path_has_perm(current_cred(), path, FILE__GETATTR);
3114 }
3115
3116 static bool has_cap_mac_admin(bool audit)
3117 {
3118 const struct cred *cred = current_cred();
3119 unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT;
3120
3121 if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, opts))
3122 return false;
3123 if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, true))
3124 return false;
3125 return true;
3126 }
3127
3128 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3129 const void *value, size_t size, int flags)
3130 {
3131 struct inode *inode = d_backing_inode(dentry);
3132 struct inode_security_struct *isec;
3133 struct superblock_security_struct *sbsec;
3134 struct common_audit_data ad;
3135 u32 newsid, sid = current_sid();
3136 int rc = 0;
3137
3138 if (strcmp(name, XATTR_NAME_SELINUX)) {
3139 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3140 if (rc)
3141 return rc;
3142
3143 /* Not an attribute we recognize, so just check the
3144 ordinary setattr permission. */
3145 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3146 }
3147
3148 sbsec = inode->i_sb->s_security;
3149 if (!(sbsec->flags & SBLABEL_MNT))
3150 return -EOPNOTSUPP;
3151
3152 if (!inode_owner_or_capable(inode))
3153 return -EPERM;
3154
3155 ad.type = LSM_AUDIT_DATA_DENTRY;
3156 ad.u.dentry = dentry;
3157
3158 isec = backing_inode_security(dentry);
3159 rc = avc_has_perm(&selinux_state,
3160 sid, isec->sid, isec->sclass,
3161 FILE__RELABELFROM, &ad);
3162 if (rc)
3163 return rc;
3164
3165 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3166 GFP_KERNEL);
3167 if (rc == -EINVAL) {
3168 if (!has_cap_mac_admin(true)) {
3169 struct audit_buffer *ab;
3170 size_t audit_size;
3171
3172 /* We strip a nul only if it is at the end, otherwise the
3173 * context contains a nul and we should audit that */
3174 if (value) {
3175 const char *str = value;
3176
3177 if (str[size - 1] == '\0')
3178 audit_size = size - 1;
3179 else
3180 audit_size = size;
3181 } else {
3182 audit_size = 0;
3183 }
3184 ab = audit_log_start(audit_context(),
3185 GFP_ATOMIC, AUDIT_SELINUX_ERR);
3186 audit_log_format(ab, "op=setxattr invalid_context=");
3187 audit_log_n_untrustedstring(ab, value, audit_size);
3188 audit_log_end(ab);
3189
3190 return rc;
3191 }
3192 rc = security_context_to_sid_force(&selinux_state, value,
3193 size, &newsid);
3194 }
3195 if (rc)
3196 return rc;
3197
3198 rc = avc_has_perm(&selinux_state,
3199 sid, newsid, isec->sclass,
3200 FILE__RELABELTO, &ad);
3201 if (rc)
3202 return rc;
3203
3204 rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3205 sid, isec->sclass);
3206 if (rc)
3207 return rc;
3208
3209 return avc_has_perm(&selinux_state,
3210 newsid,
3211 sbsec->sid,
3212 SECCLASS_FILESYSTEM,
3213 FILESYSTEM__ASSOCIATE,
3214 &ad);
3215 }
3216
3217 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3218 const void *value, size_t size,
3219 int flags)
3220 {
3221 struct inode *inode = d_backing_inode(dentry);
3222 struct inode_security_struct *isec;
3223 u32 newsid;
3224 int rc;
3225
3226 if (strcmp(name, XATTR_NAME_SELINUX)) {
3227 /* Not an attribute we recognize, so nothing to do. */
3228 return;
3229 }
3230
3231 rc = security_context_to_sid_force(&selinux_state, value, size,
3232 &newsid);
3233 if (rc) {
3234 pr_err("SELinux: unable to map context to SID"
3235 "for (%s, %lu), rc=%d\n",
3236 inode->i_sb->s_id, inode->i_ino, -rc);
3237 return;
3238 }
3239
3240 isec = backing_inode_security(dentry);
3241 spin_lock(&isec->lock);
3242 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3243 isec->sid = newsid;
3244 isec->initialized = LABEL_INITIALIZED;
3245 spin_unlock(&isec->lock);
3246
3247 return;
3248 }
3249
3250 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3251 {
3252 const struct cred *cred = current_cred();
3253
3254 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3255 }
3256
3257 static int selinux_inode_listxattr(struct dentry *dentry)
3258 {
3259 const struct cred *cred = current_cred();
3260
3261 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3262 }
3263
3264 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3265 {
3266 if (strcmp(name, XATTR_NAME_SELINUX)) {
3267 int rc = cap_inode_removexattr(dentry, name);
3268 if (rc)
3269 return rc;
3270
3271 /* Not an attribute we recognize, so just check the
3272 ordinary setattr permission. */
3273 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3274 }
3275
3276 /* No one is allowed to remove a SELinux security label.
3277 You can change the label, but all data must be labeled. */
3278 return -EACCES;
3279 }
3280
3281 /*
3282 * Copy the inode security context value to the user.
3283 *
3284 * Permission check is handled by selinux_inode_getxattr hook.
3285 */
3286 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc)
3287 {
3288 u32 size;
3289 int error;
3290 char *context = NULL;
3291 struct inode_security_struct *isec;
3292
3293 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3294 return -EOPNOTSUPP;
3295
3296 /*
3297 * If the caller has CAP_MAC_ADMIN, then get the raw context
3298 * value even if it is not defined by current policy; otherwise,
3299 * use the in-core value under current policy.
3300 * Use the non-auditing forms of the permission checks since
3301 * getxattr may be called by unprivileged processes commonly
3302 * and lack of permission just means that we fall back to the
3303 * in-core context value, not a denial.
3304 */
3305 isec = inode_security(inode);
3306 if (has_cap_mac_admin(false))
3307 error = security_sid_to_context_force(&selinux_state,
3308 isec->sid, &context,
3309 &size);
3310 else
3311 error = security_sid_to_context(&selinux_state, isec->sid,
3312 &context, &size);
3313 if (error)
3314 return error;
3315 error = size;
3316 if (alloc) {
3317 *buffer = context;
3318 goto out_nofree;
3319 }
3320 kfree(context);
3321 out_nofree:
3322 return error;
3323 }
3324
3325 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3326 const void *value, size_t size, int flags)
3327 {
3328 struct inode_security_struct *isec = inode_security_novalidate(inode);
3329 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
3330 u32 newsid;
3331 int rc;
3332
3333 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3334 return -EOPNOTSUPP;
3335
3336 if (!(sbsec->flags & SBLABEL_MNT))
3337 return -EOPNOTSUPP;
3338
3339 if (!value || !size)
3340 return -EACCES;
3341
3342 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3343 GFP_KERNEL);
3344 if (rc)
3345 return rc;
3346
3347 spin_lock(&isec->lock);
3348 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3349 isec->sid = newsid;
3350 isec->initialized = LABEL_INITIALIZED;
3351 spin_unlock(&isec->lock);
3352 return 0;
3353 }
3354
3355 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3356 {
3357 const int len = sizeof(XATTR_NAME_SELINUX);
3358 if (buffer && len <= buffer_size)
3359 memcpy(buffer, XATTR_NAME_SELINUX, len);
3360 return len;
3361 }
3362
3363 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3364 {
3365 struct inode_security_struct *isec = inode_security_novalidate(inode);
3366 *secid = isec->sid;
3367 }
3368
3369 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3370 {
3371 u32 sid;
3372 struct task_security_struct *tsec;
3373 struct cred *new_creds = *new;
3374
3375 if (new_creds == NULL) {
3376 new_creds = prepare_creds();
3377 if (!new_creds)
3378 return -ENOMEM;
3379 }
3380
3381 tsec = selinux_cred(new_creds);
3382 /* Get label from overlay inode and set it in create_sid */
3383 selinux_inode_getsecid(d_inode(src), &sid);
3384 tsec->create_sid = sid;
3385 *new = new_creds;
3386 return 0;
3387 }
3388
3389 static int selinux_inode_copy_up_xattr(const char *name)
3390 {
3391 /* The copy_up hook above sets the initial context on an inode, but we
3392 * don't then want to overwrite it by blindly copying all the lower
3393 * xattrs up. Instead, we have to filter out SELinux-related xattrs.
3394 */
3395 if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3396 return 1; /* Discard */
3397 /*
3398 * Any other attribute apart from SELINUX is not claimed, supported
3399 * by selinux.
3400 */
3401 return -EOPNOTSUPP;
3402 }
3403
3404 /* kernfs node operations */
3405
3406 static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
3407 struct kernfs_node *kn)
3408 {
3409 const struct task_security_struct *tsec = current_security();
3410 u32 parent_sid, newsid, clen;
3411 int rc;
3412 char *context;
3413
3414 rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, NULL, 0);
3415 if (rc == -ENODATA)
3416 return 0;
3417 else if (rc < 0)
3418 return rc;
3419
3420 clen = (u32)rc;
3421 context = kmalloc(clen, GFP_KERNEL);
3422 if (!context)
3423 return -ENOMEM;
3424
3425 rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, context, clen);
3426 if (rc < 0) {
3427 kfree(context);
3428 return rc;
3429 }
3430
3431 rc = security_context_to_sid(&selinux_state, context, clen, &parent_sid,
3432 GFP_KERNEL);
3433 kfree(context);
3434 if (rc)
3435 return rc;
3436
3437 if (tsec->create_sid) {
3438 newsid = tsec->create_sid;
3439 } else {
3440 u16 secclass = inode_mode_to_security_class(kn->mode);
3441 struct qstr q;
3442
3443 q.name = kn->name;
3444 q.hash_len = hashlen_string(kn_dir, kn->name);
3445
3446 rc = security_transition_sid(&selinux_state, tsec->sid,
3447 parent_sid, secclass, &q,
3448 &newsid);
3449 if (rc)
3450 return rc;
3451 }
3452
3453 rc = security_sid_to_context_force(&selinux_state, newsid,
3454 &context, &clen);
3455 if (rc)
3456 return rc;
3457
3458 rc = kernfs_xattr_set(kn, XATTR_NAME_SELINUX, context, clen,
3459 XATTR_CREATE);
3460 kfree(context);
3461 return rc;
3462 }
3463
3464
3465 /* file security operations */
3466
3467 static int selinux_revalidate_file_permission(struct file *file, int mask)
3468 {
3469 const struct cred *cred = current_cred();
3470 struct inode *inode = file_inode(file);
3471
3472 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3473 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3474 mask |= MAY_APPEND;
3475
3476 return file_has_perm(cred, file,
3477 file_mask_to_av(inode->i_mode, mask));
3478 }
3479
3480 static int selinux_file_permission(struct file *file, int mask)
3481 {
3482 struct inode *inode = file_inode(file);
3483 struct file_security_struct *fsec = selinux_file(file);
3484 struct inode_security_struct *isec;
3485 u32 sid = current_sid();
3486
3487 if (!mask)
3488 /* No permission to check. Existence test. */
3489 return 0;
3490
3491 isec = inode_security(inode);
3492 if (sid == fsec->sid && fsec->isid == isec->sid &&
3493 fsec->pseqno == avc_policy_seqno(&selinux_state))
3494 /* No change since file_open check. */
3495 return 0;
3496
3497 return selinux_revalidate_file_permission(file, mask);
3498 }
3499
3500 static int selinux_file_alloc_security(struct file *file)
3501 {
3502 return file_alloc_security(file);
3503 }
3504
3505 /*
3506 * Check whether a task has the ioctl permission and cmd
3507 * operation to an inode.
3508 */
3509 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3510 u32 requested, u16 cmd)
3511 {
3512 struct common_audit_data ad;
3513 struct file_security_struct *fsec = selinux_file(file);
3514 struct inode *inode = file_inode(file);
3515 struct inode_security_struct *isec;
3516 struct lsm_ioctlop_audit ioctl;
3517 u32 ssid = cred_sid(cred);
3518 int rc;
3519 u8 driver = cmd >> 8;
3520 u8 xperm = cmd & 0xff;
3521
3522 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3523 ad.u.op = &ioctl;
3524 ad.u.op->cmd = cmd;
3525 ad.u.op->path = file->f_path;
3526
3527 if (ssid != fsec->sid) {
3528 rc = avc_has_perm(&selinux_state,
3529 ssid, fsec->sid,
3530 SECCLASS_FD,
3531 FD__USE,
3532 &ad);
3533 if (rc)
3534 goto out;
3535 }
3536
3537 if (unlikely(IS_PRIVATE(inode)))
3538 return 0;
3539
3540 isec = inode_security(inode);
3541 rc = avc_has_extended_perms(&selinux_state,
3542 ssid, isec->sid, isec->sclass,
3543 requested, driver, xperm, &ad);
3544 out:
3545 return rc;
3546 }
3547
3548 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3549 unsigned long arg)
3550 {
3551 const struct cred *cred = current_cred();
3552 int error = 0;
3553
3554 switch (cmd) {
3555 case FIONREAD:
3556 /* fall through */
3557 case FIBMAP:
3558 /* fall through */
3559 case FIGETBSZ:
3560 /* fall through */
3561 case FS_IOC_GETFLAGS:
3562 /* fall through */
3563 case FS_IOC_GETVERSION:
3564 error = file_has_perm(cred, file, FILE__GETATTR);
3565 break;
3566
3567 case FS_IOC_SETFLAGS:
3568 /* fall through */
3569 case FS_IOC_SETVERSION:
3570 error = file_has_perm(cred, file, FILE__SETATTR);
3571 break;
3572
3573 /* sys_ioctl() checks */
3574 case FIONBIO:
3575 /* fall through */
3576 case FIOASYNC:
3577 error = file_has_perm(cred, file, 0);
3578 break;
3579
3580 case KDSKBENT:
3581 case KDSKBSENT:
3582 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3583 CAP_OPT_NONE, true);
3584 break;
3585
3586 /* default case assumes that the command will go
3587 * to the file's ioctl() function.
3588 */
3589 default:
3590 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3591 }
3592 return error;
3593 }
3594
3595 static int default_noexec;
3596
3597 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3598 {
3599 const struct cred *cred = current_cred();
3600 u32 sid = cred_sid(cred);
3601 int rc = 0;
3602
3603 if (default_noexec &&
3604 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3605 (!shared && (prot & PROT_WRITE)))) {
3606 /*
3607 * We are making executable an anonymous mapping or a
3608 * private file mapping that will also be writable.
3609 * This has an additional check.
