1 // SPDX-License-Identifier: GPL-2.0-only 2 /* Updated: Karl MacMillan <kmacmillan@tresys.com> 3 * 4 * Added conditional policy language extensions 5 * 6 * Updated: Hewlett-Packard <paul@paul-moore.com> 7 * 8 * Added support for the policy capability bitmap 9 * 10 * Copyright (C) 2007 Hewlett-Packard Development Company, L.P. 11 * Copyright (C) 2003 - 2004 Tresys Technology, LLC 12 * Copyright (C) 2004 Red Hat, Inc., James Morris <jmorris@redhat.com> 13 */ 14 15 #include <linux/kernel.h> 16 #include <linux/pagemap.h> 17 #include <linux/slab.h> 18 #include <linux/vmalloc.h> 19 #include <linux/fs.h> 20 #include <linux/fs_context.h> 21 #include <linux/hex.h> 22 #include <linux/mount.h> 23 #include <linux/mutex.h> 24 #include <linux/namei.h> 25 #include <linux/init.h> 26 #include <linux/string.h> 27 #include <linux/security.h> 28 #include <linux/major.h> 29 #include <linux/seq_file.h> 30 #include <linux/percpu.h> 31 #include <linux/audit.h> 32 #include <linux/uaccess.h> 33 #include <linux/kobject.h> 34 #include <linux/ctype.h> 35 36 /* selinuxfs pseudo filesystem for exporting the security policy API. 37 Based on the proc code and the fs/nfsd/nfsctl.c code. */ 38 39 #include "initcalls.h" 40 #include "flask.h" 41 #include "avc.h" 42 #include "avc_ss.h" 43 #include "security.h" 44 #include "objsec.h" 45 #include "conditional.h" 46 #include "ima.h" 47 48 enum sel_inos { 49 SEL_ROOT_INO = 2, 50 SEL_LOAD, /* load policy */ 51 SEL_ENFORCE, /* get or set enforcing status */ 52 SEL_CONTEXT, /* validate context */ 53 SEL_ACCESS, /* compute access decision */ 54 SEL_CREATE, /* compute create labeling decision */ 55 SEL_RELABEL, /* compute relabeling decision */ 56 SEL_USER, /* compute reachable user contexts */ 57 SEL_POLICYVERS, /* return policy version for this kernel */ 58 SEL_COMMIT_BOOLS, /* commit new boolean values */ 59 SEL_MLS, /* return if MLS policy is enabled */ 60 SEL_DISABLE, /* disable SELinux until next reboot */ 61 SEL_MEMBER, /* compute polyinstantiation membership decision */ 62 SEL_CHECKREQPROT, /* check requested protection, not kernel-applied one */ 63 SEL_COMPAT_NET, /* whether to use old compat network packet controls */ 64 SEL_REJECT_UNKNOWN, /* export unknown reject handling to userspace */ 65 SEL_DENY_UNKNOWN, /* export unknown deny handling to userspace */ 66 SEL_STATUS, /* export current status using mmap() */ 67 SEL_POLICY, /* allow userspace to read the in kernel policy */ 68 SEL_VALIDATE_TRANS, /* compute validatetrans decision */ 69 SEL_INO_NEXT, /* The next inode number to use */ 70 }; 71 72 struct selinux_fs_info { 73 struct dentry *bool_dir; 74 unsigned int bool_num; 75 char **bool_pending_names; 76 int *bool_pending_values; 77 struct dentry *class_dir; 78 u64 last_class_ino; 79 u64 last_ino; 80 struct super_block *sb; 81 }; 82 83 static int selinux_fs_info_create(struct super_block *sb) 84 { 85 struct selinux_fs_info *fsi; 86 87 fsi = kzalloc_obj(*fsi); 88 if (!fsi) 89 return -ENOMEM; 90 91 fsi->last_ino = SEL_INO_NEXT - 1; 92 fsi->sb = sb; 93 sb->s_fs_info = fsi; 94 return 0; 95 } 96 97 static void selinux_fs_info_free(struct selinux_fs_info *fsi) 98 { 99 unsigned int i; 100 101 if (fsi) { 102 for (i = 0; i < fsi->bool_num; i++) 103 kfree(fsi->bool_pending_names[i]); 104 kfree(fsi->bool_pending_names); 105 kfree(fsi->bool_pending_values); 106 } 107 kfree(fsi); 108 } 109 110 #define SEL_INITCON_INO_OFFSET 0x01000000 111 #define SEL_BOOL_INO_OFFSET 0x02000000 112 #define SEL_CLASS_INO_OFFSET 0x04000000 113 #define SEL_POLICYCAP_INO_OFFSET 0x08000000 114 #define SEL_INO_MASK 0x00ffffff 115 116 #define BOOL_DIR_NAME "booleans" 117 #define CLASS_DIR_NAME "class" 118 119 #define TMPBUFLEN 12 120 static ssize_t sel_read_enforce(struct file *filp, char __user *buf, 121 size_t count, loff_t *ppos) 122 { 123 char tmpbuf[TMPBUFLEN]; 124 ssize_t length; 125 126 length = scnprintf(tmpbuf, TMPBUFLEN, "%d", 127 enforcing_enabled()); 128 return simple_read_from_buffer(buf, count, ppos, tmpbuf, length); 129 } 130 131 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP 132 static ssize_t sel_write_enforce(struct file *file, const char __user *buf, 133 size_t count, loff_t *ppos) 134 135 { 136 char *page = NULL; 137 ssize_t length; 138 int scan_value; 139 bool old_value, new_value; 140 141 if (count >= PAGE_SIZE) 142 return -ENOMEM; 143 144 /* No partial writes. */ 145 if (*ppos != 0) 146 return -EINVAL; 147 148 page = memdup_user_nul(buf, count); 149 if (IS_ERR(page)) 150 return PTR_ERR(page); 151 152 length = -EINVAL; 153 if (sscanf(page, "%d", &scan_value) != 1) 154 goto out; 155 156 new_value = !!scan_value; 157 158 old_value = enforcing_enabled(); 159 if (new_value != old_value) { 160 length = avc_has_perm(current_sid(), SECINITSID_SECURITY, 161 SECCLASS_SECURITY, SECURITY__SETENFORCE, 162 NULL); 163 if (length) 164 goto out; 165 audit_log(audit_context(), GFP_KERNEL, AUDIT_MAC_STATUS, 166 "enforcing=%d old_enforcing=%d auid=%u ses=%u" 167 " enabled=1 old-enabled=1 lsm=selinux res=1", 168 new_value, old_value, 169 from_kuid(&init_user_ns, audit_get_loginuid(current)), 170 audit_get_sessionid(current)); 171 enforcing_set(new_value); 172 if (new_value) 173 avc_ss_reset(0); 174 selnl_notify_setenforce(new_value); 175 selinux_status_update_setenforce(new_value); 176 if (!new_value) 177 call_blocking_lsm_notifier(LSM_POLICY_CHANGE, NULL); 178 179 selinux_ima_measure_state(); 180 } 181 length = count; 182 out: 183 kfree(page); 184 return length; 185 } 186 #else 187 #define sel_write_enforce NULL 188 #endif 189 190 static const struct file_operations sel_enforce_ops = { 191 .read = sel_read_enforce, 192 .write = sel_write_enforce, 193 .llseek = generic_file_llseek, 194 }; 195 196 static ssize_t sel_read_handle_unknown(struct file *filp, char __user *buf, 197 size_t count, loff_t *ppos) 198 { 199 char tmpbuf[TMPBUFLEN]; 200 ssize_t length; 201 ino_t ino = file_inode(filp)->i_ino; 202 int handle_unknown = (ino == SEL_REJECT_UNKNOWN) ? 