3610 */
3611 rc = avc_has_perm(&selinux_state,
3612 sid, sid, SECCLASS_PROCESS,
3613 PROCESS__EXECMEM, NULL);
3614 if (rc)
3615 goto error;
3616 }
3617
3618 if (file) {
3619 /* read access is always possible with a mapping */
3620 u32 av = FILE__READ;
3621
3622 /* write access only matters if the mapping is shared */
3623 if (shared && (prot & PROT_WRITE))
3624 av |= FILE__WRITE;
3625
3626 if (prot & PROT_EXEC)
3627 av |= FILE__EXECUTE;
3628
3629 return file_has_perm(cred, file, av);
3630 }
3631
3632 error:
3633 return rc;
3634 }
3635
3636 static int selinux_mmap_addr(unsigned long addr)
3637 {
3638 int rc = 0;
3639
3640 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3641 u32 sid = current_sid();
3642 rc = avc_has_perm(&selinux_state,
3643 sid, sid, SECCLASS_MEMPROTECT,
3644 MEMPROTECT__MMAP_ZERO, NULL);
3645 }
3646
3647 return rc;
3648 }
3649
3650 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3651 unsigned long prot, unsigned long flags)
3652 {
3653 struct common_audit_data ad;
3654 int rc;
3655
3656 if (file) {
3657 ad.type = LSM_AUDIT_DATA_FILE;
3658 ad.u.file = file;
3659 rc = inode_has_perm(current_cred(), file_inode(file),
3660 FILE__MAP, &ad);
3661 if (rc)
3662 return rc;
3663 }
3664
3665 if (selinux_state.checkreqprot)
3666 prot = reqprot;
3667
3668 return file_map_prot_check(file, prot,
3669 (flags & MAP_TYPE) == MAP_SHARED);
3670 }
3671
3672 static int selinux_file_mprotect(struct vm_area_struct *vma,
3673 unsigned long reqprot,
3674 unsigned long prot)
3675 {
3676 const struct cred *cred = current_cred();
3677 u32 sid = cred_sid(cred);
3678
3679 if (selinux_state.checkreqprot)
3680 prot = reqprot;
3681
3682 if (default_noexec &&
3683 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3684 int rc = 0;
3685 if (vma->vm_start >= vma->vm_mm->start_brk &&
3686 vma->vm_end <= vma->vm_mm->brk) {
3687 rc = avc_has_perm(&selinux_state,
3688 sid, sid, SECCLASS_PROCESS,
3689 PROCESS__EXECHEAP, NULL);
3690 } else if (!vma->vm_file &&
3691 ((vma->vm_start <= vma->vm_mm->start_stack &&
3692 vma->vm_end >= vma->vm_mm->start_stack) ||
3693 vma_is_stack_for_current(vma))) {
3694 rc = avc_has_perm(&selinux_state,
3695 sid, sid, SECCLASS_PROCESS,
3696 PROCESS__EXECSTACK, NULL);
3697 } else if (vma->vm_file && vma->anon_vma) {
3698 /*
3699 * We are making executable a file mapping that has
3700 * had some COW done. Since pages might have been
3701 * written, check ability to execute the possibly
3702 * modified content. This typically should only
3703 * occur for text relocations.
3704 */
3705 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3706 }
3707 if (rc)
3708 return rc;
3709 }
3710
3711 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3712 }
3713
3714 static int selinux_file_lock(struct file *file, unsigned int cmd)
3715 {
3716 const struct cred *cred = current_cred();
3717
3718 return file_has_perm(cred, file, FILE__LOCK);
3719 }
3720
3721 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3722 unsigned long arg)
3723 {
3724 const struct cred *cred = current_cred();
3725 int err = 0;
3726
3727 switch (cmd) {
3728 case F_SETFL:
3729 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3730 err = file_has_perm(cred, file, FILE__WRITE);
3731 break;
3732 }
3733 /* fall through */
3734 case F_SETOWN:
3735 case F_SETSIG:
3736 case F_GETFL:
3737 case F_GETOWN:
3738 case F_GETSIG:
3739 case F_GETOWNER_UIDS:
3740 /* Just check FD__USE permission */
3741 err = file_has_perm(cred, file, 0);
3742 break;
3743 case F_GETLK:
3744 case F_SETLK:
3745 case F_SETLKW:
3746 case F_OFD_GETLK:
3747 case F_OFD_SETLK:
3748 case F_OFD_SETLKW:
3749 #if BITS_PER_LONG == 32
3750 case F_GETLK64:
3751 case F_SETLK64:
3752 case F_SETLKW64:
3753 #endif
3754 err = file_has_perm(cred, file, FILE__LOCK);
3755 break;
3756 }
3757
3758 return err;
3759 }
3760
3761 static void selinux_file_set_fowner(struct file *file)
3762 {
3763 struct file_security_struct *fsec;
3764
3765 fsec = selinux_file(file);
3766 fsec->fown_sid = current_sid();
3767 }
3768
3769 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3770 struct fown_struct *fown, int signum)
3771 {
3772 struct file *file;
3773 u32 sid = task_sid(tsk);
3774 u32 perm;
3775 struct file_security_struct *fsec;
3776
3777 /* struct fown_struct is never outside the context of a struct file */
3778 file = container_of(fown, struct file, f_owner);
3779
3780 fsec = selinux_file(file);
3781
3782 if (!signum)
3783 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3784 else
3785 perm = signal_to_av(signum);
3786
3787 return avc_has_perm(&selinux_state,
3788 fsec->fown_sid, sid,
3789 SECCLASS_PROCESS, perm, NULL);
3790 }
3791
3792 static int selinux_file_receive(struct file *file)
3793 {
3794 const struct cred *cred = current_cred();
3795
3796 return file_has_perm(cred, file, file_to_av(file));
3797 }
3798
3799 static int selinux_file_open(struct file *file)
3800 {
3801 struct file_security_struct *fsec;
3802 struct inode_security_struct *isec;
3803
3804 fsec = selinux_file(file);
3805 isec = inode_security(file_inode(file));
3806 /*
3807 * Save inode label and policy sequence number
3808 * at open-time so that selinux_file_permission
3809 * can determine whether revalidation is necessary.
3810 * Task label is already saved in the file security
3811 * struct as its SID.
3812 */
3813 fsec->isid = isec->sid;
3814 fsec->pseqno = avc_policy_seqno(&selinux_state);
3815 /*
3816 * Since the inode label or policy seqno may have changed
3817 * between the selinux_inode_permission check and the saving
3818 * of state above, recheck that access is still permitted.
3819 * Otherwise, access might never be revalidated against the
3820 * new inode label or new policy.
3821 * This check is not redundant - do not remove.
3822 */
3823 return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
3824 }
3825
3826 /* task security operations */
3827
3828 static int selinux_task_alloc(struct task_struct *task,
3829 unsigned long clone_flags)
3830 {
3831 u32 sid = current_sid();
3832
3833 return avc_has_perm(&selinux_state,
3834 sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
3835 }
3836
3837 /*
3838 * prepare a new set of credentials for modification
3839 */
3840 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3841 gfp_t gfp)
3842 {
3843 const struct task_security_struct *old_tsec = selinux_cred(old);
3844 struct task_security_struct *tsec = selinux_cred(new);
3845
3846 *tsec = *old_tsec;
3847 return 0;
3848 }
3849
3850 /*
3851 * transfer the SELinux data to a blank set of creds
3852 */
3853 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3854 {
3855 const struct task_security_struct *old_tsec = selinux_cred(old);
3856 struct task_security_struct *tsec = selinux_cred(new);
3857
3858 *tsec = *old_tsec;
3859 }
3860
3861 static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
3862 {
3863 *secid = cred_sid(c);
3864 }
3865
3866 /*
3867 * set the security data for a kernel service
3868 * - all the creation contexts are set to unlabelled
3869 */
3870 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3871 {
3872 struct task_security_struct *tsec = selinux_cred(new);
3873 u32 sid = current_sid();
3874 int ret;
3875
3876 ret = avc_has_perm(&selinux_state,
3877 sid, secid,
3878 SECCLASS_KERNEL_SERVICE,
3879 KERNEL_SERVICE__USE_AS_OVERRIDE,
3880 NULL);
3881 if (ret == 0) {
3882 tsec->sid = secid;
3883 tsec->create_sid = 0;
3884 tsec->keycreate_sid = 0;
3885 tsec->sockcreate_sid = 0;
3886 }
3887 return ret;
3888 }
3889
3890 /*
3891 * set the file creation context in a security record to the same as the
3892 * objective context of the specified inode
3893 */
3894 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3895 {
3896 struct inode_security_struct *isec = inode_security(inode);
3897 struct task_security_struct *tsec = selinux_cred(new);
3898 u32 sid = current_sid();
3899 int ret;
3900
3901 ret = avc_has_perm(&selinux_state,
3902 sid, isec->sid,
3903 SECCLASS_KERNEL_SERVICE,
3904 KERNEL_SERVICE__CREATE_FILES_AS,
3905 NULL);
3906
3907 if (ret == 0)
3908 tsec->create_sid = isec->sid;
3909 return ret;
3910 }
3911
3912 static int selinux_kernel_module_request(char *kmod_name)
3913 {
3914 struct common_audit_data ad;
3915
3916 ad.type = LSM_AUDIT_DATA_KMOD;
3917 ad.u.kmod_name = kmod_name;
3918
3919 return avc_has_perm(&selinux_state,
3920 current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
3921 SYSTEM__MODULE_REQUEST, &ad);
3922 }
3923
3924 static int selinux_kernel_module_from_file(struct file *file)
3925 {
3926 struct common_audit_data ad;
3927 struct inode_security_struct *isec;
3928 struct file_security_struct *fsec;
3929 u32 sid = current_sid();
3930 int rc;
3931
3932 /* init_module */
3933 if (file == NULL)
3934 return avc_has_perm(&selinux_state,
3935 sid, sid, SECCLASS_SYSTEM,
3936 SYSTEM__MODULE_LOAD, NULL);
3937
3938 /* finit_module */
3939
3940 ad.type = LSM_AUDIT_DATA_FILE;
3941 ad.u.file = file;
3942
3943 fsec = selinux_file(file);
3944 if (sid != fsec->sid) {
3945 rc = avc_has_perm(&selinux_state,
3946 sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3947 if (rc)
3948 return rc;
3949 }
3950
3951 isec = inode_security(file_inode(file));
3952 return avc_has_perm(&selinux_state,
3953 sid, isec->sid, SECCLASS_SYSTEM,
3954 SYSTEM__MODULE_LOAD, &ad);
3955 }
3956
3957 static int selinux_kernel_read_file(struct file *file,
3958 enum kernel_read_file_id id)
3959 {
3960 int rc = 0;
3961
3962 switch (id) {
3963 case READING_MODULE:
3964 rc = selinux_kernel_module_from_file(file);
3965 break;
3966 default:
3967 break;
3968 }
3969
3970 return rc;
3971 }
3972
3973 static int selinux_kernel_load_data(enum kernel_load_data_id id)
3974 {
3975 int rc = 0;
3976
3977 switch (id) {
3978 case LOADING_MODULE:
3979 rc = selinux_kernel_module_from_file(NULL);
3980 default:
3981 break;
3982 }
3983
3984 return rc;
3985 }
3986
3987 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3988 {
3989 return avc_has_perm(&selinux_state,
3990 current_sid(), task_sid(p), SECCLASS_PROCESS,
3991 PROCESS__SETPGID, NULL);
3992 }
3993
3994 static int selinux_task_getpgid(struct task_struct *p)
3995 {
3996 return avc_has_perm(&selinux_state,
3997 current_sid(), task_sid(p), SECCLASS_PROCESS,
3998 PROCESS__GETPGID, NULL);
3999 }
4000
4001 static int selinux_task_getsid(struct task_struct *p)
4002 {
4003 return avc_has_perm(&selinux_state,
4004 current_sid(), task_sid(p), SECCLASS_PROCESS,
4005 PROCESS__GETSESSION, NULL);
4006 }
4007
4008 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
4009 {
4010 *secid = task_sid(p);
4011 }
4012
4013 static int selinux_task_setnice(struct task_struct *p, int nice)
4014 {
4015 return avc_has_perm(&selinux_state,
4016 current_sid(), task_sid(p), SECCLASS_PROCESS,
4017 PROCESS__SETSCHED, NULL);
4018 }
4019
4020 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4021 {
4022 return avc_has_perm(&selinux_state,
4023 current_sid(), task_sid(p), SECCLASS_PROCESS,
4024 PROCESS__SETSCHED, NULL);
4025 }
4026
4027 static int selinux_task_getioprio(struct task_struct *p)
4028 {
4029 return avc_has_perm(&selinux_state,
4030 current_sid(), task_sid(p), SECCLASS_PROCESS,
4031 PROCESS__GETSCHED, NULL);
4032 }
4033
4034 static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4035 unsigned int flags)
4036 {
4037 u32 av = 0;
4038
4039 if (!flags)
4040 return 0;
4041 if (flags & LSM_PRLIMIT_WRITE)
4042 av |= PROCESS__SETRLIMIT;
4043 if (flags & LSM_PRLIMIT_READ)
4044 av |= PROCESS__GETRLIMIT;
4045 return avc_has_perm(&selinux_state,
4046 cred_sid(cred), cred_sid(tcred),
4047 SECCLASS_PROCESS, av, NULL);
4048 }
4049
4050 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4051 struct rlimit *new_rlim)
4052 {
4053 struct rlimit *old_rlim = p->signal->rlim + resource;
4054
4055 /* Control the ability to change the hard limit (whether
4056 lowering or raising it), so that the hard limit can
4057 later be used as a safe reset point for the soft limit
4058 upon context transitions. See selinux_bprm_committing_creds. */
4059 if (old_rlim->rlim_max != new_rlim->rlim_max)
4060 return avc_has_perm(&selinux_state,
4061 current_sid(), task_sid(p),
4062 SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
4063
4064 return 0;
4065 }
4066
4067 static int selinux_task_setscheduler(struct task_struct *p)
4068 {
4069 return avc_has_perm(&selinux_state,
4070 current_sid(), task_sid(p), SECCLASS_PROCESS,
4071 PROCESS__SETSCHED, NULL);
4072 }
4073
4074 static int selinux_task_getscheduler(struct task_struct *p)
4075 {
4076 return avc_has_perm(&selinux_state,
4077 current_sid(), task_sid(p), SECCLASS_PROCESS,
4078 PROCESS__GETSCHED, NULL);
4079 }
4080
4081 static int selinux_task_movememory(struct task_struct *p)
4082 {
4083 return avc_has_perm(&selinux_state,
4084 current_sid(), task_sid(p), SECCLASS_PROCESS,
4085 PROCESS__SETSCHED, NULL);
4086 }
4087
4088 static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
4089 int sig, const struct cred *cred)
4090 {
4091 u32 secid;
4092 u32 perm;
4093
4094 if (!sig)
4095 perm = PROCESS__SIGNULL; /* null signal; existence test */
4096 else
4097 perm = signal_to_av(sig);
4098 if (!cred)
4099 secid = current_sid();
4100 else
4101 secid = cred_sid(cred);
4102 return avc_has_perm(&selinux_state,
4103 secid, task_sid(p), SECCLASS_PROCESS, perm, NULL);
4104 }
4105
4106 static void selinux_task_to_inode(struct task_struct *p,
4107 struct inode *inode)
4108 {
4109 struct inode_security_struct *isec = selinux_inode(inode);
4110 u32 sid = task_sid(p);
4111
4112 spin_lock(&isec->lock);
4113 isec->sclass = inode_mode_to_security_class(inode->i_mode);
4114 isec->sid = sid;
4115 isec->initialized = LABEL_INITIALIZED;
4116 spin_unlock(&isec->lock);
4117 }
4118
4119 /* Returns error only if unable to parse addresses */
4120 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4121 struct common_audit_data *ad, u8 *proto)
4122 {
4123 int offset, ihlen, ret = -EINVAL;
4124 struct iphdr _iph, *ih;
4125
4126 offset = skb_network_offset(skb);
4127 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4128 if (ih == NULL)
4129 goto out;
4130
4131 ihlen = ih->ihl * 4;
4132 if (ihlen < sizeof(_iph))
4133 goto out;
4134
4135 ad->u.net->v4info.saddr = ih->saddr;
4136 ad->u.net->v4info.daddr = ih->daddr;
4137 ret = 0;
4138
4139 if (proto)
4140 *proto = ih->protocol;
4141
4142 switch (ih->protocol) {
4143 case IPPROTO_TCP: {
4144 struct tcphdr _tcph, *th;
4145
4146 if (ntohs(ih->frag_off) & IP_OFFSET)
4147 break;
4148
4149 offset += ihlen;
4150 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4151 if (th == NULL)
4152 break;
4153
4154 ad->u.net->sport = th->source;
4155 ad->u.net->dport = th->dest;
4156 break;
4157 }
4158
4159 case IPPROTO_UDP: {
4160 struct udphdr _udph, *uh;
4161
4162 if (ntohs(ih->frag_off) & IP_OFFSET)
4163 break;
4164
4165 offset += ihlen;
4166 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4167 if (uh == NULL)
4168 break;
4169
4170 ad->u.net->sport = uh->source;
4171 ad->u.net->dport = uh->dest;
4172 break;
4173 }
4174
4175 case IPPROTO_DCCP: {
4176 struct dccp_hdr _dccph, *dh;
4177
4178 if (ntohs(ih->frag_off) & IP_OFFSET)
4179 break;
4180
4181 offset += ihlen;
4182 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4183 if (dh == NULL)
4184 break;
4185
4186 ad->u.net->sport = dh->dccph_sport;
4187 ad->u.net->dport = dh->dccph_dport;
4188 break;
4189 }
4190
4191 #if IS_ENABLED(CONFIG_IP_SCTP)
4192 case IPPROTO_SCTP: {
4193 struct sctphdr _sctph, *sh;
4194
4195 if (ntohs(ih->frag_off) & IP_OFFSET)
4196 break;
4197
4198 offset += ihlen;
4199 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4200 if (sh == NULL)
4201 break;
4202
4203 ad->u.net->sport = sh->source;
4204 ad->u.net->dport = sh->dest;
4205 break;
4206 }
4207 #endif
4208 default:
4209 break;
4210 }
4211 out:
4212 return ret;
4213 }
4214
4215 #if IS_ENABLED(CONFIG_IPV6)
4216
4217 /* Returns error only if unable to parse addresses */
4218 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4219 struct common_audit_data *ad, u8 *proto)
4220 {
4221 u8 nexthdr;
4222 int ret = -EINVAL, offset;
4223 struct ipv6hdr _ipv6h, *ip6;
4224 __be16 frag_off;
4225
4226 offset = skb_network_offset(skb);
4227 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4228 if (ip6 == NULL)
4229 goto out;
4230
4231 ad->u.net->v6info.saddr = ip6->saddr;
4232 ad->u.net->v6info.daddr = ip6->daddr;
4233 ret = 0;
4234
4235 nexthdr = ip6->nexthdr;
4236 offset += sizeof(_ipv6h);
4237 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4238 if (offset < 0)
4239 goto out;
4240
4241 if (proto)
4242 *proto = nexthdr;
4243
4244 switch (nexthdr) {
4245 case IPPROTO_TCP: {
4246 struct tcphdr _tcph, *th;
4247
4248 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4249 if (th == NULL)
4250 break;
4251
4252 ad->u.net->sport = th->source;
4253 ad->u.net->dport = th->dest;
4254 break;
4255 }
4256
4257 case IPPROTO_UDP: {
4258 struct udphdr _udph, *uh;
4259
4260 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4261 if (uh == NULL)
4262 break;
4263
4264 ad->u.net->sport = uh->source;
4265 ad->u.net->dport = uh->dest;
4266 break;
4267 }
4268
4269 case IPPROTO_DCCP: {
4270 struct dccp_hdr _dccph, *dh;
4271
4272 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4273 if (dh == NULL)
4274 break;
4275
4276 ad->u.net->sport = dh->dccph_sport;
4277 ad->u.net->dport = dh->dccph_dport;
4278 break;
4279 }
4280
4281 #if IS_ENABLED(CONFIG_IP_SCTP)
4282 case IPPROTO_SCTP: {
4283 struct sctphdr _sctph, *sh;
4284
4285 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4286 if (sh == NULL)
4287 break;
4288
4289 ad->u.net->sport = sh->source;
4290 ad->u.net->dport = sh->dest;
4291 break;
4292 }
4293 #endif
4294 /* includes fragments */
4295 default:
4296 break;
4297 }
4298 out:
4299 return ret;
4300 }
4301
4302 #endif /* IPV6 */
4303
4304 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4305 char **_addrp, int src, u8 *proto)
4306 {
4307 char *addrp;
4308 int ret;
4309
4310 switch (ad->u.net->family) {
4311 case PF_INET:
4312 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4313 if (ret)
4314 goto parse_error;
4315 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4316 &ad->u.net->v4info.daddr);
4317 goto okay;
4318
4319 #if IS_ENABLED(CONFIG_IPV6)
4320 case PF_INET6:
4321 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4322 if (ret)
4323 goto parse_error;
4324 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4325 &ad->u.net->v6info.daddr);
4326 goto okay;
4327 #endif /* IPV6 */
4328 default:
4329 addrp = NULL;
4330 goto okay;
4331 }
4332
4333 parse_error:
4334 pr_warn(
4335 "SELinux: failure in selinux_parse_skb(),"
4336 " unable to parse packet\n");
4337 return ret;
4338
4339 okay:
4340 if (_addrp)
4341 *_addrp = addrp;
4342 return 0;
4343 }
4344
4345 /**
4346 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4347 * @skb: the packet
4348 * @family: protocol family
4349 * @sid: the packet's peer label SID
4350 *
4351 * Description:
4352 * Check the various different forms of network peer labeling and determine
4353 * the peer label/SID for the packet; most of the magic actually occurs in
4354 * the security server function security_net_peersid_cmp(). The function
4355 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4356 * or -EACCES if @sid is invalid due to inconsistencies with the different
4357 * peer labels.
4358 *
4359 */
4360 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4361 {
4362 int err;
4363 u32 xfrm_sid;
4364 u32 nlbl_sid;
4365 u32 nlbl_type;
4366
4367 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4368 if (unlikely(err))
4369 return -EACCES;
4370 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4371 if (unlikely(err))
4372 return -EACCES;
4373
4374 err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4375 nlbl_type, xfrm_sid, sid);
4376 if (unlikely(err)) {
4377 pr_warn(
4378 "SELinux: failure in selinux_skb_peerlbl_sid(),"
4379 " unable to determine packet's peer label\n");
4380 return -EACCES;
4381 }
4382
4383 return 0;
4384 }
4385
4386 /**
4387 * selinux_conn_sid - Determine the child socket label for a connection
4388 * @sk_sid: the parent socket's SID
4389 * @skb_sid: the packet's SID
4390 * @conn_sid: the resulting connection SID
4391 *
4392 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4393 * combined with the MLS information from @skb_sid in order to create
4394 * @conn_sid. If @skb_sid is not valid then then @conn_sid is simply a copy
4395 * of @sk_sid. Returns zero on success, negative values on failure.
4396 *
4397 */
4398 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4399 {
4400 int err = 0;
4401
4402 if (skb_sid != SECSID_NULL)
4403 err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4404 conn_sid);
4405 else
4406 *conn_sid = sk_sid;
4407
4408 return err;
4409 }
4410
4411 /* socket security operations */
4412
4413 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4414 u16 secclass, u32 *socksid)
4415 {
4416 if (tsec->sockcreate_sid > SECSID_NULL) {
4417 *socksid = tsec->sockcreate_sid;
4418 return 0;
4419 }
4420
4421 return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4422 secclass, NULL, socksid);
4423 }
4424
4425 static int sock_has_perm(struct sock *sk, u32 perms)
4426 {
4427 struct sk_security_struct *sksec = sk->sk_security;
4428 struct common_audit_data ad;
4429 struct lsm_network_audit net = {0,};
4430
4431 if (sksec->sid == SECINITSID_KERNEL)
4432 return 0;
4433
4434 ad.type = LSM_AUDIT_DATA_NET;
4435 ad.u.net = &net;
4436 ad.u.net->sk = sk;
4437
4438 return avc_has_perm(&selinux_state,
4439 current_sid(), sksec->sid, sksec->sclass, perms,
4440 &ad);
4441 }
4442
4443 static int selinux_socket_create(int family, int type,
4444 int protocol, int kern)
4445 {
4446 const struct task_security_struct *tsec = selinux_cred(current_cred());
4447 u32 newsid;
4448 u16 secclass;
4449 int rc;
4450
4451 if (kern)
4452 return 0;
4453
4454 secclass = socket_type_to_security_class(family, type, protocol);
4455 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4456 if (rc)
4457 return rc;
4458
4459 return avc_has_perm(&selinux_state,
4460 tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4461 }
4462
4463 static int selinux_socket_post_create(struct socket *sock, int family,
4464 int type, int protocol, int kern)
4465 {
4466 const struct task_security_struct *tsec = selinux_cred(current_cred());
4467 struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4468 struct sk_security_struct *sksec;
4469 u16 sclass = socket_type_to_security_class(family, type, protocol);
4470 u32 sid = SECINITSID_KERNEL;
4471 int err = 0;
4472
4473 if (!kern) {
4474 err = socket_sockcreate_sid(tsec, sclass, &sid);
4475 if (err)
4476 return err;
4477 }
4478
4479 isec->sclass = sclass;
4480 isec->sid = sid;
4481 isec->initialized = LABEL_INITIALIZED;
4482
4483 if (sock->sk) {
4484 sksec = sock->sk->sk_security;
4485 sksec->sclass = sclass;
4486 sksec->sid = sid;
4487 /* Allows detection of the first association on this socket */
4488 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4489 sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4490
4491 err = selinux_netlbl_socket_post_create(sock->sk, family);
4492 }
4493
4494 return err;
4495 }
4496
4497 static int selinux_socket_socketpair(struct socket *socka,
4498 struct socket *sockb)
4499 {
4500 struct sk_security_struct *sksec_a = socka->sk->sk_security;
4501 struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4502
4503 sksec_a->peer_sid = sksec_b->sid;
4504 sksec_b->peer_sid = sksec_a->sid;
4505
4506 return 0;
4507 }
4508
4509 /* Range of port numbers used to automatically bind.
4510 Need to determine whether we should perform a name_bind
4511 permission check between the socket and the port number. */
4512
4513 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4514 {
4515 struct sock *sk = sock->sk;
4516 struct sk_security_struct *sksec = sk->sk_security;
4517 u16 family;
4518 int err;
4519
4520 err = sock_has_perm(sk, SOCKET__BIND);
4521 if (err)
4522 goto out;
4523
4524 /* If PF_INET or PF_INET6, check name_bind permission for the port. */
4525 family = sk->sk_family;
4526 if (family == PF_INET || family == PF_INET6) {
4527 char *addrp;
4528 struct common_audit_data ad;
4529 struct lsm_network_audit net = {0,};
4530 struct sockaddr_in *addr4 = NULL;
4531 struct sockaddr_in6 *addr6 = NULL;
4532 u16 family_sa;
4533 unsigned short snum;
4534 u32 sid, node_perm;
4535
4536 /*
4537 * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4538 * that validates multiple binding addresses. Because of this
4539 * need to check address->sa_family as it is possible to have
4540 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4541 */
4542 if (addrlen < offsetofend(struct sockaddr, sa_family))
4543 return -EINVAL;
4544 family_sa = address->sa_family;
4545 switch (family_sa) {
4546 case AF_UNSPEC:
4547 case AF_INET:
4548 if (addrlen < sizeof(struct sockaddr_in))
4549 return -EINVAL;
4550 addr4 = (struct sockaddr_in *)address;
4551 if (family_sa == AF_UNSPEC) {
4552 /* see __inet_bind(), we only want to allow
4553 * AF_UNSPEC if the address is INADDR_ANY
4554 */
4555 if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4556 goto err_af;
4557 family_sa = AF_INET;
4558 }
4559 snum = ntohs(addr4->sin_port);
4560 addrp = (char *)&addr4->sin_addr.s_addr;
4561 break;
4562 case AF_INET6:
4563 if (addrlen < SIN6_LEN_RFC2133)
4564 return -EINVAL;
4565 addr6 = (struct sockaddr_in6 *)address;
4566 snum = ntohs(addr6->sin6_port);
4567 addrp = (char *)&addr6->sin6_addr.s6_addr;
4568 break;
4569 default:
4570 goto err_af;
4571 }
4572
4573 ad.type = LSM_AUDIT_DATA_NET;
4574 ad.u.net = &net;
4575 ad.u.net->sport = htons(snum);
4576 ad.u.net->family = family_sa;
4577
4578 if (snum) {
4579 int low, high;
4580
4581 inet_get_local_port_range(sock_net(sk), &low, &high);
4582
4583 if (snum < max(inet_prot_sock(sock_net(sk)), low) ||
4584 snum > high) {
4585 err = sel_netport_sid(sk->sk_protocol,
4586 snum, &sid);
4587 if (err)
4588 goto out;
4589 err = avc_has_perm(&selinux_state,
4590 sksec->sid, sid,
4591 sksec->sclass,
4592 SOCKET__NAME_BIND, &ad);
4593 if (err)
4594 goto out;
4595 }
4596 }
4597
4598 switch (sksec->sclass) {
4599 case SECCLASS_TCP_SOCKET:
4600 node_perm = TCP_SOCKET__NODE_BIND;
4601 break;
4602
4603 case SECCLASS_UDP_SOCKET:
4604 node_perm = UDP_SOCKET__NODE_BIND;
4605 break;
4606
4607 case SECCLASS_DCCP_SOCKET:
4608 node_perm = DCCP_SOCKET__NODE_BIND;
4609 break;
4610
4611 case SECCLASS_SCTP_SOCKET:
4612 node_perm = SCTP_SOCKET__NODE_BIND;
4613 break;
4614
4615 default:
4616 node_perm = RAWIP_SOCKET__NODE_BIND;
4617 break;
4618 }
4619
4620 err = sel_netnode_sid(addrp, family_sa, &sid);
4621 if (err)
4622 goto out;
4623
4624 if (family_sa == AF_INET)
4625 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4626 else
4627 ad.u.net->v6info.saddr = addr6->sin6_addr;
4628
4629 err = avc_has_perm(&selinux_state,
4630 sksec->sid, sid,
4631 sksec->sclass, node_perm, &ad);
4632 if (err)
4633 goto out;
4634 }
4635 out:
4636 return err;
4637 err_af:
4638 /* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4639 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4640 return -EINVAL;
4641 return -EAFNOSUPPORT;
4642 }
4643
4644 /* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4645 * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst
4646 */
4647 static int selinux_socket_connect_helper(struct socket *sock,
4648 struct sockaddr *address, int addrlen)
4649 {
4650 struct sock *sk = sock->sk;
4651 struct sk_security_struct *sksec = sk->sk_security;
4652 int err;
4653
4654 err = sock_has_perm(sk, SOCKET__CONNECT);
4655 if (err)
4656 return err;
4657 if (addrlen < offsetofend(struct sockaddr, sa_family))
4658 return -EINVAL;
4659
4660 /* connect(AF_UNSPEC) has special handling, as it is a documented
4661 * way to disconnect the socket
4662 */
4663 if (address->sa_family == AF_UNSPEC)
4664 return 0;
4665
4666 /*
4667 * If a TCP, DCCP or SCTP socket, check name_connect permission
4668 * for the port.