203 security_get_reject_unknown() : 204 !security_get_allow_unknown(); 205 206 length = scnprintf(tmpbuf, TMPBUFLEN, "%d", handle_unknown); 207 return simple_read_from_buffer(buf, count, ppos, tmpbuf, length); 208 } 209 210 static const struct file_operations sel_handle_unknown_ops = { 211 .read = sel_read_handle_unknown, 212 .llseek = generic_file_llseek, 213 }; 214 215 static int sel_open_handle_status(struct inode *inode, struct file *filp) 216 { 217 struct page *status = selinux_kernel_status_page(); 218 219 if (!status) 220 return -ENOMEM; 221 222 filp->private_data = status; 223 224 return 0; 225 } 226 227 static ssize_t sel_read_handle_status(struct file *filp, char __user *buf, 228 size_t count, loff_t *ppos) 229 { 230 struct page *status = filp->private_data; 231 232 BUG_ON(!status); 233 234 return simple_read_from_buffer(buf, count, ppos, 235 page_address(status), 236 sizeof(struct selinux_kernel_status)); 237 } 238 239 static int sel_mmap_handle_status(struct file *filp, 240 struct vm_area_struct *vma) 241 { 242 struct page *status = filp->private_data; 243 unsigned long size = vma->vm_end - vma->vm_start; 244 245 BUG_ON(!status); 246 247 /* only allows one page from the head */ 248 if (vma->vm_pgoff > 0 || size != PAGE_SIZE) 249 return -EIO; 250 251 return remap_pfn_range(vma, vma->vm_start, 252 page_to_pfn(status), 253 size, vma->vm_page_prot); 254 } 255 256 static const struct file_operations sel_handle_status_ops = { 257 .open = sel_open_handle_status, 258 .read = sel_read_handle_status, 259 .mmap = sel_mmap_handle_status, 260 .llseek = generic_file_llseek, 261 }; 262 263 static ssize_t sel_write_disable(struct file *file, const char __user *buf, 264 size_t count, loff_t *ppos) 265 266 { 267 /* 268 * Setting disable is no longer supported, see 269 * https://github.com/SELinuxProject/selinux-kernel/wiki/DEPRECATE-runtime-disable 270 */ 271 pr_err_once("SELinux: %s (%d) wrote to disable. This is no longer supported.\n", 272 current->comm, current->pid); 273 return count; 274 } 275 276 static const struct file_operations sel_disable_ops = { 277 .write = sel_write_disable, 278 .llseek = generic_file_llseek, 279 }; 280 281 static ssize_t sel_read_policyvers(struct file *filp, char __user *buf, 282 size_t count, loff_t *ppos) 283 { 284 char tmpbuf[TMPBUFLEN]; 285 ssize_t length; 286 287 length = scnprintf(tmpbuf, TMPBUFLEN, "%u", POLICYDB_VERSION_MAX); 288 return simple_read_from_buffer(buf, count, ppos, tmpbuf, length); 289 } 290 291 static const struct file_operations sel_policyvers_ops = { 292 .read = sel_read_policyvers, 293 .llseek = generic_file_llseek, 294 }; 295 296 /* declaration for sel_write_load */ 297 static int sel_make_bools(struct selinux_policy *newpolicy, struct dentry *bool_dir, 298 unsigned int *bool_num, char ***bool_pending_names, 299 int **bool_pending_values); 300 static int sel_make_classes(struct selinux_policy *newpolicy, 301 struct dentry *class_dir, 302 u64 *last_class_ino); 303 304 /* declaration for sel_make_class_dirs */ 305 static struct dentry *sel_make_dir(struct dentry *dir, const char *name, 306 u64 *ino); 307 308 /* declaration for sel_make_policy_nodes */ 309 static struct dentry *sel_make_swapover_dir(struct super_block *sb, u64 *ino); 310 311 static ssize_t sel_read_mls(struct file *filp, char __user *buf, 312 size_t count, loff_t *ppos) 313 { 314 char tmpbuf[TMPBUFLEN]; 315 ssize_t length; 316 317 length = scnprintf(tmpbuf, TMPBUFLEN, "%d", 318 security_mls_enabled()); 319 return simple_read_from_buffer(buf, count, ppos, tmpbuf, length); 320 } 321 322 static const struct file_operations sel_mls_ops = { 323 .read = sel_read_mls, 324 .llseek = generic_file_llseek, 325 }; 326 327 struct policy_load_memory { 328 size_t len; 329 void *data; 330 }; 331 332 static int sel_open_policy(struct inode *inode, struct file *filp) 333 { 334 struct policy_load_memory *plm = NULL; 335 int rc; 336 337 rc = avc_has_perm(current_sid(), SECINITSID_SECURITY, 338 SECCLASS_SECURITY, SECURITY__READ_POLICY, NULL); 339 if (rc) 340 return rc; 341 342 plm = kzalloc_obj(*plm); 343 if (!plm) 344 return -ENOMEM; 345 346 mutex_lock(&selinux_state.policy_mutex); 347 rc = security_read_policy(&plm->data, &plm->len); 348 if (rc) 349 goto err; 350 if ((size_t)i_size_read(inode) != plm->len) { 351 inode_lock(inode); 352 i_size_write(inode, plm->len); 353 inode_unlock(inode); 354 } 355 mutex_unlock(&selinux_state.policy_mutex); 356 357 filp->private_data = plm; 358 359 return 0; 360 err: 361 mutex_unlock(&selinux_state.policy_mutex); 362 363 if (plm) 364 vfree(plm->data); 365 kfree(plm); 366 return rc; 367 } 368 369 static int sel_release_policy(struct inode *inode, struct file *filp) 370 { 371 struct policy_load_memory *plm = filp->private_data; 372 373 vfree(plm->data); 374 kfree(plm); 375 376 return 0; 377 } 378 379 static ssize_t sel_read_policy(struct file *filp, char __user *buf, 380 size_t count, loff_t *ppos) 381 { 382 struct policy_load_memory *plm = filp->private_data; 383 int ret; 384 385 ret = avc_has_perm(current_sid(), SECINITSID_SECURITY, 386 SECCLASS_SECURITY, SECURITY__READ_POLICY, NULL); 387 if (ret) 388 return ret; 389 390 return simple_read_from_buffer(buf, count, ppos, plm->data, plm->len); 391 } 392 393 static vm_fault_t sel_mmap_policy_fault(struct vm_fault *vmf) 394 { 395 struct policy_load_memory *plm = vmf->vma->vm_file->private_data; 396 unsigned long offset; 397 struct page *page; 398 399 if (vmf->flags & (FAULT_FLAG_MKWRITE | FAULT_FLAG_WRITE)) 400 return VM_FAULT_SIGBUS; 401 402 offset = vmf->pgoff << PAGE_SHIFT; 403 if (offset >= roundup(plm->len, PAGE_SIZE)) 404 return VM_FAULT_SIGBUS; 405 406 page = vmalloc_to_page(plm->data + offset); 407 get_page(page); 408 409 vmf->page = page; 410 411 return 0; 412 } 413 414 static const struct vm_operations_struct sel_mmap_policy_ops = { 415 .fault = sel_mmap_policy_fault, 416 .page_mkwrite = sel_mmap_policy_fault, 417 }; 418 419 static int sel_mmap_policy(struct file *filp, struct vm_area_struct *vma) 420 { 421 if (vma->vm_flags & VM_SHARED) { 422 /* do not allow mprotect to make mapping writable */ 423 vm_flags_clear(vma, VM_MAYWRITE); 424 425 if (vma->vm_flags & VM_WRITE) 426 return -EACCES; 427 } 428 429 vm_flags_set(vma, VM_DONTEXPAND | VM_DONTDUMP); 430 vma->vm_ops = &sel_mmap_policy_ops; 431 432 return 0; 433 } 434 435 static const struct file_operations sel_policy_ops = { 436 .open = sel_open_policy, 437 .read = sel_read_policy, 438 .mmap = sel_mmap_policy, 439 .release = sel_release_policy, 440 .llseek = generic_file_llseek, 441 }; 442 443 static void sel_remove_old_bool_data(unsigned int bool_num, char **bool_names, 444 int *bool_values) 445 { 446 u32 i; 447 448 /* bool_dir cleanup */ 449 for (i = 0; i < bool_num; i++) 450 kfree(bool_names[i]); 451 kfree(bool_names); 452 kfree(bool_values); 453 } 454 455 static int sel_make_policy_nodes(struct selinux_fs_info *fsi, 456 struct selinux_policy *newpolicy) 457 { 458 int ret = 0; 459 struct dentry *tmp_parent, *tmp_bool_dir, *tmp_class_dir; 460 struct renamedata rd = {}; 461 unsigned int bool_num = 0; 462 char **bool_names = NULL; 463 int *bool_values = NULL; 464 u64 tmp_ino = fsi->last_ino; /* Don't increment last_ino in this function */ 465 466 tmp_parent = sel_make_swapover_dir(fsi->sb, &tmp_ino); 467 if (IS_ERR(tmp_parent)) 468 return PTR_ERR(tmp_parent); 469 470 tmp_ino = fsi->bool_dir->d_inode->i_ino - 1; /* sel_make_dir will increment and set */ 471 tmp_bool_dir = sel_make_dir(tmp_parent, BOOL_DIR_NAME, &tmp_ino); 472 if (IS_ERR(tmp_bool_dir)) { 473 ret = PTR_ERR(tmp_bool_dir); 474 goto out; 475 } 476 477 tmp_ino = fsi->class_dir->d_inode->i_ino - 1; /* sel_make_dir will increment and set */ 478 tmp_class_dir = sel_make_dir(tmp_parent, CLASS_DIR_NAME, &tmp_ino); 