4669 */
4670 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4671 sksec->sclass == SECCLASS_DCCP_SOCKET ||
4672 sksec->sclass == SECCLASS_SCTP_SOCKET) {
4673 struct common_audit_data ad;
4674 struct lsm_network_audit net = {0,};
4675 struct sockaddr_in *addr4 = NULL;
4676 struct sockaddr_in6 *addr6 = NULL;
4677 unsigned short snum;
4678 u32 sid, perm;
4679
4680 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4681 * that validates multiple connect addresses. Because of this
4682 * need to check address->sa_family as it is possible to have
4683 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4684 */
4685 switch (address->sa_family) {
4686 case AF_INET:
4687 addr4 = (struct sockaddr_in *)address;
4688 if (addrlen < sizeof(struct sockaddr_in))
4689 return -EINVAL;
4690 snum = ntohs(addr4->sin_port);
4691 break;
4692 case AF_INET6:
4693 addr6 = (struct sockaddr_in6 *)address;
4694 if (addrlen < SIN6_LEN_RFC2133)
4695 return -EINVAL;
4696 snum = ntohs(addr6->sin6_port);
4697 break;
4698 default:
4699 /* Note that SCTP services expect -EINVAL, whereas
4700 * others expect -EAFNOSUPPORT.
4701 */
4702 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4703 return -EINVAL;
4704 else
4705 return -EAFNOSUPPORT;
4706 }
4707
4708 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4709 if (err)
4710 return err;
4711
4712 switch (sksec->sclass) {
4713 case SECCLASS_TCP_SOCKET:
4714 perm = TCP_SOCKET__NAME_CONNECT;
4715 break;
4716 case SECCLASS_DCCP_SOCKET:
4717 perm = DCCP_SOCKET__NAME_CONNECT;
4718 break;
4719 case SECCLASS_SCTP_SOCKET:
4720 perm = SCTP_SOCKET__NAME_CONNECT;
4721 break;
4722 }
4723
4724 ad.type = LSM_AUDIT_DATA_NET;
4725 ad.u.net = &net;
4726 ad.u.net->dport = htons(snum);
4727 ad.u.net->family = address->sa_family;
4728 err = avc_has_perm(&selinux_state,
4729 sksec->sid, sid, sksec->sclass, perm, &ad);
4730 if (err)
4731 return err;
4732 }
4733
4734 return 0;
4735 }
4736
4737 /* Supports connect(2), see comments in selinux_socket_connect_helper() */
4738 static int selinux_socket_connect(struct socket *sock,
4739 struct sockaddr *address, int addrlen)
4740 {
4741 int err;
4742 struct sock *sk = sock->sk;
4743
4744 err = selinux_socket_connect_helper(sock, address, addrlen);
4745 if (err)
4746 return err;
4747
4748 return selinux_netlbl_socket_connect(sk, address);
4749 }
4750
4751 static int selinux_socket_listen(struct socket *sock, int backlog)
4752 {
4753 return sock_has_perm(sock->sk, SOCKET__LISTEN);
4754 }
4755
4756 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4757 {
4758 int err;
4759 struct inode_security_struct *isec;
4760 struct inode_security_struct *newisec;
4761 u16 sclass;
4762 u32 sid;
4763
4764 err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4765 if (err)
4766 return err;
4767
4768 isec = inode_security_novalidate(SOCK_INODE(sock));
4769 spin_lock(&isec->lock);
4770 sclass = isec->sclass;
4771 sid = isec->sid;
4772 spin_unlock(&isec->lock);
4773
4774 newisec = inode_security_novalidate(SOCK_INODE(newsock));
4775 newisec->sclass = sclass;
4776 newisec->sid = sid;
4777 newisec->initialized = LABEL_INITIALIZED;
4778
4779 return 0;
4780 }
4781
4782 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4783 int size)
4784 {
4785 return sock_has_perm(sock->sk, SOCKET__WRITE);
4786 }
4787
4788 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4789 int size, int flags)
4790 {
4791 return sock_has_perm(sock->sk, SOCKET__READ);
4792 }
4793
4794 static int selinux_socket_getsockname(struct socket *sock)
4795 {
4796 return sock_has_perm(sock->sk, SOCKET__GETATTR);
4797 }
4798
4799 static int selinux_socket_getpeername(struct socket *sock)
4800 {
4801 return sock_has_perm(sock->sk, SOCKET__GETATTR);
4802 }
4803
4804 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4805 {
4806 int err;
4807
4808 err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4809 if (err)
4810 return err;
4811
4812 return selinux_netlbl_socket_setsockopt(sock, level, optname);
4813 }
4814
4815 static int selinux_socket_getsockopt(struct socket *sock, int level,
4816 int optname)
4817 {
4818 return sock_has_perm(sock->sk, SOCKET__GETOPT);
4819 }
4820
4821 static int selinux_socket_shutdown(struct socket *sock, int how)
4822 {
4823 return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4824 }
4825
4826 static int selinux_socket_unix_stream_connect(struct sock *sock,
4827 struct sock *other,
4828 struct sock *newsk)
4829 {
4830 struct sk_security_struct *sksec_sock = sock->sk_security;
4831 struct sk_security_struct *sksec_other = other->sk_security;
4832 struct sk_security_struct *sksec_new = newsk->sk_security;
4833 struct common_audit_data ad;
4834 struct lsm_network_audit net = {0,};
4835 int err;
4836
4837 ad.type = LSM_AUDIT_DATA_NET;
4838 ad.u.net = &net;
4839 ad.u.net->sk = other;
4840
4841 err = avc_has_perm(&selinux_state,
4842 sksec_sock->sid, sksec_other->sid,
4843 sksec_other->sclass,
4844 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4845 if (err)
4846 return err;
4847
4848 /* server child socket */
4849 sksec_new->peer_sid = sksec_sock->sid;
4850 err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
4851 sksec_sock->sid, &sksec_new->sid);
4852 if (err)
4853 return err;
4854
4855 /* connecting socket */
4856 sksec_sock->peer_sid = sksec_new->sid;
4857
4858 return 0;
4859 }
4860
4861 static int selinux_socket_unix_may_send(struct socket *sock,
4862 struct socket *other)
4863 {
4864 struct sk_security_struct *ssec = sock->sk->sk_security;
4865 struct sk_security_struct *osec = other->sk->sk_security;
4866 struct common_audit_data ad;
4867 struct lsm_network_audit net = {0,};
4868
4869 ad.type = LSM_AUDIT_DATA_NET;
4870 ad.u.net = &net;
4871 ad.u.net->sk = other->sk;
4872
4873 return avc_has_perm(&selinux_state,
4874 ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4875 &ad);
4876 }
4877
4878 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4879 char *addrp, u16 family, u32 peer_sid,
4880 struct common_audit_data *ad)
4881 {
4882 int err;
4883 u32 if_sid;
4884 u32 node_sid;
4885
4886 err = sel_netif_sid(ns, ifindex, &if_sid);
4887 if (err)
4888 return err;
4889 err = avc_has_perm(&selinux_state,
4890 peer_sid, if_sid,
4891 SECCLASS_NETIF, NETIF__INGRESS, ad);
4892 if (err)
4893 return err;
4894
4895 err = sel_netnode_sid(addrp, family, &node_sid);
4896 if (err)
4897 return err;
4898 return avc_has_perm(&selinux_state,
4899 peer_sid, node_sid,
4900 SECCLASS_NODE, NODE__RECVFROM, ad);
4901 }
4902
4903 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4904 u16 family)
4905 {
4906 int err = 0;
4907 struct sk_security_struct *sksec = sk->sk_security;
4908 u32 sk_sid = sksec->sid;
4909 struct common_audit_data ad;
4910 struct lsm_network_audit net = {0,};
4911 char *addrp;
4912
4913 ad.type = LSM_AUDIT_DATA_NET;
4914 ad.u.net = &net;
4915 ad.u.net->netif = skb->skb_iif;
4916 ad.u.net->family = family;
4917 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4918 if (err)
4919 return err;
4920
4921 if (selinux_secmark_enabled()) {
4922 err = avc_has_perm(&selinux_state,
4923 sk_sid, skb->secmark, SECCLASS_PACKET,
4924 PACKET__RECV, &ad);
4925 if (err)
4926 return err;
4927 }
4928
4929 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4930 if (err)
4931 return err;
4932 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4933
4934 return err;
4935 }
4936
4937 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4938 {
4939 int err;
4940 struct sk_security_struct *sksec = sk->sk_security;
4941 u16 family = sk->sk_family;
4942 u32 sk_sid = sksec->sid;
4943 struct common_audit_data ad;
4944 struct lsm_network_audit net = {0,};
4945 char *addrp;
4946 u8 secmark_active;
4947 u8 peerlbl_active;
4948
4949 if (family != PF_INET && family != PF_INET6)
4950 return 0;
4951
4952 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4953 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4954 family = PF_INET;
4955
4956 /* If any sort of compatibility mode is enabled then handoff processing
4957 * to the selinux_sock_rcv_skb_compat() function to deal with the
4958 * special handling. We do this in an attempt to keep this function
4959 * as fast and as clean as possible. */
4960 if (!selinux_policycap_netpeer())
4961 return selinux_sock_rcv_skb_compat(sk, skb, family);
4962
4963 secmark_active = selinux_secmark_enabled();
4964 peerlbl_active = selinux_peerlbl_enabled();
4965 if (!secmark_active && !peerlbl_active)
4966 return 0;
4967
4968 ad.type = LSM_AUDIT_DATA_NET;
4969 ad.u.net = &net;
4970 ad.u.net->netif = skb->skb_iif;
4971 ad.u.net->family = family;
4972 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4973 if (err)
4974 return err;
4975
4976 if (peerlbl_active) {
4977 u32 peer_sid;
4978
4979 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4980 if (err)
4981 return err;
4982 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4983 addrp, family, peer_sid, &ad);
4984 if (err) {
4985 selinux_netlbl_err(skb, family, err, 0);
4986 return err;
4987 }
4988 err = avc_has_perm(&selinux_state,
4989 sk_sid, peer_sid, SECCLASS_PEER,
4990 PEER__RECV, &ad);
4991 if (err) {
4992 selinux_netlbl_err(skb, family, err, 0);
4993 return err;
4994 }
4995 }
4996
4997 if (secmark_active) {
4998 err = avc_has_perm(&selinux_state,
4999 sk_sid, skb->secmark, SECCLASS_PACKET,
5000 PACKET__RECV, &ad);
5001 if (err)
5002 return err;
5003 }
5004
5005 return err;
5006 }
5007
5008 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
5009 int __user *optlen, unsigned len)
5010 {
5011 int err = 0;
5012 char *scontext;
5013 u32 scontext_len;
5014 struct sk_security_struct *sksec = sock->sk->sk_security;
5015 u32 peer_sid = SECSID_NULL;
5016
5017 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
5018 sksec->sclass == SECCLASS_TCP_SOCKET ||
5019 sksec->sclass == SECCLASS_SCTP_SOCKET)
5020 peer_sid = sksec->peer_sid;
5021 if (peer_sid == SECSID_NULL)
5022 return -ENOPROTOOPT;
5023
5024 err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
5025 &scontext_len);
5026 if (err)
5027 return err;
5028
5029 if (scontext_len > len) {
5030 err = -ERANGE;
5031 goto out_len;
5032 }
5033
5034 if (copy_to_user(optval, scontext, scontext_len))
5035 err = -EFAULT;
5036
5037 out_len:
5038 if (put_user(scontext_len, optlen))
5039 err = -EFAULT;
5040 kfree(scontext);
5041 return err;
5042 }
5043
5044 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
5045 {
5046 u32 peer_secid = SECSID_NULL;
5047 u16 family;
5048 struct inode_security_struct *isec;
5049
5050 if (skb && skb->protocol == htons(ETH_P_IP))
5051 family = PF_INET;
5052 else if (skb && skb->protocol == htons(ETH_P_IPV6))
5053 family = PF_INET6;
5054 else if (sock)
5055 family = sock->sk->sk_family;
5056 else
5057 goto out;
5058
5059 if (sock && family == PF_UNIX) {
5060 isec = inode_security_novalidate(SOCK_INODE(sock));
5061 peer_secid = isec->sid;
5062 } else if (skb)
5063 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
5064
5065 out:
5066 *secid = peer_secid;
5067 if (peer_secid == SECSID_NULL)
5068 return -EINVAL;
5069 return 0;
5070 }
5071
5072 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
5073 {
5074 struct sk_security_struct *sksec;
5075
5076 sksec = kzalloc(sizeof(*sksec), priority);
5077 if (!sksec)
5078 return -ENOMEM;
5079
5080 sksec->peer_sid = SECINITSID_UNLABELED;
5081 sksec->sid = SECINITSID_UNLABELED;
5082 sksec->sclass = SECCLASS_SOCKET;
5083 selinux_netlbl_sk_security_reset(sksec);
5084 sk->sk_security = sksec;
5085
5086 return 0;
5087 }
5088
5089 static void selinux_sk_free_security(struct sock *sk)
5090 {
5091 struct sk_security_struct *sksec = sk->sk_security;
5092
5093 sk->sk_security = NULL;
5094 selinux_netlbl_sk_security_free(sksec);
5095 kfree(sksec);
5096 }
5097
5098 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5099 {
5100 struct sk_security_struct *sksec = sk->sk_security;
5101 struct sk_security_struct *newsksec = newsk->sk_security;
5102
5103 newsksec->sid = sksec->sid;
5104 newsksec->peer_sid = sksec->peer_sid;
5105 newsksec->sclass = sksec->sclass;
5106
5107 selinux_netlbl_sk_security_reset(newsksec);
5108 }
5109
5110 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
5111 {
5112 if (!sk)
5113 *secid = SECINITSID_ANY_SOCKET;
5114 else {
5115 struct sk_security_struct *sksec = sk->sk_security;
5116
5117 *secid = sksec->sid;
5118 }
5119 }
5120
5121 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
5122 {
5123 struct inode_security_struct *isec =
5124 inode_security_novalidate(SOCK_INODE(parent));
5125 struct sk_security_struct *sksec = sk->sk_security;
5126
5127 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5128 sk->sk_family == PF_UNIX)
5129 isec->sid = sksec->sid;
5130 sksec->sclass = isec->sclass;
5131 }
5132
5133 /* Called whenever SCTP receives an INIT chunk. This happens when an incoming
5134 * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
5135 * already present).
5136 */
5137 static int selinux_sctp_assoc_request(struct sctp_endpoint *ep,
5138 struct sk_buff *skb)
5139 {
5140 struct sk_security_struct *sksec = ep->base.sk->sk_security;
5141 struct common_audit_data ad;
5142 struct lsm_network_audit net = {0,};
5143 u8 peerlbl_active;
5144 u32 peer_sid = SECINITSID_UNLABELED;
5145 u32 conn_sid;
5146 int err = 0;
5147
5148 if (!selinux_policycap_extsockclass())
5149 return 0;
5150
5151 peerlbl_active = selinux_peerlbl_enabled();
5152
5153 if (peerlbl_active) {
5154 /* This will return peer_sid = SECSID_NULL if there are
5155 * no peer labels, see security_net_peersid_resolve().