479 if (IS_ERR(tmp_class_dir)) { 480 ret = PTR_ERR(tmp_class_dir); 481 goto out; 482 } 483 484 ret = sel_make_bools(newpolicy, tmp_bool_dir, &bool_num, 485 &bool_names, &bool_values); 486 if (ret) 487 goto out; 488 489 ret = sel_make_classes(newpolicy, tmp_class_dir, 490 &fsi->last_class_ino); 491 if (ret) 492 goto out; 493 494 rd.old_parent = tmp_parent; 495 rd.new_parent = fsi->sb->s_root; 496 497 /* booleans */ 498 ret = start_renaming_two_dentries(&rd, tmp_bool_dir, fsi->bool_dir); 499 if (ret) 500 goto out; 501 502 d_exchange(tmp_bool_dir, fsi->bool_dir); 503 504 swap(fsi->bool_num, bool_num); 505 swap(fsi->bool_pending_names, bool_names); 506 swap(fsi->bool_pending_values, bool_values); 507 508 fsi->bool_dir = tmp_bool_dir; 509 end_renaming(&rd); 510 511 /* classes */ 512 ret = start_renaming_two_dentries(&rd, tmp_class_dir, fsi->class_dir); 513 if (ret) 514 goto out; 515 516 d_exchange(tmp_class_dir, fsi->class_dir); 517 fsi->class_dir = tmp_class_dir; 518 519 end_renaming(&rd); 520 521 out: 522 sel_remove_old_bool_data(bool_num, bool_names, bool_values); 523 /* Since the other temporary dirs are children of tmp_parent 524 * this will handle all the cleanup in the case of a failure before 525 * the swapover 526 */ 527 simple_recursive_removal(tmp_parent, NULL); 528 529 return ret; 530 } 531 532 static ssize_t sel_write_load(struct file *file, const char __user *buf, 533 size_t count, loff_t *ppos) 534 535 { 536 struct selinux_fs_info *fsi; 537 struct selinux_load_state load_state; 538 ssize_t length; 539 void *data = NULL; 540 541 /* no partial writes */ 542 if (*ppos) 543 return -EINVAL; 544 /* no empty policies */ 545 if (!count) 546 return -EINVAL; 547 548 length = avc_has_perm(current_sid(), SECINITSID_SECURITY, 549 SECCLASS_SECURITY, SECURITY__LOAD_POLICY, NULL); 550 if (length) 551 return length; 552 553 data = vmalloc(count); 554 if (!data) 555 return -ENOMEM; 556 if (copy_from_user(data, buf, count) != 0) { 557 length = -EFAULT; 558 goto out; 559 } 560 561 mutex_lock(&selinux_state.policy_mutex); 562 length = security_load_policy(data, count, &load_state); 563 if (length) { 564 pr_warn_ratelimited("SELinux: failed to load policy\n"); 565 goto out_unlock; 566 } 567 fsi = file_inode(file)->i_sb->s_fs_info; 568 length = sel_make_policy_nodes(fsi, load_state.policy); 569 if (length) { 570 pr_warn_ratelimited("SELinux: failed to initialize selinuxfs\n"); 571 selinux_policy_cancel(&load_state); 572 goto out_unlock; 573 } 574 575 selinux_policy_commit(&load_state); 576 length = count; 577 audit_log(audit_context(), GFP_KERNEL, AUDIT_MAC_POLICY_LOAD, 578 "auid=%u ses=%u lsm=selinux res=1", 579 from_kuid(&init_user_ns, audit_get_loginuid(current)), 580 audit_get_sessionid(current)); 581 582 out_unlock: 583 mutex_unlock(&selinux_state.policy_mutex); 584 out: 585 vfree(data); 586 return length; 587 } 588 589 static const struct file_operations sel_load_ops = { 590 .write = sel_write_load, 591 .llseek = generic_file_llseek, 592 }; 593 594 static ssize_t sel_write_context(struct file *file, char *buf, size_t size) 595 { 596 char *canon = NULL; 597 u32 sid, len; 598 ssize_t length; 599 600 length = avc_has_perm(current_sid(), SECINITSID_SECURITY, 601 SECCLASS_SECURITY, SECURITY__CHECK_CONTEXT, NULL); 602 if (length) 603 goto out; 604 605 length = security_context_to_sid(buf, size, &sid, GFP_KERNEL); 606 if (length) 607 goto out; 608 609 length = security_sid_to_context(sid, &canon, &len); 610 if (length) 611 goto out; 612 613 length = -ERANGE; 614 if (len > SIMPLE_TRANSACTION_LIMIT) { 615 pr_err("SELinux: %s: context size (%u) exceeds " 616 "payload max\n", __func__, len); 617 goto out; 618 } 619 620 memcpy(buf, canon, len); 621 length = len; 622 out: 623 kfree(canon); 624 return length; 625 } 626 627 static ssize_t sel_read_checkreqprot(struct file *filp, char __user *buf, 628 size_t count, loff_t *ppos) 629 { 630 char tmpbuf[TMPBUFLEN]; 631 ssize_t length; 632 633 length = scnprintf(tmpbuf, TMPBUFLEN, "%u", 634 checkreqprot_get()); 635 return simple_read_from_buffer(buf, count, ppos, tmpbuf, length); 636 } 637 638 static ssize_t sel_write_checkreqprot(struct file *file, const char __user *buf, 639 size_t count, loff_t *ppos) 640 { 641 /* 642 * Setting checkreqprot is no longer supported, see 643 * https://github.com/SELinuxProject/selinux-kernel/wiki/DEPRECATE-checkreqprot 644 */ 645 pr_err_once("SELinux: %s (%d) wrote to checkreqprot. This is no longer supported.\n", 646 current->comm, current->pid); 647 return count; 648 } 649 static const struct file_operations sel_checkreqprot_ops = { 650 .read = sel_read_checkreqprot, 651 .write = sel_write_checkreqprot, 652 .llseek = generic_file_llseek, 653 }; 654 655 static ssize_t sel_write_validatetrans(struct file *file, 656 const char __user *buf, 657 size_t count, loff_t *ppos) 658 { 659 char *oldcon = NULL, *newcon = NULL, *taskcon = NULL; 660 char *req = NULL; 661 u32 osid, nsid, tsid; 662 u16 tclass; 663 int rc; 664 665 rc = avc_has_perm(current_sid(), SECINITSID_SECURITY, 666 SECCLASS_SECURITY, SECURITY__VALIDATE_TRANS, NULL); 667 if (rc) 668 goto out; 669 670 rc = -ENOMEM; 671 if (count >= PAGE_SIZE) 672 goto out; 673 674 /* No partial writes. */ 675 rc = -EINVAL; 676 if (*ppos != 0) 677 goto out; 678 679 req = memdup_user_nul(buf, count); 680 if (IS_ERR(req)) { 681 rc = PTR_ERR(req); 682 req = NULL; 683 goto out; 684 } 685 686 rc = -ENOMEM; 687 oldcon = kzalloc(count + 1, GFP_KERNEL); 688 if (!oldcon) 689 goto out; 690 691 newcon = kzalloc(count + 1, GFP_KERNEL); 692 if (!newcon) 693 goto out; 694 695 taskcon = kzalloc(count + 1, GFP_KERNEL); 696 if (!taskcon) 697 goto out; 698 699 rc = -EINVAL; 700 if (sscanf(req, "%s %s %hu %s", oldcon, newcon, &tclass, taskcon) != 4) 701 goto out; 702 703 rc = security_context_str_to_sid(oldcon, &osid, GFP_KERNEL); 704 if (rc) 705 goto out; 706 707 rc = security_context_str_to_sid(newcon, &nsid, GFP_KERNEL); 708 if (rc) 709 goto out; 710 711 rc = security_context_str_to_sid(taskcon, &tsid, GFP_KERNEL); 712 if (rc) 713 goto out; 714 715 rc = security_validate_transition_user(osid, nsid, tsid, tclass); 716 if (!rc) 717 rc = count; 718 out: 719 kfree(req); 720 kfree(oldcon); 721 kfree(newcon); 722 kfree(taskcon); 723 return rc; 724 } 725 726 static const struct file_operations sel_transition_ops = { 727 .write = sel_write_validatetrans, 728 .llseek = generic_file_llseek, 729 }; 730 731 /* 732 * Remaining nodes use transaction based IO methods like nfsd/nfsctl.c 733 */ 734 static ssize_t sel_write_access(struct file *file, char *buf, size_t size); 735 static ssize_t sel_write_create(struct file *file, char *buf, size_t size); 736 static ssize_t sel_write_relabel(struct file *file, char *buf, size_t size); 737 static ssize_t sel_write_user(struct file *file, char *buf, size_t size); 738 static ssize_t sel_write_member(struct file *file, char *buf, size_t size); 739 740 static ssize_t (*const write_op[])(struct file *, char *, size_t) = { 741 [SEL_ACCESS] = sel_write_access, 742 [SEL_CREATE] = sel_write_create, 743 [SEL_RELABEL] = sel_write_relabel, 744 [SEL_USER] = sel_write_user, 745 [SEL_MEMBER] = sel_write_member, 746 [SEL_CONTEXT] = sel_write_context, 747 }; 748 749 static ssize_t selinux_transaction_write(struct file *file, const char __user *buf, size_t size, loff_t *pos) 750 { 751 ino_t ino = file_inode(file)->i_ino; 752 char *data; 753 ssize_t rv; 754 755 if (ino >= ARRAY_SIZE(write_op) || !write_op[ino]) 756 return -EINVAL; 757 758 data = simple_transaction_get(file, buf, size); 759 if (IS_ERR(data)) 760 return PTR_ERR(data); 761 762 rv = write_op[ino](file, data, size); 763 if (rv > 0) { 764 simple_transaction_set(file, rv); 765 rv = size; 766 } 767 return rv; 768 } 769 770 static const struct file_operations transaction_ops = { 771 .write = selinux_transaction_write, 772 .read = simple_transaction_read, 773 .release = simple_transaction_release, 774 .llseek = generic_file_llseek, 775 }; 776 777 /* 778 * payload - write methods 779 * If the method has a response, the response should be put in buf, 780 * and the length returned. Otherwise return 0 or -error. 781 */ 782 783 static ssize_t sel_write_access(struct file *file, char *buf, size_t size) 784 { 785 char *scon = NULL, *tcon = NULL; 786 u32 ssid, tsid; 787 u16 tclass; 788 struct av_decision avd; 789 ssize_t length; 790 791 length = avc_has_perm(current_sid(), SECINITSID_SECURITY, 792 SECCLASS_SECURITY, SECURITY__COMPUTE_AV, NULL); 793 if (length) 794 goto out; 795 796 length = -ENOMEM; 797 scon = kzalloc(size + 1, GFP_KERNEL); 798 if (!scon) 799 goto out; 800 801 length = -ENOMEM; 802 tcon = kzalloc(size + 1, GFP_KERNEL); 803 if (!tcon) 804 goto out; 805 806 length = -EINVAL; 807 if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3) 808 goto out; 809 810 length = security_context_str_to_sid(scon, &ssid, GFP_KERNEL); 811 if (length) 812 goto out; 813 814 length = security_context_str_to_sid(tcon, &tsid, GFP_KERNEL); 815 if (length) 816 goto out; 817 818 security_compute_av_user(ssid, tsid, tclass, &avd); 819 820 length = scnprintf(buf, SIMPLE_TRANSACTION_LIMIT, 821 "%x %x %x %x %u %x", 822 avd.allowed, 0xffffffff, 823 avd.auditallow, avd.auditdeny, 824 avd.seqno, avd.flags); 825 out: 826 kfree(tcon); 827 kfree(scon); 828 return length; 829 } 830 831 static ssize_t sel_write_create(struct file *file, char *buf, size_t size) 832 { 833 char *scon = NULL, *tcon = NULL; 834 char *namebuf = NULL, *objname = NULL; 835 u32 ssid, tsid, newsid; 836 u16 tclass; 837 ssize_t length; 838 char *newcon = NULL; 839 u32 len; 840 int nargs; 841 842 length = avc_has_perm(current_sid(), SECINITSID_SECURITY, 843 SECCLASS_SECURITY, SECURITY__COMPUTE_CREATE, 844 NULL); 845 if (length) 846 goto out; 847 848 length = -ENOMEM; 849 scon = kzalloc(size + 1, GFP_KERNEL); 850 if (!scon) 851 goto out; 852 853 length = -ENOMEM; 854 tcon = kzalloc(size + 1, GFP_KERNEL); 855 if (!tcon) 856 goto out; 857 858 length = -ENOMEM; 859 namebuf = kzalloc(size + 1, GFP_KERNEL); 860 if (!namebuf) 861 goto out; 862 863 length = -EINVAL; 864 nargs = sscanf(buf, "%s %s %hu %s", scon, tcon, &tclass, namebuf); 865 if (nargs < 3 || nargs > 4) 866 goto out; 867 if (nargs == 4) { 868 /* 869 * If and when the name of new object to be queried contains 870 * either whitespace or multibyte characters, they shall be 871 * encoded based on the percentage-encoding rule. 872 * If not encoded, the sscanf logic picks up only left-half 873 * of the supplied name; split by a whitespace unexpectedly. 874 */ 875 char *r, *w; 876 int c1, c2; 877 878 r = w = namebuf; 879 do { 880 c1 = *r++; 881 if (c1 == '+') 882 c1 = ' '; 883 else if (c1 == '%') { 884 c1 = hex_to_bin(*r++); 885 if (c1 < 0) 886 goto out; 887 c2 = hex_to_bin(*r++); 888 if (c2 < 0) 889 goto out; 890 c1 = (c1 << 4) | c2; 891 } 892 *w++ = c1; 893 } while (c1 != '\0'); 894 895 objname = namebuf; 896 } 897 898 length = security_context_str_to_sid(scon, &ssid, GFP_KERNEL); 899 if (length) 900 goto out; 901 902 length = security_context_str_to_sid(tcon, &tsid, GFP_KERNEL); 903 if (length) 904 goto out; 905 906 length = security_transition_sid_user(ssid, tsid, tclass, 907 objname, &newsid); 908 if (length) 909 goto out; 910 911 length = security_sid_to_context(newsid, &newcon, &len); 912 if (length) 913 goto out; 914 915 length = -ERANGE; 916 if (len > SIMPLE_TRANSACTION_LIMIT) { 917 pr_err("SELinux: %s: context size (%u) exceeds " 918 "payload max\n", __func__, len); 919 goto out; 920 } 921 922 memcpy(buf, newcon, len); 923 length = len; 924 out: 925 kfree(newcon); 926 kfree(namebuf); 927 kfree(tcon); 928 kfree(scon); 929 return length; 930 } 931 932 static ssize_t sel_write_relabel(struct file *file, char *buf, size_t size) 933 { 934 char *scon = NULL, *tcon = NULL; 935 u32 ssid, tsid, newsid; 936 u16 tclass; 937 ssize_t length; 938 char *newcon = NULL; 939 u32 len; 940 941 length = avc_has_perm(current_sid(), SECINITSID_SECURITY, 942 SECCLASS_SECURITY, SECURITY__COMPUTE_RELABEL, 943 NULL); 944 if (length) 945 goto out; 946 947 length = -ENOMEM; 948 scon = kzalloc(size + 1, GFP_KERNEL); 949 if (!scon) 950 goto out; 951 952 length = -ENOMEM; 953 tcon = kzalloc(size + 1, GFP_KERNEL); 954 if (!tcon) 955 goto out; 956 957 length = -EINVAL; 958 if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3) 959 goto out; 960 961 length = security_context_str_to_sid(scon, &ssid, GFP_KERNEL); 962 if (length) 963 goto out; 964 965 length = security_context_str_to_sid(tcon, &tsid, GFP_KERNEL); 966 if (length) 967 goto out; 968 969 length = security_change_sid(ssid, tsid, tclass, &newsid); 970 if (length) 971 goto out; 972 973 length = security_sid_to_context(newsid, &newcon, &len); 974 if (length) 975 goto out; 976 977 length = -ERANGE; 978 if (len > SIMPLE_TRANSACTION_LIMIT) 979 goto out; 980 981 memcpy(buf, newcon, len); 982 length = len; 983 out: 984 kfree(newcon); 985 kfree(tcon); 986 kfree(scon); 987 return length; 988 } 989 990 static ssize_t sel_write_user(struct file *file, char *buf, size_t size) 991 { 992 pr_err_once("SELinux: %s (%d) wrote to user. This is no longer supported.