5156 */
5157 err = selinux_skb_peerlbl_sid(skb, ep->base.sk->sk_family,
5158 &peer_sid);
5159 if (err)
5160 return err;
5161
5162 if (peer_sid == SECSID_NULL)
5163 peer_sid = SECINITSID_UNLABELED;
5164 }
5165
5166 if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5167 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5168
5169 /* Here as first association on socket. As the peer SID
5170 * was allowed by peer recv (and the netif/node checks),
5171 * then it is approved by policy and used as the primary
5172 * peer SID for getpeercon(3).
5173 */
5174 sksec->peer_sid = peer_sid;
5175 } else if (sksec->peer_sid != peer_sid) {
5176 /* Other association peer SIDs are checked to enforce
5177 * consistency among the peer SIDs.
5178 */
5179 ad.type = LSM_AUDIT_DATA_NET;
5180 ad.u.net = &net;
5181 ad.u.net->sk = ep->base.sk;
5182 err = avc_has_perm(&selinux_state,
5183 sksec->peer_sid, peer_sid, sksec->sclass,
5184 SCTP_SOCKET__ASSOCIATION, &ad);
5185 if (err)
5186 return err;
5187 }
5188
5189 /* Compute the MLS component for the connection and store
5190 * the information in ep. This will be used by SCTP TCP type
5191 * sockets and peeled off connections as they cause a new
5192 * socket to be generated. selinux_sctp_sk_clone() will then
5193 * plug this into the new socket.
5194 */
5195 err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
5196 if (err)
5197 return err;
5198
5199 ep->secid = conn_sid;
5200 ep->peer_secid = peer_sid;
5201
5202 /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5203 return selinux_netlbl_sctp_assoc_request(ep, skb);
5204 }
5205
5206 /* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5207 * based on their @optname.
5208 */
5209 static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5210 struct sockaddr *address,
5211 int addrlen)
5212 {
5213 int len, err = 0, walk_size = 0;
5214 void *addr_buf;
5215 struct sockaddr *addr;
5216 struct socket *sock;
5217
5218 if (!selinux_policycap_extsockclass())
5219 return 0;
5220
5221 /* Process one or more addresses that may be IPv4 or IPv6 */
5222 sock = sk->sk_socket;
5223 addr_buf = address;
5224
5225 while (walk_size < addrlen) {
5226 if (walk_size + sizeof(sa_family_t) > addrlen)
5227 return -EINVAL;
5228
5229 addr = addr_buf;
5230 switch (addr->sa_family) {
5231 case AF_UNSPEC:
5232 case AF_INET:
5233 len = sizeof(struct sockaddr_in);
5234 break;
5235 case AF_INET6:
5236 len = sizeof(struct sockaddr_in6);
5237 break;
5238 default:
5239 return -EINVAL;
5240 }
5241
5242 if (walk_size + len > addrlen)
5243 return -EINVAL;
5244
5245 err = -EINVAL;
5246 switch (optname) {
5247 /* Bind checks */
5248 case SCTP_PRIMARY_ADDR:
5249 case SCTP_SET_PEER_PRIMARY_ADDR:
5250 case SCTP_SOCKOPT_BINDX_ADD:
5251 err = selinux_socket_bind(sock, addr, len);
5252 break;
5253 /* Connect checks */
5254 case SCTP_SOCKOPT_CONNECTX:
5255 case SCTP_PARAM_SET_PRIMARY:
5256 case SCTP_PARAM_ADD_IP:
5257 case SCTP_SENDMSG_CONNECT:
5258 err = selinux_socket_connect_helper(sock, addr, len);
5259 if (err)
5260 return err;
5261
5262 /* As selinux_sctp_bind_connect() is called by the
5263 * SCTP protocol layer, the socket is already locked,
5264 * therefore selinux_netlbl_socket_connect_locked() is
5265 * is called here. The situations handled are:
5266 * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5267 * whenever a new IP address is added or when a new
5268 * primary address is selected.
5269 * Note that an SCTP connect(2) call happens before
5270 * the SCTP protocol layer and is handled via
5271 * selinux_socket_connect().
5272 */
5273 err = selinux_netlbl_socket_connect_locked(sk, addr);
5274 break;
5275 }
5276
5277 if (err)
5278 return err;
5279
5280 addr_buf += len;
5281 walk_size += len;
5282 }
5283
5284 return 0;
5285 }
5286
5287 /* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5288 static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
5289 struct sock *newsk)
5290 {
5291 struct sk_security_struct *sksec = sk->sk_security;
5292 struct sk_security_struct *newsksec = newsk->sk_security;
5293
5294 /* If policy does not support SECCLASS_SCTP_SOCKET then call
5295 * the non-sctp clone version.
5296 */
5297 if (!selinux_policycap_extsockclass())
5298 return selinux_sk_clone_security(sk, newsk);
5299
5300 newsksec->sid = ep->secid;
5301 newsksec->peer_sid = ep->peer_secid;
5302 newsksec->sclass = sksec->sclass;
5303 selinux_netlbl_sctp_sk_clone(sk, newsk);
5304 }
5305
5306 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
5307 struct request_sock *req)
5308 {
5309 struct sk_security_struct *sksec = sk->sk_security;
5310 int err;
5311 u16 family = req->rsk_ops->family;
5312 u32 connsid;
5313 u32 peersid;
5314
5315 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
5316 if (err)
5317 return err;
5318 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5319 if (err)
5320 return err;
5321 req->secid = connsid;
5322 req->peer_secid = peersid;
5323
5324 return selinux_netlbl_inet_conn_request(req, family);
5325 }
5326
5327 static void selinux_inet_csk_clone(struct sock *newsk,
5328 const struct request_sock *req)
5329 {
5330 struct sk_security_struct *newsksec = newsk->sk_security;
5331
5332 newsksec->sid = req->secid;
5333 newsksec->peer_sid = req->peer_secid;
5334 /* NOTE: Ideally, we should also get the isec->sid for the
5335 new socket in sync, but we don't have the isec available yet.
5336 So we will wait until sock_graft to do it, by which
5337 time it will have been created and available. */
5338
5339 /* We don't need to take any sort of lock here as we are the only
5340 * thread with access to newsksec */
5341 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
5342 }
5343
5344 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
5345 {
5346 u16 family = sk->sk_family;
5347 struct sk_security_struct *sksec = sk->sk_security;
5348
5349 /* handle mapped IPv4 packets arriving via IPv6 sockets */
5350 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5351 family = PF_INET;
5352
5353 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
5354 }
5355
5356 static int selinux_secmark_relabel_packet(u32 sid)
5357 {
5358 const struct task_security_struct *__tsec;
5359 u32 tsid;
5360
5361 __tsec = selinux_cred(current_cred());
5362 tsid = __tsec->sid;
5363
5364 return avc_has_perm(&selinux_state,
5365 tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5366 NULL);
5367 }
5368
5369 static void selinux_secmark_refcount_inc(void)
5370 {
5371 atomic_inc(&selinux_secmark_refcount);
5372 }
5373
5374 static void selinux_secmark_refcount_dec(void)
5375 {
5376 atomic_dec(&selinux_secmark_refcount);
5377 }
5378
5379 static void selinux_req_classify_flow(const struct request_sock *req,
5380 struct flowi *fl)
5381 {
5382 fl->flowi_secid = req->secid;
5383 }
5384
5385 static int selinux_tun_dev_alloc_security(void **security)
5386 {
5387 struct tun_security_struct *tunsec;
5388
5389 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5390 if (!tunsec)
5391 return -ENOMEM;
5392 tunsec->sid = current_sid();
5393
5394 *security = tunsec;
5395 return 0;
5396 }
5397
5398 static void selinux_tun_dev_free_security(void *security)
5399 {
5400 kfree(security);
5401 }
5402
5403 static int selinux_tun_dev_create(void)
5404 {
5405 u32 sid = current_sid();
5406
5407 /* we aren't taking into account the "sockcreate" SID since the socket
5408 * that is being created here is not a socket in the traditional sense,
5409 * instead it is a private sock, accessible only to the kernel, and
5410 * representing a wide range of network traffic spanning multiple
5411 * connections unlike traditional sockets - check the TUN driver to
5412 * get a better understanding of why this socket is special */
5413
5414 return avc_has_perm(&selinux_state,
5415 sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5416 NULL);
5417 }
5418
5419 static int selinux_tun_dev_attach_queue(void *security)
5420 {
5421 struct tun_security_struct *tunsec = security;
5422
5423 return avc_has_perm(&selinux_state,
5424 current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5425 TUN_SOCKET__ATTACH_QUEUE, NULL);
5426 }
5427
5428 static int selinux_tun_dev_attach(struct sock *sk, void *security)
5429 {
5430 struct tun_security_struct *tunsec = security;
5431 struct sk_security_struct *sksec = sk->sk_security;
5432
5433 /* we don't currently perform any NetLabel based labeling here and it
5434 * isn't clear that we would want to do so anyway; while we could apply
5435 * labeling without the support of the TUN user the resulting labeled
5436 * traffic from the other end of the connection would almost certainly
5437 * cause confusion to the TUN user that had no idea network labeling
5438 * protocols were being used */
5439
5440 sksec->sid = tunsec->sid;
5441 sksec->sclass = SECCLASS_TUN_SOCKET;
5442
5443 return 0;
5444 }
5445
5446 static int selinux_tun_dev_open(void *security)
5447 {
5448 struct tun_security_struct *tunsec = security;
5449 u32 sid = current_sid();
5450 int err;
5451
5452 err = avc_has_perm(&selinux_state,
5453 sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5454 TUN_SOCKET__RELABELFROM, NULL);
5455 if (err)
5456 return err;
5457 err = avc_has_perm(&selinux_state,
5458 sid, sid, SECCLASS_TUN_SOCKET,
5459 TUN_SOCKET__RELABELTO, NULL);
5460 if (err)
5461 return err;
5462 tunsec->sid = sid;
5463
5464 return 0;
5465 }
5466
5467 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
5468 {
5469 int err = 0;
5470 u32 perm;
5471 struct nlmsghdr *nlh;
5472 struct sk_security_struct *sksec = sk->sk_security;
5473
5474 if (skb->len < NLMSG_HDRLEN) {
5475 err = -EINVAL;
5476 goto out;
5477 }
5478 nlh = nlmsg_hdr(skb);
5479
5480 err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
5481 if (err) {
5482 if (err == -EINVAL) {
5483 pr_warn_ratelimited("SELinux: unrecognized netlink"
5484 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5485 " pig=%d comm=%s\n",
5486 sk->sk_protocol, nlh->nlmsg_type,
5487 secclass_map[sksec->sclass - 1].name,
5488 task_pid_nr(current), current->comm);
5489 if (!enforcing_enabled(&selinux_state) ||
5490 security_get_allow_unknown(&selinux_state))
5491 err = 0;
5492 }
5493
5494 /* Ignore */
5495 if (err == -ENOENT)
5496 err = 0;
5497 goto out;
5498 }
5499
5500 err = sock_has_perm(sk, perm);
5501 out:
5502 return err;
5503 }
5504
5505 #ifdef CONFIG_NETFILTER
5506
5507 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5508 const struct net_device *indev,
5509 u16 family)
5510 {
5511 int err;
5512 char *addrp;
5513 u32 peer_sid;
5514 struct common_audit_data ad;
5515 struct lsm_network_audit net = {0,};
5516 u8 secmark_active;
5517 u8 netlbl_active;
5518 u8 peerlbl_active;
5519
5520 if (!selinux_policycap_netpeer())
5521 return NF_ACCEPT;
5522
5523 secmark_active = selinux_secmark_enabled();
5524 netlbl_active = netlbl_enabled();
5525 peerlbl_active = selinux_peerlbl_enabled();
5526 if (!secmark_active && !peerlbl_active)
5527 return NF_ACCEPT;
5528
5529 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5530 return NF_DROP;
5531
5532 ad.type = LSM_AUDIT_DATA_NET;
5533 ad.u.net = &net;
5534 ad.u.net->netif = indev->ifindex;
5535 ad.u.net->family = family;
5536 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5537 return NF_DROP;
5538
5539 if (peerlbl_active) {
5540 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5541 addrp, family, peer_sid, &ad);
5542 if (err) {
5543 selinux_netlbl_err(skb, family, err, 1);
5544 return NF_DROP;
5545 }
5546 }
5547
5548 if (secmark_active)
5549 if (avc_has_perm(&selinux_state,
5550 peer_sid, skb->secmark,
5551 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5552 return NF_DROP;
5553
5554 if (netlbl_active)
5555 /* we do this in the FORWARD path and not the POST_ROUTING
5556 * path because we want to make sure we apply the necessary
5557 * labeling before IPsec is applied so we can leverage AH
5558 * protection */
5559 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5560 return NF_DROP;
5561
5562 return NF_ACCEPT;
5563 }
5564
5565 static unsigned int selinux_ipv4_forward(void *priv,
5566 struct sk_buff *skb,
5567 const struct nf_hook_state *state)
5568 {
5569 return selinux_ip_forward(skb, state->in, PF_INET);
5570 }
5571
5572 #if IS_ENABLED(CONFIG_IPV6)
5573 static unsigned int selinux_ipv6_forward(void *priv,
5574 struct sk_buff *skb,
5575 const struct nf_hook_state *state)
5576 {
5577 return selinux_ip_forward(skb, state->in, PF_INET6);
5578 }
5579 #endif /* IPV6 */
5580
5581 static unsigned int selinux_ip_output(struct sk_buff *skb,
5582 u16 family)
5583 {
5584 struct sock *sk;
5585 u32 sid;
5586
5587 if (!netlbl_enabled())
5588 return NF_ACCEPT;
5589
5590 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5591 * because we want to make sure we apply the necessary labeling
5592 * before IPsec is applied so we can leverage AH protection */
5593 sk = skb->sk;
5594 if (sk) {
5595 struct sk_security_struct *sksec;
5596
5597 if (sk_listener(sk))
5598 /* if the socket is the listening state then this
5599 * packet is a SYN-ACK packet which means it needs to
5600 * be labeled based on the connection/request_sock and
5601 * not the parent socket. unfortunately, we can't
5602 * lookup the request_sock yet as it isn't queued on
5603 * the parent socket until after the SYN-ACK is sent.