\n", 993 current->comm, current->pid); 994 buf[0] = '0'; 995 buf[1] = 0; 996 return 2; 997 } 998 999 static ssize_t sel_write_member(struct file *file, char *buf, size_t size) 1000 { 1001 char *scon = NULL, *tcon = NULL; 1002 u32 ssid, tsid, newsid; 1003 u16 tclass; 1004 ssize_t length; 1005 char *newcon = NULL; 1006 u32 len; 1007 1008 length = avc_has_perm(current_sid(), SECINITSID_SECURITY, 1009 SECCLASS_SECURITY, SECURITY__COMPUTE_MEMBER, 1010 NULL); 1011 if (length) 1012 goto out; 1013 1014 length = -ENOMEM; 1015 scon = kzalloc(size + 1, GFP_KERNEL); 1016 if (!scon) 1017 goto out; 1018 1019 length = -ENOMEM; 1020 tcon = kzalloc(size + 1, GFP_KERNEL); 1021 if (!tcon) 1022 goto out; 1023 1024 length = -EINVAL; 1025 if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3) 1026 goto out; 1027 1028 length = security_context_str_to_sid(scon, &ssid, GFP_KERNEL); 1029 if (length) 1030 goto out; 1031 1032 length = security_context_str_to_sid(tcon, &tsid, GFP_KERNEL); 1033 if (length) 1034 goto out; 1035 1036 length = security_member_sid(ssid, tsid, tclass, &newsid); 1037 if (length) 1038 goto out; 1039 1040 length = security_sid_to_context(newsid, &newcon, &len); 1041 if (length) 1042 goto out; 1043 1044 length = -ERANGE; 1045 if (len > SIMPLE_TRANSACTION_LIMIT) { 1046 pr_err("SELinux: %s: context size (%u) exceeds " 1047 "payload max\n", __func__, len); 1048 goto out; 1049 } 1050 1051 memcpy(buf, newcon, len); 1052 length = len; 1053 out: 1054 kfree(newcon); 1055 kfree(tcon); 1056 kfree(scon); 1057 return length; 1058 } 1059 1060 static struct inode *sel_make_inode(struct super_block *sb, umode_t mode) 1061 { 1062 struct inode *ret = new_inode(sb); 1063 1064 if (ret) { 1065 ret->i_mode = mode; 1066 simple_inode_init_ts(ret); 1067 } 1068 return ret; 1069 } 1070 1071 static struct dentry *sel_attach(struct dentry *parent, const char *name, 1072 struct inode *inode) 1073 { 1074 struct dentry *dentry = d_alloc_name(parent, name); 1075 if (unlikely(!dentry)) { 1076 iput(inode); 1077 return ERR_PTR(-ENOMEM); 1078 } 1079 d_make_persistent(dentry, inode); 1080 dput(dentry); 1081 return dentry; 1082 } 1083 1084 static int sel_attach_file(struct dentry *parent, const char *name, 1085 struct inode *inode) 1086 { 1087 struct dentry *dentry = sel_attach(parent, name, inode); 1088 return PTR_ERR_OR_ZERO(dentry); 1089 } 1090 1091 static ssize_t sel_read_bool(struct file *filep, char __user *buf, 1092 size_t count, loff_t *ppos) 1093 { 1094 struct selinux_fs_info *fsi = file_inode(filep)->i_sb->s_fs_info; 1095 char buffer[4]; 1096 ssize_t length; 1097 ssize_t ret; 1098 int cur_enforcing; 1099 unsigned index = file_inode(filep)->i_ino & SEL_INO_MASK; 1100 const char *name = filep->f_path.dentry->d_name.name; 1101 1102 mutex_lock(&selinux_state.policy_mutex); 1103 1104 ret = -EINVAL; 1105 if (index >= fsi->bool_num || strcmp(name, 1106 fsi->bool_pending_names[index])) 1107 goto out_unlock; 1108 1109 cur_enforcing = security_get_bool_value(index); 1110 if (cur_enforcing < 0) { 1111 ret = cur_enforcing; 1112 goto out_unlock; 1113 } 1114 length = scnprintf(buffer, sizeof(buffer), "%d %d", !!cur_enforcing, 1115 !!fsi->bool_pending_values[index]); 1116 mutex_unlock(&selinux_state.policy_mutex); 1117 return simple_read_from_buffer(buf, count, ppos, buffer, length); 1118 1119 out_unlock: 1120 mutex_unlock(&selinux_state.policy_mutex); 1121 return ret; 1122 } 1123 1124 static ssize_t sel_write_bool(struct file *filep, const char __user *buf, 1125 size_t count, loff_t *ppos) 1126 { 1127 struct selinux_fs_info *fsi = file_inode(filep)->i_sb->s_fs_info; 1128 char *page = NULL; 1129 ssize_t length; 1130 int new_value; 1131 unsigned index = file_inode(filep)->i_ino & SEL_INO_MASK; 1132 const char *name = filep->f_path.dentry->d_name.name; 1133 1134 if (count >= PAGE_SIZE) 1135 return -ENOMEM; 1136 1137 /* No partial writes. */ 1138 if (*ppos != 0) 1139 return -EINVAL; 1140 1141 page = memdup_user_nul(buf, count); 1142 if (IS_ERR(page)) 1143 return PTR_ERR(page); 1144 1145 mutex_lock(&selinux_state.policy_mutex); 1146 1147 length = avc_has_perm(current_sid(), SECINITSID_SECURITY, 1148 SECCLASS_SECURITY, SECURITY__SETBOOL, 1149 NULL); 1150 if (length) 1151 goto out; 1152 1153 length = -EINVAL; 1154 if (index >= fsi->bool_num || strcmp(name, 1155 fsi->bool_pending_names[index])) 1156 goto out; 1157 1158 length = -EINVAL; 1159 if (sscanf(page, "%d", &new_value) != 1) 1160 goto out; 1161 1162 if (new_value) 1163 new_value = 1; 1164 1165 fsi->bool_pending_values[index] = new_value; 1166 length = count; 1167 1168 out: 1169 mutex_unlock(&selinux_state.policy_mutex); 1170 kfree(page); 1171 return length; 1172 } 1173 1174 static const struct file_operations sel_bool_ops = { 1175 .read = sel_read_bool, 1176 .write = sel_write_bool, 1177 .llseek = generic_file_llseek, 1178 }; 1179 1180 static ssize_t sel_commit_bools_write(struct file *filep, 1181 const char __user *buf, 1182 size_t count, loff_t *ppos) 1183 { 1184 struct selinux_fs_info *fsi = file_inode(filep)->i_sb->s_fs_info; 1185 char *page = NULL; 1186 ssize_t length; 1187 int new_value; 1188 1189 if (count >= PAGE_SIZE) 1190 return -ENOMEM; 1191 1192 /* No partial writes. */ 1193 if (*ppos != 0) 1194 return -EINVAL; 1195 1196 page = memdup_user_nul(buf, count); 1197 if (IS_ERR(page)) 1198 return PTR_ERR(page); 1199 1200 mutex_lock(&selinux_state.policy_mutex); 1201 1202 length = avc_has_perm(current_sid(), SECINITSID_SECURITY, 1203 SECCLASS_SECURITY, SECURITY__SETBOOL, 1204 NULL); 1205 if (length) 1206 goto out; 1207 1208 length = -EINVAL; 1209 if (sscanf(page, "%d", &new_value) != 1) 1210 goto out; 1211 1212 length = 0; 1213 if (new_value && fsi->bool_pending_values) 1214 length = security_set_bools(fsi->bool_num, 1215 fsi->bool_pending_values); 1216 1217 if (!length) 1218 length = count; 1219 1220 out: 1221 mutex_unlock(&selinux_state.policy_mutex); 1222 kfree(page); 1223 return length; 1224 } 1225 1226 static const struct file_operations sel_commit_bools_ops = { 1227 .write = sel_commit_bools_write, 1228 .llseek = generic_file_llseek, 1229 }; 1230 1231 static int sel_make_bools(struct selinux_policy *newpolicy, struct dentry *bool_dir, 1232 unsigned int *bool_num, char ***bool_pending_names, 1233 int **bool_pending_values) 1234 { 1235 int ret; 1236 char **names, *page; 1237 u32 i, num; 1238 1239 page = kzalloc(PAGE_SIZE, GFP_KERNEL); 1240 if (!page) 1241 return -ENOMEM; 1242 1243 ret = security_get_bools(newpolicy, &num, &names, bool_pending_values); 1244 if (ret) 1245 goto out; 1246 1247 *bool_num = num; 1248 *bool_pending_names = names; 1249 1250 for (i = 0; !ret && i < num; i++) { 1251 struct inode *inode; 1252 struct inode_security_struct *isec; 1253 ssize_t len; 1254 u32 sid; 1255 1256 len = snprintf(page, PAGE_SIZE, "/%s/%s", BOOL_DIR_NAME, names[i]); 1257 if (len >= PAGE_SIZE) { 1258 ret = -ENAMETOOLONG; 1259 break; 1260 } 1261 1262 inode = sel_make_inode(bool_dir->d_sb, S_IFREG | S_IRUGO | S_IWUSR); 1263 if (!inode) { 1264 ret = -ENOMEM; 1265 break; 1266 } 1267 1268 isec = selinux_inode(inode); 1269 ret = selinux_policy_genfs_sid(newpolicy, "selinuxfs", page, 1270 SECCLASS_FILE, &sid); 1271 if (ret) { 1272 pr_warn_ratelimited("SELinux: no sid found, defaulting to security isid for %s\n", 1273 page); 1274 sid = SECINITSID_SECURITY; 1275 } 1276 1277 isec->sid = sid; 1278 isec->initialized = LABEL_INITIALIZED; 1279 inode->i_fop = &sel_bool_ops; 1280 inode->i_ino = i|SEL_BOOL_INO_OFFSET; 1281 1282 ret = sel_attach_file(bool_dir, names[i], inode); 1283 } 1284 out: 1285 kfree(page); 1286 return ret; 1287 } 1288 1289 static ssize_t sel_read_avc_cache_threshold(struct file *filp, char __user *buf, 1290 size_t count, loff_t *ppos) 1291 { 1292 char tmpbuf[TMPBUFLEN]; 1293 ssize_t length; 1294 1295 length = scnprintf(tmpbuf, TMPBUFLEN, "%u", 1296 avc_get_cache_threshold()); 1297 return simple_read_from_buffer(buf, count, ppos, tmpbuf, length); 1298 } 1299 1300 static ssize_t sel_write_avc_cache_threshold(struct file *file, 1301 const char __user *buf, 1302 size_t count, loff_t *ppos) 1303 1304 { 1305 char *page; 1306 ssize_t ret; 1307 unsigned int new_value; 1308 1309 ret = avc_has_perm(current_sid(), SECINITSID_SECURITY, 1310 SECCLASS_SECURITY, SECURITY__SETSECPARAM, 1311 NULL); 1312 if (ret) 1313 return ret; 1314 1315 if (count >= PAGE_SIZE) 1316 return -ENOMEM; 1317 1318 /* No partial writes. */ 1319 if (*ppos != 0) 1320 return -EINVAL; 1321 1322 page = memdup_user_nul(buf, count); 1323 if (IS_ERR(page)) 1324 return PTR_ERR(page); 1325 1326 ret = -EINVAL; 1327 if (sscanf(page, "%u", &new_value) != 1) 1328 goto out; 1329 1330 avc_set_cache_threshold(new_value); 1331 1332 ret = count; 1333 out: 1334 kfree(page); 1335 return ret; 1336 } 1337 1338 static ssize_t sel_read_avc_hash_stats(struct file *filp, char __user *buf, 1339 size_t count, loff_t *ppos) 1340 { 1341 char *page; 1342 ssize_t length; 1343 1344 page = kmalloc(PAGE_SIZE, GFP_KERNEL); 1345 if (!page) 1346 return -ENOMEM; 1347 1348 length = avc_get_hash_stats(page); 1349 if (length >= 0) 1350 length = simple_read_from_buffer(buf, count, ppos, page, length); 1351 kfree(page); 1352 1353 return length; 1354 } 1355 1356 static ssize_t sel_read_sidtab_hash_stats(struct file *filp, char __user *buf, 1357 size_t count, loff_t *ppos) 1358 { 1359 char *page; 1360 ssize_t length; 1361 1362 page = kmalloc(PAGE_SIZE, GFP_KERNEL); 1363 if (!page) 1364 return -ENOMEM; 1365 1366 length = security_sidtab_hash_stats(page); 1367 if (length >= 0) 1368 length = simple_read_from_buffer(buf, count, ppos, page, 1369 length); 1370 kfree(page); 1371 1372 return length; 1373 } 1374 1375 static const struct file_operations sel_sidtab_hash_stats_ops = { 1376 .read = sel_read_sidtab_hash_stats, 1377 .llseek = generic_file_llseek, 1378 }; 1379 1380 static const struct file_operations sel_avc_cache_threshold_ops = { 1381 .read = sel_read_avc_cache_threshold, 1382 .write = sel_write_avc_cache_threshold, 1383 .llseek = generic_file_llseek, 1384 }; 1385 1386 static const struct file_operations sel_avc_hash_stats_ops = { 1387 .read = sel_read_avc_hash_stats, 1388 .llseek = generic_file_llseek, 1389 }; 1390 1391 #ifdef CONFIG_SECURITY_SELINUX_AVC_STATS 1392 static struct avc_cache_stats *sel_avc_get_stat_idx(loff_t *idx) 1393 { 1394 loff_t cpu; 1395 1396 for (cpu = *idx; cpu < nr_cpu_ids; ++cpu) { 1397 if (!cpu_possible(cpu)) 1398 continue; 1399 *idx = cpu + 1; 1400 return &per_cpu(avc_cache_stats, cpu); 1401 } 1402 (*idx)++; 1403 return NULL; 1404 } 1405 1406 static void *sel_avc_stats_seq_start(struct seq_file *seq, loff_t *pos) 1407 { 1408 loff_t n = *pos - 1; 1409 1410 if (*pos == 0) 1411 return SEQ_START_TOKEN; 1412 1413 return sel_avc_get_stat_idx(&n); 1414 } 1415 1416 static void *sel_avc_stats_seq_next(struct seq_file *seq, void *v, loff_t *pos) 1417 { 1418 return sel_avc_get_stat_idx(pos); 1419 } 1420 1421 static int sel_avc_stats_seq_show(struct seq_file *seq, void *v) 1422 { 1423 struct avc_cache_stats *st = v; 1424 1425 if (v == SEQ_START_TOKEN) { 1426 seq_puts(seq, 1427 "lookups hits misses allocations reclaims frees\n"); 1428 } else { 1429 unsigned int lookups = st->lookups; 1430 unsigned int misses = st->misses; 1431 unsigned int hits = lookups - misses; 1432 seq_printf(seq, "%u %u %u %u %u %u\n", lookups, 1433 hits, misses, st->allocations, 1434 st->reclaims, st->frees); 1435 } 1436 return 0; 1437 } 1438 1439 static void sel_avc_stats_seq_stop(struct seq_file *seq, void *v) 1440 { } 1441 1442 static const struct seq_operations sel_avc_cache_stats_seq_ops = { 1443 .start = sel_avc_stats_seq_start, 1444 .next = sel_avc_stats_seq_next, 1445 .show = sel_avc_stats_seq_show, 1446 .stop = sel_avc_stats_seq_stop, 1447 }; 1448 1449 static int sel_open_avc_cache_stats(struct inode *inode, struct file *file) 1450 { 1451 return seq_open(file, &sel_avc_cache_stats_seq_ops); 1452 } 1453 1454 static const struct file_operations sel_avc_cache_stats_ops = { 1455 .open = sel_open_avc_cache_stats, 1456 .read = seq_read, 1457 .llseek = seq_lseek, 1458 .release = seq_release, 1459 }; 1460 #endif 1461 1462 static int sel_make_avc_files(struct dentry *dir) 1463 { 1464 struct super_block *sb = dir->d_sb; 1465 struct selinux_fs_info *fsi = sb->s_fs_info; 1466 unsigned int i; 1467 int err = 0; 1468 static const struct tree_descr files[] = { 1469 { "cache_threshold", 1470 &sel_avc_cache_threshold_ops, S_IRUGO|S_IWUSR }, 1471 { "hash_stats", &sel_avc_hash_stats_ops, S_IRUGO }, 1472 #ifdef CONFIG_SECURITY_SELINUX_AVC_STATS 1473 { "cache_stats", &sel_avc_cache_stats_ops, S_IRUGO }, 1474 #endif 1475 }; 1476 1477 for (i = 0; !err && i < ARRAY_SIZE(files); i++) { 1478 struct inode *inode; 1479 1480 inode = sel_make_inode(dir->d_sb, S_IFREG|files[i].mode); 1481 if (!inode) 1482 return -ENOMEM; 1483 1484 inode->i_fop = files[i].ops; 1485 inode->i_ino = ++fsi->last_ino; 1486 1487 err = sel_attach_file(dir, files[i].name, inode); 1488 } 1489 1490 return err; 1491 } 1492 1493 static int sel_make_ss_files(struct dentry *dir) 1494 { 1495 struct super_block *sb = dir->d_sb; 1496 struct selinux_fs_info *fsi = sb->s_fs_info; 1497 unsigned int i; 1498 int err = 0; 1499 static const struct tree_descr files[] = { 1500 { "sidtab_hash_stats", &sel_sidtab_hash_stats_ops, S_IRUGO }, 1501 }; 1502 1503 for (i = 0; !err && i < ARRAY_SIZE(files); i++) { 1504 struct inode *inode; 1505 1506 inode = sel_make_inode(dir->d_sb, S_IFREG|files[i].mode); 1507 if (!inode) 1508 return -ENOMEM; 1509 1510 inode->i_fop = files[i].ops; 1511 inode->i_ino = ++fsi->last_ino; 1512 1513 err = sel_attach_file(dir, files[i].name, inode); 1514 } 1515 1516 return err; 1517 } 1518 1519 static ssize_t sel_read_initcon(struct file *file, char __user *buf, 1520 size_t count, loff_t *ppos) 1521 { 1522 char *con; 1523 u32 sid, len; 1524 ssize_t ret; 1525 1526 sid = file_inode(file)->i_ino&SEL_INO_MASK; 1527 ret = security_sid_to_context(sid, &con, &len); 1528 if (ret) 1529 return ret; 1530 1531 ret = simple_read_from_buffer(buf, count, ppos, con, len); 1532 kfree(con); 1533 return ret; 1534 } 1535 1536 static const struct file_operations sel_initcon_ops = { 1537 .read = sel_read_initcon, 1538 .llseek = generic_file_llseek, 1539 }; 1540 1541 static int sel_make_initcon_files(struct dentry *dir) 1542 { 1543 unsigned int i; 1544 int err = 0; 1545 1546 for (i = 1; !err && i <= SECINITSID_NUM; i++) { 