5604 * the "solution" is to simply pass the packet as-is
5605 * as any IP option based labeling should be copied
5606 * from the initial connection request (in the IP
5607 * layer). it is far from ideal, but until we get a
5608 * security label in the packet itself this is the
5609 * best we can do. */
5610 return NF_ACCEPT;
5611
5612 /* standard practice, label using the parent socket */
5613 sksec = sk->sk_security;
5614 sid = sksec->sid;
5615 } else
5616 sid = SECINITSID_KERNEL;
5617 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5618 return NF_DROP;
5619
5620 return NF_ACCEPT;
5621 }
5622
5623 static unsigned int selinux_ipv4_output(void *priv,
5624 struct sk_buff *skb,
5625 const struct nf_hook_state *state)
5626 {
5627 return selinux_ip_output(skb, PF_INET);
5628 }
5629
5630 #if IS_ENABLED(CONFIG_IPV6)
5631 static unsigned int selinux_ipv6_output(void *priv,
5632 struct sk_buff *skb,
5633 const struct nf_hook_state *state)
5634 {
5635 return selinux_ip_output(skb, PF_INET6);
5636 }
5637 #endif /* IPV6 */
5638
5639 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5640 int ifindex,
5641 u16 family)
5642 {
5643 struct sock *sk = skb_to_full_sk(skb);
5644 struct sk_security_struct *sksec;
5645 struct common_audit_data ad;
5646 struct lsm_network_audit net = {0,};
5647 char *addrp;
5648 u8 proto;
5649
5650 if (sk == NULL)
5651 return NF_ACCEPT;
5652 sksec = sk->sk_security;
5653
5654 ad.type = LSM_AUDIT_DATA_NET;
5655 ad.u.net = &net;
5656 ad.u.net->netif = ifindex;
5657 ad.u.net->family = family;
5658 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5659 return NF_DROP;
5660
5661 if (selinux_secmark_enabled())
5662 if (avc_has_perm(&selinux_state,
5663 sksec->sid, skb->secmark,
5664 SECCLASS_PACKET, PACKET__SEND, &ad))
5665 return NF_DROP_ERR(-ECONNREFUSED);
5666
5667 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5668 return NF_DROP_ERR(-ECONNREFUSED);
5669
5670 return NF_ACCEPT;
5671 }
5672
5673 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5674 const struct net_device *outdev,
5675 u16 family)
5676 {
5677 u32 secmark_perm;
5678 u32 peer_sid;
5679 int ifindex = outdev->ifindex;
5680 struct sock *sk;
5681 struct common_audit_data ad;
5682 struct lsm_network_audit net = {0,};
5683 char *addrp;
5684 u8 secmark_active;
5685 u8 peerlbl_active;
5686
5687 /* If any sort of compatibility mode is enabled then handoff processing
5688 * to the selinux_ip_postroute_compat() function to deal with the
5689 * special handling. We do this in an attempt to keep this function
5690 * as fast and as clean as possible. */
5691 if (!selinux_policycap_netpeer())
5692 return selinux_ip_postroute_compat(skb, ifindex, family);
5693
5694 secmark_active = selinux_secmark_enabled();
5695 peerlbl_active = selinux_peerlbl_enabled();
5696 if (!secmark_active && !peerlbl_active)
5697 return NF_ACCEPT;
5698
5699 sk = skb_to_full_sk(skb);
5700
5701 #ifdef CONFIG_XFRM
5702 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5703 * packet transformation so allow the packet to pass without any checks
5704 * since we'll have another chance to perform access control checks
5705 * when the packet is on it's final way out.
5706 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5707 * is NULL, in this case go ahead and apply access control.
5708 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5709 * TCP listening state we cannot wait until the XFRM processing
5710 * is done as we will miss out on the SA label if we do;
5711 * unfortunately, this means more work, but it is only once per
5712 * connection. */
5713 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5714 !(sk && sk_listener(sk)))
5715 return NF_ACCEPT;
5716 #endif
5717
5718 if (sk == NULL) {
5719 /* Without an associated socket the packet is either coming
5720 * from the kernel or it is being forwarded; check the packet
5721 * to determine which and if the packet is being forwarded
5722 * query the packet directly to determine the security label. */
5723 if (skb->skb_iif) {
5724 secmark_perm = PACKET__FORWARD_OUT;
5725 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5726 return NF_DROP;
5727 } else {
5728 secmark_perm = PACKET__SEND;
5729 peer_sid = SECINITSID_KERNEL;
5730 }
5731 } else if (sk_listener(sk)) {
5732 /* Locally generated packet but the associated socket is in the
5733 * listening state which means this is a SYN-ACK packet. In
5734 * this particular case the correct security label is assigned
5735 * to the connection/request_sock but unfortunately we can't
5736 * query the request_sock as it isn't queued on the parent
5737 * socket until after the SYN-ACK packet is sent; the only
5738 * viable choice is to regenerate the label like we do in
5739 * selinux_inet_conn_request(). See also selinux_ip_output()
5740 * for similar problems. */
5741 u32 skb_sid;
5742 struct sk_security_struct *sksec;
5743
5744 sksec = sk->sk_security;
5745 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5746 return NF_DROP;
5747 /* At this point, if the returned skb peerlbl is SECSID_NULL
5748 * and the packet has been through at least one XFRM
5749 * transformation then we must be dealing with the "final"
5750 * form of labeled IPsec packet; since we've already applied
5751 * all of our access controls on this packet we can safely
5752 * pass the packet. */
5753 if (skb_sid == SECSID_NULL) {
5754 switch (family) {
5755 case PF_INET:
5756 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5757 return NF_ACCEPT;
5758 break;
5759 case PF_INET6:
5760 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5761 return NF_ACCEPT;
5762 break;
5763 default:
5764 return NF_DROP_ERR(-ECONNREFUSED);
5765 }
5766 }
5767 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5768 return NF_DROP;
5769 secmark_perm = PACKET__SEND;
5770 } else {
5771 /* Locally generated packet, fetch the security label from the
5772 * associated socket. */
5773 struct sk_security_struct *sksec = sk->sk_security;
5774 peer_sid = sksec->sid;
5775 secmark_perm = PACKET__SEND;
5776 }
5777
5778 ad.type = LSM_AUDIT_DATA_NET;
5779 ad.u.net = &net;
5780 ad.u.net->netif = ifindex;
5781 ad.u.net->family = family;
5782 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5783 return NF_DROP;
5784
5785 if (secmark_active)
5786 if (avc_has_perm(&selinux_state,
5787 peer_sid, skb->secmark,
5788 SECCLASS_PACKET, secmark_perm, &ad))
5789 return NF_DROP_ERR(-ECONNREFUSED);
5790
5791 if (peerlbl_active) {
5792 u32 if_sid;
5793 u32 node_sid;
5794
5795 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5796 return NF_DROP;
5797 if (avc_has_perm(&selinux_state,
5798 peer_sid, if_sid,
5799 SECCLASS_NETIF, NETIF__EGRESS, &ad))
5800 return NF_DROP_ERR(-ECONNREFUSED);
5801
5802 if (sel_netnode_sid(addrp, family, &node_sid))
5803 return NF_DROP;
5804 if (avc_has_perm(&selinux_state,
5805 peer_sid, node_sid,
5806 SECCLASS_NODE, NODE__SENDTO, &ad))
5807 return NF_DROP_ERR(-ECONNREFUSED);
5808 }
5809
5810 return NF_ACCEPT;
5811 }
5812
5813 static unsigned int selinux_ipv4_postroute(void *priv,
5814 struct sk_buff *skb,
5815 const struct nf_hook_state *state)
5816 {
5817 return selinux_ip_postroute(skb, state->out, PF_INET);
5818 }
5819
5820 #if IS_ENABLED(CONFIG_IPV6)
5821 static unsigned int selinux_ipv6_postroute(void *priv,
5822 struct sk_buff *skb,
5823 const struct nf_hook_state *state)
5824 {
5825 return selinux_ip_postroute(skb, state->out, PF_INET6);
5826 }
5827 #endif /* IPV6 */
5828
5829 #endif /* CONFIG_NETFILTER */
5830
5831 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5832 {
5833 return selinux_nlmsg_perm(sk, skb);
5834 }
5835
5836 static void ipc_init_security(struct ipc_security_struct *isec, u16 sclass)
5837 {
5838 isec->sclass = sclass;
5839 isec->sid = current_sid();
5840 }
5841
5842 static int msg_msg_alloc_security(struct msg_msg *msg)
5843 {
5844 struct msg_security_struct *msec;
5845
5846 msec = selinux_msg_msg(msg);
5847 msec->sid = SECINITSID_UNLABELED;
5848
5849 return 0;
5850 }
5851
5852 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5853 u32 perms)
5854 {
5855 struct ipc_security_struct *isec;
5856 struct common_audit_data ad;
5857 u32 sid = current_sid();
5858
5859 isec = selinux_ipc(ipc_perms);
5860
5861 ad.type = LSM_AUDIT_DATA_IPC;
5862 ad.u.ipc_id = ipc_perms->key;
5863
5864 return avc_has_perm(&selinux_state,
5865 sid, isec->sid, isec->sclass, perms, &ad);
5866 }
5867
5868 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5869 {
5870 return msg_msg_alloc_security(msg);
5871 }
5872
5873 /* message queue security operations */
5874 static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
5875 {
5876 struct ipc_security_struct *isec;
5877 struct common_audit_data ad;
5878 u32 sid = current_sid();
5879 int rc;
5880
5881 isec = selinux_ipc(msq);
5882 ipc_init_security(isec, SECCLASS_MSGQ);
5883
5884 ad.type = LSM_AUDIT_DATA_IPC;
5885 ad.u.ipc_id = msq->key;
5886
5887 rc = avc_has_perm(&selinux_state,
5888 sid, isec->sid, SECCLASS_MSGQ,
5889 MSGQ__CREATE, &ad);
5890 return rc;
5891 }
5892
5893 static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
5894 {
5895 struct ipc_security_struct *isec;
5896 struct common_audit_data ad;
5897 u32 sid = current_sid();
5898
5899 isec = selinux_ipc(msq);
5900
5901 ad.type = LSM_AUDIT_DATA_IPC;
5902 ad.u.ipc_id = msq->key;
5903
5904 return avc_has_perm(&selinux_state,
5905 sid, isec->sid, SECCLASS_MSGQ,
5906 MSGQ__ASSOCIATE, &ad);
5907 }
5908
5909 static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
5910 {
5911 int err;
5912 int perms;
5913
5914 switch (cmd) {
5915 case IPC_INFO:
5916 case MSG_INFO:
5917 /* No specific object, just general system-wide information. */
5918 return avc_has_perm(&selinux_state,
5919 current_sid(), SECINITSID_KERNEL,
5920 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
5921 case IPC_STAT:
5922 case MSG_STAT:
5923 case MSG_STAT_ANY:
5924 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5925 break;
5926 case IPC_SET:
5927 perms = MSGQ__SETATTR;
5928 break;
5929 case IPC_RMID:
5930 perms = MSGQ__DESTROY;
5931 break;
5932 default:
5933 return 0;
5934 }
5935
5936 err = ipc_has_perm(msq, perms);
5937 return err;
5938 }
5939
5940 static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
5941 {
5942 struct ipc_security_struct *isec;
5943 struct msg_security_struct *msec;
5944 struct common_audit_data ad;
5945 u32 sid = current_sid();
5946 int rc;
5947
5948 isec = selinux_ipc(msq);
5949 msec = selinux_msg_msg(msg);
5950
5951 /*
5952 * First time through, need to assign label to the message
5953 */
5954 if (msec->sid == SECINITSID_UNLABELED) {
5955 /*
5956 * Compute new sid based on current process and
5957 * message queue this message will be stored in
5958 */
5959 rc = security_transition_sid(&selinux_state, sid, isec->sid,
5960 SECCLASS_MSG, NULL, &msec->sid);
5961 if (rc)
5962 return rc;
5963 }
5964
5965 ad.type = LSM_AUDIT_DATA_IPC;
5966 ad.u.ipc_id = msq->key;
5967
5968 /* Can this process write to the queue? */
5969 rc = avc_has_perm(&selinux_state,
5970 sid, isec->sid, SECCLASS_MSGQ,
5971 MSGQ__WRITE, &ad);
5972 if (!rc)
5973 /* Can this process send the message */
5974 rc = avc_has_perm(&selinux_state,
5975 sid, msec->sid, SECCLASS_MSG,
5976 MSG__SEND, &ad);
5977 if (!rc)
5978 /* Can the message be put in the queue? */
5979 rc = avc_has_perm(&selinux_state,
5980 msec->sid, isec->sid, SECCLASS_MSGQ,
5981 MSGQ__ENQUEUE, &ad);
5982
5983 return rc;
5984 }
5985
5986 static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
5987 struct task_struct *target,
5988 long type, int mode)
5989 {
5990 struct ipc_security_struct *isec;
5991 struct msg_security_struct *msec;
5992 struct common_audit_data ad;
5993 u32 sid = task_sid(target);
5994 int rc;
5995
5996 isec = selinux_ipc(msq);
5997 msec = selinux_msg_msg(msg);
5998
5999 ad.type = LSM_AUDIT_DATA_IPC;
6000 ad.u.ipc_id = msq->key;
6001
6002 rc = avc_has_perm(&selinux_state,
6003 sid, isec->sid,
6004 SECCLASS_MSGQ, MSGQ__READ, &ad);
6005 if (!rc)
6006 rc = avc_has_perm(&selinux_state,
6007 sid, msec->sid,
6008 SECCLASS_MSG, MSG__RECEIVE, &ad);
6009 return rc;
6010 }
6011
6012 /* Shared Memory security operations */
6013 static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
6014 {
6015 struct ipc_security_struct *isec;
6016 struct common_audit_data ad;
6017 u32 sid = current_sid();
6018 int rc;
6019
6020 isec = selinux_ipc(shp);
6021 ipc_init_security(isec, SECCLASS_SHM);
6022
6023 ad.type = LSM_AUDIT_DATA_IPC;
6024 ad.u.ipc_id = shp->key;
6025
6026 rc = avc_has_perm(&selinux_state,
6027 sid, isec->sid, SECCLASS_SHM,
6028 SHM__CREATE, &ad);
6029 return rc;
6030 }
6031
6032 static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
6033 {
6034 struct ipc_security_struct *isec;
6035 struct common_audit_data ad;
6036 u32 sid = current_sid();
6037
6038 isec = selinux_ipc(shp);
6039
6040 ad.type = LSM_AUDIT_DATA_IPC;
6041 ad.u.ipc_id = shp->key;
6042
6043 return avc_has_perm(&selinux_state,
6044 sid, isec->sid, SECCLASS_SHM,
6045 SHM__ASSOCIATE, &ad);
6046 }
6047
6048 /* Note, at this point, shp is locked down */
6049 static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
6050 {
6051 int perms;
6052 int err;
6053
6054 switch (cmd) {
6055 case IPC_INFO:
6056 case SHM_INFO:
6057 /* No specific object, just general system-wide information. */
6058 return avc_has_perm(&selinux_state,
6059 current_sid(), SECINITSID_KERNEL,
6060 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6061 case IPC_STAT:
6062 case SHM_STAT:
6063 case SHM_STAT_ANY:
6064 perms = SHM__GETATTR | SHM__ASSOCIATE;
6065 break;
6066 case IPC_SET:
6067 perms = SHM__SETATTR;
6068 break;
6069 case SHM_LOCK:
6070 case SHM_UNLOCK:
6071 perms = SHM__LOCK;
6072 break;
6073 case IPC_RMID:
6074 perms = SHM__DESTROY;
6075 break;
6076 default:
6077 return 0;
6078 }
6079
6080 err = ipc_has_perm(shp, perms);
6081 return err;
6082 }
6083
6084 static int selinux_shm_shmat(struct kern_ipc_perm *shp,
6085 char __user *shmaddr, int shmflg)
6086 {
6087 u32 perms;
6088
6089 if (shmflg & SHM_RDONLY)
6090 perms = SHM__READ;
6091 else
6092 perms = SHM__READ | SHM__WRITE;
6093
6094 return ipc_has_perm(shp, perms);
6095 }
6096
6097 /* Semaphore security operations */
6098 static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