1547 const char *s = security_get_initial_sid_context(i); 1548 struct inode *inode; 1549 1550 if (!s) 1551 continue; 1552 1553 inode = sel_make_inode(dir->d_sb, S_IFREG|S_IRUGO); 1554 if (!inode) 1555 return -ENOMEM; 1556 1557 inode->i_fop = &sel_initcon_ops; 1558 inode->i_ino = i|SEL_INITCON_INO_OFFSET; 1559 err = sel_attach_file(dir, s, inode); 1560 } 1561 1562 return err; 1563 } 1564 1565 static inline u64 sel_class_to_ino(u16 class) 1566 { 1567 return (class * (SEL_VEC_MAX + 1)) | SEL_CLASS_INO_OFFSET; 1568 } 1569 1570 static inline u16 sel_ino_to_class(u64 ino) 1571 { 1572 u32 ino_masked = ino & SEL_INO_MASK; 1573 return ino_masked / (SEL_VEC_MAX + 1); 1574 } 1575 1576 static inline u64 sel_perm_to_ino(u16 class, u32 perm) 1577 { 1578 return (class * (SEL_VEC_MAX + 1) + perm) | SEL_CLASS_INO_OFFSET; 1579 } 1580 1581 static inline u32 sel_ino_to_perm(u64 ino) 1582 { 1583 u32 ino_masked = ino & SEL_INO_MASK; 1584 return ino_masked % (SEL_VEC_MAX + 1); 1585 } 1586 1587 static ssize_t sel_read_class(struct file *file, char __user *buf, 1588 size_t count, loff_t *ppos) 1589 { 1590 u64 ino = file_inode(file)->i_ino; 1591 char res[TMPBUFLEN]; 1592 ssize_t len = scnprintf(res, sizeof(res), "%d", sel_ino_to_class(ino)); 1593 return simple_read_from_buffer(buf, count, ppos, res, len); 1594 } 1595 1596 static const struct file_operations sel_class_ops = { 1597 .read = sel_read_class, 1598 .llseek = generic_file_llseek, 1599 }; 1600 1601 static ssize_t sel_read_perm(struct file *file, char __user *buf, 1602 size_t count, loff_t *ppos) 1603 { 1604 u64 ino = file_inode(file)->i_ino; 1605 char res[TMPBUFLEN]; 1606 ssize_t len = scnprintf(res, sizeof(res), "%d", sel_ino_to_perm(ino)); 1607 return simple_read_from_buffer(buf, count, ppos, res, len); 1608 } 1609 1610 static const struct file_operations sel_perm_ops = { 1611 .read = sel_read_perm, 1612 .llseek = generic_file_llseek, 1613 }; 1614 1615 static ssize_t sel_read_policycap(struct file *file, char __user *buf, 1616 size_t count, loff_t *ppos) 1617 { 1618 int value; 1619 char tmpbuf[TMPBUFLEN]; 1620 ssize_t length; 1621 u64 i_ino = file_inode(file)->i_ino; 1622 1623 value = security_policycap_supported(i_ino & SEL_INO_MASK); 1624 length = scnprintf(tmpbuf, TMPBUFLEN, "%d", value); 1625 1626 return simple_read_from_buffer(buf, count, ppos, tmpbuf, length); 1627 } 1628 1629 static const struct file_operations sel_policycap_ops = { 1630 .read = sel_read_policycap, 1631 .llseek = generic_file_llseek, 1632 }; 1633 1634 static int sel_make_perm_files(struct selinux_policy *newpolicy, 1635 char *objclass, int classvalue, 1636 struct dentry *dir) 1637 { 1638 u32 i, nperms; 1639 int rc; 1640 char **perms; 1641 1642 rc = security_get_permissions(newpolicy, objclass, &perms, &nperms); 1643 if (rc) 1644 return rc; 1645 1646 for (i = 0; !rc && i < nperms; i++) { 1647 struct inode *inode; 1648 1649 inode = sel_make_inode(dir->d_sb, S_IFREG|S_IRUGO); 1650 if (!inode) { 1651 rc = -ENOMEM; 1652 break; 1653 } 1654 1655 inode->i_fop = &sel_perm_ops; 1656 /* i+1 since perm values are 1-indexed */ 1657 inode->i_ino = sel_perm_to_ino(classvalue, i + 1); 1658 1659 rc = sel_attach_file(dir, perms[i], inode); 1660 } 1661 for (i = 0; i < nperms; i++) 1662 kfree(perms[i]); 1663 kfree(perms); 1664 return rc; 1665 } 1666 1667 static int sel_make_class_dir_entries(struct selinux_policy *newpolicy, 1668 char *classname, int index, 1669 struct dentry *dir) 1670 { 1671 struct super_block *sb = dir->d_sb; 1672 struct selinux_fs_info *fsi = sb->s_fs_info; 1673 struct dentry *dentry = NULL; 1674 struct inode *inode = NULL; 1675 int err; 1676 1677 inode = sel_make_inode(dir->d_sb, S_IFREG|S_IRUGO); 1678 if (!inode) 1679 return -ENOMEM; 1680 1681 inode->i_fop = &sel_class_ops; 1682 inode->i_ino = sel_class_to_ino(index); 1683 1684 err = sel_attach_file(dir, "index", inode); 1685 if (err) 1686 return err; 1687 1688 dentry = sel_make_dir(dir, "perms", &fsi->last_class_ino); 1689 if (IS_ERR(dentry)) 1690 return PTR_ERR(dentry); 1691 1692 return sel_make_perm_files(newpolicy, classname, index, dentry); 1693 } 1694 1695 static int sel_make_classes(struct selinux_policy *newpolicy, 1696 struct dentry *class_dir, 1697 u64 *last_class_ino) 1698 { 1699 u32 i, nclasses; 1700 int rc; 1701 char **classes; 1702 1703 rc = security_get_classes(newpolicy, &classes, &nclasses); 1704 if (rc) 1705 return rc; 1706 1707 /* +2 since classes are 1-indexed */ 1708 *last_class_ino = sel_class_to_ino(nclasses + 2); 1709 1710 for (i = 0; i < nclasses; i++) { 1711 struct dentry *class_name_dir; 1712 1713 class_name_dir = sel_make_dir(class_dir, classes[i], 1714 last_class_ino); 1715 if (IS_ERR(class_name_dir)) { 1716 rc = PTR_ERR(class_name_dir); 1717 goto out; 1718 } 1719 1720 /* i+1 since class values are 1-indexed */ 1721 rc = sel_make_class_dir_entries(newpolicy, classes[i], i + 1, 1722 class_name_dir); 1723 if (rc) 1724 goto out; 1725 } 1726 rc = 0; 1727 out: 1728 for (i = 0; i < nclasses; i++) 1729 kfree(classes[i]); 1730 kfree(classes); 1731 return rc; 1732 } 1733 1734 static int sel_make_policycap(struct dentry *dir) 1735 { 1736 struct super_block *sb = dir->d_sb; 1737 unsigned int iter; 1738 struct inode *inode = NULL; 1739 int err = 0; 1740 1741 for (iter = 0; !err && iter <= POLICYDB_CAP_MAX; iter++) { 1742 const char *name; 1743 1744 if (iter < ARRAY_SIZE(selinux_policycap_names)) 1745 name = selinux_policycap_names[iter]; 1746 else 1747 name = "unknown"; 1748 1749 inode = sel_make_inode(sb, S_IFREG | 0444); 1750 if (!inode) 1751 return -ENOMEM; 1752 1753 inode->i_fop = &sel_policycap_ops; 1754 inode->i_ino = iter | SEL_POLICYCAP_INO_OFFSET; 1755 err = sel_attach_file(dir, name, inode); 1756 } 1757 1758 return err; 1759 } 1760 1761 static struct dentry *sel_make_dir(struct dentry *dir, const char *name, 1762 u64 *ino) 1763 { 1764 struct inode *inode; 1765 1766 inode = sel_make_inode(dir->d_sb, S_IFDIR | S_IRUGO | S_IXUGO); 1767 if (!inode) 1768 return ERR_PTR(-ENOMEM); 1769 1770 inode->i_op = &simple_dir_inode_operations; 1771 inode->i_fop = &simple_dir_operations; 1772 inode->i_ino = ++(*ino); 1773 /* directory inodes start off with i_nlink == 2 (for "." entry) */ 1774 inc_nlink(inode); 1775 /* bump link count on parent directory, too */ 1776 inc_nlink(d_inode(dir)); 1777 1778 return sel_attach(dir, name, inode); 1779 } 1780 1781 static int reject_all(const struct mnt_idmap *idmap, struct inode *inode, int mask) 1782 { 1783 return -EPERM; // no access for anyone, root or no root. 1784 } 1785 1786 static const struct inode_operations swapover_dir_inode_operations = { 1787 .lookup = simple_lookup, 1788 .permission = reject_all, 1789 }; 1790 1791 static struct dentry *sel_make_swapover_dir(struct super_block *sb, u64 *ino) 1792 { 1793 struct dentry *dentry; 1794 struct inode *inode; 1795 1796 inode = sel_make_inode(sb, S_IFDIR); 