6099 {
6100 struct ipc_security_struct *isec;
6101 struct common_audit_data ad;
6102 u32 sid = current_sid();
6103 int rc;
6104
6105 isec = selinux_ipc(sma);
6106 ipc_init_security(isec, SECCLASS_SEM);
6107
6108 ad.type = LSM_AUDIT_DATA_IPC;
6109 ad.u.ipc_id = sma->key;
6110
6111 rc = avc_has_perm(&selinux_state,
6112 sid, isec->sid, SECCLASS_SEM,
6113 SEM__CREATE, &ad);
6114 return rc;
6115 }
6116
6117 static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
6118 {
6119 struct ipc_security_struct *isec;
6120 struct common_audit_data ad;
6121 u32 sid = current_sid();
6122
6123 isec = selinux_ipc(sma);
6124
6125 ad.type = LSM_AUDIT_DATA_IPC;
6126 ad.u.ipc_id = sma->key;
6127
6128 return avc_has_perm(&selinux_state,
6129 sid, isec->sid, SECCLASS_SEM,
6130 SEM__ASSOCIATE, &ad);
6131 }
6132
6133 /* Note, at this point, sma is locked down */
6134 static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
6135 {
6136 int err;
6137 u32 perms;
6138
6139 switch (cmd) {
6140 case IPC_INFO:
6141 case SEM_INFO:
6142 /* No specific object, just general system-wide information. */
6143 return avc_has_perm(&selinux_state,
6144 current_sid(), SECINITSID_KERNEL,
6145 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6146 case GETPID:
6147 case GETNCNT:
6148 case GETZCNT:
6149 perms = SEM__GETATTR;
6150 break;
6151 case GETVAL:
6152 case GETALL:
6153 perms = SEM__READ;
6154 break;
6155 case SETVAL:
6156 case SETALL:
6157 perms = SEM__WRITE;
6158 break;
6159 case IPC_RMID:
6160 perms = SEM__DESTROY;
6161 break;
6162 case IPC_SET:
6163 perms = SEM__SETATTR;
6164 break;
6165 case IPC_STAT:
6166 case SEM_STAT:
6167 case SEM_STAT_ANY:
6168 perms = SEM__GETATTR | SEM__ASSOCIATE;
6169 break;
6170 default:
6171 return 0;
6172 }
6173
6174 err = ipc_has_perm(sma, perms);
6175 return err;
6176 }
6177
6178 static int selinux_sem_semop(struct kern_ipc_perm *sma,
6179 struct sembuf *sops, unsigned nsops, int alter)
6180 {
6181 u32 perms;
6182
6183 if (alter)
6184 perms = SEM__READ | SEM__WRITE;
6185 else
6186 perms = SEM__READ;
6187
6188 return ipc_has_perm(sma, perms);
6189 }
6190
6191 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6192 {
6193 u32 av = 0;
6194
6195 av = 0;
6196 if (flag & S_IRUGO)
6197 av |= IPC__UNIX_READ;
6198 if (flag & S_IWUGO)
6199 av |= IPC__UNIX_WRITE;
6200
6201 if (av == 0)
6202 return 0;
6203
6204 return ipc_has_perm(ipcp, av);
6205 }
6206
6207 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6208 {
6209 struct ipc_security_struct *isec = selinux_ipc(ipcp);
6210 *secid = isec->sid;
6211 }
6212
6213 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
6214 {
6215 if (inode)
6216 inode_doinit_with_dentry(inode, dentry);
6217 }
6218
6219 static int selinux_getprocattr(struct task_struct *p,
6220 char *name, char **value)
6221 {
6222 const struct task_security_struct *__tsec;
6223 u32 sid;
6224 int error;
6225 unsigned len;
6226
6227 rcu_read_lock();
6228 __tsec = selinux_cred(__task_cred(p));
6229
6230 if (current != p) {
6231 error = avc_has_perm(&selinux_state,
6232 current_sid(), __tsec->sid,
6233 SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6234 if (error)
6235 goto bad;
6236 }
6237
6238 if (!strcmp(name, "current"))
6239 sid = __tsec->sid;
6240 else if (!strcmp(name, "prev"))
6241 sid = __tsec->osid;
6242 else if (!strcmp(name, "exec"))
6243 sid = __tsec->exec_sid;
6244 else if (!strcmp(name, "fscreate"))
6245 sid = __tsec->create_sid;
6246 else if (!strcmp(name, "keycreate"))
6247 sid = __tsec->keycreate_sid;
6248 else if (!strcmp(name, "sockcreate"))
6249 sid = __tsec->sockcreate_sid;
6250 else {
6251 error = -EINVAL;
6252 goto bad;
6253 }
6254 rcu_read_unlock();
6255
6256 if (!sid)
6257 return 0;
6258
6259 error = security_sid_to_context(&selinux_state, sid, value, &len);
6260 if (error)
6261 return error;
6262 return len;
6263
6264 bad:
6265 rcu_read_unlock();
6266 return error;
6267 }
6268
6269 static int selinux_setprocattr(const char *name, void *value, size_t size)
6270 {
6271 struct task_security_struct *tsec;
6272 struct cred *new;
6273 u32 mysid = current_sid(), sid = 0, ptsid;
6274 int error;
6275 char *str = value;
6276
6277 /*
6278 * Basic control over ability to set these attributes at all.
6279 */
6280 if (!strcmp(name, "exec"))
6281 error = avc_has_perm(&selinux_state,
6282 mysid, mysid, SECCLASS_PROCESS,
6283 PROCESS__SETEXEC, NULL);
6284 else if (!strcmp(name, "fscreate"))
6285 error = avc_has_perm(&selinux_state,
6286 mysid, mysid, SECCLASS_PROCESS,
6287 PROCESS__SETFSCREATE, NULL);
6288 else if (!strcmp(name, "keycreate"))
6289 error = avc_has_perm(&selinux_state,
6290 mysid, mysid, SECCLASS_PROCESS,
6291 PROCESS__SETKEYCREATE, NULL);
6292 else if (!strcmp(name, "sockcreate"))
6293 error = avc_has_perm(&selinux_state,
6294 mysid, mysid, SECCLASS_PROCESS,
6295 PROCESS__SETSOCKCREATE, NULL);
6296 else if (!strcmp(name, "current"))
6297 error = avc_has_perm(&selinux_state,
6298 mysid, mysid, SECCLASS_PROCESS,
6299 PROCESS__SETCURRENT, NULL);
6300 else
6301 error = -EINVAL;
6302 if (error)
6303 return error;
6304
6305 /* Obtain a SID for the context, if one was specified. */
6306 if (size && str[0] && str[0] != '\n') {
6307 if (str[size-1] == '\n') {
6308 str[size-1] = 0;
6309 size--;
6310 }
6311 error = security_context_to_sid(&selinux_state, value, size,
6312 &sid, GFP_KERNEL);
6313 if (error == -EINVAL && !strcmp(name, "fscreate")) {
6314 if (!has_cap_mac_admin(true)) {
6315 struct audit_buffer *ab;
6316 size_t audit_size;
6317
6318 /* We strip a nul only if it is at the end, otherwise the
6319 * context contains a nul and we should audit that */
6320 if (str[size - 1] == '\0')
6321 audit_size = size - 1;
6322 else
6323 audit_size = size;
6324 ab = audit_log_start(audit_context(),
6325 GFP_ATOMIC,
6326 AUDIT_SELINUX_ERR);
6327 audit_log_format(ab, "op=fscreate invalid_context=");
6328 audit_log_n_untrustedstring(ab, value, audit_size);
6329 audit_log_end(ab);
6330
6331 return error;
6332 }
6333 error = security_context_to_sid_force(
6334 &selinux_state,
6335 value, size, &sid);
6336 }
6337 if (error)
6338 return error;
6339 }
6340
6341 new = prepare_creds();
6342 if (!new)
6343 return -ENOMEM;
6344
6345 /* Permission checking based on the specified context is
6346 performed during the actual operation (execve,
6347 open/mkdir/...), when we know the full context of the
6348 operation. See selinux_bprm_set_creds for the execve
6349 checks and may_create for the file creation checks. The
6350 operation will then fail if the context is not permitted. */
6351 tsec = selinux_cred(new);
6352 if (!strcmp(name, "exec")) {
6353 tsec->exec_sid = sid;
6354 } else if (!strcmp(name, "fscreate")) {
6355 tsec->create_sid = sid;
6356 } else if (!strcmp(name, "keycreate")) {
6357 error = avc_has_perm(&selinux_state,
6358 mysid, sid, SECCLASS_KEY, KEY__CREATE,
6359 NULL);
6360 if (error)
6361 goto abort_change;
6362 tsec->keycreate_sid = sid;
6363 } else if (!strcmp(name, "sockcreate")) {
6364 tsec->sockcreate_sid = sid;
6365 } else if (!strcmp(name, "current")) {
6366 error = -EINVAL;
6367 if (sid == 0)
6368 goto abort_change;
6369
6370 /* Only allow single threaded processes to change context */
6371 error = -EPERM;
6372 if (!current_is_single_threaded()) {
6373 error = security_bounded_transition(&selinux_state,
6374 tsec->sid, sid);
6375 if (error)
6376 goto abort_change;
6377 }
6378
6379 /* Check permissions for the transition. */
6380 error = avc_has_perm(&selinux_state,
6381 tsec->sid, sid, SECCLASS_PROCESS,
6382 PROCESS__DYNTRANSITION, NULL);
6383 if (error)
6384 goto abort_change;
6385
6386 /* Check for ptracing, and update the task SID if ok.
6387 Otherwise, leave SID unchanged and fail. */
6388 ptsid = ptrace_parent_sid();
6389 if (ptsid != 0) {
6390 error = avc_has_perm(&selinux_state,
6391 ptsid, sid, SECCLASS_PROCESS,
6392 PROCESS__PTRACE, NULL);
6393 if (error)
6394 goto abort_change;
6395 }
6396
6397 tsec->sid = sid;
6398 } else {
6399 error = -EINVAL;
6400 goto abort_change;
6401 }
6402
6403 commit_creds(new);
6404 return size;
6405
6406 abort_change:
6407 abort_creds(new);
6408 return error;
6409 }
6410
6411 static int selinux_ismaclabel(const char *name)
6412 {
6413 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6414 }
6415
6416 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6417 {
6418 return security_sid_to_context(&selinux_state, secid,
6419 secdata, seclen);
6420 }
6421
6422 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6423 {
6424 return security_context_to_sid(&selinux_state, secdata, seclen,
6425 secid, GFP_KERNEL);
6426 }
6427
6428 static void selinux_release_secctx(char *secdata, u32 seclen)
6429 {
6430 kfree(secdata);
6431 }
6432
6433 static void selinux_inode_invalidate_secctx(struct inode *inode)
6434 {
6435 struct inode_security_struct *isec = selinux_inode(inode);
6436
6437 spin_lock(&isec->lock);
6438 isec->initialized = LABEL_INVALID;
6439 spin_unlock(&isec->lock);
6440 }
6441
6442 /*
6443 * called with inode->i_mutex locked
6444 */
6445 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6446 {
6447 int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
6448 ctx, ctxlen, 0);
6449 /* Do not return error when suppressing label (SBLABEL_MNT not set). */
6450 return rc == -EOPNOTSUPP ? 0 : rc;
6451 }
6452
6453 /*
6454 * called with inode->i_mutex locked
6455 */
6456 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6457 {
6458 return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
6459 }
6460
6461 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6462 {
6463 int len = 0;
6464 len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
6465 ctx, true);
6466 if (len < 0)
6467 return len;
6468 *ctxlen = len;
6469 return 0;
6470 }
6471 #ifdef CONFIG_KEYS
6472
6473 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6474 unsigned long flags)
6475 {
6476 const struct task_security_struct *tsec;
6477 struct key_security_struct *ksec;
6478
6479 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6480 if (!ksec)
6481 return -ENOMEM;
6482
6483 tsec = selinux_cred(cred);
6484 if (tsec->keycreate_sid)
6485 ksec->sid = tsec->keycreate_sid;
6486 else
6487 ksec->sid = tsec->sid;
6488
6489 k->security = ksec;
6490 return 0;
6491 }
6492
6493 static void selinux_key_free(struct key *k)
6494 {
6495 struct key_security_struct *ksec = k->security;
6496
6497 k->security = NULL;
6498 kfree(ksec);
6499 }
6500
6501 static int selinux_key_permission(key_ref_t key_ref,
6502 const struct cred *cred,
6503 unsigned perm)
6504 {
6505 struct key *key;
6506 struct key_security_struct *ksec;
6507 u32 sid;
6508
6509 /* if no specific permissions are requested, we skip the
6510 permission check. No serious, additional covert channels
6511 appear to be created. */
6512 if (perm == 0)
6513 return 0;
6514
6515 sid = cred_sid(cred);
6516
6517 key = key_ref_to_ptr(key_ref);
6518 ksec = key->security;
6519
6520 return avc_has_perm(&selinux_state,
6521 sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6522 }
6523
6524 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6525 {
6526 struct key_security_struct *ksec = key->security;
6527 char *context = NULL;
6528 unsigned len;
6529 int rc;
6530
6531 rc = security_sid_to_context(&selinux_state, ksec->sid,
6532 &context, &len);
6533 if (!rc)
6534 rc = len;
6535 *_buffer = context;
6536 return rc;
6537 }
6538 #endif
6539
6540 #ifdef CONFIG_SECURITY_INFINIBAND
6541 static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6542 {
6543 struct common_audit_data ad;
6544 int err;
6545 u32 sid = 0;
6546 struct ib_security_struct *sec = ib_sec;
6547 struct lsm_ibpkey_audit ibpkey;
6548
6549 err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6550 if (err)
6551 return err;
6552
6553 ad.type = LSM_AUDIT_DATA_IBPKEY;
6554 ibpkey.subnet_prefix = subnet_prefix;
6555 ibpkey.pkey = pkey_val;
6556 ad.u.ibpkey = &ibpkey;
6557 return avc_has_perm(&selinux_state,
6558 sec->sid, sid,
6559 SECCLASS_INFINIBAND_PKEY,
6560 INFINIBAND_PKEY__ACCESS, &ad);
6561 }
6562
6563 static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6564 u8 port_num)
6565 {
6566 struct common_audit_data ad;
6567 int err;
6568 u32 sid = 0;
6569 struct ib_security_struct *sec = ib_sec;
6570 struct lsm_ibendport_audit ibendport;
6571
6572 err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6573 &sid);
6574
6575 if (err)
6576 return err;
6577
6578 ad.type = LSM_AUDIT_DATA_IBENDPORT;
6579 strncpy(ibendport.dev_name, dev_name, sizeof(ibendport.dev_name));
6580 ibendport.port = port_num;
6581 ad.u.ibendport = &ibendport;
6582 return avc_has_perm(&selinux_state,
6583 sec->sid, sid,
6584 SECCLASS_INFINIBAND_ENDPORT,
6585 INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6586 }
6587
6588 static int selinux_ib_alloc_security(void **ib_sec)
6589 {
6590 struct ib_security_struct *sec;
6591
6592 sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6593 if (!sec)
6594 return -ENOMEM;
6595 sec->sid = current_sid();
6596
6597 *ib_sec = sec;
6598 return 0;
6599 }
6600
6601 static void selinux_ib_free_security(void *ib_sec)
6602 {
6603 kfree(ib_sec);
6604 }
6605 #endif
6606
6607 #ifdef CONFIG_BPF_SYSCALL
6608 static int selinux_bpf(int cmd, union bpf_attr *attr,
6609 unsigned int size)
6610 {
6611 u32 sid = current_sid();
6612 int ret;
6613
6614 switch (cmd) {
6615 case BPF_MAP_CREATE:
6616 ret = avc_has_perm(&selinux_state,
6617 sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
6618 NULL);
6619 break;
6620 case BPF_PROG_LOAD:
6621 ret = avc_has_perm(&selinux_state,
6622 sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
6623 NULL);
6624 break;
6625 default:
6626 ret = 0;
6627 break;
6628 }
6629
6630 return ret;
6631 }
6632
6633 static u32 bpf_map_fmode_to_av(fmode_t fmode)
6634 {
6635 u32 av = 0;
6636
6637 if (fmode & FMODE_READ)
6638 av |= BPF__MAP_READ;
6639 if (fmode & FMODE_WRITE)
6640 av |= BPF__MAP_WRITE;
6641 return av;
6642 }
6643
6644 /* This function will check the file pass through unix socket or binder to see
6645 * if it is a bpf related object. And apply correspinding checks on the bpf
6646 * object based on the type. The bpf maps and programs, not like other files and
6647 * socket, are using a shared anonymous inode inside the kernel as their inode.