1797 if (!inode) 1798 return ERR_PTR(-ENOMEM); 1799 1800 dentry = simple_start_creating(sb->s_root, ".swapover"); 1801 if (IS_ERR(dentry)) { 1802 iput(inode); 1803 return dentry; 1804 } 1805 1806 inode->i_op = &swapover_dir_inode_operations; 1807 inode->i_ino = ++(*ino); 1808 /* directory inodes start off with i_nlink == 2 (for "." entry) */ 1809 inc_nlink(inode); 1810 d_make_persistent(dentry, inode); 1811 inc_nlink(sb->s_root->d_inode); 1812 simple_done_creating(dentry); 1813 return dentry; // borrowed 1814 } 1815 1816 #define NULL_FILE_NAME "null" 1817 1818 static void sel_mark_immutable(struct dentry *root, const char *name) 1819 { 1820 struct qstr q = QSTR(name); 1821 struct dentry *dentry = try_lookup_noperm(&q, root); 1822 1823 if (!IS_ERR_OR_NULL(dentry)) { 1824 d_inode(dentry)->i_flags |= S_IMMUTABLE; 1825 dput(dentry); 1826 } 1827 } 1828 1829 static int sel_fill_super(struct super_block *sb, struct fs_context *fc) 1830 { 1831 struct selinux_fs_info *fsi; 1832 int ret; 1833 struct dentry *dentry; 1834 struct inode *inode; 1835 struct inode_security_struct *isec; 1836 1837 static const struct tree_descr selinux_files[] = { 1838 [SEL_LOAD] = {"load", &sel_load_ops, S_IRUSR|S_IWUSR}, 1839 [SEL_ENFORCE] = {"enforce", &sel_enforce_ops, S_IRUGO|S_IWUSR}, 1840 [SEL_CONTEXT] = {"context", &transaction_ops, S_IRUGO|S_IWUGO}, 1841 [SEL_ACCESS] = {"access", &transaction_ops, S_IRUGO|S_IWUGO}, 1842 [SEL_CREATE] = {"create", &transaction_ops, S_IRUGO|S_IWUGO}, 1843 [SEL_RELABEL] = {"relabel", &transaction_ops, S_IRUGO|S_IWUGO}, 1844 [SEL_USER] = {"user", &transaction_ops, S_IRUGO|S_IWUGO}, 1845 [SEL_POLICYVERS] = {"policyvers", &sel_policyvers_ops, S_IRUGO}, 1846 [SEL_COMMIT_BOOLS] = {"commit_pending_bools", &sel_commit_bools_ops, S_IWUSR}, 1847 [SEL_MLS] = {"mls", &sel_mls_ops, S_IRUGO}, 1848 [SEL_DISABLE] = {"disable", &sel_disable_ops, S_IWUSR}, 1849 [SEL_MEMBER] = {"member", &transaction_ops, S_IRUGO|S_IWUGO}, 1850 [SEL_CHECKREQPROT] = {"checkreqprot", &sel_checkreqprot_ops, S_IRUGO|S_IWUSR}, 1851 [SEL_REJECT_UNKNOWN] = {"reject_unknown", &sel_handle_unknown_ops, S_IRUGO}, 1852 [SEL_DENY_UNKNOWN] = {"deny_unknown", &sel_handle_unknown_ops, S_IRUGO}, 1853 [SEL_STATUS] = {"status", &sel_handle_status_ops, S_IRUGO}, 1854 [SEL_POLICY] = {"policy", &sel_policy_ops, S_IRUGO}, 1855 [SEL_VALIDATE_TRANS] = {"validatetrans", &sel_transition_ops, 1856 S_IWUGO}, 1857 /* last one */ {"", NULL, 0} 1858 }; 1859 1860 ret = selinux_fs_info_create(sb); 1861 if (ret) 1862 goto err; 1863 1864 ret = simple_fill_super(sb, SELINUX_MAGIC, selinux_files); 1865 if (ret) 1866 goto err; 1867 1868 sel_mark_immutable(sb->s_root, "status"); 1869 sel_mark_immutable(sb->s_root, "policy"); 1870 1871 fsi = sb->s_fs_info; 1872 fsi->bool_dir = sel_make_dir(sb->s_root, BOOL_DIR_NAME, &fsi->last_ino); 1873 if (IS_ERR(fsi->bool_dir)) { 1874 ret = PTR_ERR(fsi->bool_dir); 1875 fsi->bool_dir = NULL; 1876 goto err; 1877 } 1878 1879 ret = -ENOMEM; 1880 inode = sel_make_inode(sb, S_IFCHR | S_IRUGO | S_IWUGO); 1881 if (!inode) 1882 goto err; 1883 1884 inode->i_ino = ++fsi->last_ino; 1885 isec = selinux_inode(inode); 1886 isec->sid = SECINITSID_DEVNULL; 1887 isec->sclass = SECCLASS_CHR_FILE; 1888 isec->initialized = LABEL_INITIALIZED; 1889 1890 init_special_inode(inode, S_IFCHR | S_IRUGO | S_IWUGO, MKDEV(MEM_MAJOR, 3)); 1891 ret = sel_attach_file(sb->s_root, NULL_FILE_NAME, inode); 1892 if (ret) 1893 goto err; 1894 1895 dentry = sel_make_dir(sb->s_root, "avc", &fsi->last_ino); 1896 if (IS_ERR(dentry)) { 1897 ret = PTR_ERR(dentry); 1898 goto err; 1899 } 1900 1901 ret = sel_make_avc_files(dentry); 1902 if (ret) 1903 goto err; 1904 1905 dentry = sel_make_dir(sb->s_root, "ss", &fsi->last_ino); 1906 if (IS_ERR(dentry)) { 1907 ret = PTR_ERR(dentry); 1908 goto err; 1909 } 1910 1911 ret = sel_make_ss_files(dentry); 1912 if (ret) 1913 goto err; 1914 1915 dentry = sel_make_dir(sb->s_root, "initial_contexts", &fsi->last_ino); 1916 if (IS_ERR(dentry)) { 1917 ret = PTR_ERR(dentry); 1918 goto err; 1919 } 1920 1921 ret = sel_make_initcon_files(dentry); 1922 if (ret) 1923 goto err; 1924 1925 fsi->class_dir = sel_make_dir(sb->s_root, CLASS_DIR_NAME, &fsi->last_ino); 1926 if (IS_ERR(fsi->class_dir)) { 1927 ret = PTR_ERR(fsi->class_dir); 1928 fsi->class_dir = NULL; 1929 goto err; 1930 } 1931 1932 dentry = sel_make_dir(sb->s_root, "policy_capabilities", &fsi->last_ino); 1933 if (IS_ERR(dentry)) { 1934 ret = PTR_ERR(dentry); 1935 goto err; 1936 } 1937 1938 ret = sel_make_policycap(dentry); 1939 if (ret) { 1940 pr_err("SELinux: failed to load policy capabilities\n"); 1941 goto err; 1942 } 1943 1944 return 0; 1945 err: 1946 pr_err("SELinux: %s: failed while creating inodes\n", 1947 __func__); 1948 1949 return ret; 1950 } 1951 1952 static int sel_get_tree(struct fs_context *fc) 1953 { 1954 return get_tree_single(fc, sel_fill_super); 1955 } 1956 1957 static const struct fs_context_operations sel_context_ops = { 1958 .get_tree = sel_get_tree, 1959 }; 1960 1961 static int sel_init_fs_context(struct fs_context *fc) 1962 { 1963 fc->ops = &sel_context_ops; 1964 return 0; 1965 } 1966 1967 static void sel_kill_sb(struct super_block *sb) 1968 { 1969 struct selinux_fs_info *fsi = sb->s_fs_info; 1970 1971 kill_anon_super(sb); 1972 selinux_fs_info_free(fsi); 1973 } 1974 1975 static struct file_system_type sel_fs_type = { 1976 .name = "selinuxfs", 1977 .init_fs_context = sel_init_fs_context, 1978 .kill_sb = sel_kill_sb, 1979 }; 1980 1981 struct path selinux_null __ro_after_init; 1982 1983 int __init init_sel_fs(void) 1984 { 1985 struct qstr null_name = QSTR(NULL_FILE_NAME); 1986 int err; 1987 1988 if (!selinux_enabled_boot) 1989 return 0; 1990 1991 err = sysfs_create_mount_point(fs_kobj, "selinux"); 1992 if (err) 1993 return err; 1994 1995 err = register_filesystem(&sel_fs_type); 1996 if (err) 1997 goto err_remove_mount_point; 1998 1999 selinux_null.mnt = kern_mount(&sel_fs_type); 2000 if (IS_ERR(selinux_null.mnt)) { 2001 pr_err("selinuxfs: could not mount!\n"); 2002 err = PTR_ERR(selinux_null.mnt); 2003 selinux_null.mnt = NULL; 2004 goto err_unregister_fs; 2005 } 2006 2007 selinux_null.dentry = try_lookup_noperm(&null_name, 2008 selinux_null.mnt->mnt_root); 2009 if (IS_ERR(selinux_null.dentry)) { 2010 pr_err("selinuxfs: could not lookup null!\n"); 2011 err = PTR_ERR(selinux_null.dentry); 2012 selinux_null.dentry = NULL; 2013 goto err_unmount; 2014 } 2015 2016 /* 2017 * Try to pre-allocate the status page, so the sequence number of the 2018 * initial policy load can be stored. 2019 */ 2020 (void) selinux_kernel_status_page(); 2021 2022 return 0; 2023 2024 err_unmount: 2025 kern_unmount(selinux_null.mnt); 2026 selinux_null.mnt = NULL; 2027 err_unregister_fs: 2028 unregister_filesystem(&sel_fs_type); 2029 err_remove_mount_point: 2030 sysfs_remove_mount_point(fs_kobj, "selinux"); 2031 return err; 2032 } 2033