6648 * So checking that inode cannot identify if the process have privilege to
6649 * access the bpf object and that's why we have to add this additional check in
6650 * selinux_file_receive and selinux_binder_transfer_files.
6651 */
6652 static int bpf_fd_pass(struct file *file, u32 sid)
6653 {
6654 struct bpf_security_struct *bpfsec;
6655 struct bpf_prog *prog;
6656 struct bpf_map *map;
6657 int ret;
6658
6659 if (file->f_op == &bpf_map_fops) {
6660 map = file->private_data;
6661 bpfsec = map->security;
6662 ret = avc_has_perm(&selinux_state,
6663 sid, bpfsec->sid, SECCLASS_BPF,
6664 bpf_map_fmode_to_av(file->f_mode), NULL);
6665 if (ret)
6666 return ret;
6667 } else if (file->f_op == &bpf_prog_fops) {
6668 prog = file->private_data;
6669 bpfsec = prog->aux->security;
6670 ret = avc_has_perm(&selinux_state,
6671 sid, bpfsec->sid, SECCLASS_BPF,
6672 BPF__PROG_RUN, NULL);
6673 if (ret)
6674 return ret;
6675 }
6676 return 0;
6677 }
6678
6679 static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6680 {
6681 u32 sid = current_sid();
6682 struct bpf_security_struct *bpfsec;
6683
6684 bpfsec = map->security;
6685 return avc_has_perm(&selinux_state,
6686 sid, bpfsec->sid, SECCLASS_BPF,
6687 bpf_map_fmode_to_av(fmode), NULL);
6688 }
6689
6690 static int selinux_bpf_prog(struct bpf_prog *prog)
6691 {
6692 u32 sid = current_sid();
6693 struct bpf_security_struct *bpfsec;
6694
6695 bpfsec = prog->aux->security;
6696 return avc_has_perm(&selinux_state,
6697 sid, bpfsec->sid, SECCLASS_BPF,
6698 BPF__PROG_RUN, NULL);
6699 }
6700
6701 static int selinux_bpf_map_alloc(struct bpf_map *map)
6702 {
6703 struct bpf_security_struct *bpfsec;
6704
6705 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6706 if (!bpfsec)
6707 return -ENOMEM;
6708
6709 bpfsec->sid = current_sid();
6710 map->security = bpfsec;
6711
6712 return 0;
6713 }
6714
6715 static void selinux_bpf_map_free(struct bpf_map *map)
6716 {
6717 struct bpf_security_struct *bpfsec = map->security;
6718
6719 map->security = NULL;
6720 kfree(bpfsec);
6721 }
6722
6723 static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6724 {
6725 struct bpf_security_struct *bpfsec;
6726
6727 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6728 if (!bpfsec)
6729 return -ENOMEM;
6730
6731 bpfsec->sid = current_sid();
6732 aux->security = bpfsec;
6733
6734 return 0;
6735 }
6736
6737 static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
6738 {
6739 struct bpf_security_struct *bpfsec = aux->security;
6740
6741 aux->security = NULL;
6742 kfree(bpfsec);
6743 }
6744 #endif
6745
6746 struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = {
6747 .lbs_cred = sizeof(struct task_security_struct),
6748 .lbs_file = sizeof(struct file_security_struct),
6749 .lbs_inode = sizeof(struct inode_security_struct),
6750 .lbs_ipc = sizeof(struct ipc_security_struct),
6751 .lbs_msg_msg = sizeof(struct msg_security_struct),
6752 };
6753
6754 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
6755 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
6756 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
6757 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
6758 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
6759
6760 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
6761 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
6762 LSM_HOOK_INIT(capget, selinux_capget),
6763 LSM_HOOK_INIT(capset, selinux_capset),
6764 LSM_HOOK_INIT(capable, selinux_capable),
6765 LSM_HOOK_INIT(quotactl, selinux_quotactl),
6766 LSM_HOOK_INIT(quota_on, selinux_quota_on),
6767 LSM_HOOK_INIT(syslog, selinux_syslog),
6768 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
6769
6770 LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
6771
6772 LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
6773 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
6774 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
6775
6776 LSM_HOOK_INIT(fs_context_dup, selinux_fs_context_dup),
6777 LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param),
6778
6779 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
6780 LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
6781 LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts),
6782 LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts),
6783 LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
6784 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
6785 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
6786 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
6787 LSM_HOOK_INIT(sb_mount, selinux_mount),
6788 LSM_HOOK_INIT(sb_umount, selinux_umount),
6789 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
6790 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
6791 LSM_HOOK_INIT(sb_add_mnt_opt, selinux_add_mnt_opt),
6792
6793 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
6794 LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
6795
6796 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
6797 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
6798 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
6799 LSM_HOOK_INIT(inode_create, selinux_inode_create),
6800 LSM_HOOK_INIT(inode_link, selinux_inode_link),
6801 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
6802 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
6803 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
6804 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
6805 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
6806 LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
6807 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
6808 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
6809 LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
6810 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
6811 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
6812 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
6813 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
6814 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
6815 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
6816 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
6817 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
6818 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
6819 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
6820 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
6821 LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
6822 LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
6823
6824 LSM_HOOK_INIT(kernfs_init_security, selinux_kernfs_init_security),
6825
6826 LSM_HOOK_INIT(file_permission, selinux_file_permission),
6827 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
6828 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
6829 LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
6830 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
6831 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
6832 LSM_HOOK_INIT(file_lock, selinux_file_lock),
6833 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
6834 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
6835 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
6836 LSM_HOOK_INIT(file_receive, selinux_file_receive),
6837
6838 LSM_HOOK_INIT(file_open, selinux_file_open),
6839
6840 LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
6841 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
6842 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
6843 LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
6844 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
6845 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
6846 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
6847 LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
6848 LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
6849 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
6850 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
6851 LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
6852 LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
6853 LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
6854 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
6855 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
6856 LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
6857 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
6858 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
6859 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
6860 LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
6861 LSM_HOOK_INIT(task_kill, selinux_task_kill),
6862 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
6863
6864 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6865 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
6866
6867 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6868
6869 LSM_HOOK_INIT(msg_queue_alloc_security,
6870 selinux_msg_queue_alloc_security),
6871 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6872 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6873 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6874 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
6875
6876 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6877 LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6878 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6879 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6880
6881 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6882 LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6883 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6884 LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6885
6886 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
6887
6888 LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6889 LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
6890
6891 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6892 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6893 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6894 LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6895 LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
6896 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6897 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6898 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6899
6900 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6901 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6902
6903 LSM_HOOK_INIT(socket_create, selinux_socket_create),
6904 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6905 LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
6906 LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6907 LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6908 LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6909 LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6910 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6911 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6912 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6913 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6914 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6915 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6916 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6917 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6918 LSM_HOOK_INIT(socket_getpeersec_stream,
6919 selinux_socket_getpeersec_stream),
6920 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6921 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6922 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6923 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6924 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6925 LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6926 LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
6927 LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
6928 LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
6929 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6930 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6931 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6932 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6933 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6934 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6935 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6936 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6937 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6938 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6939 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6940 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6941 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6942 #ifdef CONFIG_SECURITY_INFINIBAND
6943 LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
6944 LSM_HOOK_INIT(ib_endport_manage_subnet,
6945 selinux_ib_endport_manage_subnet),
6946 LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
6947 LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
6948 #endif
6949 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6950 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6951 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6952 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6953 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6954 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6955 LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6956 selinux_xfrm_state_alloc_acquire),
6957 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6958 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6959 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6960 LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6961 selinux_xfrm_state_pol_flow_match),
6962 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6963 #endif
6964
6965 #ifdef CONFIG_KEYS
6966 LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6967 LSM_HOOK_INIT(key_free, selinux_key_free),
6968 LSM_HOOK_INIT(key_permission, selinux_key_permission),
6969 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6970 #endif
6971
6972 #ifdef CONFIG_AUDIT
6973 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6974 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6975 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6976 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6977 #endif
6978
6979 #ifdef CONFIG_BPF_SYSCALL
6980 LSM_HOOK_INIT(bpf, selinux_bpf),
6981 LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
6982 LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
6983 LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
6984 LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
6985 LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
6986 LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
6987 #endif
6988 };
6989
6990 static __init int selinux_init(void)
6991 {
6992 pr_info("SELinux: Initializing.\n");
6993
6994 memset(&selinux_state, 0, sizeof(selinux_state));
6995 enforcing_set(&selinux_state, selinux_enforcing_boot);
6996 selinux_state.checkreqprot = selinux_checkreqprot_boot;
6997 selinux_ss_init(&selinux_state.ss);
6998 selinux_avc_init(&selinux_state.avc);
6999
7000 /* Set the security state for the initial task. */
7001 cred_init_security();
7002
7003 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
7004
7005 avc_init();
7006
7007 avtab_cache_init();
7008
7009 ebitmap_cache_init();
7010
7011 hashtab_cache_init();
7012
7013 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
7014
7015 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
7016 panic("SELinux: Unable to register AVC netcache callback\n");
7017
7018 if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7019 panic("SELinux: Unable to register AVC LSM notifier callback\n");
7020
7021 if (selinux_enforcing_boot)
7022 pr_debug("SELinux: Starting in enforcing mode\n");
7023 else
7024 pr_debug("SELinux: Starting in permissive mode\n");
7025
7026 fs_validate_description(&selinux_fs_parameters);
7027
7028 return 0;
7029 }
7030
7031 static void delayed_superblock_init(struct super_block *sb, void *unused)
7032 {
7033 selinux_set_mnt_opts(sb, NULL, 0, NULL);
7034 }
7035
7036 void selinux_complete_init(void)
7037 {
7038 pr_debug("SELinux: Completing initialization.\n");
7039
7040 /* Set up any superblocks initialized prior to the policy load. */
7041 pr_debug("SELinux: Setting up existing superblocks.\n");
7042 iterate_supers(delayed_superblock_init, NULL);
7043 }
7044
7045 /* SELinux requires early initialization in order to label
7046 all processes and objects when they are created. */
7047 DEFINE_LSM(selinux) = {
7048 .name = "selinux",
7049 .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
7050 .enabled = &selinux_enabled,
7051 .blobs = &selinux_blob_sizes,
7052 .init = selinux_init,
7053 };
7054
7055 #if defined(CONFIG_NETFILTER)
7056
7057 static const struct nf_hook_ops selinux_nf_ops[] = {
7058 {
7059 .hook = selinux_ipv4_postroute,
7060 .pf = NFPROTO_IPV4,
7061 .hooknum = NF_INET_POST_ROUTING,
7062 .priority = NF_IP_PRI_SELINUX_LAST,
7063 },
7064 {
7065 .hook = selinux_ipv4_forward,
7066 .pf = NFPROTO_IPV4,
7067 .hooknum = NF_INET_FORWARD,
7068 .priority = NF_IP_PRI_SELINUX_FIRST,
7069 },
7070 {
7071 .hook = selinux_ipv4_output,
7072 .pf = NFPROTO_IPV4,
7073 .hooknum = NF_INET_LOCAL_OUT,
7074 .priority = NF_IP_PRI_SELINUX_FIRST,
7075 },
7076 #if IS_ENABLED(CONFIG_IPV6)
7077 {
7078 .hook = selinux_ipv6_postroute,
7079 .pf = NFPROTO_IPV6,
7080 .hooknum = NF_INET_POST_ROUTING,
7081 .priority = NF_IP6_PRI_SELINUX_LAST,
7082 },
7083 {
7084 .hook = selinux_ipv6_forward,
7085 .pf = NFPROTO_IPV6,
7086 .hooknum = NF_INET_FORWARD,
7087 .priority = NF_IP6_PRI_SELINUX_FIRST,
7088 },
7089 {
7090 .hook = selinux_ipv6_output,
7091 .pf = NFPROTO_IPV6,
7092 .hooknum = NF_INET_LOCAL_OUT,
7093 .priority = NF_IP6_PRI_SELINUX_FIRST,
7094 },
7095 #endif /* IPV6 */
7096 };
7097
7098 static int __net_init selinux_nf_register(struct net *net)
7099 {
7100 return nf_register_net_hooks(net, selinux_nf_ops,
7101 ARRAY_SIZE(selinux_nf_ops));
7102 }
7103
7104 static void __net_exit selinux_nf_unregister(struct net *net)
7105 {
7106 nf_unregister_net_hooks(net, selinux_nf_ops,
7107 ARRAY_SIZE(selinux_nf_ops));
7108 }
7109
7110 static struct pernet_operations selinux_net_ops = {
7111 .init = selinux_nf_register,
7112 .exit = selinux_nf_unregister,
7113 };
7114
7115 static int __init selinux_nf_ip_init(void)
7116 {
7117 int err;
7118
7119 if (!selinux_enabled)
7120 return 0;
7121
7122 pr_debug("SELinux: Registering netfilter hooks\n");
7123
7124 err = register_pernet_subsys(&selinux_net_ops);
7125 if (err)
7126 panic("SELinux: register_pernet_subsys: error %d\n", err);
7127
7128 return 0;
7129 }
7130 __initcall(selinux_nf_ip_init);
7131
7132 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7133 static void selinux_nf_ip_exit(void)
7134 {
7135 pr_debug("SELinux: Unregistering netfilter hooks\n");
7136
7137 unregister_pernet_subsys(&selinux_net_ops);
7138 }
7139 #endif
7140
7141 #else /* CONFIG_NETFILTER */
7142
7143 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7144 #define selinux_nf_ip_exit()
7145 #endif
7146
7147 #endif /* CONFIG_NETFILTER */
7148
7149 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7150 int selinux_disable(struct selinux_state *state)
7151 {
7152 if (state->initialized) {
7153 /* Not permitted after initial policy load. */
7154 return -EINVAL;
7155 }
7156
7157 if (state->disabled) {
7158 /* Only do this once. */
7159 return -EINVAL;
7160 }
7161
7162 state->disabled = 1;
7163
7164 pr_info("SELinux: Disabled at runtime.\n");
7165
7166 selinux_enabled = 0;
7167
7168 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
7169
7170 /* Try to destroy the avc node cache */
7171 avc_disable();
7172
7173 /* Unregister netfilter hooks. */
7174 selinux_nf_ip_exit();
7175
7176 /* Unregister selinuxfs. */
7177 exit_sel_fs();
7178
7179 return 0;
7180 }
7181 #endif
Mirror https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git